Microsoft Security, Compliance, and Identity Fundamentals SC-900 practice test

A company uses a cloud-based SaaS (Software as a Service) application for customer relationship management. According to the shared responsibility model, which security responsibility is primarily handled by the customer?

Trap 1: Physical security of the data center hosting the application

Physical security is always the responsibility of the cloud provider, even in a SaaS model.

Trap 2: Security of the underlying networking infrastructure

The networking infrastructure (e.g., routers, firewalls) is maintained by the cloud provider as part of the platform security.

Trap 3: Applying security patches to the application's code

In SaaS, the provider is responsible for patching the application code because they own the software.

A
Physical security of the data center hosting the application
Why wrong: Physical security is always the responsibility of the cloud provider, even in a SaaS model.
B
Security of the underlying networking infrastructure
Why wrong: The networking infrastructure (e.g., routers, firewalls) is maintained by the cloud provider as part of the platform security.
C
Managing user access and permissions for the application
The customer controls who uses the application and with what privileges. This is a customer responsibility regardless of the cloud service model.
D
Applying security patches to the application's code
Why wrong: In SaaS, the provider is responsible for patching the application code because they own the software.

Question 2easymultiple choice

A company has a document management system. The security policy requires that a user in the Sales department can only view documents related to sales and cannot access documents in the Finance or HR folders. Which security principle is being applied?

Trap 1: Availability

Availability ensures systems are accessible when needed, but this scenario focuses on restricting access to specific data, not on uptime.

Trap 2: Defense in depth

Defense in depth uses multiple layers of security controls, but the scenario only discusses one access control policy, not a layered approach.

Trap 3: Non-repudiation

Non-repudiation ensures that actions cannot be denied later, typically via digital signatures, which is not relevant here.

A
Availability
Why wrong: Availability ensures systems are accessible when needed, but this scenario focuses on restricting access to specific data, not on uptime.
B
Least privilege
Correct. Least privilege restricts permissions to only what is necessary for the job, which is exactly what is described in the scenario.
C
Defense in depth
Why wrong: Defense in depth uses multiple layers of security controls, but the scenario only discusses one access control policy, not a layered approach.
D
Non-repudiation
Why wrong: Non-repudiation ensures that actions cannot be denied later, typically via digital signatures, which is not relevant here.

Question 3easymultiple choice

A company implements a security measure to ensure that only authorized employees can view sensitive customer records. Which principle of the CIA triad does this measure primarily protect?

Trap 1: Integrity

Incorrect. Integrity focuses on maintaining the accuracy and consistency of data, not on restricting access.

Trap 2: Availability

Incorrect. Availability ensures that systems and data are accessible when needed, not specifically who can view them.

Trap 3: Accountability

Incorrect. Accountability is not part of the CIA triad; it involves tracking actions to a specific user, often through auditing.

A
Confidentiality
Correct. Confidentiality prevents unauthorized access to information, which matches the requirement to limit access to authorized employees.
B
Integrity
Why wrong: Incorrect. Integrity focuses on maintaining the accuracy and consistency of data, not on restricting access.
C
Availability
Why wrong: Incorrect. Availability ensures that systems and data are accessible when needed, not specifically who can view them.
D
Accountability
Why wrong: Incorrect. Accountability is not part of the CIA triad; it involves tracking actions to a specific user, often through auditing.

Question 4easymultiple choice

A company has a SharePoint Online site that stores project documents. Due to legal requirements, all documents in this site must be retained for exactly 5 years from the date they were created, and then automatically deleted. No user should be able to permanently delete a document before the retention period ends. Which Microsoft Purview solution should the administrator configure?

Trap 1: Sensitivity label

Sensitivity labels are used to apply classification, encryption, and visual markings to documents. They do not enforce retention or deletion schedules by themselves.

Trap 2: Data loss prevention (DLP) policy

DLP policies detect and prevent sensitive information from being shared inappropriately. They do not enforce content retention or deletion.

Trap 3: Audit policy

Audit policies enable logging of activities for auditing purposes. They do not directly control retention or deletion of content.

A
Retention policy
A retention policy in Microsoft Purview allows administrators to set a retention period (e.g., 5 years) and an action (such as automatic deletion) for content in SharePoint sites. Users cannot permanently delete the content until the retention period expires.
B
Sensitivity label
Why wrong: Sensitivity labels are used to apply classification, encryption, and visual markings to documents. They do not enforce retention or deletion schedules by themselves.
C
Data loss prevention (DLP) policy
Why wrong: DLP policies detect and prevent sensitive information from being shared inappropriately. They do not enforce content retention or deletion.
D
Audit policy
Why wrong: Audit policies enable logging of activities for auditing purposes. They do not directly control retention or deletion of content.

Question 5mediummultiple choice

A company has deployed Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, and Microsoft Defender for Cloud Apps. The security operations team wants a single, unified portal where they can view alerts from all these products, perform cross-domain investigations, and orchestrate automated response actions. Which Microsoft security solution should they use?

Trap 1: Microsoft Sentinel

Microsoft Sentinel is a cloud-native SIEM and SOAR solution that can collect logs from various sources, but it is not the default unified portal for the four Defender products. The native unification comes from Microsoft 365 Defender.

Trap 2: Microsoft Defender for Cloud

Microsoft Defender for Cloud provides cloud security posture management and threat protection for cloud workloads (VMs, databases, etc.). It does not natively unify the four Defender products into a single incident view.

Trap 3: Microsoft Defender for Endpoint

Microsoft Defender for Endpoint is an enterprise endpoint security platform that provides EDR and antivirus. It is one of the products to be unified, not the unified solution itself.

A
Microsoft Sentinel
Why wrong: Microsoft Sentinel is a cloud-native SIEM and SOAR solution that can collect logs from various sources, but it is not the default unified portal for the four Defender products. The native unification comes from Microsoft 365 Defender.
B
Microsoft 365 Defender
Correct. Microsoft 365 Defender is the unified portal that correlates alerts and incidents from Defender for Endpoint, Office 365, Identity, and Cloud Apps, enabling cross-domain investigations and automated response.
C
Microsoft Defender for Cloud
Why wrong: Microsoft Defender for Cloud provides cloud security posture management and threat protection for cloud workloads (VMs, databases, etc.). It does not natively unify the four Defender products into a single incident view.
D
Microsoft Defender for Endpoint
Why wrong: Microsoft Defender for Endpoint is an enterprise endpoint security platform that provides EDR and antivirus. It is one of the products to be unified, not the unified solution itself.

Question 6easymultiple choice

A company deploys firewalls, intrusion detection systems, and endpoint antivirus software at multiple layers of its network. This strategy is intended to ensure that if one security control fails, others still provide protection. Which security concept does this approach represent?

Trap 1: Least privilege

Least privilege is about granting users the minimum permissions needed to perform their tasks, not about layered controls.

Trap 2: Separation of duties

Separation of duties prevents a single individual from having excessive control by splitting critical actions among multiple people, not by layering defenses.

Trap 3: Zero trust

Zero trust is a security model that requires continuous verification of every access request, treating all users as potential threats even if inside the network. It is not the same as deploying multiple security layers.

A
Defense in depth
Defense in depth is the correct concept. It employs overlapping security controls so that if one layer is breached, subsequent layers continue to protect the system.
B
Least privilege
Why wrong: Least privilege is about granting users the minimum permissions needed to perform their tasks, not about layered controls.
C
Separation of duties
Why wrong: Separation of duties prevents a single individual from having excessive control by splitting critical actions among multiple people, not by layering defenses.
D
Zero trust
Why wrong: Zero trust is a security model that requires continuous verification of every access request, treating all users as potential threats even if inside the network. It is not the same as deploying multiple security layers.