Microsoft Security, Compliance, and Identity Fundamentals (SC-900)

Correct answer: A. Microsoft Entra ID Privileged Identity Management (PIM)

Privileged Identity Management provides Just-in-Time access by allowing eligible users to temporarily activate elevated privileges. This minimizes risk compared to standing access, which is a key exam objective.

Correct answer: B. Microsoft Entra ID Connect

Microsoft Entra Connect is the tool used to synchronize identities from on-premises Active Directory Domain Services to the cloud. It handles password hash synchronization and seamless single sign-on.

Correct answer: A. access reviews

Access reviews allow administrators to periodically verify group memberships and automatically remove users who no longer need access. Identity Protection is used for risk-based sign-in detection, not routine group membership validation.

Correct answer: C. sensitivity labels

Sensitivity labels can apply encryption automatically when specific content conditions or sensitive data types are detected. Retention policies handle data deletion and lifecycle management rather than encryption.

Correct answer: C. Content Search

The Content Search tool locates specific documents across Microsoft 365 locations like SharePoint Online using targeted keyword queries. Auditing tracks logged user actions rather than searching for specific file contents.

Correct answer: C. Microsoft Entra ID Privileged Identity Management (PIM)

Microsoft Entra ID Privileged Identity Management provides just-in-time access by letting eligible users activate administrative roles for a specific, time-bound window. Conditional Access is a strong distractor, but it enforces session rules rather than temporarily assigning the role itself.

Correct answer: B. Automated investigation and remediation · D. Attack surface reduction

Automated investigation and remediation, along with attack surface reduction, are core endpoint protection capabilities of Microsoft Defender for Endpoint. Shadow IT discovery is a distractor because it belongs to Microsoft Defender for Cloud Apps, not the endpoint solution.

Correct answer: A. Yes

Conditional Access uses signals like network location to allow, block, or require multi-factor authentication for specific applications. Administrators frequently create location-based policies to block access entirely from unauthorized or high-risk countries.

Correct answer: A. Yes

Conditional Access can enforce Multi-Factor Authentication when users target specific cloud applications, adding dynamic verification upon access. This ensures sensitive applications require stronger identity assurance during the sign-in event.

Correct answer: A. No

A Microsoft Entra ID user can be assigned multiple roles to grant different levels of access. For the exam, remember that role assignments are additive and not mutually exclusive.

Correct answer: C. Microsoft 365 compliance center.

Compliance Manager is accessed directly through the Microsoft Purview compliance portal, formerly the Microsoft 365 compliance center. The Defender portal is used for security operations instead of compliance tasks.

Correct answer: D. to prevent users from using specific words in their passwords

Microsoft Entra ID Password Protection prevents users from creating passwords containing easily guessed or banned terms. It expands native password policies beyond complexity rules by blocking weak custom words.

Correct answer: D. Information barriers

Information barriers restrict communication and collaboration between specific groups to prevent conflicts of interest. Sensitivity labels classify and protect data but do not block users from interacting.

Correct answer: B. Azure Blueprints

Azure Blueprints orchestrates deploying resources and policies consistently across multiple subscriptions. While Azure Policy enforces rules on existing resources, Blueprints packages those artifacts for repeatable deployments.

Correct answer: A. Yes

Microsoft Entra ID Identity Protection uses risk policies to automatically challenge users with multi-factor authentication when their session appears risky. Remember that Identity Protection is the primary engine for risk-based MFA.

Correct answer: A. Yes

Global Administrator is the highest privileged role in Microsoft Entra ID, granting full access to manage all administrative features. Expect questions mapping default roles to their specific administrative boundaries.

Correct answer: B. stored only on a local device.

Windows Hello for Business stores biometric authentication data locally on the device and never transmits it to external servers or the cloud. This prevents the data from being intercepted or stolen remotely.

Correct answer: A. Yes

Microsoft Entra ID Identity Protection continuously monitors for leaked credentials by checking public and dark web databases against your tenant. This feature allows administrators to automatically remediate compromised users.

Correct answer: A. Display policy tips to users who are about to violate your organization's policies. · B. Protect documents in Microsoft OneDrive that contain sensitive information.

DLP policies protect sensitive data across Microsoft 365 locations like OneDrive and show policy tips before a user accidentally leaks information. Disk encryption and security baselines are device management tasks handled by Intune, not DLP.

Correct answer: A. Yes

Sensitivity labels can apply visual markings like headers, footers, and watermarks to clearly classify and protect documents. This feature helps users instantly identify the handling requirements for sensitive data.

Correct answer: C. text message (SMS) · D. phone call · E. Microsoft Authenticator app

Azure MFA verifies identity using methods like the Microsoft Authenticator app, text messages, or voice calls. Security questions and standard email verification are not valid MFA verification methods under modern security standards.

Correct answer: B. Microsoft Defender for Identity

Microsoft Defender for Identity uses on-premises Active Directory signals to detect and investigate advanced targeted attacks. Defender for Endpoint focuses on devices, while Cloud App Security monitors SaaS applications.

Correct answer: A. Yes

Conditional Access evaluates device state signals, such as Microsoft Intune compliance, to ensure only healthy devices access resources. This signal can enforce stricter controls like blocking access from unmanaged devices.

Correct answer: A. No

Microsoft Entra ID is fundamentally a cloud-based identity and access management service rather than an on-premises directory. For the exam, remember that while it synchronizes with on-premises Active Directory via Entra Connect, the service itself runs entirely in the cloud.

Correct answer: A. Yes

A higher Microsoft Secure Score indicates that you have implemented more recommended security controls, directly lowering your risk exposure. The score measures your security posture against best practices, so completing more actions drives the identified risk down.

Correct answer: A. Yes

Sensitivity labels from Microsoft Purview Information Protection can apply visual markings like watermarks, headers, and footers to emails and documents. This metadata helps users instantly recognize data classification and ensures organizational compliance rules are enforced.

Correct answer: A. Yes

Advanced Auditing in Microsoft Purview provides MailItemsAccessed events to track when email items are accessed. This forensic capability is key for investigating potential data breaches.

Correct answer: A. Yes

Microsoft Purview Compliance Manager supplies predefined templates for various regulations and standards. These templates simplify the process of building assessments for your compliance needs.

Correct answer: A. Yes

Azure Bastion provides seamless RDP and SSH access to virtual machines directly through the Azure portal over TLS. It eliminates the need to expose public IP addresses to the internet.

Correct answer: A. Yes

Conditional Access policies actively target global administrators to enforce stricter security controls like MFA. Microsoft highly recommends configuring these policies to protect your most privileged accounts.

Correct answer: C. Detective

Auditing system access is a detective control because it actively monitors and identifies irregular behaviors or potential breaches after they happen. Preventive controls instead block an event before it occurs.

Correct answer: A. Corrective

Making configuration changes to fix a system after a security incident is a corrective control because it attempts to reverse damage and restore operations. Detective controls only identify issues, while corrective controls resolve them.

Correct answer: C. Preventive

Encrypting data at rest is a preventive control because it directly blocks unauthorized users from reading sensitive data if they bypass physical or network security. Detective controls only alert you after the fact.

Correct answer: C. incidents

Incidents in the Microsoft security portal aggregate multiple related alerts into a single comprehensive view of an attack. This grouping helps defenders understand the full scope of an attack rather than reviewing isolated alerts.

Correct answer: B. No

Microsoft Secure Score focuses heavily on security best practices and identity configurations rather than regulatory compliance. The phrasing is tricky, but the correct answer is yes because its controls ultimately map to data protection, unlike Microsoft Compliance Manager.

Correct answer: A. Yes

The foundational Cloud Security Posture Management features are enabled by default on all Azure subscriptions at no extra cost. Defender CSPM is an optional paid plan adding advanced risk prioritization.

Correct answer: C. Microsoft Sentinel

Microsoft Sentinel is the correct cloud-native SIEM and SOAR solution for threat detection and response across the enterprise. Azure Monitor or Advisor focus on infrastructure health and best practices rather than comprehensive security incident management.

Correct answer: A. incidents

Incidents in the Microsoft Defender portal group related alerts and affected entities, such as devices, into a single view for investigation. Policies are configuration rules, not active alert aggregators.

Correct answer: C. Multi-Factor Authentication (MFA)

Multi-Factor Authentication requires an additional verification factor, like a code sent to a mobile device, on top of the primary password. Pass-through authentication simply validates passwords against your on-premises Active Directory without requiring this extra step.

Correct answer: C. an identity provider

Microsoft Entra ID acts as a cloud-based identity provider responsible for authenticating users and authorizing their access to applications. A SIEM system is a strong distractor, but that security monitoring role belongs to Microsoft Sentinel.

Correct answer: A. No

Conditional Access policies are evaluated after the primary authentication completes but before granting access to the target application. This ensures the system can validate identity signals like location or device compliance before finalizing the session.

Correct answer: A. On-premises Active Directory Domain Services (AD DS)

Defender for Identity uses your on-premises Active Directory Domain Services signals to detect advanced threats. Remember that Microsoft Entra Connect is just the synchronization tool, not the primary source for these threat detections.

Correct answer: B. continuously

Compliance Manager continuously evaluates an organization's compliance posture to provide ongoing risk assessments. Avoid options like quarterly or on demand because the platform calculates your improvement actions and baseline assessments automatically in real time.