SC-900 Describe the concepts of security, compliance, and identity — 100 Questions

Question 1

A security analyst is explaining the core principles of information security to a new team member. Which principle ensures that data is not modified by unauthorized parties?

Accepted Answer

Integrity. The principle of integrity ensures that data remains accurate and unaltered during storage, processing, or transmission, except by authorized entities. In the context of information security, integrity is specifically concerned with preventing unauthorized modification, deletion, or creation of data. This is often enforced through mechanisms such as hashing (e.g., SHA-256), digital signatures, and checksums (e.g., CRC32) that detect any tampering.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 2

A company is moving its on-premises database to Azure SQL Database. According to the shared responsibility model, which security tasks remain the responsibility of the customer?

Accepted Answer

Managing access controls and authentication for database users. In the shared responsibility model for Azure SQL Database, Microsoft manages the physical infrastructure, including servers, storage, and network, while the customer is responsible for data and access management. Option B is correct because managing access controls and authentication for database users, such as configuring logins, users, and permissions via T-SQL or Azure Active Directory, falls squarely on the customer. Microsoft ensures the platform is patched and secure, but the customer must control who can access the database and what they can do.

Answer

Patching the physical servers hosting the database

Answer

Securing the hypervisor running the virtual machines

Answer

Hardening the network firewalls at the datacenter perimeter

Question 3

A security architect is adopting a new security model that assumes breach and verifies every access request. The model eliminates implicit trust and requires continuous validation. Which security model is being implemented?

Accepted Answer

Zero Trust. Zero Trust is the correct model because it explicitly assumes breach, eliminates implicit trust, and requires continuous validation of every access request. This aligns with the core Zero Trust principle of 'never trust, always verify,' which mandates that no user, device, or network is trusted by default, even if they are inside the corporate perimeter.

Answer

Defense in Depth

Answer

Least Privilege

Answer

Shared Responsibility

Question 4

A company is migrating its on-premises workloads to Azure. The CISO wants to understand the division of security responsibilities between Microsoft and the customer across cloud service models. For which cloud service model does the customer have the most security responsibility?

Accepted Answer

Infrastructure as a Service (IaaS). In the Infrastructure as a Service (IaaS) model, the customer is responsible for securing the operating system, applications, data, and network configurations, while Microsoft only secures the physical datacenter, host servers, and hypervisor. This gives the customer the most security responsibility compared to PaaS or SaaS, where Microsoft manages more of the stack.

Answer

Software as a Service (SaaS)

Answer

Platform as a Service (PaaS)

Answer

On-premises

Question 5

A security architect is designing a new security posture based on the Zero Trust model. The architect wants to ensure that every access request is fully authenticated, authorized, and encrypted before granting access, and that access is granted only to the minimum necessary resources. Which three principles of Zero Trust align with these requirements? (Choose three.)

Accepted Answer

Verify explicitly. Option A is correct because the 'Verify explicitly' principle of Zero Trust requires that every access request must be fully authenticated, authorized, and encrypted before granting access. This means using strong authentication mechanisms (e.g., multifactor authentication) and continuous validation of identity and device health, not just relying on network location or implicit trust.

Answer

Network segmentation

Question 6

A company's security policy requires that customer data must only be accessible by authorized sales representatives. Which security principle does this requirement directly enforce?

Accepted Answer

Confidentiality. The principle of confidentiality ensures that information is accessible only to authorized individuals or systems. In this scenario, restricting access to customer data to only authorized sales representatives aligns with maintaining confidentiality. The other options are incorrect: Integrity ensures data is not improperly modified, Availability ensures systems are operational, and Non-repudiation ensures actions cannot be denied.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 7

A company uses Microsoft Entra ID and has multiple departments with separate organizational units (OUs) in its on-premises Active Directory. The help desk team needs to be able to reset passwords for users only in the Finance department. What feature should be used to delegate this administrative scope?

Accepted Answer

Administrative Units. Administrative Units (AUs) in Microsoft Entra ID allow you to delegate administrative permissions over a subset of users, groups, or devices without granting broader tenant-wide access. By creating an AU for the Finance department and assigning the Helpdesk Administrator role scoped to that AU, the help desk team can reset passwords only for Finance users, matching the on-premises OU structure.

Answer

Dynamic groups

Answer

Conditional Access policies

Answer

Privileged Identity Management (PIM)

Question 8

A security administrator is explaining the concept of defense in depth to a new team member. Which statement best describes this approach?

Accepted Answer

Layering multiple security controls across different areas of the IT environment. Defense in depth is a cybersecurity strategy that employs multiple layers of security controls across different areas of the IT environment (network, endpoint, application, data, and physical). This approach ensures that if one control fails, another is already in place to mitigate the threat, providing redundancy and reducing the risk of a single point of failure. Microsoft's security framework, including tools like Microsoft Defender for Cloud and Azure Firewall, operationalizes this concept by integrating protections at each layer.

Answer

Using a single, strong firewall to block all external traffic

Answer

Relying solely on encryption to protect all data at rest and in transit

Answer

Implementing only physical security measures to protect the data center

Question 9

A user logs into a company's financial application using their Microsoft Entra ID credentials. After successful sign-in, the application displays a dashboard with data for only the regions the user is authorized to manage. Which two security concepts are demonstrated in this scenario? (Select all that apply.)

Accepted Answer

Authentication. Authentication is demonstrated because the user proves their identity by logging in with Microsoft Entra ID credentials, confirming they are who they claim to be. Authorization is demonstrated because after authentication, the application restricts the dashboard to show only data for regions the user is permitted to manage, enforcing access control based on assigned permissions.

Answer

Accounting

Answer

Non-repudiation

Question 10

A security manager wants to ensure that an employee who sends an email cannot later deny having sent it. Which security concept and associated technology is best suited to achieve this?

Accepted Answer

Non-repudiation, achieved through digital signatures. Non-repudiation ensures that a party cannot deny an action, such as sending an email. Digital signatures, which use asymmetric cryptography (e.g., RSA or ECDSA) and a hash of the message, provide cryptographic proof of the sender's identity and message integrity, making denial impossible.

Answer

Confidentiality, achieved through encryption

Answer

Integrity, achieved through hashing

Answer

Access control, achieved through permissions

Question 11

A company assigns permissions to users based strictly on their job title (e.g., Sales Manager can edit documents, Sales User can only read). Which identity and access management concept is being implemented?

Accepted Answer

Role-Based Access Control (RBAC). Role-Based Access Control (RBAC) is the correct concept because it assigns permissions to users based on their job title or role within the organization. In this scenario, the Sales Manager role is granted edit permissions, while the Sales User role is restricted to read-only, which is a direct implementation of RBAC where access rights are tied to roles rather than individual users.

Answer

Least privilege

Answer

Defense in depth

Answer

Zero Trust

Question 12

A company implements a security measure to ensure that only authorized employees can view sensitive customer records. Which principle of the CIA triad does this measure primarily protect?

Accepted Answer

Confidentiality. Confidentiality ensures that sensitive information is accessible only to authorized individuals. By restricting access to customer records to authorized employees, the company directly prevents unauthorized disclosure, which is the core goal of confidentiality in the CIA triad.

Answer

Integrity

Answer

Availability

Answer

Accountability

Question 13

A company implements regular data backups and a disaster recovery plan to restore critical systems after an outage. Which security principle is primarily being addressed by these measures?

Accepted Answer

Availability. Regular data backups and a disaster recovery plan directly ensure that critical systems and data can be restored and remain accessible after an outage. This aligns with the Availability principle of the CIA triad, which guarantees that authorized users have reliable access to resources when needed. In Azure, this is supported by services like Azure Backup and Azure Site Recovery, which provide automated backup and failover capabilities to maintain uptime.

Answer

Confidentiality

Answer

Integrity

Answer

Non-repudiation

Question 14

A security administrator configures user accounts so that employees have only the permissions necessary to perform their job functions and no more. Which security concept is being applied?

Accepted Answer

Least privilege. The principle of least privilege dictates that users should be granted only the permissions necessary to perform their specific job functions and no more. By configuring accounts with minimal access rights, the administrator directly applies this concept to reduce the attack surface and limit potential damage from compromised credentials.

Answer

Defense in depth

Answer

Separation of duties

Answer

Zero Trust

Question 15

A company uses cryptographic hashes to verify that a downloaded software file has not been modified by an attacker during transmission. Which principle of the CIA triad is primarily being addressed?

Accepted Answer

Integrity. Cryptographic hashing (e.g., SHA-256) produces a fixed-size digest from the file's contents. By comparing the computed hash with the publisher's published hash, any change to the file—even a single bit—yields a completely different digest, proving the file has not been tampered with. This directly protects the integrity of the data, ensuring it remains unaltered during transit.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 16

A healthcare organization stores patient records in an encrypted database. Access to the database is restricted to authorized medical staff only. Which security principle is primarily being addressed by these measures?

Accepted Answer

Confidentiality. Confidentiality ensures that sensitive data, such as patient records, is accessible only to authorized individuals. Encryption renders the data unreadable to unauthorized parties, and access restrictions enforce that only authorized medical staff can decrypt and view the records. This directly aligns with the principle of confidentiality, which is a core pillar of the CIA triad.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 17

A financial institution uses digital signatures to ensure that a transaction record has not been altered after it was processed. Which security principle is primarily addressed?

Accepted Answer

B. Integrity. Digital signatures use asymmetric cryptography (e.g., RSA or ECDSA) to create a hash of the transaction record, which is then encrypted with the sender's private key. Any alteration to the record after signing would cause the hash verification to fail, directly ensuring data integrity. This is why option B is correct.

Answer

A. Confidentiality

Answer

C. Availability

Answer

D. Non-repudiation

Question 18

A company requires all employees to provide a one-time passcode generated by an authenticator app in addition to their password when accessing the corporate VPN. This practice is an example of which security concept?

Accepted Answer

C. Authentication. Option C is correct because the requirement for a one-time passcode (OTP) from an authenticator app in addition to a password is a classic implementation of multi-factor authentication (MFA). Authentication is the process of verifying the identity of a user, device, or service, and this scenario uses two distinct factors: something you know (password) and something you have (the OTP generated by the app). This directly aligns with the security concept of authentication, not authorization, auditing, or accounting.

Answer

A. Authorization

Answer

B. Auditing

Answer

D. Accounting

Question 19

A security architect is designing a system where user access rights are reviewed and certified on a regular basis by data owners. The goal is to ensure that users continue to have only the permissions necessary to perform their job functions and that no excessive permissions exist. Which security principle is primarily being implemented through these regular reviews?

Accepted Answer

Least privilege. Option C is correct because regular access reviews directly enforce the principle of least privilege by ensuring users retain only the permissions necessary for their current job functions. This process identifies and removes excessive permissions that may have accumulated over time, aligning with the core goal of minimizing the attack surface. In Microsoft 365, this is often implemented through Azure AD access reviews, where data owners certify or revoke user access.

Answer

Defense in depth

Answer

Zero trust

Answer

Separation of duties

Question 20

A company configures its access control system so that each user can only access the data and perform actions that are strictly necessary for their job role. This configuration is a direct implementation of which security principle?

Accepted Answer

Least privilege. The configuration described—granting each user only the access and actions strictly necessary for their job role—is the direct definition of the least privilege principle. In Microsoft identity and access management, this is implemented by assigning the minimum required permissions via Azure RBAC roles (e.g., Reader instead of Contributor) or using Azure AD Privileged Identity Management (PIM) for just-in-time access. This minimizes the attack surface by ensuring users cannot exceed their authorized scope.

Answer

Defense in depth

Answer

Separation of duties

Answer

Zero Trust