Azure Fundamentals AZ-900 Sign in Try 10 free questions

Microsoft Defender for Cloud: posture and protection

One service, two jobs — measure how secure your resources are, then actively defend the workloads running on them. AZ-900, 2026 edition.

Here are 7 typical Defender for Cloud questions in the exam's own style — free, each answer explained, no sign-up.

Straight to the 7 free questions ↓

Microsoft Defender for Cloud is one service that answers two different questions: how securely are my resources configured? and is anything attacking the workloads running on them? Keep those two halves separate in your head and this whole topic becomes easy points. The diagram above draws them as two pillars — learn which feature belongs to which.

Pillar one: posture (CSPM)

Cloud security posture management is the assessment half, and it is free and on by default for every subscription. It gives you three things the exam names again and again:

  • Secure Score — a single percentage that rates how secure your configuration is. It is a measure of progress: it rises as you fix things, and falls when you add unhardened resources.
  • Security recommendations — the prioritized to-do list behind that score. Each one flags a specific weakness (an unencrypted disk, an open port, missing endpoint protection) and the action that hardens it. Remediating recommendations is exactly what pushes Secure Score up.
  • The regulatory compliance dashboard — your resources measured against standards such as ISO 27001 and SOC 2, with passing and failing controls listed. (Note the contrast: this is your environment’s compliance; Microsoft’s own platform certifications live on the Service Trust Portal.)

Pillar two: protection (workload plans)

The second pillar actively defends running workloads, and this is the paid layer. Protection is delivered as Defender plans enabled per resource type — Defender for Servers, Defender for Storage, Defender for Databases, and more. Turn on the plan for a resource type and Defender adds threat detection tuned to it, raising threat alerts when it spots suspicious activity.

One workload feature the exam loves is just-in-time (JIT) VM access: management ports like RDP and SSH stay closed, opening only for a short, approved window when an admin actually needs in. That shrinks the attack surface without blocking legitimate work.

It reaches beyond Azure

Defender for Cloud is not limited to resources born in Azure. Through Azure Arc, servers running on-premises or in another cloud can be onboarded and protected from the same dashboard — so hybrid and multi-cloud estates get one posture-and-threats view. If a question stresses “across all environments from one place,” that is the capability being tested.

The one-line map

Split every Defender question by pillar first. Posture words — Secure Score, recommendations, compliance dashboard, free tier — point to CSPM. Protection words — threat alerts, per-resource plans, just-in-time access, paid — point to workload protection. The real exam mixes multiple-choice, true/false, and drag-and-drop formats; the seven samples above are standard multiple-choice, and every explanation carries a “why not the others” so the wrong options teach you as much as the right one.

A two-pillar diagram of Microsoft Defender for Cloud. On the left, the Cloud Security Posture Management (CSPM) pillar lists Secure Score as a single percentage, security recommendations that harden resources, and the regulatory compliance dashboard mapping resources to standards such as SOC and ISO. On the right, the Cloud Workload Protection pillar lists per-resource Defender plans for servers, storage and databases, threat alerts, and just-in-time VM access. A caption notes that both pillars extend beyond Azure to on-premises and other clouds via Azure Arc, and that a free CSPM tier is always on while workload protection plans are paid and enabled per resource type.

7 free AZ-900 practice questions

Answers and explanations — no email wall
AZ-900 Question 1 of 7

A leadership team wants one Azure service that both assesses how securely their resources are configured and actively detects threats against the workloads running on those resources. Which service combines both of these jobs?

Answer: A — Microsoft Defender for Cloud.

Microsoft Defender for Cloud has two halves. Cloud security posture management (CSPM) continuously assesses configuration and tells you how secure your resources are; cloud workload protection (CWP) actively defends running workloads and raises threat alerts. One service, both jobs — that is the definition the exam wants. Why not the others: Azure Monitor collects metrics and logs, but it observes health and performance, not security posture or threats. Azure Policy governs what resources are allowed to exist, not whether they are under attack. Microsoft Entra ID manages identities and sign-in — a different control plane entirely. Pro tip: if a question pairs 'how secure is my configuration' with 'detect threats,' the answer is Defender for Cloud.

AZ-900 Question 2 of 7

After enabling Microsoft Defender for Cloud, a team wants to raise their Secure Score. What actually moves that number upward?

Answer: A — Remediating the security recommendations that Defender for Cloud flags on their resources.

Secure Score is a percentage that rises as you act on Defender for Cloud's recommendations — fix a flagged misconfiguration and the score goes up. It is a measure of progress, and the recommendations are the to-do list that drives it. Why not the others: adding subscriptions gives Defender more to assess, if anything lowering the score until those resources are hardened. Spend has nothing to do with security posture. Azure Monitor alert rules watch for operational signals; they are not the remediation actions the score tracks. Pro tip: Secure Score goes up when you close recommendations, not when you grow the estate.

AZ-900 Question 3 of 7

Microsoft Defender for Cloud shows a recommendation that a virtual machine is missing disk encryption. What is the purpose of such a recommendation?

Answer: A — To give a specific, prioritized action that hardens the resource and reduces its exposure.

Recommendations are Defender for Cloud's hardening guidance. Each one names a concrete weakness — unencrypted disk, open management port, missing endpoint protection — and the fix, so you can reduce a resource's attack surface step by step. They are advisory, not destructive. Why not the others: Defender does not delete your resources; it advises you to fix them. There is no penalty charge for a misconfiguration. And a recommendation never blocks sign-in — that would be an identity control, not posture guidance. Pro tip: recommendation = a prioritized hardening step, one per weakness it finds.

AZ-900 Question 4 of 7

A compliance officer needs to see, at a glance, how the company's Azure resources measure up against regulatory standards such as ISO 27001 and SOC 2, with the passing and failing controls listed. Which part of Microsoft Defender for Cloud shows this?

Answer: A — The regulatory compliance dashboard.

Defender for Cloud's regulatory compliance dashboard maps your resources' state to compliance standards and shows which controls pass and which fail — the auditor's-eye view of your own environment. Why not the others: the Pricing Calculator estimates deployment cost and knows nothing about compliance. The Azure Monitor activity log records who did what in the subscription, not standard-by-standard compliance. A resource group's Overview lists resources and basic details, not control mappings. Pro tip: your resources measured against ISO or SOC controls = Defender's compliance dashboard; Microsoft's own platform certifications = the Service Trust Portal.

AZ-900 Question 5 of 7

A company wants Microsoft Defender for Cloud to actively protect specific resource types — their virtual machines, their storage accounts, and their SQL databases — with threat detection tuned to each. How is this protection enabled?

Answer: A — By turning on the relevant Defender plans, which are enabled per resource type.

Workload protection in Defender for Cloud is delivered as individual Defender plans — Defender for Servers, Defender for Storage, Defender for Databases and more — each switched on for the resource type it guards and each adding threat detection tuned to that workload. Why not the others: the Owner role grants access; it does not turn on threat protection. Azure Policy governs what is allowed to exist, not workload threat detection. Virtual machine size affects performance, not security coverage. Pro tip: posture assessment (CSPM) is free and always on; the workload protection plans are the paid, per-resource-type layer you enable.

AZ-900 Question 6 of 7

A security team wants management ports on their virtual machines to stay closed by default, opening only for a short, approved window when an administrator actually needs to connect. Which Microsoft Defender for Cloud feature provides this?

Answer: A — Just-in-time (JIT) VM access.

Just-in-time VM access keeps management ports (like RDP and SSH) locked down and grants time-boxed, approved access only when it is requested — shrinking the window an attacker could exploit. It is a workload-protection feature of Defender for Cloud. Why not the others: Cost Management budgets track spending, not port access. Azure Advisor gives general reliability, cost and performance advice, not on-demand port control. The TCO Calculator compares on-premises versus Azure costs — unrelated. Pro tip: 'ports closed until approved, then only briefly' is the signature of just-in-time VM access.

AZ-900 Question 7 of 7

An organization runs some servers in Azure, some in their own datacenter, and some in another cloud provider. They want one Microsoft Defender for Cloud view of security posture and threats across all of them. What makes this possible?

Answer: A — Connecting the non-Azure servers with Azure Arc so Defender for Cloud can protect them too.

Defender for Cloud is not limited to Azure. On-premises and other-cloud servers can be onboarded — Azure Arc extends Azure management to machines anywhere — so a single dashboard covers hybrid and multi-cloud estates with the same posture assessment and threat protection. Why not the others: it is simply untrue that Defender only sees Azure-native resources. You do not have to migrate everything into Azure to protect it. And the whole point is one unified tool, not a separate product per environment. Pro tip: 'hybrid and multi-cloud from one place' is a headline capability — Azure Arc is the on-ramp for non-Azure machines.

That is exactly how every question in the course works — answer, explanation, why-not. The real set continues in the practice player: 10 free questions, no sign-up.

Continue with the 10 free questions →

Those 7 questions were the start.

The exam does not test whether you recognise a term — it tests whether you can rule out three plausible answers under time pressure. That is what the explanations above are for, and there are 300 more questions built exactly like them.

Collecting questions yourself

  • Scattered across forums, of unknown age
  • Answer keys without reasoning
  • No idea which domain you are weak in

Practising with a system

  • 300 questions in 6 full tests, AZ-900 (2026)
  • Every option explained — including the wrong ones
  • Readiness per exam domain, and drills for your weakest
Start free — 10 questions

Straight into the player. No account, no email.

Frequently asked questions

Is Microsoft Defender for Cloud free?
Partly. The cloud security posture management layer — Secure Score, security recommendations, and the compliance view — is a free tier that is on by default for every subscription. The workload protection plans (Defender for Servers, Defender for Storage, Defender for Databases, and the rest) are paid and are enabled per resource type when you want active threat detection for that workload. So you can watch your posture for nothing and pay only for the protection you switch on.
How is Defender for Cloud different from Azure Advisor's security recommendations?
They overlap in wording but sit in different services. Azure Advisor is a broad, free recommendations engine spanning reliability, security, cost, performance, and operational excellence — a general tune-up list. Microsoft Defender for Cloud is the dedicated security service: it produces the Secure Score, deep security recommendations, a regulatory compliance dashboard, and — through its paid plans — real-time threat alerts and features like just-in-time VM access. If a question is specifically about security posture, threat detection, or Secure Score, it is pointing at Defender for Cloud.
Are these real exam questions?
No. They are our own questions, written in the style and difficulty of the AZ-900 — never copied from any question bank or the real exam. Reproducing live exam items violates Microsoft's certification agreement and can cost a candidate their certification, and a crammed answer teaches you nothing about the one you have not seen.

Updated for AZ-900 (July 2026). The sample questions above are our own work in the style of the exam — not real exam items. The exam itself is set and marked by the certification body.