SC-900 Describe the concepts of security, compliance, and identity Practice Test 8 — 15 Questions

Question 1

An organization is migrating its on-premises applications to Azure Infrastructure-as-a-Service (IaaS). According to the shared responsibility model, which of the following security responsibilities remain with Microsoft? (Select two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Physical security of the datacenters. In the shared responsibility model for IaaS, Microsoft retains responsibility for the physical security of its datacenters, including access controls, surveillance, and environmental protections. Additionally, Microsoft manages security at the hypervisor layer, which includes network controls that isolate virtual machines from each other and from the underlying host. These responsibilities are inherent to the infrastructure provider and cannot be delegated to the customer.

Answer

Patching the guest operating system on the VM

Answer

Configuring network security group (NSG) firewall rules

Question 2

A user scans their fingerprint to unlock a corporate laptop. After unlocking, the user attempts to open a confidential database. The system checks the user's role and grants access because the user is a member of the 'Data Analyst' group. Which two security concepts are demonstrated in this scenario?

Accepted Answer

Authentication and authorization. The fingerprint scan demonstrates authentication, as the user proves their identity through a biometric factor. The subsequent role-based check of group membership ('Data Analyst') to grant database access demonstrates authorization. Therefore, only Option A (Authentication and authorization) is correct. Option B is incorrect because confidentiality and integrity are not demonstrated in this scenario: the scenario does not address data protection from unauthorized disclosure (confidentiality) or assurance that data is accurate and unmodified (integrity). The authorization check prevents unauthorized access, which is a component of access control but not a direct demonstration of confidentiality; integrity is not shown at all. Option C is incorrect because identification (claiming an identity) is not shown; the fingerprint is used for proof, not claim, and non-repudiation is not established. Option D is incorrect because availability of the database and accountability of user actions are not demonstrated.

Answer

Confidentiality and integrity

Answer

Identification and non-repudiation

Answer

Availability and accountability

Question 3

A company's IT department implements a policy for server administrators: they must submit an access request to perform privileged tasks on critical servers. Each request is approved by a manager, and the granted elevated permissions automatically expire after four hours. This approach reduces the risk of standing privileges being exploited. Which security concept is primarily being applied?

Accepted Answer

Just-in-time access. Just-in-time (JIT) access is a security concept that grants elevated permissions only when needed, for a limited duration, and requires approval. In this scenario, the policy requires an access request, manager approval, and automatic expiration after four hours, which directly aligns with JIT access to reduce the risk of standing privileges being exploited.

Answer

Least privilege

Answer

Defense in depth

Answer

Zero Trust

Question 4

A company deploys a custom web application on Azure App Service (PaaS). The application stores user data in Azure SQL Database. The security team is responsible for securing the application code, managing authentication, and configuring TLS for data in transit. According to the Microsoft shared responsibility model, which security responsibility remains with Microsoft for this PaaS deployment?

Accepted Answer

Patching the operating system of the underlying physical and virtual hosts. In a PaaS deployment like Azure App Service, Microsoft is responsible for the security of the underlying cloud infrastructure, including patching the operating system of the physical and virtual hosts that run the platform. This is a core tenant of the shared responsibility model, where the customer manages application-level security (code, authentication, TLS) while Microsoft manages the host OS and hypervisor.

Answer

Configuring the firewall rules for the web application

Answer

Managing user access to the application

Answer

Encrypting the application data at rest in Azure SQL Database

Question 5

A company stores sensitive customer data in an Azure SQL database. To protect this data, the database files are encrypted at rest using Transparent Data Encryption (TDE). Additionally, all network traffic between the application and the database is encrypted using TLS. Which security goal is primarily addressed by these encryption measures?

Accepted Answer

Confidentiality. Transparent Data Encryption (TDE) encrypts data at rest, meaning the database files on disk are encrypted so that unauthorized access to the physical storage cannot read the data. TLS encrypts data in transit between the application and the database, preventing eavesdropping or interception over the network. Together, these measures primarily ensure that sensitive customer data remains secret and inaccessible to unauthorized parties, which is the core goal of confidentiality.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 6

A company implements multiple layers of security controls, including firewalls, antivirus software, access controls, and security awareness training. Which security concept does this approach best represent?

Accepted Answer

Defense in depth. Defense in depth is the correct concept because it involves layering multiple independent security controls—such as firewalls, antivirus, access controls, and training—so that if one layer fails, others continue to protect the asset. This approach reduces the likelihood of a single point of failure and is a foundational strategy in cybersecurity architecture.

Answer

Zero Trust

Answer

Shared responsibility

Answer

Least privilege

Question 7

A user authenticates with a smart card and is then granted access to a specific database based on their job role in the finance department. Which security concept describes the process of determining what the authenticated user is allowed to do?

Accepted Answer

Authorization. Authorization is the security concept that determines what an authenticated user is permitted to do. In this scenario, after the user authenticates with a smart card, the system checks their job role in the finance department against access control lists (ACLs) or role-based access control (RBAC) policies to grant access to the specific database. This is distinct from authentication, which only verifies identity.

Answer

Authentication

Answer

Accounting

Answer

Encryption

Question 8

A company uses a cloud-based email service. The service provider ensures that the physical data centers are secure and that the email platform is patched and available. The company is responsible for managing user accounts and ensuring that employees use strong passwords. This division of responsibilities is an example of which concept?

Accepted Answer

Shared responsibility model. The scenario describes a clear division of security responsibilities between the cloud service provider (securing physical data centers, patching the platform) and the customer (managing user accounts, enforcing strong passwords). This is the core definition of the shared responsibility model, which is a foundational concept in cloud computing (as defined by NIST SP 800-145 and adopted by major providers like Microsoft 365). The model explicitly delineates that the provider is responsible for 'security of the cloud' (physical hosts, network, hypervisor) while the customer is responsible for 'security in the cloud' (user identities, data, client endpoints).

Answer

Defense in depth

Answer

Zero Trust

Answer

Principle of least privilege

Question 9

A healthcare company stores patient records in an Azure SQL database. To protect the data, they enable Transparent Data Encryption (TDE) for the database and require all client connections to use TLS. Which security goal is being primarily addressed by these measures?

Accepted Answer

Confidentiality. Transparent Data Encryption (TDE) encrypts data at rest in the Azure SQL database, ensuring that even if the physical storage media is compromised, the data remains unreadable. Requiring TLS for client connections encrypts data in transit, preventing eavesdropping or interception. Both measures directly protect the confidentiality of patient records by preventing unauthorized access to the data.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 10

A company deploys a custom web application on Azure App Service (PaaS). The application stores data in Azure SQL Database. The security team needs to identify which security responsibilities fall under the customer according to the Microsoft shared responsibility model. Which of the following is primarily the customer's responsibility for this PaaS deployment?

Accepted Answer

Managing user identities and access to the application. In a PaaS deployment like Azure App Service with Azure SQL Database, the customer is responsible for managing user identities and access to the application, including authentication, authorization, and role-based access control (RBAC). Microsoft manages the underlying infrastructure, including the host OS, physical datacenter security, and network backbone, but the customer must secure application-level access and data plane operations.

Answer

Physical security of the datacenter hosting the App Service

Answer

Patching the operating system of the App Service host machines

Answer

Network security for the Azure backbone connecting datacenters

Question 11

A company implements a security policy where employees must use a smart card to log into their workstations. After logging in, they can only access file shares that correspond to their department. Which two security concepts are demonstrated in this scenario?

Accepted Answer

Authentication and authorization. The smart card login verifies the user's identity, which is authentication. The subsequent restriction to department-specific file shares controls what resources the user can access, which is authorization. Non-repudiation is not demonstrated because the scenario lacks any mechanism (such as audit logs or digital signatures) that would prevent the user from denying the login action. Therefore, only authentication and authorization are demonstrated, making Option A the sole correct answer.

Answer

Identification and accounting

Answer

Authorization and non-repudiation

Answer

Confidentiality and integrity

Question 12

A financial company processes stock trades. To ensure that a trader cannot later deny having submitted a specific trade order, the system captures a digital signature from the trader for each order. Which security goal is being addressed by this practice?

Accepted Answer

Non-repudiation. Non-repudiation ensures that a party cannot deny having performed a specific action. By capturing a digital signature from the trader for each trade order, the system creates cryptographic proof that the trader indeed submitted that order. This prevents the trader from later claiming they did not authorize the trade, directly addressing the non-repudiation goal.

Answer

Confidentiality

Answer

Integrity

Answer

Availability

Question 13

A company deploys a virtual machine on Azure IaaS. According to the Microsoft shared responsibility model, which of the following security responsibilities is primarily the customer's responsibility?

Accepted Answer

Patching the guest operating system and applications. In the Microsoft shared responsibility model, the customer is responsible for securing and patching the guest operating system and applications running on an Azure IaaS virtual machine. Microsoft manages the physical infrastructure, hypervisor, and network, while the customer controls the OS, applications, and data.

Answer

Physical security of the data centers

Answer

Ensuring the hypervisor is secured

Answer

Maintaining the network infrastructure

Question 14

A healthcare organization uses digital signatures on electronic medical records to ensure that the records have not been tampered with during transmission. Which security goal is primarily being addressed by this practice?

Accepted Answer

Integrity. Digital signatures use asymmetric cryptography (e.g., RSA or ECDSA) to create a hash of the electronic medical record, which is then encrypted with the signer's private key. Any tampering with the record during transmission will cause the hash verification to fail, directly ensuring data integrity. This practice does not primarily address confidentiality (which requires encryption) or availability (which focuses on uptime).

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 15

A company configures its identity and access management system so that employees are granted only the permissions necessary to perform their job functions. For example, a sales representative has read-only access to the customer database and cannot modify financial records. Which security principle is being applied in this scenario?

Accepted Answer

Least privilege. The scenario describes granting employees only the permissions necessary to perform their job functions, which is the core definition of the least privilege principle. In Microsoft identity and access management, this is implemented by assigning the minimum required Azure RBAC roles or Microsoft Entra ID directory roles, ensuring users have no more access than needed. This directly reduces the attack surface and limits potential damage from compromised accounts.

Answer

Segregation of duties

Answer

Defense in depth

Answer

Zero Trust