AZ-900 Describe Azure architecture and services Practice Question
Which Azure service provides intelligent threat protection across your Azure and hybrid environments by collecting and analyzing security data?
⚠ Common exam trap
Test-takers frequently confuse Azure Sentinel (a SIEM for log analysis) with Microsoft Defender for Cloud (a CSPM and workload protection platform), because both involve 'security data' and 'threat protection,' but Defender for Cloud is the service that directly protects Azure and hybrid workloads by collecting and analyzing security data from those environments themselves, whereas Sentinel ingests data from any source for broader security operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Cloud
Microsoft Defender for Cloud (formerly Azure Security Center) is the correct answer because it provides unified security management and intelligent threat protection across Azure and hybrid environments. It continuously assesses the security posture of your resources, applies security recommendations, and collects and analyzes security data from various sources to detect and respond to threats. Azure Sentinel, while also a security service, is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration Automation and Response) solution that focuses on log aggregation and incident response, not the integrated workload protection and posture management that Defender for Cloud offers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Sentinel
Why it's wrong here
Azure Sentinel (now Microsoft Sentinel) is a cloud-native SIEM/SOAR that ingests logs and telemetry from across your entire enterprise to detect and respond to threats, but it does not provide the automated security posture assessments or compliance recommendations that Defender for Cloud offers. While Sentinel is essential for proactive threat hunting and incident response, the service specifically responsible for continuously improving your security posture and hardening Azure and hybrid workloads is Defender for Cloud, not Sentinel.
- ✓
Microsoft Defender for Cloud
Why this is correct
Microsoft Defender for Cloud is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) that continuously assesses your Azure, on-premises, and multi-cloud resources against security benchmarks. It provides actionable hardening recommendations, detects threats, and integrates with Azure Policy to enforce governance. This makes it the correct service for both security posture management and broad threat protection across Azure and hybrid environments, covering compute, data, storage, and identities.
- ✗
Azure DDoS Protection
Why it's wrong here
Azure DDoS Protection is a specialized network security service that shields your applications from distributed denial-of-service (DDoS) attacks by absorbing and mitigating volumetric traffic floods. However, it only addresses availability threats at the network layer and does not evaluate misconfigurations, vulnerabilities, or provide security recommendations for your workloads. Defender for Cloud offers a much broader range of protections, including posture assessments, just-in-time VM access, and adaptive application controls, making DDoS Protection too narrow for the described role.
- ✗
Azure Firewall
Why it's wrong here
Azure Firewall is a managed, stateful network firewall that filters east-west and north-south traffic based on application and network rules, primarily enforcing connectivity and access boundaries. It does not perform vulnerability scanning, security baseline assessments, or provide the compliance monitoring and threat detection for workloads that Defender for Cloud handles. While Azure Firewall is a critical security perimeter component, it is not a security posture management service, which is why it is incorrect for the scenario described.
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Microsoft Defender for Cloud
Microsoft Defender for Cloud is a cloud-native application protection platform that provides unified security management and advanced threat protection across multicloud and hybrid environments.
Key term
Workload
A workload is any discrete application, service, or function that runs on a computing resource, consuming CPU, memory, storage, or network capacity.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.