AZ-900 Describe Azure management and governance Practice Question
Which Azure service provides a unified security management system that strengthens the security posture of data centers and cloud workloads?
⚠ Common exam trap
It's easy for candidates to confuse a specific security tool (like Azure Firewall or DDoS Protection) with a unified security management platform, overlooking that Defender for Cloud is the overarching service for posture management and threat protection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Cloud
Microsoft Defender for Cloud (formerly Azure Security Center) is a unified security management system that provides continuous assessment, security recommendations, and threat protection across hybrid cloud workloads. It strengthens the security posture of data centers and cloud workloads by offering features like secure score, regulatory compliance dashboards, and just-in-time VM access, making it the correct answer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Firewall
Why it's wrong here
Azure Firewall is incorrect because it is a stateful, network-layer security service that filters traffic between Azure resources and the internet or between virtual networks. It enforces allow/deny rules based on IP addresses, ports, and protocols, but it does not assess overall security posture, provide compliance monitoring, or deliver threat protection for workloads beyond the network perimeter. Its scope is narrowly focused on network traffic control, not unified security management across a hybrid estate.
- ✓
Microsoft Defender for Cloud
Why this is correct
Microsoft Defender for Cloud is the correct answer because it serves as a unified security posture management and threat protection platform, aggregating security signals from Azure, on-premises, and other clouds. It continuously assesses resources against compliance standards, provides hardening recommendations, and offers just-in-time access and adaptive application controls. This breadth of capabilities — covering vulnerability management, regulatory compliance, and workload protection — is exactly what the question describes.
- ✗
Azure DDoS Protection
Why it's wrong here
Azure DDoS Protection is incorrect because it specifically mitigates distributed denial-of-service attacks by absorbing and scrubbing volumetric, protocol, and application-layer attacks before they reach your applications. While it is an important security control, it operates in a reactive, traffic-level capacity and does not offer continuous assessment, compliance dashboards, or security recommendations across all your cloud resources. It solves a single, albeit critical, security problem rather than acting as a comprehensive management platform.
- ✗
Azure Key Vault
Why it's wrong here
Azure Key Vault is incorrect because it is a cryptographic secrets management service designed to safeguard encryption keys, secrets, and certificates, with features like hardware security module (HSM) backed keys and controlled access via RBAC and policies. It does not perform security posture assessment, detect misconfigurations, or monitor compliance — its role is strictly to store and control access to sensitive credentials. As such, it is a discrete component, not a unified security management and threat protection solution.
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Hybrid cloud
A hybrid cloud is a computing environment that combines a private cloud (on-premises infrastructure) with one or more public cloud services, allowing data and applications to be shared between them.
Key term
Microsoft Defender for Cloud
Microsoft Defender for Cloud is a cloud-native application protection platform that provides unified security management and advanced threat protection across multicloud and hybrid environments.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.