SC-900 Describe the concepts of security, compliance, and identity — 100 Questions

Question 1

A security architect is designing a new security posture based on the Zero Trust model. The architect wants to ensure that every access request is fully authenticated, authorized, and encrypted before granting access, and that access is granted only to the minimum necessary resources. Which three principles of Zero Trust align with these requirements? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify explicitly. The 'Verify explicitly' principle requires that every access request is fully authenticated, authorized, and encrypted before granting access, using all available data points. The 'Least privilege access' principle ensures that access is granted only to the minimum necessary resources, for the minimum necessary time. The 'Assume breach' principle underpins the entire model, driving the need for continuous verification and least privilege by designing security with the expectation that a breach is inevitable, thus minimizing its potential impact and blast radius.

Answer

Network segmentation

Question 2

A company subscribes to Microsoft 365 E5, a Software-as-a-Service (SaaS) offering. The IT department is responsible for configuring user accounts and managing data in Exchange Online and SharePoint Online. According to the shared responsibility model, which security responsibility is retained by Microsoft for this SaaS deployment?

Accepted Answer

Securing the underlying application code and platform. In a SaaS model like Microsoft 365 E5, Microsoft retains responsibility for securing the underlying application code, platform, and physical infrastructure. This includes patching the operating system, hardening the application stack, ensuring the runtime environment is secure, and maintaining tenant isolation to protect data from unauthorized access by other tenants. The customer is responsible for managing user identities, configuring access controls, and protecting their own data.

Answer

Managing user access to the applications

Answer

Configuring multi-factor authentication for users

Question 3

A security architect is designing a Zero Trust security model for a hybrid organization. Which principle of Zero Trust requires that every access request must be fully authenticated and authorized regardless of the network location, and that access should be granted with the minimum level required?

Accepted Answer

Verify explicitly. The explanation incorrectly states that 'Verify explicitly' requires access to be granted with the minimum level required. This aspect is a core tenet of the 'Use least privileged access' principle. The explanation even acknowledges this by stating it's 'further enforced by the 'Use least privileged access' principle,' which contradicts the idea that 'Verify explicitly' alone covers this requirement.

Answer

Assume breach

Answer

Use least privileged access

Answer

Segment access

Question 4

An organization adopts a security model where they never trust a request by default, even if it comes from inside the corporate network. Every access request must be authenticated, authorized, and encrypted. They also assume that a breach will happen and design their systems to minimize the blast radius. Which security model does this describe?

Accepted Answer

Zero Trust. This describes Zero Trust: never trust any request by default, even from inside the network; always authenticate, authorize, and encrypt; assume breach and limit blast radius. Defense in depth adds layers but does not require distrusting internal traffic by default. Shared responsibility assigns security duties between cloud provider and customer. Perimeter-based security typically trusts internal traffic.

Answer

Defense in depth

Answer

Shared responsibility model

Answer

Perimeter-based security

Question 5

An organization uses a system where users first provide a username and password (Step 1) and then the system checks whether the user has permission to view a specific folder (Step 2). Which two security concepts are demonstrated in this process? (Choose two.)

Accepted Answer

Authentication. Step 1 (username and password) is authentication, which verifies the identity of the user by validating credentials against an identity provider such as Azure AD or on-premises Active Directory. This confirms who the user is before any access decisions are made. Step 2 (checking whether the user has permission to view a specific folder) is authorization, which determines what resources an authenticated user is allowed to access or what actions they are permitted to perform.

Answer

Accounting

Answer

Encryption

Question 6

A user logs into a company portal by entering a username and password. After successful login, the system checks if the user is a member of the 'Sales' group and then grants access to the sales dashboard. Which two security concepts are demonstrated in this process? (Choose all that apply.) (Choose two.)

Accepted Answer

Authentication. Authentication is demonstrated because the user proves their identity by providing a username and password, which the system verifies before allowing access. This is the process of validating credentials, typically against a directory service like Azure AD or an on-premises Active Directory, confirming the user is who they claim to be. Authorization is demonstrated when, after successful authentication, the system checks the user's group membership ('Sales' group) to determine if they are permitted to access the sales dashboard. This is the process of determining what an authenticated user is allowed to do.

Answer

Non-repudiation

Answer

Accounting

Question 7

Match each Microsoft security feature to its primary purpose.

Accepted Answer

Azure AD Privileged Identity Management (PIM): Provides just-in-time privileged access to Azure AD and Azure resources.. Azure AD PIM's primary purpose is to provide just-in-time and just-enough privileged access. Microsoft Intune is used for managing mobile devices and applications, including endpoint management. Microsoft Defender for Office 365 protects against email, link, and collaboration tool threats. Microsoft Purview Information Protection focuses on classifying and protecting sensitive data with labels and encryption. Options E and F incorrectly assign the purposes of PIM and Intune to each other.

Answer

Azure AD PIM: Manages mobile devices and applications.

Answer

Microsoft Intune: Provides just-in-time privileged access.

Question 8

You are the security architect for a multinational organization that uses Microsoft 365 E5, Microsoft Entra ID P2, and Microsoft Purview. The company has 10,000 employees across five regions. The legal department requires that all documents containing personally identifiable information (PII) of European Union citizens be automatically labeled with a 'Highly Confidential' sensitivity label and encrypted. Additionally, any sharing of such documents with external users must be blocked unless the sender explicitly justifies the business need. The solution must minimize manual user intervention. You need to design a Microsoft Purview configuration. What should you do?

Accepted Answer

Create an auto-labeling policy that detects EU PII sensitive info types, applies the 'Highly Confidential' label with encryption, and configure a conditional access rule to block external sharing without justification. Auto-labeling policies in Microsoft Purview can automatically detect sensitive info types (such as EU PII) and apply a sensitivity label like 'Highly Confidential' with encryption. Additionally, a Data Loss Prevention (DLP) policy can be configured to detect documents with this label (or EU PII sensitive info types) being shared externally and block the sharing unless the sender explicitly justifies the business need, meeting the requirement to block sharing unless the sender justifies the business need. Option A is incorrect because the unified labeling client prompts users manually, which contradicts the 'minimize manual intervention' requirement. Option C is incorrect because trainable classifiers require training and are not ideal for automatic PII detection; also manual labeling requires user intervention. Option D is incorrect because while DLP policies can block sharing, they do not apply sensitivity labels, so encryption would not be automatically applied.

Answer

Use a unified labeling client policy to prompt users to classify documents containing PII

Answer

Create a trainable classifier for PII and configure a manual labeling policy

Answer

Configure a DLP policy that blocks all documents containing PII from being shared externally

Question 9

Your company has a Microsoft 365 E5 subscription and uses Microsoft Teams for collaboration. The security team needs to ensure that guest users invited to Teams channels are required to pass multi-factor authentication (MFA) before accessing company resources. Currently, guest users are invited via Entra ID External ID but MFA is not enforced. You need to enforce MFA for all guest users. The solution should apply to all guest users across all applications. What should you configure?

Accepted Answer

Create a Conditional Access policy in Entra ID that targets all guest users and requires MFA. A Conditional Access policy targeting all guest users and requiring MFA is the standard way to enforce MFA for guests across applications. Option B is wrong because Teams guest access settings primarily control permissions within Teams, not authentication requirements like MFA, and would only apply to Teams, not across all applications. Option C is wrong because there is no direct global setting within Entra ID External ID to enforce MFA for all external users; Conditional Access is the mechanism for enforcement. Option D is wrong because the per-user MFA option is deprecated and less flexible for managing all guest users.

Answer

Set the guest user access level in Teams to allow only authenticated users

Answer

Configure Entra ID External ID to require MFA for all external users

Answer

Enable MFA for each guest user account individually

Question 10

A small business uses Microsoft 365 Business Premium. The owner wants to ensure that employees can access their email and files from anywhere, but only from trusted devices that comply with company security policies (e.g., have antivirus enabled and are up-to-date). They have heard about Microsoft Intune but are not sure if it's included. You need to recommend a solution that enforces device compliance for accessing company data. What should you do?

Accepted Answer

Use Microsoft Intune to create device compliance policies and a Conditional Access policy to require compliant devices. Microsoft 365 Business Premium includes Microsoft Intune, which is essential for managing devices and defining compliance policies. Option C is correct because it combines Intune to create device compliance policies (e.g., requiring antivirus and up-to-date OS) with Conditional Access to enforce these policies, ensuring only compliant devices can access company data. Option A is wrong because while Conditional Access can require managed devices, it relies on a device management solution like Intune to define and report device compliance, which is not fully addressed by just configuring Conditional Access. Option B is wrong because requiring all devices to be domain-joined is a traditional on-premises approach that is often impractical for a small business with remote access needs and personal devices. Option D is wrong because Security Defaults provide a baseline for identity security (such as requiring multi-factor authentication) but do not enforce device compliance or check for device health attributes like antivirus status or update levels.

Answer

Configure Conditional Access to require managed devices

Answer

Require all employees to use company-issued devices that are domain-joined

Answer

Enable Security Defaults in Entra ID

Question 11

A company is planning to use Copilot for Microsoft 365. To ensure that Copilot responses are based only on data accessible to the user, which principle must be enforced?

Accepted Answer

User permissions and access controls are respected. Copilot for Microsoft 365 uses the user's existing permissions to determine which content it can access. Option A is incorrect because Copilot does not automatically grant users access to data; it operates within existing user permissions. Option C is incorrect because while data is indexed, Copilot's access to that data for a specific user is always governed by that user's existing permissions, meaning not all organizational data is available to every user. Option D is incorrect because the storage location of data is not the principle that ensures Copilot responses are based only on data accessible to the user; rather, it is the enforcement of user permissions.

Answer

Copilot automatically grants access to all data

Answer

All organizational data is indexed and available to Copilot

Answer

Data must be stored in a specific location

Question 12

You work for a healthcare organization that uses Microsoft 365 E5 licenses. The organization must comply with HIPAA regulations. You need to ensure that electronic protected health information (ePHI) is classified and protected. Specifically, you want to automatically detect and apply a 'Highly Confidential' sensitivity label to documents containing medical record numbers, and also prevent users from sharing these documents externally via email. You have Microsoft Purview deployed. What should you implement first?

Accepted Answer

Create a sensitive information type for medical record numbers, then an auto-labeling policy to apply a sensitivity label, and finally a DLP policy to block external sharing of labeled documents.. To meet the requirements, first create a sensitive information type (SIT) for medical record numbers. Then create an auto-labeling policy that uses that SIT to apply the 'Highly Confidential' sensitivity label, and finally create a DLP policy to block external sharing of documents with that label. Option A is incorrect because it relies on custom keywords instead of a SIT and does not apply a sensitivity label. Option B is incorrect because it skips the required first step of creating a SIT; without a SIT, the auto-labeling policy cannot reliably detect medical record numbers, and auto-labeling alone does not block external sharing. Option C is incorrect because it skips the SIT and does not apply the 'Highly Confidential' sensitivity label; detecting medical record numbers and blocking sharing is only part of the solution.

Answer

Create a DLP policy that blocks external sharing of any document with a custom keyword.

Answer

Create an auto-labeling policy that applies a sensitivity label to documents with medical record numbers.

Answer

Create a DLP policy that detects medical record numbers and blocks external sharing.

Question 13

Which TWO of the following are components of the Microsoft Security Development Lifecycle (SDL)? (Choose two.)

Accepted Answer

Security training. The explanation for option A ('Penetration testing is part of security validation but is not an SDL phase.') is misleading. Penetration testing is explicitly listed as a key practice within the SDL's Verification phase in Microsoft's official documentation and SC-900 learning paths. If Threat modeling (E), which is a practice within the Design phase, is considered a 'core phase' or component, then Penetration testing (A) should also be considered a component. The explanation for E also imprecisely calls Threat modeling a 'core phase' instead of a core practice or component within a phase. Both Security training (C) and Threat modeling (E) are indeed core to the SDL, but so is Penetration testing (A) as a critical verification activity.

Answer

Penetration testing

Answer

Data classification

Answer

Code signing

Question 14

A company is implementing data classification in Microsoft Purview. Which THREE of the following are types of sensitive information that can be detected using built-in sensitive information types?

Accepted Answer

Passport numbers. Passport numbers, Social Security numbers, and Credit card numbers are all examples of built-in sensitive information types in Microsoft Purview. These types are predefined to detect specific patterns (e.g., formats, keywords, checksums, regular expressions) associated with regulated data like Personally Identifiable Information (PII) and Payment Card Industry (PCI) data. Microsoft Purview includes a vast library of these built-in types to help organizations identify and protect sensitive data across various services like Exchange, SharePoint, and OneDrive.

Answer

Favorite color

Answer

Project codenames

Question 15

A security analyst is explaining the core principles of information security to a new team member. Which principle ensures that data is not modified by unauthorized parties?

Accepted Answer

Integrity. The principle of integrity ensures that data remains accurate and unaltered during storage, processing, or transmission, except by authorized entities. In the context of information security, integrity is specifically concerned with preventing unauthorized modification, deletion, or creation of data. This is often enforced through mechanisms such as hashing (e.g., SHA-256), digital signatures, and checksums (e.g., CRC32) that detect any tampering.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 16

A company is moving its on-premises database to Azure SQL Database. According to the shared responsibility model, which security tasks remain the responsibility of the customer?

Accepted Answer

Managing access controls and authentication for database users. In the shared responsibility model for Azure SQL Database, Microsoft manages the physical infrastructure, including servers, storage, and network, while the customer is responsible for data and access management. Option B is correct because managing access controls and authentication for database users, such as configuring logins, users, and permissions via T-SQL or Azure Active Directory, falls squarely on the customer. Microsoft ensures the platform is patched and secure, but the customer must control who can access the database and what they can do.

Answer

Patching the physical servers hosting the database

Answer

Securing the hypervisor running the virtual machines

Answer

Hardening the network firewalls at the datacenter perimeter

Question 17

A security architect is adopting a new security model that assumes breach and verifies every access request. The model eliminates implicit trust and requires continuous validation. Which security model is being implemented?

Accepted Answer

Zero Trust. Zero Trust is the correct model because it explicitly assumes breach, eliminates implicit trust, and requires continuous validation of every access request. This aligns with the core Zero Trust principle of 'never trust, always verify,' which mandates that no user, device, or network is trusted by default, even if they are inside the corporate perimeter.

Answer

Defense in Depth

Answer

Least Privilege

Answer

Shared Responsibility

Question 18

A company is migrating its on-premises workloads to Azure. The CISO wants to understand the division of security responsibilities between Microsoft and the customer across cloud service models. For which cloud service model does the customer have the most security responsibility?

Accepted Answer

Infrastructure as a Service (IaaS). In the Infrastructure as a Service (IaaS) model, the customer is responsible for securing the operating system, applications, data, and network configurations, while Microsoft only secures the physical datacenter, host servers, and hypervisor. This gives the customer the most security responsibility compared to PaaS or SaaS, where Microsoft manages more of the stack.

Answer

Software as a Service (SaaS)

Answer

Platform as a Service (PaaS)

Answer

On-premises

Question 19

A company's security policy requires that customer data must only be accessible by authorized sales representatives. Which security principle does this requirement directly enforce?

Accepted Answer

Confidentiality. The principle of confidentiality ensures that information is accessible only to authorized individuals or systems. In this scenario, restricting access to customer data to only authorized sales representatives aligns with maintaining confidentiality. The other options are incorrect: Integrity ensures data is not improperly modified, Availability ensures systems are operational, and Non-repudiation ensures actions cannot be denied.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 20

A company uses Microsoft Entra ID and has multiple departments with separate organizational units (OUs) in its on-premises Active Directory. The help desk team needs to be able to reset passwords for users only in the Finance department. What feature should be used to delegate this administrative scope?

Accepted Answer

Administrative Units. Administrative Units (AUs) in Microsoft Entra ID allow you to delegate administrative permissions over a subset of users, groups, or devices without granting broader tenant-wide access. By creating an AU for the Finance department and assigning the Helpdesk Administrator role scoped to that AU, the help desk team can reset passwords only for Finance users, matching the on-premises OU structure.

Answer

Dynamic groups

Answer

Conditional Access policies

Answer

Privileged Identity Management (PIM)