Microsoft Security, Compliance, and Identity Fundamentals (SC-900)

Correct answer: G. Yes, no, and yes

Conditional Access policies apply to all users including global admins and evaluate device platform signals, but they are enforced only after primary authentication succeeds. Remember that the policy enforcement happens post-authentication.

Correct answer: D. Microsoft Defender for Identity

Microsoft Defender for Identity uses on-premises Active Directory signals to detect advanced threats like lateral movement. The other Defender solutions focus on endpoints, email, or cloud apps rather than on-premises AD integration.

Correct answer: D. Service principal

Registering an application creates a service principal, which lets the app authenticate and access resources. Managed identities are special service principals automatically managed by Azure for specific resources.

Correct answer: A. Managed identity

A system-assigned managed identity lets an Azure resource authenticate to Entra ID without storing credentials. Service principals require manual secrets, so they fail the automatic access requirement.

Correct answer: B. Registration for MFA is required for all users. · E. Administrators must always use multifactor authentication (MFA).

Security defaults enforce MFA registration for everyone and require administrators to perform MFA on every sign-in. Passwordless or specific device logins are not globally forced by this baseline protection.

Correct answer: A. Microsoft Entra ID Privileged Identity Management (PIM)

Privileged Identity Management provides time-based and approval-based activation to grant temporary access. Conditional Access controls sign-in requirements but does not manage role activation.

Correct answer: C. A virtual network subnet · D. A network interface

Network security groups attach directly to subnets and network interfaces to filter traffic. You cannot assign an NSG to an entire virtual network or a resource group.

Correct answer: C. Multifactor authentication (MFA)

Multifactor authentication requires a second verification method, like a code sent to a phone. Single sign-on simplifies access but does not inherently provide a second verification step.

Correct answer: D. Content search

Content search locates specific keywords across SharePoint, Exchange, and OneDrive. Compliance Manager assesses regulatory posture rather than scanning file contents.

Correct answer: C. Incidents

The Incidents view in the Microsoft Defender portal correlates related alerts into a single investigative scenario, exposing affected devices and users. Secure score evaluates your security posture rather than mapping active alerts to specific compromised assets.

Correct answer: C. Service Principal

When you register an application in Microsoft Entra ID, a service principal is automatically created in your tenant to represent that application for permissions. Managed identities are a specialized service principal type automatically managed by Azure for supported resources.

Correct answer: C. Microsoft Defender for Office 365

Attack simulation training is included with Microsoft Defender for Office 365 to help train users against phishing. The other Defender plans focus on SQL, identity, or cloud apps, but email threats belong to Defender for Office 365.

Correct answer: A. Azure virtual machines

Azure Bastion provides secure and seamless RDP and SSH access to Azure virtual machines directly from the Azure portal. It does not secure access to PaaS services like App Service or Azure SQL.

Correct answer: B. Playbooks

Playbooks, powered by Azure Logic Apps, are used in Microsoft Sentinel to automate responses to security incidents. Workbooks are just for visualization, and hunting tools are strictly for manual threat probing.

Correct answer: A. Investigate risks related to user authentication. · B. Automate the detection and remediation of identity-based risks. · C. Export risk detections to third-party tools.

Identity Protection investigates user risk, automates remediation through policies, and exports risk data to third-party SIEMs. Configuring external partner access is handled by Entra B2B, not Identity Protection.

Correct answer: C. On-premises Active Directory Domain Services (AD DS)

Microsoft Defender for Identity analyzes on-premises Active Directory Domain Services signals to detect advanced threats. It does not monitor cloud identities directly, which is handled by Microsoft Entra ID Protection.

Correct answer: B. Conditional Access policies

Conditional Access policies evaluate device compliance and other signals to allow or block access. For the exam, remember that PIM only governs privileged role activation, while NSGs filter network traffic rather than authentication.

Correct answer: A. a virtual network subnet · C. a network interface

Network security groups attach to subnets or network interfaces to filter network traffic. They are not associated with entire virtual networks or resource groups, which is a common exam trap.

Correct answer: A. Reports

The Reports section in the Microsoft Defender portal provides dashboards for tracking security trends and protection statuses. Incidents are used for managing active alerts and investigating attacks, not for viewing long-term trends.

Correct answer: A. Network protection

Network protection acts proactively to block access to dangerous domains, shrinking the attack surface before threats execute. The other options handle post-detection activities like investigation and remediation.

Correct answer: D. Integration with Microsoft 365 Defender

Integrating with Microsoft 365 Defender brings XDR capabilities by correlating signals across endpoints and email. While threat hunting is supported, the specific XDR feature comes from this integration.

Correct answer: B. Multifactor authentication (MFA)

Enabling security defaults automatically requires all users to register for and use multifactor authentication. It does not enable premium features like Identity Protection or PIM.

Correct answer: C. Microsoft Defender for Endpoint

The Microsoft 365 Defender portal centralizes endpoint alerts for investigation and remediation. Cloud workload alerts like SQL or Storage are managed in Microsoft Defender for Cloud.

Correct answer: A. a virtual network subnet · E. a network interface

Network security groups attach directly to virtual network subnets or individual network interfaces to filter traffic. They cannot be assigned to resource groups or entire virtual networks, which is a common exam trap.

Correct answer: C. 180 days

Microsoft 365 E3 includes Standard Audit, which currently retains unified audit logs for 180 days. Remember this updated retention limit, as older documentation might incorrectly point to the previous 90-day default.

Correct answer: C. know

A password represents something you know in multi-factor authentication. For the exam, recall the other two factors: something you have, like a token, and something you are, like biometrics.

Correct answer: D. The Azure portal

Azure Bastion provides secure RDP and SSH access directly through the Azure portal over TLS. Because the connection happens in the browser, you do not need standalone remote desktop or SSH clients.

Correct answer: C. Microsoft 365 compliance center

The Microsoft Purview compliance portal provides the central hub for information protection, governance, and data loss prevention. Although the Microsoft 365 compliance center name is legacy, it remains the intended answer over device management portals.

Correct answer: B. Azure Sentinel

Azure Sentinel, now officially named Microsoft Sentinel, is the cloud-native SIEM and SOAR solution. While the product name changed, the concept remains identical for the exam.

Correct answer: G. Yes, yes, and no

Advanced Audit provides longer log retention and dedicated bandwidth, and allows tracking email access. Standard auditing lacks these premium capabilities, making the retention period different between the tiers.