Microsoft Security, Compliance, and Identity Fundamentals (SC-900) Exam Questions

Domain 1: Describe the concepts of security, compliance, and identity (12%)

---

A company moves its email and document collaboration to a Software as a Service (SaaS) offering from Microsoft. Under the shared responsibility model, which of the following remains the customer’s responsibility no matter which cloud service type is used?

⬜ Physical hosts and the physical network
⬜ Operating system patching
⬜ Information and data
⬜ Network controls

An attacker gets past a company’s perimeter firewall, but is then stopped by network security rules between subnets. When the attacker later compromises a virtual machine, the most sensitive files are still unreadable because they’re encrypted. Which security approach does this layered design illustrate?

⬜ Defense in depth
⬜ Shared responsibility model
⬜ Hashing
⬜ Federation

A security architect designs an environment in which network access is segmented, all traffic is encrypted end to end, and analytics continuously look for threats, because the design expects that attackers may already be operating inside the network. Which Zero Trust guiding principle does this reflect?

⬜ Verify explicitly
⬜ Use least privilege access
⬜ Defense in depth
⬜ Assume breach

A developer needs to store user passwords so that the application can check a password at sign-in, but the original password can never be recovered from the stored value, even by an administrator. The design must also defeat precomputed “rainbow table” attacks. Which technique should the developer use?

⬜ Symmetric encryption
⬜ Hashing with a unique salt per password
⬜ Asymmetric encryption
⬜ Base64 encoding

A multinational company learns that data collected about a country’s residents is subject to that country’s laws and regulations, even if the data is later stored or processed in a datacenter in a different country. Which governance, risk, and compliance (GRC) concept does this describe?

⬜ Data residency
⬜ Data privacy
⬜ Data sovereignty
⬜ Data classification

Two partner organizations want employees of each company to access some of the other company’s applications using their existing work credentials, without creating and maintaining a second username and password in the partner’s system. This works by setting up a trust relationship between the two organizations’ identity providers. Which identity concept is this?

⬜ Federation
⬜ Directory services
⬜ Authorization
⬜ Multifactor authentication

Domain 2: Describe the capabilities of Microsoft Entra (27%)

---

A web app running on Azure App Service must read secrets from Azure Key Vault. The security team doesn’t want any credentials (passwords, client secrets, or certificates) stored in the app’s code or configuration, and wants the identity to be deleted automatically if the App Service resource is deleted. Which type of identity should be used?

⬜ An app registration with a client secret stored in the app settings
⬜ A system-assigned managed identity
⬜ A guest (B2B) user account
⬜ A shared administrator user account

A company wants people from a partner organization to sign in to its Microsoft Teams, SharePoint sites, and line-of-business apps using the partner’s own work accounts. The partner users should appear in the company’s own Microsoft Entra directory so they can be added to groups and assigned access. Which Microsoft Entra capability meets this requirement?

⬜ Creating new member user accounts with new passwords for each partner employee
⬜ An external tenant configured for consumer-facing apps
⬜ Microsoft Entra Connect synchronization from the partner’s on-premises Active Directory
⬜ Microsoft Entra B2B collaboration (guest users)

An organization with on-premises Active Directory wants users to sign in to Microsoft 365 with the same password they use on-premises. It wants the simplest hybrid identity option with authentication handled in the cloud, so it doesn’t need extra on-premises authentication servers or agents that must stay available for every sign-in. Which option should it choose?

⬜ Federation with Active Directory Federation Services (AD FS)
⬜ Pass-through authentication (PTA)
⬜ Password hash synchronization (PHS)
⬜ Microsoft Entra Domain Services

A security team wants administrators to use a phishing-resistant authentication method when they sign in to Microsoft Entra ID. Which of the following authentication methods is phishing-resistant?

⬜ FIDO2 security key
⬜ SMS text message code
⬜ Voice call
⬜ Microsoft Authenticator push notification

Which of the following sign-in combinations is an example of true multifactor authentication (MFA)?

⬜ A password and the answer to a security question
⬜ A password and a code from the Microsoft Authenticator app on the user’s registered phone
⬜ A password and a memorized PIN
⬜ A username and a password

A company’s help desk is overwhelmed with “I forgot my password” calls. Management wants users to reset or unlock their own accounts after verifying their identity with registered methods, such as the Authenticator app or a mobile phone, without calling the help desk. Which Microsoft Entra capability should be enabled?

⬜ Microsoft Entra Privileged Identity Management
⬜ Microsoft Entra Password Protection
⬜ Microsoft Entra ID Protection
⬜ Self-service password reset (SSPR)

Contoso notices that many employees choose predictable passwords built from the company’s name, product names, and its headquarters city (for example, “Contoso2026!”). Which Microsoft Entra feature lets the administrator block these organization-specific terms and their variations?

⬜ The global banned password list
⬜ Self-service password reset
⬜ A custom banned password list in Microsoft Entra Password Protection
⬜ A Conditional Access policy

An organization wants to require MFA only when users access the finance application from outside the corporate network’s IP address ranges, and to block sign-ins from countries where it doesn’t do business. Which Microsoft Entra capability provides this kind of signal-based, “if-then” access policy?

⬜ Conditional Access
⬜ Security defaults
⬜ Access reviews
⬜ Privileged Identity Management

Help desk staff need to reset passwords for non-administrator users in Microsoft Entra ID. Following the principle of least privilege, what should they be assigned?

⬜ The Azure RBAC Owner role on the subscription
⬜ A Microsoft Entra built-in role scoped to this task, such as Helpdesk Administrator
⬜ The Azure RBAC Contributor role on the subscription
⬜ The Global Administrator role

An external auditor needs to view all resources in an Azure subscription to check their configuration, but must not be able to create, change, or delete anything, or grant access to anyone else. Which Azure built-in role should be assigned?

⬜ Owner
⬜ Contributor
⬜ User Access Administrator
⬜ Reader

Every quarter, a company wants the owners of each Microsoft 365 group to confirm whether each guest user in their group still needs access, and to remove anyone who doesn’t. Which Microsoft Entra ID Governance feature supports this recurring recertification?

⬜ Privileged Identity Management
⬜ Entitlement management
⬜ Access reviews
⬜ Conditional Access

A project team wants to bundle a Microsoft 365 group, two enterprise applications, and a SharePoint Online site into one set that users from a partner organization can request. Requests need manager approval, and the partner users should be added as B2B guests automatically and have their access removed when it expires. Which Microsoft Entra ID Governance capability should be used?

⬜ Entitlement management (access packages)
⬜ Access reviews
⬜ Conditional Access
⬜ Microsoft Entra ID Protection

A company doesn’t want anyone to hold the Global Administrator role permanently. Instead, eligible administrators should activate the role only when needed, for a limited time, after completing MFA, giving a business justification, and getting approval. Which Microsoft Entra capability provides this?

⬜ Access reviews
⬜ Microsoft Entra Privileged Identity Management (PIM)
⬜ Microsoft Entra ID Protection
⬜ Entitlement management

A security team wants Microsoft Entra ID to automatically detect things like a user’s credentials appearing in a leak, sign-ins from anonymous IP addresses, and password spray attacks, and to calculate a risk level for both the user and each sign-in. Which Microsoft Entra capability provides this?

⬜ Microsoft Defender for Identity
⬜ Conditional Access on its own, with no risk signal source
⬜ Privileged Identity Management
⬜ Microsoft Entra ID Protection

Domain 3: Describe the capabilities of Microsoft security solutions (38%)

---

An online retailer’s public IP addresses in an Azure virtual network are flooded with volumetric traffic meant to make its services unavailable. The company wants always-on traffic monitoring, adaptive real-time tuning, access to rapid response support, and cost protection during attacks. Which Azure service should it enable?

⬜ Azure Firewall
⬜ Network security groups
⬜ Azure DDoS Protection
⬜ Azure Web Application Firewall

A company wants one managed, cloud-native service to centrally create, enforce, and log network and application connectivity policies across several virtual networks. It must be fully stateful, have built-in high availability and unlimited cloud scalability, and support threat intelligence-based filtering. Which service should it use?

⬜ Azure Firewall
⬜ Network security groups
⬜ Azure Bastion
⬜ Azure DDoS Protection

A public-facing web application keeps receiving requests that try to exploit it with SQL injection and cross-site scripting (XSS). Which Azure service is designed to centrally protect web applications from these common exploits?

⬜ Network security groups
⬜ Azure Web Application Firewall (WAF) on Azure Application Gateway or Azure Front Door
⬜ Azure DDoS Protection
⬜ Azure Key Vault

A network security group (NSG) has two inbound rules for TCP port 3389 from any source: rule “DenyRDP” with priority 100 and action Deny, and rule “AllowRDP” with priority 200 and action Allow. What happens to an inbound RDP connection attempt?

⬜ It’s allowed, because Allow rules always override Deny rules
⬜ It’s allowed, because the rule with the higher priority number wins
⬜ It’s denied, because the default DenyAllInbound rule is always evaluated first
⬜ It’s denied, because the rule with priority 100 is processed first, and processing stops at the first match

A company is deploying a three-tier application in Azure. It wants the web tier and database tier in separate address ranges, and only traffic from the web tier on the database port allowed to reach the database tier. Which approach provides this network segmentation?

⬜ Put all VMs in a single subnet and give each one a public IP address
⬜ Create a separate Microsoft Entra tenant for each tier
⬜ Place each tier in its own subnet within an Azure virtual network and filter traffic between subnets with network security groups
⬜ Store the database connection string in Azure Key Vault

Administrators need to RDP and SSH into Azure virtual machines directly from the Azure portal in a web browser. The VMs must not have public IP addresses, and RDP/SSH ports must not be exposed to the internet. Which Azure service should be deployed?

⬜ Azure Bastion
⬜ Public IP addresses on each VM, with an NSG allowing ports 3389 and 22
⬜ Azure DDoS Protection
⬜ Azure Web Application Firewall

A development team keeps database passwords and API keys in configuration files, and manages TLS/SSL certificates and encryption keys manually. The team wants one Azure service to centrally store and control access to secrets, keys, and certificates, with the option of HSM-protected keys. Which service should it use?

⬜ Azure Storage account
⬜ Azure Key Vault
⬜ Azure Policy
⬜ Microsoft Defender for Cloud

A CISO checks the secure score in Microsoft Defender for Cloud each month and sees that it has gone up significantly since the team started fixing security recommendations. What does a higher secure score indicate?

⬜ The organization is guaranteed to be compliant with all regulatory standards
⬜ More resources are being monitored
⬜ More security alerts were generated this month
⬜ The identified security risk level is lower

Microsoft Defender for Cloud flags several storage accounts because they don’t restrict network access with virtual network rules, and it generates security recommendations to harden them. Which built-in security standard, applied by default, contains the controls these recommendations come from?

⬜ ISO 27001
⬜ NIST SP 800-53
⬜ Microsoft cloud security benchmark (MCSB)
⬜ PCI DSS

A company enables Microsoft Defender for Cloud plans such as Defender for Servers, Defender for Storage, and Defender for SQL, so that it gets real-time threat detection and security alerts for its VMs, storage accounts, and databases in Azure, AWS, and Google Cloud. Which Defender for Cloud pillar does this describe?

⬜ Cloud workload protection platform (CWPP)
⬜ Cloud security posture management (CSPM)
⬜ DevOps security
⬜ Security information and event management (SIEM)

A security team uses Defender for Cloud’s free foundational CSPM capabilities, including secure score and security recommendations. It now wants attack path analysis and the cloud security explorer, to find how an attacker could chain misconfigurations to reach critical assets. What must it enable?

⬜ Nothing more; these are included in foundational CSPM
⬜ The Defender CSPM plan
⬜ Defender for Servers Plan 1
⬜ Azure Policy

When Microsoft Sentinel creates a high-severity incident for a compromised account, a predefined workflow automatically disables the user in Microsoft Entra ID, posts a message to the SOC’s Teams channel, and opens a ServiceNow ticket, with no analyst involvement. Which security concept does this represent?

⬜ Security information and event management (SIEM)
⬜ Cloud security posture management (CSPM)
⬜ Extended detection and response (XDR)
⬜ Security orchestration, automation, and response (SOAR)

A SOC team is onboarding Microsoft Sentinel. Before any analytics can detect threats, the team must bring in sign-in logs from Microsoft Entra ID, Azure activity logs, and logs from a third-party firewall. Which Microsoft Sentinel feature is used to ingest this data?

⬜ Workbooks
⬜ Playbooks
⬜ Data connectors
⬜ Analytics rules

A security analyst wants alerts from Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps automatically correlated into single incidents, so the full scope of an attack can be investigated from one unified location. What should the analyst use?

⬜ Microsoft Defender XDR in the Microsoft Defender portal
⬜ Microsoft Purview portal
⬜ Microsoft Entra admin center
⬜ Azure Advisor

An employee clicks a link in an email that looked safe when it was delivered, but the attacker has since switched the destination website to a phishing page. Which Microsoft Defender for Office 365 feature checks URLs at the moment they’re clicked, to protect against this?

⬜ Safe Attachments
⬜ Safe Links
⬜ Attack simulation training
⬜ Threat Explorer

An organization needs a solution for its Windows, macOS, and mobile devices that provides attack surface reduction, next-generation protection against malware and ransomware, and endpoint detection and response (EDR), so it can investigate and respond to advanced threats on devices. Which Microsoft solution should it deploy?

⬜ Microsoft Defender for Identity
⬜ Microsoft Defender for Office 365
⬜ Microsoft Defender for Cloud Apps
⬜ Microsoft Defender for Endpoint

A company suspects employees are using hundreds of unsanctioned cloud apps (shadow IT) to share work files. Security wants to discover which cloud apps are in use, assess each app’s risk against a catalog of risk indicators, and apply policies to control them. Which Microsoft solution provides these cloud access security broker (CASB) capabilities?

⬜ Microsoft Defender for Endpoint
⬜ Microsoft Defender for Cloud
⬜ Microsoft Defender for Cloud Apps
⬜ Azure Firewall

A security team wants to detect identity-based attacks on its on-premises Active Directory, such as reconnaissance and account enumeration, brute-force attempts, lateral movement, and Golden Ticket activity, using lightweight sensors that analyze domain controller network traffic and Windows events. Which Microsoft solution should it use?

⬜ Microsoft Defender for Identity
⬜ Microsoft Entra ID Protection
⬜ Microsoft Defender for Endpoint
⬜ Microsoft Defender for Cloud

A company wants continuous discovery of software, certificates, and browser extensions across its devices, vulnerability prioritization based on threat intelligence and breach likelihood, and the ability to send remediation tasks to Microsoft Intune. Which Microsoft solution provides this?

⬜ Secure score in Defender for Cloud
⬜ Microsoft Defender Vulnerability Management
⬜ Microsoft Defender for Identity
⬜ Microsoft Purview Compliance Manager

A threat analyst wants to research a specific threat actor group: its known campaigns, tools, attack patterns, and associated indicators such as IP addresses, domains, and file hashes. They also want to read Microsoft researchers’ analysis of emerging threats. Which Microsoft capability is designed for this?

⬜ Microsoft Service Trust Portal
⬜ Microsoft Entra ID Protection
⬜ Microsoft Purview Compliance Manager
⬜ Microsoft Threat Intelligence in the Microsoft Defender portal

Domain 4: Describe the capabilities of Microsoft compliance solutions (23%)

---

A company’s auditor asks for Microsoft’s latest independent SOC 2 audit report and ISO/IEC 27001 certification documents for Microsoft 365 and Azure. Where can the company’s compliance officer download these?

⬜ Microsoft Purview Compliance Manager
⬜ Microsoft Defender for Cloud regulatory compliance dashboard
⬜ Microsoft Service Trust Portal
⬜ Azure Advisor

Microsoft’s position is that all government requests for a customer’s data should be directed to the customer, not to Microsoft, and that Microsoft doesn’t give any government direct or unfettered access to customer data, challenging requests through contractual commitments and, if necessary, the courts. Which Microsoft privacy principle is this?

⬜ Microsoft defends your data
⬜ Know where your data is located
⬜ Your data is secured at rest and in transit
⬜ You control your data

A compliance manager uses Microsoft Purview Compliance Manager to track the organization’s progress against a GDPR assessment. Compliance score awards points for completing improvement actions, weighted by risk. Which type of improvement action carries the highest point value?

⬜ Detective discretionary
⬜ Preventative mandatory
⬜ Corrective mandatory
⬜ Preventative discretionary

A legal department wants Microsoft Purview to automatically find documents that are contracts or resumes. These documents don’t contain a consistent pattern such as a credit card or passport number, so they have to be recognized by what kind of content they are. Which data classification capability should be used?

⬜ A sensitive information type with a regular expression
⬜ A keyword dictionary
⬜ Exact data match based on a specific customer database
⬜ A trainable classifier

A compliance officer wants to see a history of what users have been doing with labeled content, for example when a sensitivity label was downgraded or removed from a file, when labeled files were read, and when DLP policies were matched. Which Microsoft Purview tool should they use?

⬜ Content explorer
⬜ Compliance Manager
⬜ Activity explorer
⬜ Service Trust Portal

A company wants its “Highly Confidential” documents and emails to be encrypted so only specific employees can open them, and marked with a “CONFIDENTIAL” watermark and footer. This protection must stay with the file even when it’s emailed or copied outside the organization. What should the administrator configure and publish?

⬜ A Microsoft Purview sensitivity label, published to users with a label policy
⬜ A retention label
⬜ A Conditional Access policy
⬜ An Azure Key Vault access policy

A company wants to stop employees from sharing credit card numbers with external recipients in email and Microsoft Teams chats. Users should see a policy tip explaining the issue and be allowed to override the block only by giving a business justification. Which Microsoft Purview solution should be configured?

⬜ Insider Risk Management
⬜ Data loss prevention (DLP)
⬜ Records management
⬜ eDiscovery

A SharePoint site has a retention policy that keeps all content for 5 years. A specific contract document on that site also has a retention label applied that keeps it for 7 years. How long will the document be retained?

⬜ 5 years, because the site-level retention policy applies first
⬜ Until a user deletes it, because the two settings cancel each other out
⬜ It’s deleted immediately, because the two settings conflict
⬜ 7 years, because the longest retention period wins

A regulated financial firm must make certain trade records completely immutable for their retention period. Once the classification is applied, no one (not even a global administrator) may edit the content, delete it, or remove or change the label. What should the firm use?

⬜ A retention policy applied to the whole Exchange mailbox
⬜ A sensitivity label with encryption
⬜ A retention label, part of records management, that marks items as regulatory records
⬜ A DLP policy that blocks external sharing

HR is concerned that employees who have resigned may download and take confidential files before their last day. The company wants a Microsoft Purview solution with a built-in “data theft by departing users” policy template that correlates risk indicators into alerts for investigation, and shows users pseudonymized by default to protect their privacy. Which solution should it use?

⬜ Microsoft Purview Insider Risk Management
⬜ Microsoft Purview Audit (Standard)
⬜ Microsoft Entra ID Protection
⬜ Microsoft Purview Compliance Manager

A company expects a lawsuit. Its legal team must identify and preserve the relevant Exchange mailboxes, OneDrive accounts, and Teams messages of several employees, so the content can’t be permanently deleted while the case is open, and then search and export the relevant items. Which Microsoft Purview solution should it use?

⬜ Data loss prevention
⬜ eDiscovery, using a case with holds, searches, and exports
⬜ Content explorer
⬜ Activity explorer

After a suspected account compromise, investigators need to find out exactly which mail items an attacker accessed in a user’s Exchange Online mailbox, using the MailItemsAccessed event, and they need audit records for Exchange, SharePoint, and Microsoft Entra ID kept for one year by default. Which Microsoft Purview solution provides this?

⬜ Microsoft Purview Audit (Standard)
⬜ Activity explorer
⬜ Microsoft Purview Communication Compliance
⬜ Microsoft Purview Audit (Premium)