Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Defender for Cloud Security Posture Recommendations
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization has deployed several workloads across Azure, including virtual machines, SQL databases, and web applications. The security team needs a centralized solution that performs continuous security assessments across these resources, identifies vulnerabilities and configuration deviations from best practices, and provides actionable recommendations to strengthen the overall security posture.
Which Azure service should the organization use?
Explanations
Azure DDoS Protection
Azure DDoS Protection
What Azure DDoS Protection Is
Azure DDoS Protection is an availability safeguard that defends Azure applications and virtual networks against large-scale Distributed Denial of Service attacks by actively monitoring and mitigating malicious traffic spikes.
Why It Doesn't Meet the Requirement
Azure DDoS Protection is solely focused on mitigating volumetric and protocol-based denial-of-service network attacks at Layers 3 and 4. It does not scan resource configurations, assess database or virtual machine vulnerabilities, or provide configuration recommendations to improve general cloud security posture.
Key Characteristics and Limitations
- Adaptive Traffic Tuning: Continuously analyzes traffic patterns to establish baseline thresholds and mitigate unexpected volume surges.
- Always-On Monitoring: Inspects incoming network traffic in real time at the Azure network perimeter.
- Attack Analytics: Generates post-mitigation reports and attack telemetry.
- Narrow Defense Objective: Targets service availability during flooding attacks rather than resource misconfigurations or compliance posture.
This Answer Would Be Correct If
The primary goal was to prevent public-facing web applications from being overwhelmed and rendered unavailable by massive floods of malicious Internet traffic.
Additional Context
While DDoS mitigation is a critical component of defense-in-depth, security posture management requires auditing resource configurations, which is handled by Defender for Cloud.
Azure Network Watcher
Azure Network Watcher
What Azure Network Watcher Is
Azure Network Watcher is a specialized regional monitoring service designed to diagnose, monitor, and gain operational insights into network health and traffic flows within Azure virtual networks.
Why It Doesn't Meet the Requirement
While Network Watcher is essential for diagnosing network layer connectivity problems, it is not a comprehensive security posture management tool. It does not perform continuous vulnerability scanning on application layers or databases, nor does it generate holistic security recommendations or calculate a secure score for cloud workloads.
Key Characteristics and Limitations
- Packet Capture: Captures raw network traffic traversing virtual machines for forensic analysis.
- NSG Flow Logs: Records information about IP traffic passing through network security groups.
- Connection Monitor: Evaluates end-to-end network connectivity between endpoints and resources.
- Scope Limitation: Confined strictly to software-defined networking components rather than broad workload security posture.
This Answer Would Be Correct If
The organization specifically needed to capture network packets on a virtual machine or diagnose latency and connectivity failures between subnets.
Additional Context
Network Watcher provides diagnostic telemetry that can inform security audits, but it relies on security management tools like Defender for Cloud to analyze overarching security health.
Azure Front Door
Azure Front Door
What Azure Front Door Is
Azure Front Door is a global, scalable entry point that combines content delivery network (CDN) capabilities, global HTTP/HTTPS load balancing, TLS termination, and edge-based web application firewall (WAF) services.
Why It Doesn't Meet the Requirement
Azure Front Door is a Layer 7 traffic routing and edge delivery platform. While it includes security features like Web Application Firewall rules to block web exploits (e.g., SQL injection and cross-site scripting), it does not continuously evaluate resource configurations across Azure subscriptions, manage vulnerabilities, or generate organization-wide security posture recommendations.
Key Characteristics and Limitations
- Global Ingress and Failover: Uses anycast routing to direct web traffic to the nearest Microsoft point of presence.
- Edge Security: Integrates WAF policies and TLS termination directly at the network edge.
- Path-Based Routing: Directs client requests to distinct backend service pools based on URL paths.
- Focus Area: Optimized for web application routing and delivery performance rather than centralized compliance assessment.
This Answer Would Be Correct If
The requirement called for global HTTP load balancing, SSL/TLS offloading, and edge content caching for a web application.
Additional Context
Front Door protects the ingress path of web workloads, whereas Microsoft Defender for Cloud evaluates the internal configurations and security health of all backend resources.
Microsoft Defender for Cloud
Microsoft Defender for Cloud
What Microsoft Defender for Cloud Is
Microsoft Defender for Cloud is a centralized cloud security posture management (CSPM) and cloud workload protection platform (CWPP). It provides comprehensive visibility and control over the security configuration of Azure resources, hybrid environments, and multicloud workloads.
How It Meets the Security Posture Requirements
Microsoft Defender for Cloud continuously evaluates the configuration of cloud resources against security baselines and benchmarks, such as the Microsoft Cloud Security Benchmark. By performing automated, ongoing assessments, it detects misconfigurations, tracks known software vulnerabilities, and generates prioritized, step-by-step security recommendations that guide administrators in remediating risks before they can be exploited.
Key Advantages and Capabilities
- Continuous Security Assessment: Constantly evaluates deployed assets to detect security drift and identify missing security controls.
- Actionable Recommendations: Offers guided remediation steps and automated fix scripts to resolve vulnerabilities quickly.
- Centralized Security Management: Delivers a single dashboard providing holistic visibility into the security health of virtual machines, storage, networks, and databases.
- Secure Score Calculation: Quantifies the overall security posture into a measurable score, helping teams track risk reduction over time.
- Integrated Threat Protection: Delivers real-time alerting and threat detection across cloud workloads.
Why This Is Optimal
Microsoft Defender for Cloud is specifically engineered for multi-resource security posture management and automated vulnerability assessment across Azure environments, making it the most direct and capable solution for continuous posture improvement.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Defender for Cloud Regulatory Compliance Dashboard
Describe the purpose of Microsoft Defender for Cloud
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Sentinel SIEM Integration
Describe the purpose of Microsoft Defender for Cloud
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Defender for Cloud Threat Detection
Describe the purpose of Microsoft Defender for Cloud
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Defender for Cloud Capabilities
Describe the purpose of Microsoft Defender for Cloud
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Zero Trust Least Privilege Access
Describe the concept of Zero Trust
AdvancedAZ-104 Microsoft Azure Administrator Exam
Availability Zones High Availability
Deploy virtual machines to availability zones and availability sets
Last updated Validated