AZ-900 Describe Azure architecture and services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure SQL Database auditing

  Why it's wrong here

  Azure SQL Database auditing records database events, such as SELECT, INSERT, UPDATE, and permission changes, by writing them to an audit log for compliance and forensic purposes. It provides a trail of activity that can be reviewed after an incident, but it does not perform real-time analysis, anomaly detection, or generate security alerts on its own. Thus, auditing supports investigation but lacks the active threat detection needed to identify attacks as they happen.

• ✓

  Microsoft Defender for SQL

  Why this is correct

  Microsoft Defender for SQL is a cloud-native security solution that provides advanced threat protection, including vulnerability assessments and security alerts for Azure SQL databases and SQL servers on VMs. It continuously monitors database activity to detect SQL injection, brute-force attacks, and anomalous access patterns, then delivers actionable alerts with investigation steps. This makes it specifically designed for the database-level threat detection described in the scenario.

• ✗

  Azure Policy

  Why it's wrong here

  Azure Policy is a governance service that enforces rules on Azure resource configuration, such as allowed regions, resource types, or required tags, and can deny or modify non-compliant resources. It operates at the control plane, evaluating the state of resources, but it does not inspect database queries, connection patterns, or other data-plane runtime activity. Therefore, Azure Policy cannot identify a SQL injection or brute-force attempt against a database.

• ✗

  Azure Firewall

  Why it's wrong here

  Azure Firewall is a managed, stateful firewall that filters network traffic between Azure Virtual Networks and to/from the internet based on source/destination IPs, ports, and protocols. It protects the network perimeter by blocking malicious IP addresses or restricting open ports, but it sits outside the database engine and has no awareness of SQL query content or authentication attempts. As a result, it cannot detect database-specific threats like SQL injection, which occur at the application layer within the database service.