Question 993 of 1,031

Describe Azure architecture and services →mediumMultiple ChoiceObjective-mapped

Quick Answer

The answer is Microsoft Defender for Cloud (formerly Azure Security Center). This service is the correct choice because it continuously assesses your Azure environment for security misconfiguration detection, scanning resources like virtual machines for open management ports (such as RDP or SSH) and checking storage accounts for missing encryption. It then provides prioritized, actionable recommendations for remediation, along with a secure score to track your security posture over time. On the Microsoft Azure Fundamentals AZ-900 exam, this question tests your understanding of which native tool handles proactive security assessment and compliance enforcement, often contrasting it with Azure Policy (which sets rules) or Azure Sentinel (which focuses on threat detection). A common trap is confusing Defender for Cloud’s remediation recommendations with Azure Advisor’s general best-practice suggestions. Memory tip: think of Defender for Cloud as your “security posture doctor” — it scans for misconfigurations, diagnoses issues, and prescribes a fix list.

AZ-900 Describe Azure architecture and services Practice Question

This AZ-900 practice question tests your understanding of describe azure architecture and services. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A company wants to proactively identify Azure resources that are misconfigured and could lead to security vulnerabilities, such as virtual machines with open management ports or unencrypted storage accounts. They also need to get prioritized recommendations for remediating these issues. Which Azure service should the company use?

Question 1mediummultiple choice

Full question →

A
Microsoft Defender for Cloud (formerly Azure Security Center)
This service is designed specifically to assess and improve the security posture of Azure resources. It continuously monitors for misconfigurations (like open management ports, unencrypted data) and provides prioritized recommendations to remediate them.
B
Azure Advisor
Why wrong: Azure Advisor provides best practice recommendations across cost, performance, reliability, and security. While it does include some security suggestions, it is not the dedicated service for in-depth vulnerability scanning and secure posture management; Microsoft Defender for Cloud is the primary tool for that purpose.
C
Azure Policy
Why wrong: Azure Policy helps enforce organizational standards by applying rules (e.g., 'require encryption on storage accounts'). It can evaluate compliance but does not natively scan for security vulnerabilities or provide a prioritized list of security issues across all resources.
D
Azure Blueprints
Why wrong: Azure Blueprints automates the deployment of resource groups, policies, RBAC assignments, and more to create a compliant environment. It does not perform ongoing security assessments or generate vulnerability recommendations.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Microsoft Defender for Cloud (formerly Azure Security Center)

Microsoft Defender for Cloud (formerly Azure Security Center) is the correct service because it continuously assesses the security posture of Azure resources, identifies misconfigurations such as open management ports (e.g., RDP/SSH) or unencrypted storage accounts, and provides prioritized, actionable recommendations for remediation. It integrates with Azure Policy to enforce security standards and offers a secure score to track improvement over time.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Microsoft Defender for Cloud (formerly Azure Security Center)
Why this is correct
This service is designed specifically to assess and improve the security posture of Azure resources. It continuously monitors for misconfigurations (like open management ports, unencrypted data) and provides prioritized recommendations to remediate them.
Related concept
Read the scenario before looking for a memorised answer.
✗
Azure Advisor
Why it's wrong here
Azure Advisor provides best practice recommendations across cost, performance, reliability, and security. While it does include some security suggestions, it is not the dedicated service for in-depth vulnerability scanning and secure posture management; Microsoft Defender for Cloud is the primary tool for that purpose.
✗
Azure Policy
Why it's wrong here
Azure Policy helps enforce organizational standards by applying rules (e.g., 'require encryption on storage accounts'). It can evaluate compliance but does not natively scan for security vulnerabilities or provide a prioritized list of security issues across all resources.
✗
Azure Blueprints
Why it's wrong here
Azure Blueprints automates the deployment of resource groups, policies, RBAC assignments, and more to create a compliant environment. It does not perform ongoing security assessments or generate vulnerability recommendations.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates often confuse Azure Advisor's general recommendations with Defender for Cloud's security-specific assessments, but Azure Advisor does not detect misconfigurations like open management ports or unencrypted storage—it focuses on cost, performance, and reliability instead.

Detailed technical explanation

How to think about this question

Under the hood, Defender for Cloud uses the Log Analytics agent and Azure Policy-based security initiatives (e.g., the Azure Security Benchmark) to continuously scan resource configurations against a set of built-in security controls. For example, it detects VMs with inbound RDP (port 3389) or SSH (port 22) rules open to the internet by analyzing Network Security Group (NSG) rules, and flags storage accounts without encryption at rest (Azure Storage Service Encryption) as vulnerabilities. The service then assigns a severity level (High, Medium, Low) to each recommendation and calculates a secure score (0-100%) to help organizations prioritize remediation efforts.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related AZ-900 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Describe cloud concepts practice questions

Practise AZ-900 questions linked to Describe cloud concepts.

Describe Azure architecture and services practice questions

Practise AZ-900 questions linked to Describe Azure architecture and services.

Describe Azure management and governance practice questions

Practise AZ-900 questions linked to Describe Azure management and governance.

AZ-900 Azure services practice questions

Practise AZ-900 questions linked to AZ-900 Azure services.

AZ-900 pricing and support practice questions

Practise AZ-900 questions linked to AZ-900 pricing and support.

AZ-900 security and compliance practice questions

Practise AZ-900 questions linked to AZ-900 security and compliance.

AZ-900 governance practice questions

Practise AZ-900 questions linked to AZ-900 governance.

Practice this exam

Start a free AZ-900 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

AZ-900 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this AZ-900 question test?

Describe Azure architecture and services — This question tests Describe Azure architecture and services — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Microsoft Defender for Cloud (formerly Azure Security Center) — Microsoft Defender for Cloud (formerly Azure Security Center) is the correct service because it continuously assesses the security posture of Azure resources, identifies misconfigurations such as open management ports (e.g., RDP/SSH) or unencrypted storage accounts, and provides prioritized, actionable recommendations for remediation. It integrates with Azure Policy to enforce security standards and offers a secure score to track improvement over time.

What should I do if I get this AZ-900 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.