SC-900 Practice Test 2 — 30 Questions

Question 1

A company uses Microsoft Entra ID and wants to automatically detect potential security risks such as leaked credentials and suspicious sign-in patterns. They also need the ability to investigate these risks and configure automated responses based on risk levels. Which Microsoft Entra capability should they use?

Accepted Answer

Microsoft Entra Identity Protection. Microsoft Entra Identity Protection is the correct service because it automatically detects potential security risks such as leaked credentials and suspicious sign-in patterns, provides investigation tools (e.g., risk reports and detailed risk event logs), and enables automated responses like conditional access policies that block or require MFA based on risk levels. This directly matches the scenario's requirements for detection, investigation, and automated remediation.

Answer

Microsoft Entra ID Governance

Answer

Microsoft Entra Privileged Identity Management (PIM)

Answer

Microsoft Entra Domain Services

Question 2

A financial institution uses digital signatures to sign all transaction records. This ensures that the records have not been altered after signing. Which security goal does this primarily protect?

Accepted Answer

Integrity. Digital signatures use asymmetric cryptography (e.g., RSA or ECDSA) to create a hash of the transaction record, which is then encrypted with the signer's private key. Any alteration to the record after signing would cause the hash verification to fail, directly protecting the integrity of the data. While digital signatures also support non-repudiation, the question specifically asks which goal is primarily protected by ensuring records have not been altered, which is integrity.

Answer

Confidentiality

Answer

Non-repudiation

Answer

Availability

Question 3

A company wants to automatically detect emails in Exchange Online that contain credit card numbers and apply encryption to those emails before they are sent. Which Microsoft Purview solution should the administrator configure?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) in Microsoft Purview is specifically designed to detect sensitive information such as credit card numbers in emails and automatically apply protective actions like encryption. DLP policies can scan Exchange Online messages in transit and enforce rules to encrypt the email before it is sent, which directly meets the requirement.

Answer

Information Protection (sensitivity labels)

Answer

Data Lifecycle Management

Answer

eDiscovery

Question 4

A healthcare organization stores patient records in an encrypted database. Access to the database is restricted to authorized medical staff only. Which security principle is primarily being addressed by these measures?

Accepted Answer

Confidentiality. Confidentiality ensures that sensitive data, such as patient records, is accessible only to authorized individuals. Encryption renders the data unreadable to unauthorized parties, and access restrictions enforce that only authorized medical staff can decrypt and view the records. This directly aligns with the principle of confidentiality, which is a core pillar of the CIA triad.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 5

A security operations team uses Microsoft 365 Defender and wants to detect, investigate, and automatically respond to advanced identity-based attacks targeting on-premises Active Directory, such as Pass-the-Hash (PtH) and Golden Ticket attacks. They also need to integrate these alerts into Microsoft Sentinel for central incident management. Which Microsoft security solution provides these capabilities?

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity (MDI) is the correct answer because it is specifically designed to detect, investigate, and automatically respond to advanced identity-based attacks targeting on-premises Active Directory, including Pass-the-Hash (PtH) and Golden Ticket attacks. It uses behavioral analytics and machine learning to identify suspicious activities such as anomalous Kerberos ticket requests and NTLM authentication anomalies. MDI also natively integrates with Microsoft Sentinel, allowing alerts to be ingested for central incident management.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Office 365

Question 6

A multinational company stores customer data across multiple Azure regions. A new regulation requires that customer data must remain within the country's borders and cannot be transferred abroad. Which concept does this regulation primarily relate to?

Accepted Answer

Data Sovereignty. Data Sovereignty is the correct answer because the regulation mandates that customer data must remain within the country's borders and cannot be transferred abroad. This legal and compliance concept asserts that data is subject to the laws and governance structures of the nation where it is physically stored, directly addressing cross-border transfer restrictions.

Answer

Data Residency

Answer

Data Retention

Answer

Data Classification

Question 7

A security administrator is explaining authentication and authorization to new IT staff. Which statement correctly describes the difference between these two processes?

Accepted Answer

Authentication verifies who the user is; authorization verifies what the user can do.. Authentication is the process of verifying the identity of a user, device, or other entity, typically through credentials like a password, biometric, or certificate. Authorization determines what an authenticated entity is permitted to do, such as accessing specific resources or performing certain actions, often enforced via access control lists (ACLs) or role-based access control (RBAC). In Microsoft Entra ID, authentication occurs first (e.g., via OAuth 2.0 or SAML), and then authorization is evaluated using claims or directory roles.

Answer

Authentication verifies what a user can do; authorization verifies who the user is.

Answer

Both authentication and authorization verify the user's identity.

Answer

Authorization is always performed before authentication.

Question 8

A security architect is designing a new security posture based on the Zero Trust model. The architect wants to ensure that every access request is fully authenticated, authorized, and encrypted before granting access, and that access is granted only to the minimum necessary resources. Which three principles of Zero Trust align with these requirements? (Choose three.)

Accepted Answer

Verify explicitly. Option A is correct because the 'Verify explicitly' principle of Zero Trust requires that every access request must be fully authenticated, authorized, and encrypted before granting access. This means using strong authentication mechanisms (e.g., multifactor authentication) and continuous validation of identity and device health, not just relying on network location or implicit trust.

Answer

Network segmentation

Question 9

A multinational organization uses Microsoft Entra ID. The IT help desk team is responsible for password resets and group management, but only for users located in the European region. The organization has created a group containing all European user accounts. Which Microsoft Entra feature should an administrator use to delegate these administrative tasks specifically to the help desk team, limited to the European user scope?

Accepted Answer

Administrative units. Administrative units (AUs) in Microsoft Entra ID allow administrators to delegate administrative permissions scoped to a specific subset of users, groups, or devices. By creating an AU containing only the European user group, the administrator can assign the help desk team roles (e.g., Helpdesk Administrator or User Administrator) limited to that AU, ensuring they can perform password resets and group management only for European users.

Answer

Access reviews

Answer

Conditional Access

Answer

Self-service password reset (SSPR)

Question 10

A security administrator configures user accounts so that employees have only the permissions necessary to perform their job functions and no more. Which security concept is being applied?

Accepted Answer

Least privilege. The principle of least privilege dictates that users should be granted only the permissions necessary to perform their specific job functions and no more. By configuring accounts with minimal access rights, the administrator directly applies this concept to reduce the attack surface and limit potential damage from compromised credentials.

Answer

Defense in depth

Answer

Separation of duties

Answer

Zero Trust

Question 11

An organization adopts a security model that requires explicit verification of every access request, uses least privilege principles, and assumes that a breach has already occurred. Which security model does this describe?

Accepted Answer

Zero Trust. Zero Trust is the correct answer because the model explicitly requires verification of every access request, enforces least privilege, and assumes breach. This aligns with the core Zero Trust principles of 'never trust, always verify,' continuous validation, and micro-segmentation, as opposed to traditional perimeter-based models that implicitly trust internal traffic.

Answer

Perimeter-based security

Answer

Defense in depth

Answer

Shared responsibility

Question 12

A user authenticates to a company's network by entering their password and then approving a push notification on their mobile phone. After authentication, the user attempts to access a shared folder containing financial reports. The access is denied because the user's account is not a member of the 'Finance' group. Which security concept is demonstrated when the user is denied access to the folder?

Accepted Answer

Authorization. Authorization is the security concept that determines what resources a user is allowed to access after their identity has been verified. In this scenario, the user successfully authenticated but was denied access to the financial reports folder because their account lacked the necessary permissions—specifically, membership in the 'Finance' group. This access control decision is the essence of authorization, which enforces policies based on identity attributes like group membership.

Answer

Authentication

Answer

Non-repudiation

Answer

Accounting

Question 13

An organization adopts a Zero Trust security model. Which principle requires that every access request must be explicitly verified and granted least privilege regardless of the user's location or device?

Accepted Answer

Verify explicitly. The Zero Trust principle 'Verify explicitly' mandates that every access request—regardless of the user's location, device, or network—must be authenticated and authorized based on all available data points (e.g., user identity, device health, location, and real-time risk signals). This ensures that no implicit trust is granted, and least privilege is applied as a separate but complementary principle. In Microsoft's Zero Trust model, this is enforced through conditional access policies and continuous evaluation of session risk.

Answer

Use least privilege access

Answer

Assume breach

Answer

Never trust, always verify

Question 14

A user logs into the company's network using their username and password. After successful login, the user attempts to open a financial report but receives an access denied message because they are not a member of the 'Finance' security group. Which security concept is best illustrated by the access denial?

Accepted Answer

Authorization. The access denial occurs because the user lacks the necessary permissions to open the financial report, even though their identity was verified. This is the core function of authorization, which determines what resources an authenticated user can access. In this scenario, the user is authenticated but not authorized to access the report due to missing group membership.

Answer

Authentication

Answer

Accounting

Answer

Non-repudiation

Question 15

An organization adopts a security model where they never trust a request by default, even if it comes from inside the corporate network. Every access request must be authenticated, authorized, and encrypted. They also assume that a breach will happen and design their systems to minimize the blast radius. Which security model does this describe?

Accepted Answer

C. This scenario describes the Zero Trust security model, which operates on the principle of 'never trust, always verify.' It requires authentication, authorization, and encryption for every access request, regardless of origin (inside or outside the network), and assumes breach to minimize blast radius through microsegmentation and least-privilege access. Option C is correct because it aligns with the core tenets of Zero Trust as defined by NIST SP 800-207.

Answer

A

Answer

B

Answer

D

Question 16

A security architect is explaining identity management concepts to the IT team. Which statement correctly describes the difference between authentication and authorization?

Accepted Answer

Authentication verifies the identity of a user, while authorization determines the resources they can access.. Option C is correct because authentication is the process of verifying a user's identity (e.g., via password, biometric, or certificate), while authorization determines what resources or actions that authenticated identity is permitted to access. In Microsoft Entra ID, authentication occurs first via protocols like OAuth 2.0 or OpenID Connect, and authorization is then enforced through role-based access control (RBAC) or conditional access policies.

Answer

Authentication verifies what a user can do, while authorization verifies who the user is.

Answer

Authorization must always occur before authentication.

Answer

Authentication and authorization are synonymous terms in identity management.

Question 17

A security architect is designing a Zero Trust strategy. Which principle ensures that network location alone does not grant trust, and all access requests must be verified?

Accepted Answer

Verify explicitly. The 'Verify explicitly' principle is the core of Zero Trust, stating that every access request must be authenticated and authorized based on all available data points—including user identity, device health, location, and data sensitivity—regardless of network location. This ensures that being on a corporate network does not automatically grant trust, as all requests are verified in real time.

Answer

Least privilege

Answer

Assume breach

Answer

Segregation of duties

Question 18

A company is moving its on-premises infrastructure to Azure. The CISO wants to understand the division of security responsibilities between the cloud provider and the customer. Which of the following models defines this division?

Accepted Answer

Shared Responsibility Model. The Shared Responsibility Model defines the division of security responsibilities between the cloud provider (Microsoft) and the customer. Microsoft is responsible for the security of the cloud (physical hosts, network, datacenters), while the customer is responsible for security in the cloud (data, identities, access management, and configurations). This model is foundational for understanding compliance and security ownership in Azure.

Answer

CIA triad (Confidentiality, Integrity, Availability)

Answer

Zero Trust Model

Answer

Defense-in-Depth

Question 19

A company deploys a web application on Azure virtual machines (VMs) in an Infrastructure-as-a-Service (IaaS) model. The company is responsible for managing the guest operating system, the application code, and the data stored on the VMs. According to the shared responsibility model, which of the following security responsibilities does Microsoft retain in this scenario?

Accepted Answer

Protecting the physical datacenter and the underlying hardware. In an IaaS model, Microsoft retains responsibility for the physical datacenter, including physical security, the network infrastructure, and the underlying hardware (servers, storage, networking). This is because the customer manages the guest OS, application, and data, while Microsoft manages the physical layer up to the hypervisor. Option A correctly identifies this retained responsibility.

Answer

Configuring the operating system firewall on each VM

Answer

Installing and patching the application software

Answer

Managing user access to the application

Question 20

A company implements multiple layers of security controls: firewalls at the perimeter, intrusion detection systems on internal segments, antivirus software on all workstations, and encryption for sensitive data at rest and in transit. This strategy is intended to ensure that if one control fails, others still provide protection. Which security concept does this approach represent?

Accepted Answer

Defense in depth. Defense in depth is the correct concept because it involves implementing multiple layers of security controls (e.g., firewalls, IDS, antivirus, encryption) so that if one layer fails, subsequent layers continue to provide protection. This layered approach ensures redundancy and mitigates the risk of a single point of failure, aligning with the scenario described.

Answer

Least privilege

Answer

Separation of duties

Answer

Zero trust