Microsoft Security, Compliance, and Identity Fundamentals (SC-900)

Correct answer: D. Azure Web Application Firewall

Azure Web Application Firewall provides centralized protection for web applications from common vulnerabilities like SQL injection. Azure Firewall protects network layers instead of application-specific web threats.

Correct answer: B. a service principal

Registering an application in Entra ID creates an application object and a corresponding service principal. The service principal is what actually gets assigned permissions to access resources.

Correct answer: B. Yes

Microsoft Defender for Cloud evaluates resources across multiple subscriptions simultaneously, providing a unified view of your security posture. This aggregation allows administrators to monitor security health across the entire organization.

Correct answer: A. Yes

Network security groups can evaluate and block outbound traffic to the Internet using customizable security rules. This basic filtering mechanism secures virtual machines by restricting unauthorized network communication.

Correct answer: A. Yes

Azure Bastion provides secure RDP and SSH access directly through the Azure portal without exposing public IP addresses. This service simplifies remote administration while protecting virtual machines from external threats.

Correct answer: B. Yes

Sensitivity labels can apply visual markings like headers and footers to Office documents to indicate their protection level. This feature helps users instantly recognize data classification and handling requirements.

Correct answer: C. Encryption at rest

Encryption at rest protects data stored on physical media like hard drives and SSDs from unauthorized access. This differs from encryption in transit, which safeguards data actively moving across networks.

Correct answer: C. know

A password represents something you know, which is one of the core authentication factors. For the exam, remember the triad: something you know, something you have, and something you are.

Correct answer: C. Encryption

Encryption encodes data so only users with the correct decryption keys can read it. Deduplication and compression manage storage efficiency, but they offer no security against unauthorized reading.

Correct answer: C. Identity Provider

Microsoft Entra ID acts as an Identity Provider, managing identities and controlling access to resources. A firewall filters network traffic, while a federation server handles trust relationships but does not serve as the core identity management service.

Correct answer: C. Microsoft Entra ID Privileged Identity Management (PIM)

Privileged Identity Management provides time-bound and approval-based activation for administrative roles. Access reviews periodically validate permissions, while Identity Protection focuses on risk detection rather than managing privileged role assignments.

Correct answer: B. Yes

Yes, Azure Blueprints can package role assignments, policy assignments, and resource templates together for repeatable deployments. This orchestration ensures your environment consistently complies with organizational standards every time the blueprint is applied to a new subscription.

Correct answer: A. No

No, Microsoft Entra ID is a fully managed cloud-based identity service that does not require you to deploy or maintain any virtual machines. You simply create the tenant and manage identities directly through the web-based admin center.

Correct answer: A. Fingerprint · C. PIN · D. Facial recognition

Windows Hello for Business replaces passwords with biometric and PIN credentials. Fingerprint, facial recognition, and PINs are valid because they are tied cryptographically to the local device, unlike standard email or security question recovery methods.

Correct answer: B. Yes

Yes, network security groups use rules to allow or deny inbound and outbound traffic based on source and destination IP addresses, ports, and protocols. This basic layer of filtering protects resources connected to your Azure virtual networks effectively.

Correct answer: B. Yes

Yes, NSGs can block inbound internet traffic by creating deny rules for specific source IP ranges or service tags like Internet. This prevents unauthorized external connections from reaching your protected subnets and associated virtual machines.

Correct answer: A. Yes

Yes, Microsoft Intune fully supports managing Android devices through native enrollment and Android Enterprise profiles. This allows administrators to enforce security compliance and separate personal data from corporate data effectively.

Correct answer: A. Yes

Privileged Identity Management provides time-based access to Azure resources by enabling just-in-time role assignments. For the exam, remember that PIM limits standing privileges rather than permanently granting administrative access.

Correct answer: A. Yes

Verify explicitly is a core principle of Zero Trust, requiring authentication and authorization for every access request. This approach evaluates all data points to ensure strict security before granting access.

Correct answer: A. The Microsoft Cloud Adoption Framework for Azure

The Microsoft Cloud Adoption Framework for Azure provides proven best practices, tools, and guidance for planning and deploying Azure solutions. For the exam, remember that Azure Policy is for governance, while this framework handles the broader cloud adoption journey.

Correct answer: B. Yes

Applying system updates directly increases your secure score because it remediates an active vulnerability recommendation. A strong exam cue is associating remediation steps with positive score impacts in Defender for Cloud.

Correct answer: A. No

Microsoft Intune is used for mobile device and application management, not for provisioning Azure subscriptions. Subscriptions are billing and administrative boundaries managed through the Azure portal.

Correct answer: A. Yes

Transparency is indeed one of the foundational Microsoft privacy principles. The others are control, strong legal protections, security, and no content-based targeting.

Correct answer: A. No

Azure Firewall filters network traffic but does not encrypt it; encryption requires services like VPN Gateways or Azure Virtual Network Encryption. Firewalls focus on threat prevention and routing.

Correct answer: A. Yes

Azure Policy can automatically remediate non-compliant resources using built-in effects like deployIfNotExists or modify. This ensures environments continuously meet your corporate standards.

Correct answer: B. Yes

Yes, Microsoft Defender for Endpoint protects Windows 10 computers by providing advanced threat protection, including endpoint detection and response. For the exam, associate Defender for Endpoint with securing client operating systems like Windows.

Correct answer: B. Yes

Yes, enabling MFA increases your secure score because it is a critical security control that protects user accounts. The secure score evaluates your configuration against best practices, and enabling MFA directly aligns with those recommended baseline security configurations.

Correct answer: B. Yes

Yes, Windows Hello for Business uses a PIN as user-provided entropy to unlock a cryptographic key stored in the Trusted Platform Module. Unlike a password, the PIN is local to the specific device and never travels across networks.

Correct answer: B. No

No, Microsoft Entra ID has multiple tiers like Free, Premium P1, and Premium P2, each offering progressively advanced features. Higher tiers include capabilities like conditional access and identity protection, which are unavailable in the free version.

Correct answer: A. Yes

Yes, Azure Bastion is deployed directly into a virtual network to provide secure RDP and SSH access without public IP addresses. You provision one Bastion host per virtual network to enable seamless and secure browser-based connectivity to your virtual machines.

Correct answer: B. No

No, the biometric and PIN credentials are stored locally and independently on each specific device. This design ensures that a compromise of one laptop or phone does not expose the user's authentication keys on their other registered hardware.

Correct answer: B. Yes

Identity Protection evaluates user and sign-in risk to enforce Conditional Access policies, securing access to Azure resources. It does not grant access directly, but works through Conditional Access to block risky authentications.

Correct answer: B. Azure Bastion

Azure Bastion provides secure and seamless RDP and SSH access to virtual machines directly from the Azure portal. It eliminates the need to expose public IP addresses on your virtual machines, reducing attack surfaces.

Correct answer: A. a trust relationship

Federation establishes a trust relationship between organizations, allowing users in one domain to authenticate and access resources in another. This avoids creating duplicate accounts in separate directories.

Correct answer: B. Azure Sentinel

Microsoft Sentinel is the cloud-native SIEM and SOAR solution providing intelligent security analytics and automated incident response. Entra ID handles authentication, not broad event orchestration.

Correct answer: C. Email · D. Mobile app notification · F. Mobile app code

Self-service password reset supports email, mobile app notifications, and mobile app codes for verification. Options like image messages or passport numbers are not valid authentication methods within the Microsoft Entra ID self-service password reset configuration.

Correct answer: A. Yes

Yes, you can apply multiple locks to a single Azure resource to prevent both modifications and deletions. When multiple locks are assigned, the strictest permission level always applies, ensuring the resource remains fully protected from unwanted changes.

Correct answer: B. playbooks

Playbooks automate responses to threats in Microsoft Sentinel by running predefined sequences of actions. Workbooks visualize data, while hunting tools actively search for threats, distinguishing them from automated remediation workflows.

Correct answer: B. Yes

Yes, Access Reviews allow you to periodically validate user access to groups, applications, and roles. This feature is essential for maintaining security and compliance by ensuring only the right people retain their permissions over time.

Correct answer: E. Azure Entra ID Connect

Microsoft Entra Connect synchronizes on-premises directory identities to Entra ID, acting as the bridge for hybrid environments. Other options handle access control but lack the specific synchronization capability.

Correct answer: A. No

No, Azure Entra ID editions do not all offer the same features. The Free tier provides basic identity management, while Premium tiers add advanced features like conditional access. Knowing the specific differences between these editions is essential.

Correct answer: B. Yes

Yes, Microsoft Intune manages both corporate and personal devices. It supports bring your own device scenarios by separating personal and corporate data. Remember that Intune is the core component for mobile device management.

Correct answer: B. No

No, global administrators are not automatically exempt from conditional access policies. These policies apply to all users, including admins. Microsoft actually recommends securing your global administrators with conditional access.

Correct answer: A. Yes

Yes, network security groups filter network traffic using rules based on source IP, destination IP, port, and protocol. This basic network filtering is a fundamental Azure networking concept. Expect questions mapping features to security tools.

Correct answer: A. Yes

Yes, Azure Bastion provides secure RDP and SSH access directly through the Azure portal. It connects you to virtual machines without exposing public IP addresses. Remember that Bastion secures remote connectivity.

Correct answer: B. No

Windows Hello for Business primarily relies on biometrics or PINs to authenticate users locally. The Microsoft Authenticator app is used separately for verifying identity during sign-ins.

Correct answer: H. Customer Lockbox

Customer Lockbox ensures any Microsoft support engineer access to Exchange Online data requires explicit approval from your organization. This approval workflow prevents unauthorized access during support tickets.

Correct answer: B. managed identity

A managed identity allows an Azure resource to authenticate to other services without storing credentials in code. This eliminates the need to manage secrets. Be prepared to identify managed identities as the secure authentication method.