SC-900 Practice Test 11 — 15 Questions

Question 1

An organization uses a system where users first provide a username and password (Step 1) and then the system checks whether the user has permission to view a specific folder (Step 2). Which two security concepts are demonstrated in this process? (Choose two.)

Accepted Answer

Authentication. Step 1 (username and password) is authentication, which verifies the identity of the user by validating credentials against an identity provider such as Azure AD or on-premises Active Directory. This confirms who the user is before any access decisions are made.

Answer

Accounting

Answer

Encryption

Question 2

A company deploys a virtual machine on Azure IaaS. According to the Microsoft shared responsibility model, which of the following security responsibilities is primarily the customer's responsibility?

Accepted Answer

Patching the guest operating system and applications. In the Microsoft shared responsibility model, the customer is responsible for securing and patching the guest operating system and applications running on an Azure IaaS virtual machine. Microsoft manages the physical infrastructure, hypervisor, and network, while the customer controls the OS, applications, and data.

Answer

Physical security of the data centers

Answer

Ensuring the hypervisor is secured

Answer

Maintaining the network infrastructure

Question 3

A company assigns permissions to users based strictly on their job title (e.g., Sales Manager can edit documents, Sales User can only read). Which identity and access management concept is being implemented?

Accepted Answer

Role-Based Access Control (RBAC). Role-Based Access Control (RBAC) is the correct concept because it assigns permissions to users based on their job title or role within the organization. In this scenario, the Sales Manager role is granted edit permissions, while the Sales User role is restricted to read-only, which is a direct implementation of RBAC where access rights are tied to roles rather than individual users.

Answer

Least privilege

Answer

Defense in depth

Answer

Zero Trust

Question 4

A company has implemented a security model where every access request is fully authenticated, authorized, and encrypted before granting access, regardless of where the request originates (corporate network or internet). The model assumes that no entity is inherently trustworthy and requires continuous verification. This model is known as:

Accepted Answer

Zero Trust. The described model—requiring full authentication, authorization, and encryption for every access request, treating no entity as inherently trustworthy, and demanding continuous verification—is the core definition of Zero Trust. This aligns with the NIST SP 800-207 standard, which explicitly states that Zero Trust assumes no implicit trust and enforces verification for every request, regardless of network location.

Answer

Defense in depth

Answer

Least privilege

Answer

Shared responsibility

Question 5

A company deploys a custom web application on Azure App Service (PaaS). The application stores user data in Azure SQL Database. The security team is responsible for securing the application code, managing authentication, and configuring TLS for data in transit. According to the Microsoft shared responsibility model, which security responsibility remains with Microsoft for this PaaS deployment?

Accepted Answer

Patching the operating system of the underlying physical and virtual hosts. In a PaaS deployment like Azure App Service, Microsoft is responsible for the security of the underlying cloud infrastructure, including patching the operating system of the physical and virtual hosts that run the platform. This is a core tenant of the shared responsibility model, where the customer manages application-level security (code, authentication, TLS) while Microsoft manages the host OS and hypervisor.

Answer

Configuring the firewall rules for the web application

Answer

Managing user access to the application

Answer

Encrypting the application data at rest in Azure SQL Database

Question 6

A company configures its access control system so that each user can only access the data and perform actions that are strictly necessary for their job role. This configuration is a direct implementation of which security principle?

Accepted Answer

Least privilege. The configuration described—granting each user only the access and actions strictly necessary for their job role—is the direct definition of the least privilege principle. In Microsoft identity and access management, this is implemented by assigning the minimum required permissions via Azure RBAC roles (e.g., Reader instead of Contributor) or using Azure AD Privileged Identity Management (PIM) for just-in-time access. This minimizes the attack surface by ensuring users cannot exceed their authorized scope.

Answer

Defense in depth

Answer

Separation of duties

Answer

Zero Trust

Question 7

A company uses a hashing algorithm to verify that a downloaded software file has not been tampered with during transmission. This practice primarily protects which security principle?

Accepted Answer

Integrity. Hashing algorithms, such as SHA-256, produce a fixed-size hash value that acts as a digital fingerprint of the file. By comparing the hash of the downloaded file with the hash provided by the publisher, any change to the file—even a single bit—results in a completely different hash, immediately detecting tampering. This directly protects the integrity of the data by ensuring it has not been altered during transmission.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 8

A company deploys a custom application on Azure App Service (PaaS). Which of the following security responsibilities falls completely under the customer's scope according to the shared responsibility model?

Accepted Answer

Managing the application code and its configuration. In the shared responsibility model for PaaS like Azure App Service, the customer is responsible for managing the application code and its configuration, including secrets, connection strings, and authentication settings. Microsoft manages the underlying platform, including the OS and runtime, so the customer's scope is limited to what they deploy and configure within the service.

Answer

Applying operating system patches to the virtual machines running the App Service

Answer

Configuring network security groups to filter traffic to the App Service

Answer

Ensuring physical security of the Azure data centers

Question 9

A company configures its identity and access management system so that employees are granted only the permissions necessary to perform their job functions. For example, a sales representative has read-only access to the customer database and cannot modify financial records. Which security principle is being applied in this scenario?

Accepted Answer

Least privilege. The scenario describes granting employees only the permissions necessary to perform their job functions, which is the core definition of the least privilege principle. In Microsoft identity and access management, this is implemented by assigning the minimum required Azure RBAC roles or Microsoft Entra ID directory roles, ensuring users have no more access than needed. This directly reduces the attack surface and limits potential damage from compromised accounts.

Answer

Segregation of duties

Answer

Defense in depth

Answer

Zero Trust

Question 10

A company has an on-premises Active Directory and wants to synchronize user accounts to Microsoft Entra ID. They also need to enable password hash synchronization so users can sign in to cloud resources with the same password. Which Microsoft tool should they use?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect is the correct tool because it is specifically designed to synchronize on-premises Active Directory user accounts to Microsoft Entra ID and supports password hash synchronization (PHS). PHS enables users to sign in to cloud resources using the same password as their on-premises environment by synchronizing a hash of the password hash to Entra ID.

Answer

Microsoft Entra ID Application Proxy

Answer

Microsoft Identity Manager

Answer

Microsoft Entra Domain Services

Question 11

A company has deployed Microsoft 365 Defender to unify threat detection and response. Which two components are included within the Microsoft 365 Defender integrated solution? (Select all that apply.)

Accepted Answer

Microsoft Defender for Endpoint. Microsoft 365 Defender is an integrated threat protection suite that unifies detection and response across an organization's Microsoft 365 environment. It includes Microsoft Defender for Endpoint, which provides endpoint detection and response (EDR) capabilities for devices, and Microsoft Defender for Office 365, which protects against email, phishing, and collaboration threats. These two components work together within the Microsoft 365 Defender portal to correlate alerts and automate response across endpoints and Office 365 workloads.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Sentinel

Question 12

A company has several on-premises web-based applications that need to be securely accessed by remote employees without requiring a VPN. The IT team wants to provide single sign-on (SSO) using Microsoft Entra ID. Which Microsoft Entra ID feature should they implement?

Accepted Answer

Microsoft Entra Application Proxy. Microsoft Entra Application Proxy enables secure remote access to on-premises web applications without a VPN by acting as a reverse proxy. It integrates with Microsoft Entra ID to provide single sign-on (SSO) for users, leveraging pre-authentication and conditional access policies. This directly meets the requirement for VPN-less, SSO-enabled access.

Answer

Microsoft Entra Self-Service Password Reset (SSPR)

Answer

Microsoft Entra Privileged Identity Management (PIM)

Answer

Microsoft Entra Identity Protection

Question 13

A company has a hybrid environment with on-premises Active Directory. The security team wants to detect advanced attacks such as pass-the-hash, malicious Kerberos ticket activity, and abnormal service account behavior. They want alerts from the on-premises environment to be integrated into Microsoft Defender for Cloud for centralized monitoring. Which Microsoft security solution should they deploy on their domain controllers?

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity (MDI) is the correct solution because it is specifically designed to detect advanced on-premises Active Directory attacks like pass-the-hash, malicious Kerberos ticket activity (e.g., Golden Ticket, Silver Ticket), and abnormal service account behavior. It integrates directly with Microsoft Defender for Cloud to provide centralized monitoring and alerting, fulfilling the requirement for on-premises domain controller protection.

Answer

Microsoft Defender for Cloud (agentless)

Answer

Microsoft Defender for Office 365

Answer

Microsoft Entra ID Protection

Question 14

A company implements a security strategy that includes multiple layers of controls: a perimeter firewall, an intrusion detection system, endpoint antivirus software, and multi-factor authentication for user access. The goal is that if one layer fails, another layer is in place to prevent or mitigate an attack. Which security principle does this approach best represent?

Accepted Answer

Defense in depth. Defense in depth is a security strategy that layers independent defensive mechanisms so that if one layer fails, another layer is already in place to prevent or mitigate an attack. The scenario explicitly describes multiple layers (firewall, IDS, endpoint antivirus, MFA) working together, which is the core definition of defense in depth. This approach ensures no single point of failure can compromise the entire security posture.

Answer

Zero Trust

Answer

Least privilege

Answer

CIA triad

Question 15

A company uses Azure virtual machines (IaaS) and on-premises Windows servers. The security team needs a single solution that provides a continuous assessment of security posture, a regulatory compliance dashboard for NIST SP 800-53, and integrated threat detection for hybrid workloads (e.g., brute force attacks on SSH). Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud is the correct choice because it provides continuous assessment of security posture (via the Secure Score), a regulatory compliance dashboard with built-in standards like NIST SP 800-53, and integrated threat detection for hybrid workloads, including brute force attacks on SSH for Azure VMs and on-premises servers. It unifies these capabilities across IaaS, on-premises, and other cloud environments, making it the single solution the security team needs.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Identity

Answer

Microsoft Sentinel