SC-900 Describe the concepts of security, compliance, and identity Practice Test 7 — 15 Questions

Question 1

A company deploys full disk encryption on all employee laptops to protect data in case a device is lost or stolen. Which security goal does this measure primarily address?

Accepted Answer

Confidentiality. Full disk encryption (FDE) ensures that data stored on the laptop's hard drive is unreadable without the correct decryption key. This directly protects the confidentiality of the data by preventing unauthorized access if the device is lost or stolen, as the encrypted data cannot be deciphered without the key.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 2

A company uses Microsoft 365 E5. An employee's corporate laptop is infected with keylogging malware that captures the employee's credentials. The attacker uses these credentials to sign in to Exchange Online and forward sensitive emails to an external account. Under the shared responsibility model, who is primarily responsible for the security incident?

Accepted Answer

The customer is responsible because they control user devices, accounts, and access policies.. Under the shared responsibility model, the customer is responsible for securing user devices, managing user accounts, and configuring access policies. In this scenario, the keylogging malware on the employee's corporate laptop is a customer-side endpoint security issue, and the attacker used stolen credentials to access Exchange Online. Microsoft is responsible for the security of the cloud infrastructure (e.g., physical data centers, network, and hypervisor), but not for threats originating from compromised customer-managed devices or user accounts.

Answer

Microsoft is responsible because they provide the cloud service and must protect against all threats.

Answer

Both Microsoft and the customer share equal responsibility for all layers of the service.

Answer

Neither party is responsible because the employee bypassed security controls.

Question 3

A company's security policy requires that all data transferred between the corporate data center and the cloud must be protected from unauthorized access during transmission. They use encryption protocols such as TLS to achieve this. Which security goal is primarily being addressed?

Accepted Answer

Confidentiality. Confidentiality is the security goal that ensures data is not disclosed to unauthorized entities. By using encryption protocols such as TLS, the data in transit is rendered unreadable to any party that intercepts the traffic, directly protecting against unauthorized access during transmission.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 4

A company is implementing security controls to protect data during transmission between their on-premises database and a cloud storage service. They decide to use TLS encryption. Which security goal is primarily addressed by ensuring that data is not altered during transit?

Accepted Answer

Integrity. TLS encryption provides data integrity through message authentication codes (MACs) that detect any unauthorized modification during transit. The question specifically asks about ensuring data is not altered, which is the definition of integrity, not confidentiality or availability.

Answer

Availability

Answer

Confidentiality

Answer

Non-repudiation

Question 5

An organization is migrating its on-premises applications to Azure Infrastructure-as-a-Service (IaaS). According to the shared responsibility model, which of the following security responsibilities remain with Microsoft? (Select two.)

Accepted Answer

Physical security of the datacenters. In the shared responsibility model for IaaS, Microsoft retains responsibility for the physical security of its datacenters, including access controls, surveillance, and environmental protections. Additionally, Microsoft manages security at the hypervisor layer, which includes network controls that isolate virtual machines from each other and from the underlying host. These responsibilities are inherent to the infrastructure provider and cannot be delegated to the customer.

Answer

Patching the guest operating system on the VM

Answer

Configuring network security group (NSG) firewall rules

Question 6

A user scans their fingerprint to unlock a corporate laptop. After unlocking, the user attempts to open a confidential database. The system checks the user's role and grants access because the user is a member of the 'Data Analyst' group. Which two security concepts are demonstrated in this scenario?

Accepted Answer

Authentication and authorization. The fingerprint scan is a form of authentication, verifying the user's identity through a biometric factor. The subsequent check of the user's group membership ('Data Analyst') to grant access to the database is authorization, determining what resources the authenticated user can access. This scenario directly maps to the identity and access management (IAM) concepts of authentication (proving who you are) and authorization (what you are allowed to do).

Answer

Identification and non-repudiation

Answer

Availability and accountability

Question 7

A company's IT department implements a policy for server administrators: they must submit an access request to perform privileged tasks on critical servers. Each request is approved by a manager, and the granted elevated permissions automatically expire after four hours. This approach reduces the risk of standing privileges being exploited. Which security concept is primarily being applied?

Accepted Answer

Just-in-time access. Option A is correct because just-in-time (JIT) access is a security concept that grants elevated permissions only when needed, for a limited duration, and requires approval. In this scenario, the policy requires an access request, manager approval, and automatic expiration after four hours, which directly aligns with JIT access to reduce the risk of standing privileges being exploited.

Answer

Least privilege

Answer

Defense in depth

Answer

Zero Trust

Question 8

A company deploys a custom web application on Azure App Service (PaaS). The application stores user data in Azure SQL Database. The security team is responsible for securing the application code, managing authentication, and configuring TLS for data in transit. According to the Microsoft shared responsibility model, which security responsibility remains with Microsoft for this PaaS deployment?

Accepted Answer

Patching the operating system of the underlying physical and virtual hosts. In a PaaS deployment like Azure App Service, Microsoft is responsible for the security of the underlying cloud infrastructure, including patching the operating system of the physical and virtual hosts that run the platform. This is a core tenant of the shared responsibility model, where the customer manages application-level security (code, authentication, TLS) while Microsoft manages the host OS and hypervisor.

Answer

Configuring the firewall rules for the web application

Answer

Managing user access to the application

Answer

Encrypting the application data at rest in Azure SQL Database

Question 9

A company stores sensitive customer data in an Azure SQL database. To protect this data, the database files are encrypted at rest using Transparent Data Encryption (TDE). Additionally, all network traffic between the application and the database is encrypted using TLS. Which security goal is primarily addressed by these encryption measures?

Accepted Answer

Confidentiality. Transparent Data Encryption (TDE) encrypts data at rest, meaning the database files on disk are encrypted so that unauthorized access to the physical storage cannot read the data. TLS encrypts data in transit between the application and the database, preventing eavesdropping or interception over the network. Together, these measures primarily ensure that sensitive customer data remains secret and inaccessible to unauthorized parties, which is the core goal of confidentiality.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 10

A company implements multiple layers of security controls, including firewalls, antivirus software, access controls, and security awareness training. Which security concept does this approach best represent?

Accepted Answer

Defense in depth. Defense in depth is the correct concept because it involves layering multiple independent security controls—such as firewalls, antivirus, access controls, and training—so that if one layer fails, others continue to protect the asset. This approach reduces the likelihood of a single point of failure and is a foundational strategy in cybersecurity architecture.

Answer

Zero Trust

Answer

Shared responsibility

Answer

Least privilege

Question 11

A user authenticates with a smart card and is then granted access to a specific database based on their job role in the finance department. Which security concept describes the process of determining what the authenticated user is allowed to do?

Accepted Answer

Authorization. Authorization is the security concept that determines what an authenticated user is permitted to do. In this scenario, after the user authenticates with a smart card, the system checks their job role in the finance department against access control lists (ACLs) or role-based access control (RBAC) policies to grant access to the specific database. This is distinct from authentication, which only verifies identity.

Answer

Authentication

Answer

Accounting

Answer

Encryption

Question 12

A company uses a cloud-based email service. The service provider ensures that the physical data centers are secure and that the email platform is patched and available. The company is responsible for managing user accounts and ensuring that employees use strong passwords. This division of responsibilities is an example of which concept?

Accepted Answer

Shared responsibility model. The scenario describes a clear division of security responsibilities between the cloud service provider (securing physical data centers, patching the platform) and the customer (managing user accounts, enforcing strong passwords). This is the core definition of the shared responsibility model, which is a foundational concept in cloud computing (as defined by NIST SP 800-145 and adopted by major providers like Microsoft 365). The model explicitly delineates that the provider is responsible for 'security of the cloud' (physical hosts, network, hypervisor) while the customer is responsible for 'security in the cloud' (user identities, data, client endpoints).

Answer

Defense in depth

Answer

Zero Trust

Answer

Principle of least privilege

Question 13

A healthcare company stores patient records in an Azure SQL database. To protect the data, they enable Transparent Data Encryption (TDE) for the database and require all client connections to use TLS. Which security goal is being primarily addressed by these measures?

Accepted Answer

Confidentiality. Transparent Data Encryption (TDE) encrypts data at rest in the Azure SQL database, ensuring that even if the physical storage media is compromised, the data remains unreadable. Requiring TLS for client connections encrypts data in transit, preventing eavesdropping or interception. Both measures directly protect the confidentiality of patient records by preventing unauthorized access to the data.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 14

A company deploys a custom web application on Azure App Service (PaaS). The application stores data in Azure SQL Database. The security team needs to identify which security responsibilities fall under the customer according to the Microsoft shared responsibility model. Which of the following is primarily the customer's responsibility for this PaaS deployment?

Accepted Answer

Managing user identities and access to the application. In a PaaS deployment like Azure App Service with Azure SQL Database, the customer is responsible for managing user identities and access to the application, including authentication, authorization, and role-based access control (RBAC). Microsoft manages the underlying infrastructure, including the host OS, physical datacenter security, and network backbone, but the customer must secure application-level access and data plane operations.

Answer

Physical security of the datacenter hosting the App Service

Answer

Patching the operating system of the App Service host machines

Answer

Network security for the Azure backbone connecting datacenters

Question 15

A company implements a security policy where employees must use a smart card to log into their workstations. After logging in, they can only access file shares that correspond to their department. Which two security concepts are demonstrated in this scenario?

Accepted Answer

Authentication and authorization. The smart card login verifies the user's identity, which is authentication. The subsequent restriction to department-specific file shares controls what resources the user can access, which is authorization. Together, these two steps demonstrate the security concepts of authentication (proving who you are) and authorization (determining what you can do).

Answer

Identification and accounting

Answer

Confidentiality and integrity