SC-900 Describe the concepts of security, compliance, and identity Practice Test 6 — 15 Questions

Question 1

A company uses a cloud-based Customer Relationship Management (CRM) system that is delivered as Software-as-a-Service (SaaS). According to the shared responsibility model, which security responsibility is primarily handled by the customer?

Accepted Answer

Managing user identities and controlling access to the CRM. In a SaaS model, the cloud provider is responsible for the security of the underlying infrastructure, including physical data centers, operating systems, and network controls. The customer retains responsibility for securing their own data and identities, which includes managing user accounts, enforcing authentication policies (e.g., Azure AD Multi-Factor Authentication), and controlling access to the CRM application via role-based access control (RBAC). Therefore, managing user identities and access is the customer's primary security responsibility.

Answer

Physical security of the data center hosting the CRM

Answer

Patching the underlying operating system of the CRM servers

Answer

Ensuring network security for the CRM application's backend

Question 2

An organization is implementing a Zero Trust security model. Which principle requires that every access request must be fully authenticated, authorized, and verified based on all available signals, regardless of the user's network location?

Accepted Answer

Verify explicitly. The 'Verify explicitly' principle of Zero Trust mandates that every access request must be fully authenticated, authorized, and encrypted based on all available data points—including user identity, device health, location, and behavioral signals—regardless of whether the request originates from inside or outside the corporate network. This contrasts with traditional perimeter-based models that implicitly trust internal traffic.

Answer

Least privilege

Answer

Assume breach

Answer

Defense in depth

Question 3

A company is migrating its on-premises applications to Azure Infrastructure-as-a-Service (IaaS). According to the shared responsibility model, which of the following security responsibilities shifts from the customer to Microsoft during this migration?

Accepted Answer

Physical security of the data center infrastructure. When migrating on-premises applications to Azure IaaS, the shared responsibility model shifts physical security responsibilities—such as data center access controls, environmental controls, and hardware security—from the customer to Microsoft. Microsoft is responsible for the physical security of all Azure data centers, including perimeter security, surveillance, and facility access management, which were previously the customer's responsibility in their own on-premises environment.

Answer

Configuring network security groups (NSGs)

Answer

Patching the operating system on virtual machines

Answer

Managing user identities and access to the application

Question 4

A company is migrating its on-premises virtual machines to Azure Infrastructure-as-a-Service (IaaS). Which security responsibility primarily shifts from the customer to Microsoft during this migration?

Accepted Answer

Physical security of the data center. When migrating on-premises virtual machines to Azure IaaS, Microsoft takes over responsibility for the physical security of the data centers, including environmental controls, hardware maintenance, and physical access controls. This is a fundamental shift from the customer's responsibility under the shared responsibility model, where the customer previously managed the physical infrastructure on-premises.

Answer

Patching the guest operating system

Answer

Managing user access to the virtual machines

Answer

Configuring the firewall rules for the virtual network

Question 5

A security architect explains the Zero Trust model to the board. They state that every access request must be fully authenticated and authorized based on identity, device health, location, and risk, regardless of whether the user is on the corporate network. Which Zero Trust principle does this statement represent?

Accepted Answer

Verify explicitly. The statement emphasizes that every access request must be authenticated and authorized based on identity, device health, location, and risk, regardless of network location. This directly aligns with the 'Verify explicitly' principle of Zero Trust, which mandates that authentication and authorization are performed for every request using all available data points, not just once at the perimeter.

Answer

Least privilege

Answer

Assume breach

Answer

Microsegmentation

Question 6

A security architect is implementing a Zero Trust security model. The architect insists that the network perimeter should not be trusted and that security controls must be applied to all traffic, even within the corporate network. They also emphasize the need for continuous monitoring and detection of threats as if a breach has already occurred. Which Zero Trust principle is the architect primarily applying?

Accepted Answer

Assume breach. The architect's emphasis on not trusting the network perimeter and applying security controls to all traffic, combined with continuous monitoring as if a breach has already occurred, directly aligns with the 'Assume breach' principle of Zero Trust. This principle operates on the mindset that a breach is inevitable or has already happened, thus requiring constant verification and monitoring of all network traffic, even within the corporate network, rather than relying on a trusted internal zone.

Answer

Verify explicitly

Answer

Least privilege access

Answer

Trust but verify

Question 7

A security administrator is explaining the Zero Trust model to a new colleague. The administrator states that trust should never be granted based solely on network location, and every access request must be fully authenticated and authorized using all available signals. Which Zero Trust principle does this statement describe?

Accepted Answer

Verify explicitly. The statement that trust should never be granted based solely on network location and that every access request must be fully authenticated and authorized using all available signals directly describes the 'Verify explicitly' principle of the Zero Trust model. This principle mandates that authentication and authorization are performed for every access attempt, regardless of the source (e.g., internal network, VPN, cloud), using all available data points such as user identity, device health, and location.

Answer

Assume breach

Answer

Use least privilege

Answer

Segment access

Question 8

A security architect is explaining the evolution of the security perimeter. They state that because users access corporate resources from anywhere on any device, the traditional network perimeter is no longer sufficient. What does the architect identify as the new primary security perimeter?

Accepted Answer

The identity. In modern zero-trust architectures, identity is the new primary security perimeter because it enables granular access control regardless of network location. Since users access corporate resources from anywhere on any device, authentication and authorization (via protocols like OAuth 2.0, SAML, and OpenID Connect) become the decisive factor for granting access, rather than the traditional network boundary. This shift is foundational to Microsoft's identity-centric security model, where Azure AD (now Microsoft Entra ID) acts as the control plane for all resource access.

Answer

The cloud infrastructure

Answer

The data center

Answer

The endpoint

Question 9

A security architect is explaining the Zero Trust model to the board. The architect emphasizes that the network perimeter can no longer be considered a safe zone. Which statement best describes the modern primary security perimeter according to Zero Trust principles?

Accepted Answer

The identity of the user and device. In the Zero Trust model, the primary security perimeter is the identity of the user and device, not the network location. This is because Zero Trust assumes breach and requires explicit verification for every access request, regardless of whether it originates from inside or outside the corporate network. By treating identity as the new control plane, organizations enforce least-privilege access and continuous authentication, making the user and device identity the critical trust boundary.

Answer

The corporate network firewall and VPN

Answer

The physical on-premises data center

Answer

The endpoint antivirus and anti-malware solution

Question 10

A company subscribes to a cloud-based email service that is delivered as Software-as-a-Service (SaaS). According to the shared responsibility model, who is primarily responsible for the physical security of the data centers where the email data is stored?

Accepted Answer

The cloud provider. In the shared responsibility model for SaaS, the cloud provider is responsible for the physical security of the data centers, including hardware, network infrastructure, and physical access controls. The customer is responsible for securing their own data, user access, and compliance within the service, but not the underlying physical infrastructure.

Answer

The customer

Answer

Both the customer and the cloud provider equally

Answer

Neither the customer nor the cloud provider

Question 11

A hospital stores patient medical records electronically. An attacker gains access to the system and modifies patient diagnoses. Which principle of the CIA triad has been violated?

Accepted Answer

Integrity. The CIA triad's Integrity principle ensures that data is not modified by unauthorized parties. In this scenario, the attacker altered patient diagnoses, which directly violates data integrity. Confidentiality (unauthorized disclosure) and Availability (denial of service) are not the primary concerns here.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 12

A user logs into a corporate laptop by inserting a smart card and entering a PIN. The user then attempts to open a confidential folder. The operating system checks the user's access rights and denies access. Which security concepts are demonstrated in this scenario?

Accepted Answer

Authentication and authorization. The scenario demonstrates authentication (verifying the user's identity via smart card + PIN) and authorization (the OS checking access rights and denying access to the folder). Authentication confirms who the user is, while authorization determines what resources they can access. Option B correctly pairs these two concepts.

Answer

Identification and authorization

Answer

Authentication and accounting

Answer

Identification and authentication

Question 13

A company is implementing a new security policy that requires every user to have only the minimum permissions necessary to perform their job duties. Which security principle does this policy align with?

Accepted Answer

Principle of least privilege. The policy requiring every user to have only the minimum permissions necessary to perform their job duties directly aligns with the Principle of Least Privilege. This principle dictates that users, applications, and systems should be granted the minimal level of access rights needed to complete their tasks, reducing the attack surface and limiting potential damage from compromised accounts. In Microsoft 365, this is implemented through Role-Based Access Control (RBAC) roles and Azure AD roles, where administrators assign specific permissions rather than broad administrative roles.

Answer

Defense in depth

Answer

Zero Trust

Answer

Separation of duties

Question 14

A company's IT department deploys a multi-layered security strategy that includes a perimeter firewall, network segmentation, endpoint antivirus software, data encryption, and employee security awareness training. Which security model does this approach represent?

Accepted Answer

Defense in Depth. The described approach—combining perimeter firewalls, network segmentation, endpoint antivirus, encryption, and training—is the classic definition of Defense in Depth. This model layers multiple independent security controls so that if one layer fails (e.g., a firewall rule is misconfigured), subsequent layers (e.g., segmentation, antivirus) still protect the asset. It does not assume any single control is sufficient, which is the core principle of Defense in Depth.

Answer

Zero Trust

Answer

Least Privilege

Answer

Shared Responsibility

Question 15

A security architect is implementing a Zero Trust strategy. They state that all access requests must be verified continuously, regardless of where the request originates (corporate network or remote). They also emphasize that access is granted based on a policy that evaluates user identity, device health, location, and risk in real-time. Which Zero Trust guiding principle does this scenario primarily illustrate?

Accepted Answer

Verify explicitly. The scenario explicitly describes continuous verification of all access requests based on real-time signals (user identity, device health, location, risk). This directly maps to the 'Verify explicitly' Zero Trust principle, which mandates that every access attempt must be authenticated and authorized using all available data points before granting access, regardless of network location.

Answer

Use least privilege access

Answer

Assume breach

Answer

Enforce session controls