SC-900 Describe the concepts of security, compliance, and identity Practice Test 5 — 15 Questions

Question 1

A security architect is explaining identity management concepts to the IT team. Which statement correctly describes the difference between authentication and authorization?

Accepted Answer

Authentication verifies the identity of a user, while authorization determines the resources they can access.. Option C is correct because authentication is the process of verifying a user's identity (e.g., via password, biometric, or certificate), while authorization determines what resources or actions that authenticated identity is permitted to access. In Microsoft Entra ID, authentication occurs first via protocols like OAuth 2.0 or OpenID Connect, and authorization is then enforced through role-based access control (RBAC) or conditional access policies.

Answer

Authentication verifies what a user can do, while authorization verifies who the user is.

Answer

Authorization must always occur before authentication.

Answer

Authentication and authorization are synonymous terms in identity management.

Question 2

A security analyst is explaining the concept of 'defense in depth' to a new team member. Which of the following best describes the defense in depth strategy?

Accepted Answer

Implementing multiple layers of security controls to protect assets. Defense in depth is a cybersecurity strategy that employs multiple layers of security controls across different parts of an IT environment (network, endpoint, application, data) to ensure that if one layer fails, another layer is already in place to mitigate the threat. This approach is fundamental to Microsoft's security architecture, as seen in products like Microsoft Defender for Cloud, which integrates protections across workloads, and Azure Active Directory (now Microsoft Entra ID), which layers conditional access policies on top of identity verification. Option B correctly captures this layered, redundant approach rather than relying on a single point of defense.

Answer

Using a single strong firewall to protect all network traffic

Answer

Relying on user training as the primary security measure

Answer

Applying encryption only to data at rest

Question 3

An organization adopts a Zero Trust security model. Which principle requires that every access request must be explicitly verified and granted least privilege regardless of the user's location or device?

Accepted Answer

Verify explicitly. The Zero Trust principle 'Verify explicitly' mandates that every access request—regardless of the user's location, device, or network—must be authenticated and authorized based on all available data points (e.g., user identity, device health, location, and real-time risk signals). This ensures that no implicit trust is granted, and least privilege is applied as a separate but complementary principle. In Microsoft's Zero Trust model, this is enforced through conditional access policies and continuous evaluation of session risk.

Answer

Use least privilege access

Answer

Assume breach

Answer

Never trust, always verify

Question 4

A company uses Azure SQL Database, which is a Platform as a Service (PaaS) offering. The security team is reviewing the shared responsibility model and wants to know who is responsible for applying operating system patches to the underlying infrastructure that hosts the database. Who is responsible for this task?

Accepted Answer

Microsoft is responsible for managing and patching the operating system of the underlying infrastructure for PaaS services.. Azure SQL Database is a Platform as a Service (PaaS) offering where Microsoft manages the underlying infrastructure, including the operating system. In the shared responsibility model for PaaS, Microsoft is responsible for applying OS patches to the host servers, while the customer manages the database configuration and data. Therefore, option B correctly identifies Microsoft as responsible for OS patching in this context.

Answer

The customer is responsible for patching the OS on virtual machines but not for PaaS; however, the customer must patch the OS for Azure SQL Database.

Answer

Both the customer and Microsoft share equal responsibility for patching the OS in a PaaS model.

Answer

The cloud service provider partner (e.g., a managed service provider) is responsible for OS patches in PaaS.

Question 5

A company stores application secrets and encryption keys in Azure Key Vault. They want to move from the older vault access policy model to a more scalable and granular permission model that integrates with Azure's role-based access control (RBAC). They also need to audit permissions using Azure Policy. Which access configuration should they choose for Azure Key Vault?

Accepted Answer

Enable the Azure RBAC permission model for Key Vault. Option B is correct because enabling the Azure RBAC permission model for Key Vault replaces the older vault access policy model with Azure's native role-based access control, providing granular, scalable permissions that integrate directly with Azure Policy for auditing. This model allows you to assign roles like Key Vault Secrets User or Key Vault Crypto Officer at the management plane, enabling centralized permission management across multiple vaults and supporting Azure Policy compliance checks.

Answer

Use a single vault access policy with the Contributor role

Answer

Assign a managed identity to the Key Vault

Answer

Use a service principal and configure vault access policies per application

Question 6

An organization is moving a virtual machine to Azure Infrastructure as a Service (IaaS). According to the shared responsibility model, which of the following security tasks is the customer responsible for?

Accepted Answer

Applying security updates to the guest operating system. In an IaaS deployment, the customer retains responsibility for securing the guest operating system, including applying security updates. Microsoft manages the physical infrastructure and hypervisor, while the customer must patch and configure the OS running inside the virtual machine.

Answer

Physical security of the datacenter

Answer

Maintaining the hypervisor

Answer

Power and cooling infrastructure

Question 7

A security administrator is explaining authentication and authorization to new IT staff. Which statement correctly describes the difference between these two processes?

Accepted Answer

Authentication verifies who the user is; authorization verifies what the user can do.. Authentication is the process of verifying the identity of a user, device, or other entity, typically through credentials like a password, biometric, or certificate. Authorization determines what an authenticated entity is permitted to do, such as accessing specific resources or performing certain actions, often enforced via access control lists (ACLs) or role-based access control (RBAC). In Microsoft Entra ID, authentication occurs first (e.g., via OAuth 2.0 or SAML), and then authorization is evaluated using claims or directory roles.

Answer

Authentication verifies what a user can do; authorization verifies who the user is.

Answer

Both authentication and authorization verify the user's identity.

Answer

Authorization is always performed before authentication.

Question 8

A multinational company stores customer data across multiple Azure regions. A new regulation requires that customer data must remain within the country's borders and cannot be transferred abroad. Which concept does this regulation primarily relate to?

Accepted Answer

Data Sovereignty. Data Sovereignty is the correct answer because the regulation mandates that customer data must remain within the country's borders and cannot be transferred abroad. This legal and compliance concept asserts that data is subject to the laws and governance structures of the nation where it is physically stored, directly addressing cross-border transfer restrictions.

Answer

Data Residency

Answer

Data Retention

Answer

Data Classification

Question 9

A company deploys a custom application on Azure App Service (PaaS). Which of the following security responsibilities falls completely under the customer's scope according to the shared responsibility model?

Accepted Answer

Managing the application code and its configuration. In the shared responsibility model for PaaS like Azure App Service, the customer is responsible for managing the application code and its configuration, including secrets, connection strings, and authentication settings. Microsoft manages the underlying platform, including the OS and runtime, so the customer's scope is limited to what they deploy and configure within the service.

Answer

Applying operating system patches to the virtual machines running the App Service

Answer

Configuring network security groups to filter traffic to the App Service

Answer

Ensuring physical security of the Azure data centers

Question 10

A company uses a cloud-based SaaS (Software as a Service) application for customer relationship management. According to the shared responsibility model, which security responsibility is primarily handled by the customer?

Accepted Answer

Managing user access and permissions for the application. In a SaaS model like a cloud-based CRM application, the customer is responsible for managing user access and permissions, including identity and access management (IAM), multi-factor authentication (MFA), and role-based access control (RBAC). The cloud provider handles the underlying infrastructure, platform, and application security, but the customer must control who can access the application and what they can do within it.

Answer

Physical security of the data center hosting the application

Answer

Security of the underlying networking infrastructure

Answer

Applying security patches to the application's code

Question 11

A security analyst is explaining the concept of 'Least Privilege' to a new team member. Which statement best describes the principle of least privilege?

Accepted Answer

Users should have only the permissions necessary to perform their job functions.. Option A is correct because the principle of least privilege dictates that users should be granted only the minimum permissions necessary to complete their job functions. This reduces the attack surface and limits potential damage from accidental or malicious actions. In Microsoft 365, this is implemented through Role-Based Access Control (RBAC) and Azure AD roles, where permissions are scoped to specific administrative units or tasks.

Answer

Users should have all permissions disabled by default.

Answer

Users should be given administrator rights to ensure they can perform any task.

Answer

Users should share one account with elevated privileges for their team.

Question 12

A security architect is designing a Zero Trust strategy. Which principle ensures that network location alone does not grant trust, and all access requests must be verified?

Accepted Answer

Verify explicitly. The 'Verify explicitly' principle is the core of Zero Trust, stating that every access request must be authenticated and authorized based on all available data points—including user identity, device health, location, and data sensitivity—regardless of network location. This ensures that being on a corporate network does not automatically grant trust, as all requests are verified in real time.

Answer

Least privilege

Answer

Assume breach

Answer

Segregation of duties

Question 13

According to the Zero Trust security model, which principle assumes that a breach has already occurred and therefore requires segmenting access and monitoring for lateral movement?

Accepted Answer

Assume breach. Option C is correct because the 'Assume breach' principle of the Zero Trust security model explicitly operates under the mindset that a breach has already occurred or is inevitable. This drives the need for segmenting access (e.g., micro-segmentation using network policies or Azure Virtual Network security groups) and continuous monitoring for lateral movement (e.g., using Microsoft Defender for Identity to detect pass-the-hash or Kerberos ticket attacks).

Answer

Verify explicitly

Answer

Use least privilege

Answer

Trust but verify

Question 14

A security administrator is explaining the shared responsibility model to a new team member. The company uses a Software-as-a-Service (SaaS) application such as Microsoft 365. For which of the following items is the customer primarily responsible under this model?

Accepted Answer

Managing user access and classifying data stored in the service. In the shared responsibility model for SaaS like Microsoft 365, the customer is responsible for managing user access (e.g., configuring Azure AD roles, conditional access policies, and multi-factor authentication) and classifying data stored in the service (e.g., applying sensitivity labels via Microsoft Purview Information Protection). The provider manages the underlying infrastructure, including physical security, hypervisor patching, and application updates.

Answer

Physical security of the data center hosting the SaaS application

Answer

Patching the hypervisor that runs the SaaS infrastructure

Answer

Applying security updates to the SaaS application itself

Question 15

A security architect is designing a Zero Trust security model for a hybrid organization. Which principle of Zero Trust requires that every access request must be fully authenticated and authorized regardless of the network location, and that access should be granted with the minimum level required?

Accepted Answer

Verify explicitly. B is correct because the 'Verify explicitly' principle of Zero Trust mandates that every access request must be fully authenticated and authorized based on all available data points—including user identity, device health, and location—before granting access. This principle directly requires that authentication and authorization occur for every request, regardless of network location, and that the resulting access is granted with the minimum level required, which is further enforced by the 'Use least privileged access' principle. In a hybrid organization, this ensures that even requests from inside the corporate network are treated with the same scrutiny as external requests.

Answer

Assume breach

Answer

Use least privileged access

Answer

Segment access