2.4 - Databases, identity and security services (Cosmos DB, Entra, Key Vault)
AZ-900 objective 2.4 covers Azure database, identity and security services. Azure Cosmos DB is a globally distributed NoSQL database that replicates across continents with single-digit millisecond reads, and multi-region writes let users on several continents read and write a local replica with automatic conflict handling. On identity, authentication verifies who a user is, FIDO2 security keys give unphishable passwordless sign-in over USB or NFC, and Microsoft Entra ID adds B2B collaboration to invite an external consultant as a guest using their own credentials. Assigning permissions to a group and managing its membership keeps access current as people join and leave. For security, Microsoft Defender for Cloud combines cloud security posture management that assesses posture and recommends fixes with cloud workload protection that defends servers, containers and databases, and Azure Key Vault gives a central, access-controlled place to store secrets instead of hardcoding passwords and API keys. Under shared responsibility you always manage your own data, accounts and identities. Expect scenarios that ask which database, identity or security service fits.
Global NoSQL with single-digit millisecond reads = Cosmos DB; local read and write everywhere = multi-region writes. Unphishable passwordless key = FIDO2. Central store for secrets instead of hardcoding = Key Vault.
Practice questions
1. A security team wants to strengthen sign-ins so users must prove their identity a second way, and risky sign-ins from unexpected locations can be blocked. Which TWO Microsoft Entra features apply? (Choose TWO.)
- Multifactor authentication (MFA) (correct answer)
- Conditional Access policies (correct answer)
- Network security group flow logging on the subnets
- Azure DDoS Protection enabled on the perimeter network
- Resource locks applied to the identity resources
MFA requires a second proof of identity (app, code, key), and Conditional Access evaluates signals such as location, device, and risk to allow, block, or require MFA. NSG flow logs record network traffic, DDoS Protection defends against volumetric attacks, and resource locks prevent deletion - none of them control sign-ins.
2. An application needs a central place to store connection strings, certificates, and encryption keys, with access tightly controlled and audited. Which service should be used?
- Azure Key Vault (correct answer)
- Network security groups applied to the application subnet
- Microsoft Defender for Cloud with enhanced security features
- Azure Storage account containers with public access disabled
Key Vault is the dedicated service for secrets, keys, and certificates, with fine-grained access policies and full audit logging. NSGs filter network traffic, Defender for Cloud assesses and protects workloads, and a storage container is not designed to guard secrets with per-secret access control.
3. A gaming company needs a NoSQL database that replicates data across several continents and guarantees single-digit millisecond reads for players everywhere. Which Azure service fits?
- Azure SQL Database with its active geo-replication feature enabled on one replica
- Azure Database for PostgreSQL flexible server with several read replicas configured
- Azure Table Storage deployed into one separate storage account for each continent
- Azure Cosmos DB (correct answer)
Cosmos DB is Azure's globally distributed NoSQL database: you add regions with a click, and it backs single-digit millisecond latency with SLAs. SQL Database and PostgreSQL are relational, and separate Table Storage accounts per continent would leave the application to handle replication and consistency itself.
4. A team building a new cloud application wants a SQL Server compatible relational database as a fully managed PaaS service, with no OS, patching, or backup administration. Which option should it pick?
- Azure SQL Database (correct answer)
- SQL Server installed on an Azure virtual machine administered by the team itself
- Azure Cosmos DB configured to accept relational Transact-SQL statements natively
- Azure Database for MySQL flexible server running the Microsoft SQL Server engine
Azure SQL Database is the fully managed PaaS offering built on the latest stable SQL Server engine: Microsoft handles the OS, patching, backups, and high availability. SQL on a VM leaves all that work to the team, Cosmos DB is not a relational T-SQL database, and the MySQL service runs MySQL, never the SQL Server engine.
5. A company migrates an on-premises SQL Server that depends on SQL Server Agent jobs and cross-database queries. It wants near 100 percent engine compatibility while staying on a managed PaaS service. Which option fits BEST?
- Azure SQL Database single databases, with one created per database on the old server
- SQL Server on an Azure virtual machine, since agent jobs can never run on PaaS services
- Azure SQL Managed Instance (correct answer)
- Azure Database for PostgreSQL flexible server with a SQL Server compatibility extension
SQL Managed Instance offers near 100 percent compatibility with on-premises SQL Server, including SQL Server Agent and cross-database queries, while remaining a managed PaaS service - the classic lift-and-shift choice. Single databases lack those instance-level features, a VM abandons PaaS unnecessarily, and no PostgreSQL extension provides SQL Server compatibility.
6. Which TWO reasons justify choosing SQL Server on an Azure virtual machine instead of the PaaS options? (Choose TWO.)
- Full administrative control over the operating system is required (correct answer)
- The application depends on a specific older SQL Server version (correct answer)
- The company wants Microsoft to patch the OS and database engine automatically for it
- It is the only deployment option in Azure that supports automated database backup features
- It removes every high availability responsibility from the customer's operations team
SQL Server on a VM is IaaS: you keep full control of the OS and can install any exact SQL Server version an application requires. Automatic patching and built-in HA are arguments FOR the PaaS options, and automated backups exist across Azure SQL PaaS offerings too, so neither distractor favors the VM.