How to use SC-900 flashcards effectively
Flashcards work through active recall — the process of retrieving information from memory rather than passively re-reading it. Research consistently shows that active recall produces stronger, longer-lasting memory than re-reading study guides. For SC-900 preparation, this means flashcards are one of the highest-return study tools available.
Attempt recall first
Read the SC-900 question on each card, pause, and attempt to formulate the answer in your own words before revealing. This retrieval attempt — even if wrong — dramatically strengthens memory compared to immediately reading the answer.
Review wrong cards again
When you get a card wrong, note it and add it back to your review pile. Spaced repetition — seeing difficult cards more frequently — is the mechanism that makes flashcard study far more efficient than linear reading.
Study by domain
Group your SC-900 flashcard sessions by domain for the first 3–4 weeks. Master one domain before moving to the next. In the final week, shuffle all cards together to test cross-domain recall — which is what the real SC-900 exam requires.
Short sessions beat marathon reviews
20–30 flashcard cards per session, done daily, produces better retention than a single 200-card marathon session. Five short daily sessions per week over 4 weeks gives you over 400 total card reviews — enough to reliably pass SC-900.
SC-900 flashcard preview
Sample cards from the SC-900 flashcard bank. Read the question, think of the answer, then read the explanation below.
A security analyst is explaining the core principles of information security to a new team member. Which principle ensures that data is not modified by unauthorized parties?
Integrity
Integrity is the principle that protects data from unauthorized modification. Confidentiality protects against unauthorized disclosure, availability ensures data is accessible when needed, and non-repudiation prevents denial of actions.
A company wants to require multi-factor authentication (MFA) for all users accessing a financial application, but only when they sign in from outside the corporate network. Which Microsoft Entra ID feature should be used?
Conditional Access
Conditional Access policies evaluate signals like location, device, and risk to enforce access controls. A policy can require MFA when a user is not on the corporate network, meeting the requirement.
A security administrator is using Microsoft Defender for Cloud to improve the security posture of Azure resources. The administrator wants to view a consolidated assessment of compliance with industry standards such as CIS and NIST. Which feature should be used?
Regulatory compliance dashboard
The Regulatory compliance dashboard in Microsoft Defender for Cloud provides a comprehensive view of your compliance posture against various standards and regulations, including CIS, NIST, and Azure CIS. It maps your Azure resources to the specific controls of each standard, showing pass/fail status and recommendations. Secure Score (Option B) is a separate feature that measures overall security posture based on security controls but does not directly map to specific industry standards. Azure Policy (Option C) is used to enforce rules and ensure compliance but does not provide a dashboard. Microsoft Sentinel (Option D) is a SIEM solution for threat detection, not compliance assessment. Thus, the correct answer is the Regulatory compliance dashboard.
A multinational corporation must comply with the General Data Protection Regulation (GDPR). They use Microsoft Purview Compliance Manager to manage compliance activities. The compliance manager wants to automatically assign each control to the appropriate team member for remediation. What should they configure?
Configure improvement actions with owners
In Compliance Manager, each improvement action represents a specific control to be implemented. The compliance manager can assign an owner to each improvement action, which automatically notifies that person via email and tracks their progress. Assessments (Option A) are frameworks of controls, but they do not assign actions. Connectors (Option C) are used to import non-Microsoft data into Compliance Manager. The Microsoft 365 admin center (Option D) is not used for Compliance Manager assignments. Therefore, the correct answer is to configure improvement actions with owners.
A company must retain all customer contracts for 10 years to comply with industry regulations. After 10 years, the contracts must be permanently deleted. Which Microsoft Purview solution should be used to automate this process?
Data Lifecycle Management
Microsoft Purview Data Lifecycle Management enables organizations to define retention and deletion policies that automatically retain content for a specified period and then delete it. This solution manages data based on its lifecycle stage. The other options are incorrect: Data Loss Prevention (DLP) prevents accidental sharing of sensitive data, eDiscovery is used for legal investigations, and Information Protection focuses on classifying and labeling sensitive data.
A company uses a cloud-based SaaS (Software as a Service) application for customer relationship management. According to the shared responsibility model, which security responsibility is primarily handled by the customer?
Managing user access and permissions for the application
In the shared responsibility model for SaaS, the cloud provider manages the underlying infrastructure, platform, and application security. The customer is responsible for securing their own data, managing user access (e.g., configuring who can access the application and with what permissions), and ensuring compliance with organizational policies. Options A and B are provider responsibilities. Option D is a provider responsibility as well (securing the application code).
A company runs a mix of on-premises servers and Azure virtual machines. They deploy Microsoft Defender for Endpoint on all servers. The security team wants to create custom queries to hunt for a specific attack pattern that involves a sequence of events across multiple machines, such as a PowerShell script being downloaded and then executed on several servers. They need to write their own detection rules based on advanced hunting data. Which Microsoft 365 Defender capability should they use?
Advanced hunting in Microsoft 365 Defender
Microsoft 365 Defender advanced hunting allows security analysts to query raw data from various sources using Kusto Query Language (KQL) to proactively hunt for threats. Custom detection rules are built on top of advanced hunting queries; when the query returns results, an alert can be generated and an automated response can be triggered. Microsoft Defender for Cloud (B) provides security posture management and workload protection, but does not offer KQL-based custom detection rules. Microsoft Defender for Office 365 (C) protects email and collaboration, not cross-machine hunt queries. Microsoft Sentinel (D) is a SIEM that also uses KQL, but it is a separate service; the question asks about Microsoft 365 Defender capability, which includes advanced hunting. The correct answer is A.
A company runs a consumer-facing e-commerce website and wants to allow customers to sign in using their existing social media accounts such as Google, Facebook, or LinkedIn. Which Microsoft Entra ID solution should they implement?
Microsoft Entra External ID (B2C)
Microsoft Entra External ID includes two offerings: B2B (business-to-business) for external business partners and B2C (business-to-consumer) for customer-facing applications. B2C supports social identity providers like Google and Facebook, allowing customers to sign in with existing accounts. B2B is designed for organizational accounts and does not natively support social IDPs for consumer scenarios.
A company has a hybrid identity environment with Active Directory synchronizing to Microsoft Entra ID. They want users to be able to reset their own on-premises passwords via the cloud SSPR portal. What is the minimum license required for this capability?
Microsoft Entra ID P1
Self-service password reset (SSPR) with password writeback (enabling changes to sync back to on-premises Active Directory) requires at least Microsoft Entra ID P1. Entra ID Free does not support writeback. P2 includes P1 features but P1 is sufficient. Microsoft 365 Business Basic includes only Entra ID Free.
A company uses a cloud-based Customer Relationship Management (CRM) system that is delivered as Software-as-a-Service (SaaS). According to the shared responsibility model, which security responsibility is primarily handled by the customer?
Managing user identities and controlling access to the CRM
In the shared responsibility model, responsibilities vary by service type. For SaaS, the cloud provider manages the infrastructure, application, and platform security. The customer is responsible for securing their own data, managing user access, configuring application settings, and ensuring compliance with data protection regulations. Options A, C, and D are provider responsibilities.
A company has implemented a security model where every access request is fully authenticated, authorized, and encrypted before granting access, regardless of where the request originates (corporate network or internet). The model assumes that no entity is inherently trustworthy and requires continuous verification. This model is known as:
Zero Trust
Zero Trust is a security model that eliminates implicit trust and continuously validates each stage of a digital interaction. Defense in depth refers to multiple layers of security controls. Least privilege means granting only the minimum permissions needed. Shared responsibility describes the division of security tasks between a cloud provider and customer.
A company assigns permissions to users based strictly on their job title (e.g., Sales Manager can edit documents, Sales User can only read). Which identity and access management concept is being implemented?
Role-Based Access Control (RBAC)
Role-Based Access Control (RBAC) is a method of restricting access based on the roles of individual users within an organization. In this scenario, assigning permissions based on job title is a classic example of RBAC. Least privilege is a principle that can be implemented using RBAC, but the direct method described is RBAC.
A company deploys a custom web application on Azure App Service (PaaS). The application stores user data in Azure SQL Database. The security team is responsible for securing the application code, managing authentication, and configuring TLS for data in transit. According to the Microsoft shared responsibility model, which security responsibility remains with Microsoft for this PaaS deployment?
Patching the operating system of the underlying physical and virtual hosts
For Platform as a Service (PaaS) like Azure App Service and Azure SQL Database, Microsoft manages the underlying infrastructure, including the physical hardware, network controls, and the operating system of the host machines. This includes patching the OS of the virtual machines that host the service. The customer is responsible for securing their application code, managing access (identity), and protecting their data. While Microsoft provides infrastructure-level encryption, the customer is often responsible for configuring encryption at rest for their databases. Option D is not a clear Microsoft responsibility because encryption at rest can be customer-managed or platform-managed depending on configuration, and the question asks for a responsibility that remains with Microsoft regardless.
A company deploys a custom web application on Azure App Service (PaaS). The application stores data in Azure SQL Database. The security team needs to identify which security responsibilities fall under the customer according to the Microsoft shared responsibility model. Which of the following is primarily the customer's responsibility for this PaaS deployment?
Managing user identities and access to the application
In the shared responsibility model, the cloud provider (Microsoft) manages the physical infrastructure, host OS, and network controls. For PaaS, the customer is responsible for managing access to data, ensuring proper application-level security (code, secrets, authentication), and configuring the service settings. Physical security of datacenters and patching the underlying host OS are Microsoft's responsibility. Customer data encryption at rest can be handled by the customer by enabling features like TDE, but the underlying protection of the infrastructure is Microsoft's job.
A company deploys a virtual machine on Azure IaaS. According to the Microsoft shared responsibility model, which of the following security responsibilities is primarily the customer's responsibility?
Patching the guest operating system and applications
For IaaS, the customer is responsible for all aspects of the virtual machine they deploy, including patching the guest OS, securing the application, and managing user access. Microsoft is responsible for the physical data center, the hypervisor, and the network infrastructure.
A company configures its access control system so that each user can only access the data and perform actions that are strictly necessary for their job role. This configuration is a direct implementation of which security principle?
Least privilege
The principle of least privilege states that users should be granted only the minimum level of access (permissions) needed to perform their job functions. Role-based access control (RBAC) is often used to enforce this principle. Defense in depth uses multiple layers of security. Separation of duties prevents a single individual from having conflicting roles (e.g., authorizing and executing a transaction). Zero trust is a broader security model that assumes no implicit trust and requires continuous verification.
A company has a policy that prohibits employees from sharing confidential customer data with unauthorized parties. The compliance team needs to detect patterns of unusual user activity that may indicate insider data theft, such as downloading large volumes of data to a personal device or emailing sensitive files to external recipients. They also want to investigate the activity and take remediation actions like generating a case for litigation or notifying the user's manager. Which Microsoft Purview solution should they use?
Microsoft Purview Insider Risk Management
Microsoft Purview Insider Risk Management uses predefined and customizable policies to detect, investigate, and act on risky user activities related to data theft, data leaks, and security policy violations. It provides behavioral analytics and a workflow for cases and notifications. Data Loss Prevention (DLP) is policy-based and prevents accidental sharing but does not focus on behavioral indicators. Audit logs provide raw event data without analytics or remediation workflows. eDiscovery is used for legal holds and content searches, not for detecting risky behavior.
A company has a document management system. The security policy requires that a user in the Sales department can only view documents related to sales and cannot access documents in the Finance or HR folders. Which security principle is being applied?
Least privilege
The principle of least privilege ensures that users are granted only the permissions necessary to perform their job functions. By restricting sales users to sales documents only, the organization is applying least privilege to minimize potential damage from accidental or malicious actions. This principle reduces the attack surface and is a core concept of identity and access management.
A company deploys a custom application on Azure App Service (PaaS). Which of the following security responsibilities falls completely under the customer's scope according to the shared responsibility model?
Managing the application code and its configuration
In the shared responsibility model for Platform as a Service (PaaS), the cloud provider secures the infrastructure, including the operating system, network, and physical host. The customer is fully responsible for securing their application, including the code, configurations, and data. Applying OS patches (option A) is managed by Microsoft for PaaS services. Configuring network security groups (option B) is partly a customer capability but the underlying network controls are managed by Microsoft, and physical security (option D) is Microsoft's responsibility. Therefore, managing the application code and its configuration (option C) is the correct answer.
A company has a SharePoint Online site that stores project documents. Due to legal requirements, all documents in this site must be retained for exactly 5 years from the date they were created, and then automatically deleted. No user should be able to permanently delete a document before the retention period ends. Which Microsoft Purview solution should the administrator configure?
Retention policy
A retention policy in Microsoft Purview can be applied to a SharePoint site to enforce a specified retention period (e.g., 5 years) and then automatically delete the content. Retention policies prevent users from permanently deleting content before the retention period ends. A sensitivity label is used for classification and protection (encryption, access control), not retention alone. A data loss prevention (DLP) policy prevents sharing of sensitive data but does not enforce retention. An audit policy enables logging but does not enforce retention or deletion.
A company implements a security measure to ensure that only authorized employees can view sensitive customer records. Which principle of the CIA triad does this measure primarily protect?
Confidentiality
The CIA triad consists of Confidentiality, Integrity, and Availability. Confidentiality ensures that data is accessible only to those with the proper authorization. In this scenario, restricting access to authorized employees directly protects confidentiality. Integrity ensures data accuracy and prevents tampering, while availability ensures systems are accessible when needed.
A company configures its identity and access management system so that employees are granted only the permissions necessary to perform their job functions. For example, a sales representative has read-only access to the customer database and cannot modify financial records. Which security principle is being applied in this scenario?
Least privilege
The principle of least privilege dictates that users should be granted the minimum level of access required to accomplish their tasks. This reduces the risk of accidental or malicious misuse of permissions. Segregation of duties involves splitting critical tasks among multiple people to prevent fraud. Defense in depth uses multiple layers of security controls. Zero Trust is a broader security model that assumes no implicit trust. The scenario directly describes least privilege.
SC-900 flashcards by domain
The SC-900 flashcard bank covers all 4 official blueprint domains published by Microsoft. Cards are distributed proportionally, so domains with higher exam weight have more cards.
Domain Coverage
Describe the concepts of security, compliance, and identity
Describe the capabilities of Microsoft Entra
Describe the capabilities of Microsoft security solutions
Describe the capabilities of Microsoft compliance solutions
Flashcards vs practice tests: which is better for SC-900?
Both flashcards and practice questions are evidence-based study tools. The difference is in what they train:
Flashcards — concept retention
Best for memorising definitions, acronyms, protocol behaviours, command syntax, and conceptual distinctions. Use flashcards to build the foundational vocabulary that SC-900 questions assume you know.
Best in: weeks 1–3
Practice tests — application
Best for applying concepts to realistic scenarios, eliminating distractors, and building exam stamina.SC-900 questions test scenario reasoning — not just recall — so practice tests are essential.
Best in: weeks 3–6
The most effective SC-900 study plan combines both: use flashcards for the first 2–3 weeks to build conceptual foundations, then shift to practice tests and mock exams in the final 2–3 weeks to apply and benchmark that knowledge. Most candidates who pass on their first attempt use both tools.
SC-900 flashcards — frequently asked questions
Are the SC-900 flashcards free?
Yes — all SC-900 flashcards on Courseiva are completely free, no account required. Every card includes the question, correct answer, and a full explanation. Create a free account to track which cards you have studied and get spaced repetition recommendations.
How many SC-900 flashcards are on Courseiva?
Courseiva has 498+ original SC-900 flashcards across all 4 exam blueprint domains. New cards are added regularly as the question bank grows. All cards are written by certified engineers against the official Microsoft exam objectives.
How are Courseiva flashcards different from Anki or Quizlet?
Courseiva flashcards are purpose-built for IT certification exams. Unlike generic flashcard platforms where content quality varies, every Courseiva card is mapped to the official SC-900 exam blueprint, written by engineers who hold the certification, and includes a full explanation of the correct answer and why the distractors are wrong. This explanation quality is what separates genuine learning from rote memorisation.
Can I use SC-900 flashcards offline?
Courseiva is a web platform — an internet connection is required. For offline study, we recommend creating free Courseiva account, using the platform in your browser, and using your device's offline capabilities if your browser supports offline web apps.
Track your SC-900 flashcard progress
Save your results, see which domains need more work, and get spaced repetition recommendations — all free.
Sign Up FreeFree forever · Every certification included