SC-900 Describe the concepts of security, compliance, and identity Practice Test 3 — 15 Questions

Question 1

A company requires all employees to provide a one-time passcode generated by an authenticator app in addition to their password when accessing the corporate VPN. This practice is an example of which security concept?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

C. Authentication. The requirement for a one-time passcode (OTP) from an authenticator app in addition to a password is a classic implementation of multi-factor authentication (MFA). Authentication is the process of verifying the identity of a user, device, or service, and this scenario uses two distinct factors: something you know (password) and something you have (the OTP generated by the app). This directly aligns with the security concept of authentication, not authorization, auditing, or accounting.

Answer

A. Authorization

Answer

B. Auditing

Answer

D. Accounting

Question 2

A security architect is designing a system where user access rights are reviewed and certified on a regular basis by data owners. The goal is to ensure that users continue to have only the permissions necessary to perform their job functions and that no excessive permissions exist. Which security principle is primarily being implemented through these regular reviews?

Accepted Answer

Least privilege. Regular access reviews directly enforce the principle of least privilege by ensuring users retain only the permissions necessary for their current job functions. This process identifies and removes excessive permissions that may have accumulated over time, aligning with the core goal of minimizing the attack surface. In Microsoft 365, this is often implemented through Azure AD access reviews, where data owners certify or revoke user access.

Answer

Defense in depth

Answer

Zero trust

Answer

Separation of duties

Question 3

A company configures its access control system so that each user can only access the data and perform actions that are strictly necessary for their job role. This configuration is a direct implementation of which security principle?

Accepted Answer

Least privilege. The configuration described—granting each user only the access and actions strictly necessary for their job role—is the direct definition of the least privilege principle. In Microsoft identity and access management, this is implemented by assigning the minimum required permissions via Azure RBAC roles (e.g., Reader instead of Contributor) or using Azure AD Privileged Identity Management (PIM) for just-in-time access. This minimizes the attack surface by ensuring users cannot exceed their authorized scope.

Answer

Defense in depth

Answer

Separation of duties

Answer

Zero Trust

Question 4

A company hosts a line-of-business application on an Azure virtual machine. The IT team is responsible for configuring the operating system, installing security updates, and managing the application code. An auditor asks who is responsible for the physical security of the data center where the virtual machine runs. According to the shared responsibility model for cloud services, who is responsible?

Accepted Answer

Microsoft. Under the shared responsibility model, Microsoft is responsible for the physical security of its Azure data centers, including access controls, surveillance, and environmental safeguards. The customer is responsible for securing the virtual machine's operating system, applications, and data, but not the physical infrastructure. Therefore, Microsoft retains responsibility for physical security even when the customer manages the guest OS and application.

Answer

The customer

Answer

Both the customer and Microsoft equally

Answer

Neither – physical security is no longer needed in the cloud

Question 5

A company regularly performs automated backups of its critical databases and has a disaster recovery plan to restore operations quickly after a system failure. Which security principle is primarily being addressed by these measures?

Accepted Answer

Availability. Automated backups and a disaster recovery plan directly support the Availability principle of the CIA triad by ensuring that critical databases can be restored and operations resumed quickly after a system failure. Availability guarantees that systems and data are accessible to authorized users when needed, and these measures minimize downtime and data loss.

Answer

Confidentiality

Answer

Integrity

Answer

Non-repudiation

Question 6

A security architect is designing a defense strategy for the organization's network. The architect assumes that an attacker may already have breached the perimeter and is operating inside the network. Therefore, the design does not automatically trust any user or device, even if they are inside the corporate network, and requires continuous verification for every access request. Which security principle does this approach best represent?

Accepted Answer

Zero Trust. The Zero Trust security principle is based on the assumption that an attacker may already be inside the network, so no user or device is automatically trusted, regardless of location. This model requires continuous verification for every access request, enforcing strict identity verification and least-privilege access controls at each step. The scenario directly describes the core tenet of Zero Trust: 'never trust, always verify.'

Answer

Defense in depth

Answer

Shared responsibility

Answer

Least privilege

Question 7

A company implements a security strategy that includes multiple layers of controls: a perimeter firewall, an intrusion detection system, endpoint antivirus software, and multi-factor authentication for user access. The goal is that if one layer fails, another layer is in place to prevent or mitigate an attack. Which security principle does this approach best represent?

Accepted Answer

Defense in depth. Defense in depth is a security strategy that layers independent defensive mechanisms so that if one layer fails, another layer is already in place to prevent or mitigate an attack. The scenario explicitly describes multiple layers (firewall, IDS, endpoint antivirus, MFA) working together, which is the core definition of defense in depth. This approach ensures no single point of failure can compromise the entire security posture.

Answer

Zero Trust

Answer

Least privilege

Answer

CIA triad

Question 8

A security manager explains that the company's security strategy relies on multiple layers of controls, such as firewalls, antivirus software, and multi-factor authentication, so that if one layer fails, another can still prevent an attack. Which security principle does this strategy best represent?

Accepted Answer

Defense in depth. Defense in depth is the correct answer because it explicitly describes a layered security strategy where multiple independent controls (firewalls, antivirus, MFA) are deployed so that if one layer is bypassed or fails, subsequent layers still provide protection. This principle is foundational to modern security architecture and directly matches the scenario of using diverse controls to prevent a single point of failure.

Answer

Least privilege

Answer

Zero Trust

Answer

Separation of duties

Question 9

A company is deploying a web application on Azure App Service. The security officer states that according to the shared responsibility model, the customer is responsible for managing access to the application and securing the application code. Which of the following responsibilities does Microsoft retain for Azure App Service?

Accepted Answer

Patching the underlying operating system of the App Service host. For Azure App Service, Microsoft retains responsibility for patching the underlying operating system of the host infrastructure. This is part of the shared responsibility model where the cloud provider manages the host OS and hypervisor, while the customer manages the application code, data, and access configurations.

Answer

Configuring network firewall rules for the App Service

Answer

Managing user authentication and authorization

Answer

Applying encryption to the application data at rest

Question 10

A security architect is designing a defense strategy for a company's IT infrastructure. The strategy includes deploying a network firewall, using an intrusion detection system, installing antivirus software on all endpoints, and requiring multi-factor authentication for all user accounts. The architect explains that if the firewall fails, the IDS can detect an intrusion, and if the IDS misses something, the antivirus might catch it, and MFA can protect even if credentials are compromised. Which security principle best describes this layered approach?

Accepted Answer

Defense in depth. Defense in depth is the correct principle because it describes a layered security strategy where multiple independent controls (firewall, IDS, antivirus, MFA) are deployed so that if one layer fails, another layer can still prevent or detect an attack. This approach explicitly relies on redundancy and diversity of controls to provide resilience against failures or bypasses, as illustrated by the architect's explanation of how each subsequent layer compensates for potential gaps in the previous one.

Answer

Least privilege

Answer

Zero Trust

Answer

Shared responsibility

Question 11

A company uses digital signatures to ensure that a sender cannot later deny having sent a message. Which security principle does this primarily address?

Accepted Answer

Non-repudiation. Digital signatures use asymmetric cryptography (e.g., RSA or ECDSA) to bind a signer's identity to a message. The signature is created with the sender's private key and verified with their public key, providing cryptographic proof of origin. This directly enforces non-repudiation because the sender cannot plausibly deny having signed the message, as only they possess the private key.

Answer

Confidentiality

Answer

Integrity

Answer

Availability

Question 12

An attacker gains access to a company's email system and reads confidential customer emails. Which security principle has been compromised?

Accepted Answer

Confidentiality. Confidentiality is the security principle that ensures data is accessible only to authorized users. When an attacker reads confidential customer emails without authorization, the confidentiality of that data has been breached, as the information was exposed to an unintended party.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 13

A company operates an e-commerce website that must remain accessible during high-traffic holiday seasons. The IT team deploys additional web servers and implements automatic failover to a secondary data center if the primary site goes down. Which security principle is the company primarily addressing?

Accepted Answer

Availability. The company is ensuring that the e-commerce website remains operational even during high-traffic periods or after a primary site failure. Deploying additional web servers and implementing automatic failover to a secondary data center directly supports the availability principle, which ensures that systems and data are accessible when needed. This is a core tenet of the CIA triad, and in this scenario, the focus is on uptime and resilience, not on protecting data from unauthorized access or modification.

Answer

Confidentiality

Answer

Integrity

Answer

Authorization

Question 14

A company has a document management system. The security policy requires that a user in the Sales department can only view documents related to sales and cannot access documents in the Finance or HR folders. Which security principle is being applied?

Accepted Answer

Least privilege. The security policy restricts a Sales user's access to only sales-related documents, explicitly denying access to Finance and HR folders. This aligns with the principle of least privilege, which mandates that users be granted only the minimum permissions necessary to perform their job functions. In Microsoft 365, this is implemented via role-based access control (RBAC) or sensitivity labels that enforce read-only access on specific SharePoint document libraries or folders.

Answer

Availability

Answer

Defense in depth

Answer

Non-repudiation

Question 15

A company has implemented a security model where every access request is fully authenticated, authorized, and encrypted before granting access, regardless of where the request originates (corporate network or internet). The model assumes that no entity is inherently trustworthy and requires continuous verification. This model is known as:

Accepted Answer

Zero Trust. The described model—requiring full authentication, authorization, and encryption for every access request, treating no entity as inherently trustworthy, and demanding continuous verification—is the core definition of Zero Trust. This aligns with the NIST SP 800-207 standard, which explicitly states that Zero Trust assumes no implicit trust and enforces verification for every request, regardless of network location.

Answer

Defense in depth

Answer

Least privilege

Answer

Shared responsibility