AZ-900 Describe Azure management and governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure SQL Auditing

  Why it's wrong here

  Azure SQL Auditing records database events such as successful and failed queries, data modifications, and schema changes, writing the logs to an Azure storage account or Log Analytics workspace. While this is essential for forensic analysis, regulatory compliance, and understanding who did what, it does not actively assess vulnerabilities or generate security recommendations. Auditing merely creates an immutable record of activity; it does not interpret that activity for unusual or threat-related patterns. Defender for SQL goes beyond logging by proactively analyzing activity and delivering security alerts and posture guidance.

• ✓

  Microsoft Defender for SQL

  Why this is correct

  Microsoft Defender for SQL is the correct choice because it delivers a full security workload protection suite for Azure SQL databases. It includes vulnerability assessments that scan for misconfigurations, threat detection that alerts on anomalous and malicious database activity, and security recommendations surfaced through Microsoft Defender for Cloud. These capabilities directly address the need for security posture evaluation and threat response, which is the core focus of this question. Other services such as monitoring, key management, and auditing only cover a narrow slice of what Defender for SQL provides.

• ✗

  Azure Key Vault for SQL

  Why it's wrong here

  Azure Key Vault is a secrets management service that safely stores encryption keys, certificates, and connection strings. Its integration with Azure SQL is mainly to support Transparent Data Encryption (TDE) by holding the database encryption key, but this is a cryptographic control, not a threat detection or vulnerability assessment capability. Key Vault does not analyze SQL traffic, flag suspicious queries, or recommend security configurations. Defender for SQL, in contrast, provides those security posture and threat detection features directly for the SQL engine.

• ✗

  Azure Monitor SQL Insights

  Why it's wrong here

  Azure Monitor SQL Insights is designed for performance telemetry, not security. It collects metrics such as CPU, memory, and query wait statistics to help diagnose performance bottlenecks in Azure SQL databases. While it can display logs and health states, it does not assess vulnerability, detect malicious activity, or provide actionable security hardening recommendations. Defender for SQL fills that security gap by continuously monitoring for threats and delivering security posture findings.