Mock Exam Section 3: Security, Governance, and Cost

Welcome to Mock Exam Section 3: Security, Governance, and Cost. This domain accounts for approximately 30–35% of AZ-900 marks and covers Entra ID, Defender for Cloud, Azure Policy, resource locks, cost tools, and SLAs. This is the domain where candidates most commonly lose marks due to service name confusion and subtle distinctions. Give yourself 18–20 minutes for this section. Focus on reading each scenario carefully before answering.

Scenario: A cloud administrator wants a single dashboard showing overall security health across all Azure subscriptions, with prioritised recommendations and a numeric score representing how well the environment follows security best practices. Which Azure service provides this?

A) Microsoft Defender for Cloud (Secure Score) — B) Microsoft Sentinel — C) Azure Policy — D) Azure Advisor

Answer: A — Microsoft Defender for Cloud (Secure Score). Defender for Cloud aggregates security recommendations and provides a percentage Secure Score. Microsoft Sentinel is a SIEM for threat detection and incident response — not a posture scoring tool. Azure Policy enforces governance rules but does not provide a security score. Azure Advisor has a security pillar but is not as focused as Defender for Cloud. Key signal: 'numeric security score + recommendations' → Defender for Cloud.

Scenario: A company wants employees to sign in once with their corporate credentials and then access both Microsoft 365 and Salesforce without being prompted for credentials again. Which Entra ID feature should they configure?

A) Single Sign-On (SSO) — B) Multi-Factor Authentication (MFA) — C) Conditional Access — D) B2B Collaboration

Answer: A — Single Sign-On (SSO). Entra ID SSO allows users to authenticate once and access multiple integrated applications without re-entering credentials. MFA adds a second factor but does not reduce authentication prompts across apps. Conditional Access evaluates sign-in signals and enforces policies alongside SSO but is not SSO itself. B2B Collaboration is for external partner users, not internal employees. Key signal: 'sign in once, access multiple apps without re-prompting' → SSO.

Scenario: An enterprise wants to ensure that no Azure SQL Databases can be created outside East US and West US across all subscriptions. Resources in non-compliant regions must be rejected at creation time, not just flagged. Which Azure governance tool should they use?

A) Azure Policy (Deny effect) — B) Resource Locks — C) Azure Blueprints — D) Azure Advisor

Answer: A — Azure Policy with a Deny effect. Azure Policy with the Deny effect prevents resource creation that violates the policy rule. Assigning at a management group scope ensures it covers all child subscriptions. Resource Locks prevent deletion or modification of existing resources but cannot prevent new resources being created in wrong regions. Blueprints package Policy assignments but Policy itself does the enforcement. Key signal: 'reject at creation time' → Azure Policy, Deny effect.

Scenario: A company has not yet deployed any Azure resources. Their CFO wants to estimate the monthly cost of running 2 VMs, 1 Azure SQL Database, and 1 Load Balancer in East US before committing to the project. Which tool should they use?

A) Azure Pricing Calculator — B) Azure Cost Management — C) TCO Calculator — D) Azure Advisor

Answer: A — Azure Pricing Calculator. The Pricing Calculator estimates monthly costs for a proposed architecture before deployment. Azure Cost Management monitors actual spending for already deployed resources. The TCO Calculator compares on-premises costs vs. Azure — for migration business cases, not new architectures. Azure Advisor surfaces recommendations for existing resources, not cost estimates for undeployed services. Key signal: 'not yet deployed, estimate before committing' → Pricing Calculator.

Scenario: A company deploys a web application using Azure App Service (SLA: 99.95%) and Azure SQL Database (SLA: 99.99%). Both services must be available for the application to work. What is the composite SLA?

A) ~99.94% — B) 99.95% — C) 99.99% — D) 100%

Answer: A — approximately 99.94%. When two services must both be available (AND relationship), the composite SLA = SLA1 × SLA2 = 0.9995 × 0.9999 = 0.99940005 ≈ 99.94%. Adding dependencies always reduces the composite SLA below either individual SLA. This is why redundancy (Availability Zones, multi-region) is needed to maintain high-availability targets. An OR relationship would increase the composite SLA. Memorise this formula for the exam.

Test your understanding of Microsoft Azure Fundamentals (AZ-900) concepts from this lesson.

In this section you practiced: Defender for Cloud Secure Score for security posture, SSO for single sign-on across multiple apps, Azure Policy Deny effect to block non-compliant resource creation, Azure Pricing Calculator for pre-deployment cost estimation, and composite SLA multiplication for AND-dependent services. Review any missed questions by revisiting its lesson. Next up: the final lesson reviews your scores and builds a targeted remediation plan.