SC-900 Practice Test 5 — 10 Questions

Question 1

An organization adopts a security model that requires explicit verification of every access request, uses least privilege principles, and assumes that a breach has already occurred. Which security model does this describe?

Accepted Answer

Zero Trust. Zero Trust is the correct answer because the model explicitly requires verification of every access request, enforces least privilege, and assumes breach. This aligns with the core Zero Trust principles of 'never trust, always verify,' continuous validation, and micro-segmentation, as opposed to traditional perimeter-based models that implicitly trust internal traffic.

Answer

Perimeter-based security

Answer

Defense in depth

Answer

Shared responsibility

Question 2

A user authenticates to a company's network by entering their password and then approving a push notification on their mobile phone. After authentication, the user attempts to access a shared folder containing financial reports. The access is denied because the user's account is not a member of the 'Finance' group. Which security concept is demonstrated when the user is denied access to the folder?

Accepted Answer

Authorization. Authorization is the security concept that determines what resources a user is allowed to access after their identity has been verified. In this scenario, the user successfully authenticated but was denied access to the financial reports folder because their account lacked the necessary permissions—specifically, membership in the 'Finance' group. This access control decision is the essence of authorization, which enforces policies based on identity attributes like group membership.

Answer

Authentication

Answer

Non-repudiation

Answer

Accounting

Question 3

An organization adopts a Zero Trust security model. Which principle requires that every access request must be explicitly verified and granted least privilege regardless of the user's location or device?

Accepted Answer

Verify explicitly. The Zero Trust principle 'Verify explicitly' mandates that every access request—regardless of the user's location, device, or network—must be authenticated and authorized based on all available data points (e.g., user identity, device health, location, and real-time risk signals). This ensures that no implicit trust is granted, and least privilege is applied as a separate but complementary principle. In Microsoft's Zero Trust model, this is enforced through conditional access policies and continuous evaluation of session risk.

Answer

Use least privilege access

Answer

Assume breach

Answer

Never trust, always verify

Question 4

A user logs into the company's network using their username and password. After successful login, the user attempts to open a financial report but receives an access denied message because they are not a member of the 'Finance' security group. Which security concept is best illustrated by the access denial?

Accepted Answer

Authorization. The access denial occurs because the user lacks the necessary permissions to open the financial report, even though their identity was verified. This is the core function of authorization, which determines what resources an authenticated user can access. In this scenario, the user is authenticated but not authorized to access the report due to missing group membership.

Answer

Authentication

Answer

Accounting

Answer

Non-repudiation

Question 5

An organization adopts a security model where they never trust a request by default, even if it comes from inside the corporate network. Every access request must be authenticated, authorized, and encrypted. They also assume that a breach will happen and design their systems to minimize the blast radius. Which security model does this describe?

Accepted Answer

C. This scenario describes the Zero Trust security model, which operates on the principle of 'never trust, always verify.' It requires authentication, authorization, and encryption for every access request, regardless of origin (inside or outside the network), and assumes breach to minimize blast radius through microsegmentation and least-privilege access. Option C is correct because it aligns with the core tenets of Zero Trust as defined by NIST SP 800-207.

Answer

A

Answer

B

Answer

D

Question 6

A security architect is explaining identity management concepts to the IT team. Which statement correctly describes the difference between authentication and authorization?

Accepted Answer

Authentication verifies the identity of a user, while authorization determines the resources they can access.. Option C is correct because authentication is the process of verifying a user's identity (e.g., via password, biometric, or certificate), while authorization determines what resources or actions that authenticated identity is permitted to access. In Microsoft Entra ID, authentication occurs first via protocols like OAuth 2.0 or OpenID Connect, and authorization is then enforced through role-based access control (RBAC) or conditional access policies.

Answer

Authentication verifies what a user can do, while authorization verifies who the user is.

Answer

Authorization must always occur before authentication.

Answer

Authentication and authorization are synonymous terms in identity management.

Question 7

A security architect is designing a Zero Trust strategy. Which principle ensures that network location alone does not grant trust, and all access requests must be verified?

Accepted Answer

Verify explicitly. The 'Verify explicitly' principle is the core of Zero Trust, stating that every access request must be authenticated and authorized based on all available data points—including user identity, device health, location, and data sensitivity—regardless of network location. This ensures that being on a corporate network does not automatically grant trust, as all requests are verified in real time.

Answer

Least privilege

Answer

Assume breach

Answer

Segregation of duties

Question 8

A company is moving its on-premises infrastructure to Azure. The CISO wants to understand the division of security responsibilities between the cloud provider and the customer. Which of the following models defines this division?

Accepted Answer

Shared Responsibility Model. The Shared Responsibility Model defines the division of security responsibilities between the cloud provider (Microsoft) and the customer. Microsoft is responsible for the security of the cloud (physical hosts, network, datacenters), while the customer is responsible for security in the cloud (data, identities, access management, and configurations). This model is foundational for understanding compliance and security ownership in Azure.

Answer

CIA triad (Confidentiality, Integrity, Availability)

Answer

Zero Trust Model

Answer

Defense-in-Depth

Question 9

A company deploys a web application on Azure virtual machines (VMs) in an Infrastructure-as-a-Service (IaaS) model. The company is responsible for managing the guest operating system, the application code, and the data stored on the VMs. According to the shared responsibility model, which of the following security responsibilities does Microsoft retain in this scenario?

Accepted Answer

Protecting the physical datacenter and the underlying hardware. In an IaaS model, Microsoft retains responsibility for the physical datacenter, including physical security, the network infrastructure, and the underlying hardware (servers, storage, networking). This is because the customer manages the guest OS, application, and data, while Microsoft manages the physical layer up to the hypervisor. Option A correctly identifies this retained responsibility.

Answer

Configuring the operating system firewall on each VM

Answer

Installing and patching the application software

Answer

Managing user access to the application

Question 10

A company implements multiple layers of security controls: firewalls at the perimeter, intrusion detection systems on internal segments, antivirus software on all workstations, and encryption for sensitive data at rest and in transit. This strategy is intended to ensure that if one control fails, others still provide protection. Which security concept does this approach represent?

Accepted Answer

Defense in depth. Defense in depth is the correct concept because it involves implementing multiple layers of security controls (e.g., firewalls, IDS, antivirus, encryption) so that if one layer fails, subsequent layers continue to provide protection. This layered approach ensures redundancy and mitigates the risk of a single point of failure, aligning with the scenario described.

Answer

Least privilege

Answer

Separation of duties

Answer

Zero trust