Microsoft Certification
60 practice questions with correct answers and detailed explanations. Use this guide to review concepts before taking the practice exam.
The Microsoft Microsoft Security, Compliance, and Identity Fundamentals (SC-900) certification validates professional expertise in Microsoft technologies. This study guide covers all 60 practice questions from our SC-900 practice test, complete with correct answers and explanations to help you understand each concept thoroughly.
Review each question and explanation below, then test yourself with the full interactive practice exam to measure your readiness.
What is the primary purpose of Azure Information Protection (AIP)?
Azure Information Protection enables organizations to classify, label, and protect sensitive data both on-premises and in the cloud through encryption and access controls.
Which Microsoft 365 service is primarily responsible for managing data loss prevention (DLP) policies?
The Microsoft 365 Compliance Center is the central hub for managing DLP policies, retention policies, sensitivity labels, and other compliance-related configurations.
What does conditional access in Azure AD enable organizations to do?
Conditional Access policies allow administrators to enforce specific access requirements based on conditions such as user location, device compliance, and sign-in risk.
Which of the following best describes Zero Trust security model?
Zero Trust is a security approach that assumes breach has occurred and requires continuous verification of all users and devices before granting access, regardless of location or previous authentication.
What is the purpose of Microsoft Sentinel in a security infrastructure?
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) solution that provides threat detection, investigation, and automated response across multiple data sources.
In the context of Microsoft 365, what is a retention label used for?
Retention labels define how content is managed throughout its lifecycle, allowing organizations to automatically delete, preserve, or trigger disposition reviews when retention periods expire.
What is the primary role of Azure Active Directory (Azure AD) in a hybrid environment?
Azure AD acts as a cloud identity platform that can synchronize with on-premises Active Directory, enabling single sign-on and consistent identity management across hybrid environments.
Which Microsoft security solution specifically provides endpoint protection through threat and vulnerability management?
Microsoft Defender for Endpoint provides comprehensive endpoint protection including threat detection, investigation, and vulnerability management for Windows, macOS, Linux, and mobile devices.
What is the main benefit of implementing privileged access management (PAM) in Azure?
PAM solutions like Azure AD Privileged Identity Management (PIM) control and monitor access to critical resources, requiring just-in-time activation and providing comprehensive audit logs for compliance.
In Microsoft 365, what does a sensitivity label enable users to do?
Sensitivity labels allow users to classify content and automatically apply protection measures such as encryption, watermarking, and restricted permissions based on the document's sensitivity.
What is the primary purpose of Microsoft Defender for Cloud?
Microsoft Defender for Cloud offers unified security management, vulnerability assessment, and threat detection across Azure, on-premises, and multicloud resources.
Which of the following is a key characteristic of identity governance in Azure AD?
Identity governance through Azure AD enables automated management of user identities across their lifecycle, including access reviews, entitlement management, and compliance verification.
What does Microsoft Defender for Identity (formerly Azure ATP) primarily protect against?
Microsoft Defender for Identity monitors on-premises Active Directory infrastructure to detect and investigate advanced threats like credential attacks, lateral movement, and abnormal user behavior.
In Azure, what is the purpose of role-based access control (RBAC)?
Azure RBAC provides fine-grained access control by assigning predefined or custom roles to users, groups, and service principals, ensuring principle of least privilege.
What is eDiscovery in the Microsoft 365 Compliance Center used for?
eDiscovery tools in Microsoft 365 Compliance Center enable organizations to identify, preserve, and export data for legal investigations and regulatory compliance purposes.
Which feature in Microsoft 365 helps organizations comply with regulations like GDPR and CCPA?
Compliance Manager in Microsoft 365 provides organizations with guidance, assessments, and recommended actions to help meet complex regulatory and compliance requirements.
What is the primary function of Azure Key Vault?
Azure Key Vault serves as a centralized secrets management service that securely stores and controls access to encryption keys, passwords, and certificates used by applications.
What does Microsoft Defender for Office 365 protect against?
Microsoft Defender for Office 365 provides advanced threat protection against phishing, malware, ransomware, and business email compromise attacks across email and collaboration tools.
What is the primary benefit of implementing multi-factor authentication (MFA) in Azure AD?
MFA requires users to provide at least two different verification methods (such as password and phone approval), dramatically reducing compromise risk even when credentials are exposed.
Which Microsoft solution provides threat intelligence and security analytics for cloud environments?
Microsoft Defender for Cloud Apps (formerly MCAS) monitors cloud application usage, detects anomalous behavior, and provides visibility and control over cloud-based threats.
What is the purpose of Access Reviews in Azure AD?
Access Reviews enable organizations to systematically verify user access rights, deprovisioning unnecessary permissions and ensuring ongoing compliance with security policies.
What does the NIST Cybersecurity Framework primarily provide?
The NIST Cybersecurity Framework offers a risk-based approach to managing cybersecurity through categories of Identify, Protect, Detect, Respond, and Recover, applicable across industries.
In terms of data residency and sovereignty, what does Azure compliance enable organizations to do?
Azure provides regional data centers and compliance certifications enabling organizations to meet data residency requirements, sovereignty laws, and industry-specific regulations.
What is the primary purpose of Microsoft's Shared Responsibility Model in cloud security?
The Shared Responsibility Model defines that Microsoft secures the infrastructure, while customers are responsible for identity, data, and application security—varying by service type.
Which compliance standard is specifically focused on protecting payment card industry data?
PCI DSS (Payment Card Industry Data Security Standard) establishes requirements for protecting payment card data, including encryption, access controls, and vulnerability management.
What is the primary purpose of Azure Active Directory (Azure AD)?
Azure AD is Microsoft's cloud-based identity and access management solution that enables users to access both cloud-based and on-premises applications securely. It serves as a central identity platform for authentication and authorization.
Which of the following best describes the principle of least privilege in security?
The principle of least privilege is a fundamental security concept that limits user access to only what is necessary for their role, reducing the attack surface and potential impact of compromised accounts.
What is multi-factor authentication (MFA) and why is it important?
MFA adds an additional security layer by requiring users to provide multiple forms of evidence (something you know, have, or are) to verify their identity. This substantially reduces the risk of account compromise even if passwords are stolen.
In the context of Microsoft security, what does 'identity' refer to?
In Microsoft's security model, identity encompasses the digital credentials and attributes (users, devices, apps, services) that are authenticated and authorized to access resources. It is foundational to Zero Trust architecture.
What is the primary goal of the Zero Trust security model?
Zero Trust operates on the principle of 'never trust, always verify.' It requires continuous verification of all users, devices, and applications before granting access to resources, regardless of their location or whether they are on the corporate network.
Which Microsoft service provides real-time threat protection and detection for cloud workloads?
Microsoft Defender for Cloud (formerly Azure Security Center) provides threat protection, vulnerability management, and security recommendations for cloud and hybrid environments. It helps detect and respond to threats across Azure resources.
What is the difference between authentication and authorization?
Authentication is the process of verifying a user's identity (e.g., with credentials), while authorization determines what authenticated users are allowed to do and access. Both are essential components of access control.
In Microsoft compliance, what does GDPR primarily regulate?
The General Data Protection Regulation (GDPR) is an EU regulation that governs how personal data of EU residents must be collected, processed, and protected. Organizations worldwide must comply if they handle EU citizen data.
What is conditional access in Azure AD?
Conditional Access in Azure AD allows organizations to enforce granular access policies based on dynamic conditions, such as requiring MFA for high-risk sign-ins, blocking access from non-compliant devices, or restricting access by location.
Which compliance standard is specifically designed for healthcare organizations in the United States?
HIPAA is a US federal law that requires healthcare organizations and their business associates to protect patient privacy and secure electronic health information (ePHI). It establishes standards for data security, privacy, and breach notification.
What is a security posture, and how does it relate to Microsoft Secure Score?
Security posture refers to an organization's overall security readiness. Microsoft Secure Score is a measurement tool that assesses your security configuration against best practices and provides actionable recommendations to strengthen your posture.
In the context of data protection, what is encryption?
Encryption transforms readable data (plaintext) into an unreadable format (ciphertext) using cryptographic algorithms and keys. Only authorized parties with the correct decryption key can convert the data back to its original form.
What is the purpose of role-based access control (RBAC)?
RBAC is a method of restricting access based on predefined roles. Instead of assigning individual permissions to each user, permissions are assigned to roles, and users are assigned to appropriate roles, making access management scalable and aligned with least privilege.
Which of the following is a key component of the Microsoft identity security ecosystem?
Microsoft's identity ecosystem includes both Active Directory (for on-premises environments) and Azure AD (for cloud environments). Organizations typically use both in hybrid scenarios to manage identities across their infrastructure.
What is a security threat, and how does it differ from a vulnerability?
A threat is an external force or potential harm that could exploit a system, while a vulnerability is a weakness or gap in security controls. A threat becomes a risk when it can exploit a vulnerability.
What does the acronym 'SIEM' stand for, and what is its primary function?
SIEM stands for Security Information and Event Management. SIEM solutions aggregate, correlate, and analyze security logs and events from multiple sources to detect threats, investigate incidents, and support compliance reporting.
In Microsoft's compliance framework, what is the purpose of a Data Protection Impact Assessment (DPIA)?
A Data Protection Impact Assessment (DPIA) is a systematic process to evaluate potential privacy and data protection risks before implementing new processing activities. It is a requirement under GDPR for high-risk processing.
What is the purpose of Microsoft Defender for Identity?
Microsoft Defender for Identity uses behavioral analytics and machine learning to detect suspicious user activities, compromised accounts, and advanced threats within on-premises Active Directory environments, enabling faster incident response.
What is an access review in the context of Azure AD?
Access reviews are periodic evaluations conducted in Azure AD to confirm that users' assigned access rights remain appropriate and necessary. They help prevent access creep and ensure compliance with the principle of least privilege.
Which of the following best describes the purpose of Microsoft Information Protection (MIP)?
Microsoft Information Protection enables organizations to discover, classify, and apply labels to sensitive data. It provides tools to protect data through encryption, access controls, and visual markings throughout its lifecycle.
What is the primary benefit of implementing Azure AD B2B (Business-to-Business)?
Azure AD B2B collaboration allows organizations to securely share applications and resources with external partners and guests who can authenticate using their own organizational credentials, enabling flexible partnership scenarios.
In compliance terminology, what is the significance of a 'control' in a framework like NIST?
In compliance frameworks like NIST, a control is a specific safeguard or countermeasure designed to prevent, detect, or mitigate security risks. Controls map to identified vulnerabilities and threats to reduce organizational risk.
What is the primary purpose of Azure Policy in a security and compliance context?
Azure Policy allows organizations to define and enforce governance rules across Azure resources. It enables compliance assessment, resource configuration management, and helps ensure resources meet organizational standards and regulatory requirements.
Which Microsoft solution is designed specifically to prevent data loss by controlling how sensitive data is shared and used?
Data Loss Prevention (DLP) is a security feature within Microsoft 365 and Azure that detects and prevents unauthorized sharing of sensitive data. It can block email transmission, file downloads, or copying of sensitive information based on policies.
What is the relationship between 'risk' and 'compliance' in an organizational security context?
Compliance and risk management are interconnected. Compliance frameworks provide structured approaches to identify threats, manage vulnerabilities, and implement controls to reduce organizational risk and meet legal or regulatory obligations.
Which Azure service provides centralized management of identities and access control across hybrid and multi-cloud environments?
Azure AD is Microsoft's cloud-based identity and access management service that enables secure sign-in and access to resources across hybrid and multi-cloud environments.
What is the primary purpose of Microsoft Defender for Cloud?
Microsoft Defender for Cloud delivers unified security management and threat protection across hybrid cloud workloads, helping organizations improve their security posture and defend against threats.
Which compliance framework is specifically designed for healthcare organizations handling protected health information (PHI)?
HIPAA (Health Insurance Portability and Accountability Act) is a U.S. federal regulation that sets standards for protecting PHI in healthcare organizations.
In the context of Zero Trust security model, which principle emphasizes verifying every user and device regardless of network location?
The 'never trust, always verify' principle is foundational to Zero Trust architecture, requiring continuous authentication and authorization for all access requests regardless of origin.
What is the primary function of Microsoft Purview in the compliance ecosystem?
Microsoft Purview offers data governance, data risk management, and compliance capabilities that help organizations understand, protect, and govern their data across hybrid and multi-cloud environments.
Which Microsoft service is specifically designed to protect against advanced phishing and malware threats in email?
Microsoft Defender for Office 365 provides advanced threat protection against phishing, malware, and other email-based threats through features like safe links and safe attachments.
In a multi-tenant SaaS environment, how does Microsoft ensure data isolation between different customer organizations?
Microsoft uses logical isolation with customer-specific encryption and granular access controls to ensure data separation in multi-tenant environments, even when physical infrastructure is shared.
What is the relationship between conditional access policies and the Zero Trust model?
Conditional access policies are a key Zero Trust implementation mechanism, continuously assessing risk context (device, location, user behavior) and enforcing granular access decisions based on real-time evaluation.
Which data classification level in Microsoft Purview indicates information that could cause significant harm if disclosed?
In Microsoft's standard data classification framework, 'Restricted' represents the highest sensitivity level for data that would cause severe business impact if unauthorized disclosure occurred.
What is the primary difference between Microsoft Defender for Identity and traditional network-based intrusion detection systems?
Microsoft Defender for Identity uses behavioral analytics and machine learning to detect suspicious user activities and compromised credentials within Active Directory, providing identity-centric threat detection that traditional network IDS systems cannot achieve.
You've reviewed all 60 questions. Take the interactive practice exam to simulate the real test environment.
▶ Start Practice Exam — Free