SC-900 Security, Compliance and Identity Fundamentals Practice Questions with Explanations
Free SC-900 Security, Compliance and Identity Fundamentals practice questions with an explanation for every answer. Covers Zero Trust, Microsoft Entra identity services, Microsoft Defender, Microsoft Purview compliance, and privacy.
Questions
Under the shared responsibility model, which responsibility always stays with the customer, no matter the cloud model?
- Information and data
- Physical datacenter security
- Physical network hardware
- Physical hosts and servers
A company runs virtual machines in Azure (IaaS). Who patches the guest operating system?
- The customer
- Microsoft
- The hardware vendor
- Microsoft and the customer equally
In a SaaS model such as Microsoft 365, who is responsible for the application code?
- The cloud provider
- The customer
- The customer's IT contractor
- Whoever buys the most licenses
Which cloud model shifts the most responsibility to the cloud provider?
- SaaS
- IaaS
- PaaS
- On-premises
Which deployment leaves the customer responsible for physical datacenter security?
- On-premises
- IaaS
- PaaS
- SaaS
What is the core idea behind defense in depth?
- Multiple layers of protection
- One strong perimeter firewall that stops all attacks
- A single master key that encrypts all company data
- Giving all staff admin rights so they can respond quickly
In the defense-in-depth layers, network security groups belong to which layer?
- Network
- Perimeter
- Application
- Data
In the defense-in-depth layers, DDoS protection belongs to which layer?
- Perimeter
- Network
- Compute
- Identity and access
A DDoS attack mainly threatens which part of the CIA triad?
- Availability
- Confidentiality
- Integrity
- Authorization
Comparing a file's hash before and after download mainly verifies its:
- Integrity
- Availability
- Confidentiality
- Authorization
Which is one of the Zero Trust guiding principles?
- Assume breach
- Trust the internal network
- Verify identity once per day
- Grant broad access by default
In Zero Trust, 'use least privilege access' means:
- Just-in-time and just-enough access
- Admin rights for long-serving staff
- Full access while on the corporate LAN
- Skipping MFA for low-risk users
Which list matches the three Zero Trust guiding principles?
- Verify explicitly, use least privilege, assume breach
- Verify once, trust the internal network, log everything
- Prevent, detect, and recover from attacks
- Encrypt, hash, and digitally sign all data
Which is one of the six foundational pillars of Microsoft's Zero Trust model?
- Devices
- Firewalls
- Passwords
- Datacenters
Which statement describes symmetric encryption?
- The same key encrypts and decrypts the data
- A public key encrypts and a private key decrypts
- Data becomes a fixed-length value that can't be reversed
- No key is needed because the algorithm is secret
Asymmetric encryption uses:
- A public and private key pair
- One shared secret key
- A salt and a hash value
- A one-time passcode
What makes hashing different from encryption?
- It's one-way and can't be reversed
- It always requires a public key pair
- It makes the data larger
- It needs a certificate authority
Why add a salt before hashing passwords?
- So equal passwords get different hashes
- So the hash can be decrypted again later
- So the stored password becomes shorter
- So the hash can use a public key
TLS protecting data moving between a browser and a web server is an example of:
- Encryption in transit
- Encryption at rest
- Hashing
- Data masking
Authentication answers which question?
- Who are you?
- What can you access?
- Where is the data stored?
- When does access expire?
Authorization is best described as:
- Deciding what a verified identity can access
- Proving that a user is who they claim to be
- Recording every sign-in for later review
- Encrypting stored credentials
Why is identity called the primary security perimeter?
- Users and data now live outside the network edge
- Firewalls are no longer sold for business networks
- Identities can't be phished or stolen
- Every company app now runs on-premises
Which is one of the four pillars of an identity infrastructure?
- Auditing
- Encryption
- Patching
- Backup
In modern authentication, which party issues security tokens after verifying a user?
- Identity provider
- Resource server
- Web browser
- DNS server
What does federation allow?
- Access across organizations via trusted identity providers
- Syncing every user's password into each connected app
- Merging two Active Directory forests under one admin account
- Encrypting traffic between datacenters
In a federation, trust must always be two-way.
Which is Microsoft's traditional on-premises directory service?
- Active Directory Domain Services
- Microsoft Entra ID
- Microsoft Purview
- Azure Key Vault
Rules about the physical or geographic location where data is stored concern:
- Data residency
- Data sovereignty
- Data classification
- Data minimization
The idea that data is subject to the laws of the country where it's collected or held is:
- Data sovereignty
- Data residency
- Data integrity
- Data lifecycle
The rules, practices, and processes an organization uses to direct and control its activities are called:
- Governance
- Compliance
- Risk management
- Auditing
Adhering to laws and regulations such as GDPR is called:
- Compliance
- Governance
- Federation
- Authorization
Microsoft Entra ID is best described as:
- A cloud-based identity and access management service
- An on-premises directory that needs domain controllers
- A SIEM that analyzes security logs
- A data loss prevention service
Microsoft Entra ID was previously called:
- Azure Active Directory
- Active Directory Federation Services
- Azure Information Protection
- Microsoft Intune
Which identity type lets an Azure app reach other Azure resources without developers storing credentials?
- Managed identity
- Guest user
- Shared admin account
- Local device account
What happens to a system-assigned managed identity when its Azure resource is deleted?
- It's deleted automatically
- It becomes user-assigned
- It stays until an admin removes it
- It moves to the root management group
Which managed identity type can be shared by several Azure resources?
- User-assigned
- System-assigned
- Guest-assigned
- Device-assigned
In Microsoft Entra ID, a service principal is:
- An identity that an app or service uses
- A guest user invited from a partner tenant
- A FIDO2 key registered to an administrator
- A group that holds administrator accounts
Which Microsoft Entra identity type is designed for AI agents rather than people or traditional apps?
- Agent identity (Microsoft Entra Agent ID)
- Guest identity (B2B collaboration)
- Device identity (Microsoft Entra registered)
- Group identity (dynamic membership)
A personal phone used for work email (BYOD) is typically:
- Microsoft Entra registered
- Microsoft Entra joined
- Microsoft Entra hybrid joined
- Promoted to a domain controller
An organization-owned Windows laptop that signs in with a work account and uses no on-prem AD is:
- Microsoft Entra joined
- Microsoft Entra registered
- Microsoft Entra hybrid joined
- A workgroup computer
A device joined to on-premises AD and also registered in Entra ID is:
- Microsoft Entra hybrid joined
- Microsoft Entra registered
- Microsoft Entra joined
- Federated only
Which group type gives members a shared mailbox, calendar, and SharePoint site?
- Microsoft 365 group
- Security group
- Administrative unit
- Dynamic device group
Dynamic membership groups add members based on:
- Rules based on user or device attributes
- Invitations sent out by the group's owners
- Random selection each night
- How often members sign in
Which tool synchronizes on-premises AD identities to Microsoft Entra ID?
- Microsoft Entra Connect
- Microsoft Purview
- Azure Bastion
- Defender for Identity
With password hash synchronization, where is a user's password checked at sign-in?
- In Microsoft Entra ID
- On an on-premises domain controller
- On an AD FS server
- On the user's device only
Which hybrid method validates passwords against on-prem AD using a lightweight agent?
- Pass-through authentication
- Password hash synchronization
- Certificate-based authentication
- Temporary Access Pass
Which hybrid option hands authentication to a separate trusted system such as AD FS?
- Federation
- Password hash sync
- Seamless SSO
- Cloud-only accounts
A partner's employee is invited into your tenant and signs in with their own credentials. This is:
- B2B collaboration
- B2C sign-up
- Pass-through authentication
- Seamless single sign-on
Which Entra capability supports customer-facing apps where consumers sign up with social or email accounts?
- Microsoft Entra External ID for customers
- B2B direct connect
- Privileged Identity Management
- Microsoft Entra Connect Sync with writeback
Which combination is true multifactor authentication?
- Password plus a code from an authenticator app
- Password plus the answer to a security question
- Two different passwords
- Username plus password