Microsoft Security, Compliance, and Identity Fundamentals (SC-900)

Correct answer: A. Microsoft Service Trust Portal

The Microsoft Service Trust Portal provides compliance documentation and audit reports for Microsoft cloud services. For the exam, associate the Service Trust Portal directly with regulatory standards like ISO and GDPR.

Correct answer: D. Security baselines for Azure

Security baselines for Azure deliver predefined security recommendations based on best practices to protect Azure resources. The other options are monitoring tools rather than security configuration guides.

Correct answer: B. Preventing users from using specific words in their passwords

Azure Entra ID Password Protection prevents users from creating passwords that include specific weak or banned words. This feature blocks predictable passwords to reduce the risk of password spray attacks. It does not control expiration periods.

Correct answer: C. Microsoft Defender for Cloud

Microsoft Defender for Cloud contains the secure score dashboard to evaluate and improve your Azure security posture. While Azure Advisor offers general best practice recommendations, Defender for Cloud specifically handles security threats and scoring.

Correct answer: C. Authenticated

Users are always authenticated first to verify their identity when signing into the Azure portal. Authorization happens afterward to determine what resources they can access.

Correct answer: A. Security baselines for Azure

Security baselines for Azure provide benchmark recommendations and guidance to secure Azure services. The other options handle monitoring and analytics rather than security configuration guidance.

Correct answer: E. No, Yes, and No

Azure Entra ID editions have varying features, so statement one is No. You can manage tenants in the Azure portal, but it is a managed service requiring no virtual machines. Match the sequence correctly.

Correct answer: C. Use identity as the primary security boundary · D. Always explicitly verify a user's permissions · E. Always assume the user's system can be breached

Zero Trust relies on identity as the new perimeter, continuous explicit verification, and assuming breach to minimize impact. Traditional network perimeters are obsolete here, so eliminate any option relying on physical locations or legacy trust boundaries.

Correct answer: A. Strategy definition · E. Plan

The Cloud Adoption Framework dictates that defining strategy and planning occur before preparing infrastructure. Governance and management are ongoing phases that happen after readiness, so remember the flow: strategy, plan, ready, adopt, govern, manage.

Correct answer: D. Azure Entra ID Privileged Identity Management (PIM)

Privileged Identity Management provides time-based privileged access for specific administrative tasks. Conditional Access controls access based on conditions but does not grant temporary, time-bound role activations like PIM does.

Correct answer: B. Authorization

Authorization determines what level of access an authenticated user has to specific resources. A common distractor is authentication, but that only validates user identity without granting permissions to resources.

Correct answer: D. Access reviews

Access reviews let administrators periodically validate group memberships and automatically remove access when users no longer need it. Conditional Access and Identity Protection focus on real-time sign-in security rather than recurring access certification.

Correct answer: B. Authenticated

Authentication happens first because the system must validate user identities before checking permissions. Authorization follows authentication, determining which resources and actions the verified user is permitted to access.

Correct answer: C. Encryption

Applying encryption ensures data remains inaccessible without the correct cryptographic key. Archiving, compression, and deduplication simply organize or reduce file sizes. For the exam, associate cryptographic keys directly with the encryption process.

Correct answer: A. Authorization

Authorization determines whether an authenticated user has permission to access a specific resource. Authentication is the separate step of validating the user identity, while Single Sign-On manages the session.

Correct answer: B. Azure Entra ID Connect

Azure Entra ID Connect is the dedicated tool for synchronizing on-premises directories to the cloud, making it essential for hybrid setups. Remember that federation handles authentication pass-through, while PIM and Sentinel serve completely different security functions.

Correct answer: C. Azure Entra ID business-to-business (B2B)

Azure Entra ID B2B is designed specifically for collaborating with external partners by inviting them as guests into your primary directory. B2C handles consumer identity access for applications, while forest trusts are strictly for on-premises scenarios.

Correct answer: A. Managing the physical hardware

The cloud provider is always exclusively responsible for managing the physical hardware, datacenters, and host network. The customer remains responsible for configuring user permissions and managing their own stored data.

Correct answer: B. Yes

The customer is always responsible for managing their own information and data security across any deployment model. A reliable exam rule is that data accountability never shifts to the provider.

Correct answer: B. Yes

Yes. Assume breach is a core Zero Trust principle, meaning you should design security as if attackers are already inside the environment. Always use least privilege and encrypt sessions to limit the blast radius.

Correct answer: A. No

No. In SaaS, the cloud provider handles all underlying maintenance, including patching and service packs. The organization is only responsible for configuring data access and managing user identities within the application.

Correct answer: B. Yes

Authentication requires synchronized identities because the local directory hashes or pass-through connections validate cloud access. Remember that authentication configuration options in Entra ID Connect heavily depend on whether passwords or hashes are synced locally first.

Correct answer: A. Yes

Yes, the cloud provider manages the physical infrastructure, including the network, in an IaaS model. A key exam cue is that the provider always handles the physical hardware, while the customer handles operating systems and above.

Correct answer: D. Yes, No, and Yes

Azure Entra ID Connect synchronizes local Active Directory identities with Azure Entra ID, which is essential for hybrid identity. A single Microsoft 365 tenant is sufficient. Synchronization between on-premises AD DS and cloud directories is required.

Correct answer: D. are stored only on the local device.

Biometric data in Windows Hello for Business is never transmitted to the cloud and remains strictly on the local device's hardware. Options suggesting cloud storage or device replication are incorrect because the biometric signature unlocks a private key locally.

Correct answer: B. Yes

Control is one of the six core Microsoft privacy principles. Microsoft believes people should have control over their data, including the ability to access, modify, and delete it. Remember these foundational privacy tenets for the exam.

Correct answer: A. Yes

Azure Entra ID Connect is the primary Microsoft tool designed to synchronize on-premises Active Directory identities directly with Azure Entra ID. This synchronization is the foundational mechanism required to establish a functional hybrid identity environment.

Correct answer: A. No

Zero Trust operates on the explicit assumption of breach and never trusts any implicit location like an internal network. Every access request must be continuously verified regardless of origin, moving away from traditional perimeter-only defenses.

Correct answer: B. Yes

Transparency is a core Microsoft privacy principle. The company commits to providing clear information about data practices so users can make informed choices. Remember the other principles, like control and security, for your exam.

Correct answer: B. Encryption

Encryption uses cryptographic keys to make data readable only to authorized users who possess the correct key. For the exam, remember that archiving is simply long-term storage and does not provide data readability controls.