AZ-900 Describe Azure management and governance Practice Question
A company uses Azure for its production workloads. The security team wants to receive proactive, personalized recommendations to improve the security of their Azure resources, such as enabling Microsoft Defender for Cloud on subscriptions that do not have it enabled. Which Azure service provides these security recommendations?
⚠ Common exam trap
A common mix-up: candidates confuse Azure Advisor's security recommendations with Azure Policy's compliance enforcement, but Advisor proactively suggests improvements while Policy enforces rules—the question asks for proactive, personalized recommendations, not enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Advisor
Azure Advisor provides personalized, proactive recommendations to optimize Azure resources for security, reliability, performance, and cost. The question specifically asks for security recommendations, and Azure Advisor includes a dedicated 'Security' category that surfaces actions such as enabling Microsoft Defender for Cloud on subscriptions that lack it. This matches the scenario exactly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Policy
Why it's wrong here
Azure Policy is a governance service that enforces organizational standards and evaluates compliance at scale by applying rules to Azure resources. It can audit, deny, or modify resource configurations during deployment, and it provides a compliance dashboard for subscriptions. However, it does not generate proactive, personalized security recommendations based on workload-specific best practices; it only checks resources against defined policies.
When this WOULD be correct
A question asking: 'Which service can enforce that all subscriptions have Microsoft Defender for Cloud enabled?' would make Azure Policy correct, as it can assign a built-in policy to audit or enforce that setting.
- ✓
Azure Advisor
Why this is correct
Azure Advisor is the correct service. It provides best practice recommendations across five categories: Reliability, Security, Performance, Operational Excellence, and Cost. Security recommendations include enabling Microsoft Defender for Cloud, enabling encryption, and ensuring proper security settings.
- ✗
Azure Service Health
Why it's wrong here
Azure Service Health gives you a personalized view of the health of Azure services and regions you use, including service issues, planned maintenance, and health advisories. It alerts you about outages or degradations that affect your subscriptions, but it does not evaluate your resource configurations or offer recommendations to improve security or performance. Its scope is platform health, not workload advisories.
When this WOULD be correct
A question asking: 'Which service provides personalized alerts and guidance when Azure services are affected by outages, planned maintenance, or other health-related issues?' would make Azure Service Health the correct answer.
- ✗
Azure Monitor
Why it's wrong here
Azure Monitor is a comprehensive platform for collecting, analyzing, and acting on telemetry from cloud and on-premises environments. It helps you detect and diagnose issues using metrics, logs, and alerts, and it can trigger automated responses to conditions. But it focuses on operational monitoring and diagnostics; it does not provide proactive, multi-category best practice recommendations for resource design or security posture.
When this WOULD be correct
Azure Monitor would be correct if the question asked for a service to collect and analyze metrics and logs from Azure resources, set up alerts based on performance or availability thresholds, or monitor the health of applications and infrastructure.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure AdvisorCorrect answer▾
Why this is correct
Azure Advisor is the correct service. It provides best practice recommendations across five categories: Reliability, Security, Performance, Operational Excellence, and Cost. Security recommendations include enabling Microsoft Defender for Cloud, enabling encryption, and ensuring proper security settings.
✗Azure PolicyWrong answer — click to see why▾
Why this is wrong here
Azure Policy enforces and audits compliance rules (e.g., requiring Defender for Cloud on subscriptions), but it does not provide proactive, personalized recommendations; it evaluates and enforces policies.
★ When this WOULD be the correct answer
A question asking: 'Which service can enforce that all subscriptions have Microsoft Defender for Cloud enabled?' would make Azure Policy correct, as it can assign a built-in policy to audit or enforce that setting.
Why candidates choose this
Candidates confuse policy enforcement (Azure Policy) with advisory recommendations (Azure Advisor), especially when the scenario involves security settings like enabling Defender for Cloud.
✗Azure Service HealthWrong answer — click to see why▾
Why this is wrong here
Azure Service Health provides personalized alerts and guidance for Azure service issues, planned maintenance, and health advisories, but it does not offer proactive security recommendations like enabling Microsoft Defender for Cloud.
★ When this WOULD be the correct answer
A question asking: 'Which service provides personalized alerts and guidance when Azure services are affected by outages, planned maintenance, or other health-related issues?' would make Azure Service Health the correct answer.
Why candidates choose this
Candidates may confuse 'health' with 'security health' or think that Service Health includes security recommendations because it provides personalized alerts and guidance.
✗Azure MonitorWrong answer — click to see why▾
Why this is wrong here
Azure Monitor collects and analyzes telemetry data from Azure resources, but it does not provide proactive, personalized security recommendations like enabling Microsoft Defender for Cloud. Security recommendations are a feature of Azure Advisor.
★ When this WOULD be the correct answer
Azure Monitor would be correct if the question asked for a service to collect and analyze metrics and logs from Azure resources, set up alerts based on performance or availability thresholds, or monitor the health of applications and infrastructure.
Why candidates choose this
Candidates may confuse Azure Monitor's alerting and diagnostic capabilities with security recommendations, assuming that monitoring security-related metrics is equivalent to receiving proactive security advice.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Defender for Cloud
Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that provides unified security management and threat protection across hybrid and multi-cloud environments.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.