Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-900)

Which statement best describes the cloud shared responsibility model?

• AThe cloud provider is responsible for all security regardless of service model
• BSecurity responsibilities are divided between the cloud provider and the customer based o…
• CThe customer is always responsible for the physical datacenter
• DResponsibility shifts entirely to the customer once data is uploaded

Under the shared responsibility model, who is ALWAYS responsible for information and data, devices, and accounts/identities?

• AThe cloud provider
• BThe customer
• CIt depends on the service model
• DA neutral third party

What is the core idea behind a defense in depth strategy?

• ARely on a single strong perimeter firewall
• BUse multiple layers of security controls so no single failure exposes the asset
• CEncrypt data only when it leaves the network
• DReplace all on-premises controls with cloud-native ones

Which three principles form the foundation of the Zero Trust model?

• ATrust but verify, encrypt everything, audit annually
• BVerify explicitly, use least privilege access, assume breach
• CBuild perimeter, monitor logs, patch systems
• DBlock by default, allow by exception, log everything

Which Zero Trust principle is best illustrated by network microsegmentation and end-to-end encryption?

• AVerify explicitly
• BUse least privilege access
• CAssume breach
• DTrust internal traffic

What does the C in the CIA triad stand for?

• ACompliance
• BConfidentiality
• CContinuity
• DCryptography

Which CIA triad property is violated when an attacker tampers with a database record?

• AConfidentiality
• BIntegrity
• CAvailability
• DAuthenticity

Which encryption state protects data while it is stored on disk in a database or storage account?

• AEncryption in transit
• BEncryption at rest
• CEncryption in use
• DEncryption in motion

Which technology is most associated with encryption in use?

• ATLS 1.3
• BBitLocker
• CConfidential computing using trusted execution environments
• DStorage Service Encryption

Which statement correctly distinguishes hashing from encryption?

• AHashing is reversible with the right key; encryption is one-way
• BHashing is one-way and produces a fixed-length value; encryption is reversible with a key
• CHashing requires a public and private key; encryption only requires a password
• DHashing and encryption are interchangeable terms

Why is identity often described as the new primary security perimeter?

• ABecause firewalls are no longer used in modern networks
• BBecause users access cloud apps from anywhere on any device, so the network boundary no l…
• CBecause all attacks now bypass identity systems entirely
• DBecause compliance regulations require it

What is the difference between authentication (AuthN) and authorization (AuthZ)?

• AAuthN proves who you are; AuthZ determines what you are allowed to do
• BAuthN happens after AuthZ
• CAuthN is for users only; AuthZ is for applications
• DThey are synonyms in cloud identity

What is federation in identity?

• AA way to combine multiple usernames into one mailbox
• BA trust relationship that lets users authenticated by one identity provider access resour…
• CA way to store passwords in plaintext for compatibility
• DA backup process for identity directories

What is Microsoft Entra ID?

• AA cloud-based identity and access management service
• BAn on-premises directory service that replaces Active Directory
• CA SIEM tool for threat hunting
• DA data loss prevention solution

What does a Microsoft Entra tenant represent?

• AA virtual machine in Azure
• BA dedicated and trusted instance of Microsoft Entra ID for an organization
• CA subscription billing boundary only
• DA management group for Azure resources

Which identity type in Microsoft Entra ID represents an automated software process accessing Azure resources?

• AUser
• BGroup
• CService principal
• DDevice