SC-900 Describe the concepts of security, compliance, and identity Practice Test 9 — 15 Questions

Question 1

A company's security team has adopted a strategy that assumes a breach has already occurred. They implement network segmentation, apply strict least privilege access, continuously verify all access requests, and never trust users or devices solely because they are inside the network perimeter. This approach best describes which security model?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Zero Trust. The scenario explicitly describes the core tenets of the Zero Trust model: assume breach, enforce least privilege, segment networks, and never trust any user or device based solely on network location. Zero Trust, as defined by NIST SP 800-207, mandates continuous verification of every access request, treating every request as if it originates from an untrusted network, which directly matches the company's strategy.

Answer

Shared responsibility model

Answer

Defense in depth

Answer

Identity and Access Management (IAM)

Question 2

A company wants to ensure that data is not altered during transmission between a client and a server. They use TLS encryption. Which security goal does this primarily address?

Accepted Answer

Integrity. TLS (Transport Layer Security) uses message authentication codes (MACs) and cryptographic hashing to ensure that data is not tampered with during transit. While TLS also provides confidentiality through encryption, the specific goal of preventing alteration during transmission is integrity. Therefore, option B is correct because integrity guarantees that the data received is exactly what was sent, unchanged by any intermediary.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 3

An organization implements a policy where users must provide two forms of verification, such as a password and a text message code, to access the corporate network. Which security concept does this demonstrate?

Accepted Answer

Multifactor authentication. Multifactor authentication (MFA) requires two or more distinct factors (e.g., something you know like a password, and something you have like a text message code) to verify identity. This is correct because the policy explicitly demands two forms of verification, which is the defining characteristic of MFA, not just single-factor authentication.

Answer

Authorization

Answer

Authentication

Answer

Accounting

Question 4

A company implements a policy where each employee is granted only the permissions necessary to perform their specific job role. For example, a marketing specialist has read-only access to the customer database and cannot modify financial records. Which security principle is primarily being applied?

Accepted Answer

Least privilege. The principle of least privilege dictates that users should be granted only the permissions necessary to perform their job functions. In this scenario, the marketing specialist receives read-only access to the customer database and no access to financial records, which directly aligns with limiting permissions to the minimum required. This reduces the attack surface and limits potential damage from accidental or malicious actions.

Answer

Defense in depth

Answer

Zero Trust

Answer

Separation of duties

Question 5

A company uses an on-premises Active Directory (AD) and wants to enable single sign-on (SSO) for users to access Microsoft 365 and a third-party SaaS application. They plan to use an external identity provider (IdP) that supports Security Assertion Markup Language (SAML) 2.0. Which identity concept does this implementation primarily rely on?

Accepted Answer

Federation. Federation is the correct answer because it establishes a trust relationship between the on-premises Active Directory and the external identity provider (IdP) using SAML 2.0, enabling users to authenticate once and gain access to both Microsoft 365 and the third-party SaaS application without re-entering credentials. This relies on the IdP issuing SAML assertions that are trusted by the relying parties (Microsoft 365 and the SaaS app), which is the core mechanism of federated identity.

Answer

Provisioning

Answer

Synchronization

Answer

Directory extension

Question 6

A financial organization implements a security control that logs every access attempt to sensitive financial records, including who accessed the data, when it was accessed, and from which device. The logs are regularly reviewed by the security team. This control primarily addresses which security concept?

Accepted Answer

Accountability. Accountability ensures that actions affecting sensitive data can be traced uniquely to an individual. By logging who accessed the data, when, and from which device, the organization creates an audit trail that holds users responsible for their actions. This directly supports non-repudiation and forensic analysis, which are the core goals of accountability.

Answer

Confidentiality

Answer

Integrity

Answer

Availability

Question 7

A company's security team configures network firewall rules so that only a dedicated jump server's IP address can initiate RDP connections to production servers. This is an example of which security principle?

Accepted Answer

Least privilege. Restricting RDP access to only a dedicated jump server's IP address ensures that no other hosts or users can directly initiate remote desktop connections to production servers. This enforces the principle of least privilege by granting only the minimum necessary network access (the jump server) required for administrative tasks, reducing the attack surface and limiting lateral movement.

Answer

Defense in depth

Answer

Zero Trust

Answer

Separation of duties

Question 8

A user successfully authenticates to a system using a smart card. After authentication, the system checks whether the user's device is compliant with security policies before granting access to the network. This additional check is an example of which security concept?

Accepted Answer

Authorization. Authorization is the correct answer because after the user is authenticated via smart card, the system evaluates whether the user's device meets security compliance policies before granting network access. This decision—allowing or denying access based on conditions—is the core function of authorization, which determines what resources or actions an authenticated identity is permitted to perform.

Answer

Authentication

Answer

Accounting

Answer

Non-repudiation

Question 9

A company's security team implements a system where every access attempt to sensitive data is recorded, including who accessed the data and when. The logs are regularly reviewed to detect unauthorized access and to hold users accountable for their actions. Which security goal is primarily being addressed by this logging practice?

Accepted Answer

Non-repudiation. Non-repudiation ensures that a user cannot deny having performed an action. By recording who accessed sensitive data and when, the logging practice creates an audit trail that can prove a specific user accessed the data at a specific time, thereby preventing the user from denying that access. This directly addresses the security goal of non-repudiation.

Answer

Confidentiality

Answer

Integrity

Answer

Availability

Question 10

An organization implements a security policy where users must authenticate using a smart card and PIN. After successful authentication, the system checks whether the user's device is managed by the organization and complies with security baselines. If the device is compliant, the user is granted access to the corporate network. If not, access is denied. This approach most directly reflects which security model?

Accepted Answer

Zero Trust. The scenario explicitly enforces 'never trust, always verify' by requiring authentication (smart card + PIN) and then validating device compliance before granting network access. This directly aligns with the Zero Trust model's core principle of conditional access based on identity and device health, rather than implicit trust from network location.

Answer

Defense in depth

Answer

CIA triad

Answer

Least privilege

Question 11

A company stores critical financial reports in a SharePoint Online library. To ensure that the reports have not been tampered with, the security team compares a calculated hash of each file against a stored baseline. This verification process primarily protects which security goal?

Accepted Answer

Integrity. The verification process uses hash comparison to detect unauthorized changes to files, which directly protects data integrity. Integrity ensures that data has not been altered or tampered with during storage or transit. In SharePoint Online, hashing (e.g., SHA-256) creates a unique fingerprint; if the calculated hash matches the stored baseline, the file is unchanged.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 12

A financial institution uses digital signatures to sign all transaction records. This ensures that the records have not been altered after signing. Which security goal does this primarily protect?

Accepted Answer

Integrity. Digital signatures use asymmetric cryptography (e.g., RSA or ECDSA) to create a hash of the transaction record, which is then encrypted with the signer's private key. Any alteration to the record after signing would cause the hash verification to fail, directly protecting the integrity of the data. While digital signatures also support non-repudiation, the question specifically asks which goal is primarily protected by ensuring records have not been altered, which is integrity.

Answer

Confidentiality

Answer

Non-repudiation

Answer

Availability

Question 13

A company uses a hashing algorithm to verify that a downloaded software file has not been tampered with during transmission. This practice primarily protects which security principle?

Accepted Answer

Integrity. Hashing algorithms, such as SHA-256, produce a fixed-size hash value that acts as a digital fingerprint of the file. By comparing the hash of the downloaded file with the hash provided by the publisher, any change to the file—even a single bit—results in a completely different hash, immediately detecting tampering. This directly protects the integrity of the data by ensuring it has not been altered during transmission.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 14

An organization adopts a security model that requires explicit verification of every access request, uses least privilege principles, and assumes that a breach has already occurred. Which security model does this describe?

Accepted Answer

Zero Trust. Zero Trust is the correct answer because the model explicitly requires verification of every access request, enforces least privilege, and assumes breach. This aligns with the core Zero Trust principles of 'never trust, always verify,' continuous validation, and micro-segmentation, as opposed to traditional perimeter-based models that implicitly trust internal traffic.

Answer

Perimeter-based security

Answer

Defense in depth

Answer

Shared responsibility

Question 15

Arrange the steps to configure Azure AD Privileged Identity Management (PIM) for a role in the correct order.

Accepted Answer

Access Azure AD Privileged Identity Management, then select the role to manage, then configure role settings, then add eligible assignments, then manage approvals.. PIM setup involves first accessing PIM, then selecting a role, configuring settings, assigning eligible users, and managing approvals.

Answer

Add eligible assignments, then configure role settings, then select the role, then access Azure AD PIM, then manage approvals.

Answer

Access Azure AD PIM, then configure role settings, then select the role, then add eligible assignments, then manage approvals.

Answer

Access Azure AD PIM, then select the role, then add eligible assignments, then configure role settings, then manage approvals.