AZ-305 Practice Question: Design identity, governance, and monitoring solutions
Your organization uses Microsoft Purview for data governance. You need to classify sensitive data in Azure SQL Database and automatically apply sensitivity labels. What should you configure?
⚠ Common exam trap
Many candidates confuse Azure Policy's 'SQL classification' built-in initiative (which only audits or enforces the presence of classification) with the actual scanning and labeling capability, leading them to choose Option D instead of recognizing that Purview Data Map is the service that performs the automated classification work.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Data Map with scanning and labeling
Microsoft Purview Data Map with scanning and labeling is the correct solution because it integrates with Azure SQL Database to automatically scan for sensitive data types (e.g., credit card numbers, social security numbers) and apply sensitivity labels defined in Microsoft Purview Information Protection. This native integration uses the Purview scanning infrastructure to classify data at rest and propagate labels directly to the SQL database, meeting the requirement for automated classification and labeling.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Information Protection scanner
Why it's wrong here
Azure Information Protection scanner is designed for on-premises environments; it discovers, classifies, and labels documents in file shares and SharePoint Server by using the AIP client. It does not connect to Azure SQL Database as a data source, cannot scan database tables or columns, and therefore cannot apply sensitivity labels to structured data stored in a PaaS service.
- ✓
Microsoft Purview Data Map with scanning and labeling
Why this is correct
Microsoft Purview Data Map natively integrates with Azure SQL Database through system-assigned managed identities, performs automated scanning of schema and sensitive data patterns (e.g., PII, credentials), and applies sensitivity labels automatically via built-in classification rules. These labels can be enforced with Microsoft Defender for Cloud, and the Data Map provides a centralized catalog for governance, making this the correct tool.
- ✗
Microsoft Sentinel with a workbook
Why it's wrong here
Microsoft Sentinel is a cloud-native SIEM and SOAR platform that ingests security logs, detects threats, and orchestrates responses through playbooks; it has no capability to discover, classify, or label columns or data values within Azure SQL Database. Workbooks in Sentinel are interactive dashboards that visualize analytics rules and incidents, not data classification engines, so leveraging Sentinel here would fail to produce the desired sensitivity labels.
- ✗
Azure Policy with built-in SQL classification policy
Why it's wrong here
Azure Policy's built-in SQL classification policies, such as 'SQL databases should have sensitivity labels', are purely audit or deny policies that evaluate compliance without triggering any dynamic data discovery or automatic label assignment. They rely on pre-existing classifications and cannot scan table contents to infer sensitive data types, meaning they can only report the absence of labels rather than remediate the situation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-305 question from scratch — 795 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.