A town's security liaison reviews Azure Advisor and finds recommendations such as enabling multifactor authentication and closing exposed management ports. At AZ-900 depth, what does this illustrate?

Azure Advisor includes a security category of best-practice recommendations. Finding items such as enabling multifactor authentication or closing exposed management ports shows that Advisor coaches security hygiene alongside cost, reliability, and operational excellence. At AZ-900 depth, that is enough: Advisor surfaces personalized security suggestions based on the town's Azure configuration.

Saying Advisor replaces Microsoft Defender for Cloud as the only security product fails because Defender for Cloud (and related security services) provide deeper posture management and threat protection; Advisor does not absorb that entire role. Claiming Advisor authors custom Conditional Access policies for every user fails because Conditional Access is configured in Microsoft Entra ID—Advisor may recommend MFA-related improvements but does not become the policy authoring engine for every user. Claiming Advisor encrypts disks by rewriting the guest operating system fails because disk encryption is implemented through Azure disk/encryption features and OS configuration, not by Advisor rewriting guest OS images.

Exam caveat: Advisor recommends security improvements; remediating them may involve Entra ID, network security groups, Defender for Cloud, or other tools. Do not equate "Advisor mentioned it" with "Advisor is the only security control."

Operational check: open Advisor's security recommendations for the town subscription, pick one exposed-port or MFA-related item, and trace which separate Azure control you would change to remediate it—reinforcing the recommend-versus-implement split.