Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Centralized Data Governance with Microsoft Purview
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An enterprise manages large volumes of structured and unstructured data stored across multicloud platforms, on-premises storage, and Microsoft 365 services such as SharePoint and OneDrive.
The organization needs a centralized solution to achieve the following goals:
- Automatically scan, identify, and classify sensitive files and data at rest
- Map data assets and track data lineage across governance domains
- Assess regulatory compliance against industry standards using structured improvement actions and risk scores
Which service should the enterprise implement?
Explanations
Azure Key Vault
Azure Key Vault
What Azure Key Vault Is
Azure Key Vault is a secure cloud service for storing and managing sensitive cryptographic keys, application secrets, API tokens, and TLS/SSL certificates in hardware security modules (HSMs).
Why It Doesn't Meet the Requirement
Azure Key Vault provides secure storage for credentials and cryptographic materials used by applications to authenticate and encrypt data. However, it does not scan enterprise repositories, classify business data, track data provenance/lineage, or manage regulatory compliance frameworks.
Key Characteristics and Limitations
- Secret Management: Centrally stores database connection strings, passwords, and API keys securely.
- Key Management: Creates, rotates, and controls access to encryption keys used for data-at-rest and data-in-transit encryption.
- Certificate Management: Automates the provisioning and renewal of public and private TLS/SSL certificates.
- Access Control Integration: Uses role-based access control (RBAC) and Key Vault access policies to enforce granular credential access.
This Answer Would Be Correct If
The enterprise needed a secure repository to store cryptographic keys, automate certificate renewals, or manage sensitive application connection strings without hardcoding them into source code.
Additional Context
Microsoft Purview can integrate with Azure Key Vault to securely retrieve credentials when running automated scans across external data sources, but Key Vault itself cannot perform data classification or governance.
Azure Monitor
Azure Monitor
What Azure Monitor Is
Azure Monitor is a centralized monitoring and observability service that collects, analyzes, and responds to telemetry data (metrics, logs, and activity traces) generated by cloud and on-premises infrastructure and applications.
Why It Doesn't Meet the Requirement
Azure Monitor is designed to track system performance, application availability, and resource health. It cannot discover data assets, classify sensitive information stored inside documents and databases, or generate compliance posture assessments against regulatory frameworks like ISO 27001 or PCI DSS.
Key Characteristics and Limitations
- Telemetry Ingestion: Gathers performance metrics and event logs from virtual machines, containers, and serverless applications via Log Analytics.
- Application Performance Management: Employs Application Insights to detect live application bottlenecks and exceptions.
- Operational Alerting: Triggers alerts and automated actions based on CPU spikes, memory exhaustion, or network throughput thresholds.
- No Data Governance Tools: Does not provide data loss prevention policies, sensitive content discovery, or data lineage mapping.
This Answer Would Be Correct If
The scenario required collecting performance metrics, monitoring virtual machine uptime, analyzing application trace logs, or alerting site reliability engineers about system outages.
Additional Context
Although Microsoft Purview includes observability features to monitor data pipeline health and data lineage, Azure Monitor focuses strictly on technical infrastructure metrics and operational application logs.
Microsoft Purview
Microsoft Purview
What Microsoft Purview Is
Microsoft Purview is a comprehensive family of data governance, risk management, and compliance solutions designed to help organizations gain visibility into their entire data estate. It provides a unified platform to discover, map, govern, and protect structured, unstructured, and multicloud data assets across on-premises systems, cloud environments, and Software as a Service (SaaS) applications.
How It Meets the Requirements
Microsoft Purview directly addresses all of the enterprise's data governance and compliance goals:
- Data Discovery and Classification: Through features like on-demand classification and automated scanning, Microsoft Purview identifies sensitive content across files and databases, labeling sensitive information at rest.
- Data Lineage and Cataloging: Through the Unified Catalog and Data Map, Purview creates holistic data estate mappings, allowing teams to organize assets into governance domains and trace end-to-end data lineage.
- Compliance Management: Using Compliance Manager, organizations can evaluate their posture against hundreds of regulatory templates (such as ISO 27001, NIST 800-53, and SOC 2), track compliance scores, and execute actionable improvement actions across customer-managed and Microsoft-managed controls.
Key Advantages and Capabilities
- Automated Data Scanning: Scans data across hybrid and multicloud storage repositories to automatically catalog schema and metadata.
- Sensitive Information Types (SIT): Employs pre-built and custom classifiers to detect financial records, identification numbers, and proprietary intellectual property.
- Compliance Manager Scoring: Provides a quantitative compliance score reflecting overall risk and control implementation progress.
- Data Loss Prevention (DLP): Monitors and prevents unintended sharing of sensitive data through intelligent analytics and alert mechanisms.
Why This Is Optimal
Unlike tools that focus exclusively on resource infrastructure or network telemetry, Microsoft Purview is specifically architected for unified data governance, data protection, and regulatory compliance across heterogeneous data estates.
Azure Policy
Azure Policy
What Azure Policy Is
Azure Policy is a cloud governance tool within Azure that enforces organizational standards and assesses infrastructure compliance at scale across Azure subscriptions and management groups.
Why It Doesn't Meet the Requirement
While Azure Policy is essential for cloud governance, it governs the deployment and configuration properties of Azure resources (such as restricting virtual machine SKUs, requiring specific resource tags, or enforcing storage account encryption settings). It does not inspect the contents of files, perform automated data classification on historical data at rest in SharePoint or OneDrive, or build unified data lineage catalogs.
Key Characteristics and Limitations
- Resource-Level Governance: Evaluates control definitions against Azure Resource Manager (ARM) resource configurations rather than content payloads.
- Enforcement Mechanisms: Provides effects like
Audit,Deny, andDeployIfNotExiststo control resource deployments. - Scope Boundaries: Operates strictly within Azure Resource Manager scopes (management groups, subscriptions, and resource groups).
- Lack of Data Cataloging: Does not maintain data dictionaries, business glossaries, or data lineage tracking.
This Answer Would Be Correct If
The organization needed to automatically enforce infrastructure standards across Azure subscriptions, such as blocking the deployment of unencrypted storage accounts or restricting cloud deployments to specific geographic regions.
Additional Context
Azure Policy and Microsoft Purview work together in an enterprise architecture: Azure Policy governs the cloud infrastructure where workloads run, whereas Microsoft Purview governs the information and data processed by those workloads.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Purview Data Lineage
Describe the purpose of Microsoft Purview in Azure
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Purview Data Governance
Describe the purpose of Microsoft Purview in Azure
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Purview Compliance Manager
Describe the purpose of Microsoft Purview in Azure
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Conditional Access Signals
Describe Microsoft Entra Conditional Access
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Monitor
Describe the benefits of manageability in the cloud
AdvancedAZ-104 Microsoft Azure Administrator Exam
Availability Zones High Availability
Deploy virtual machines to availability zones and availability sets
Last updated Validated