Microsoft Security, Compliance, and Identity Fundamentals (SC-900)

Correct answer: A. Trainable classifiers

Trainable classifiers use machine learning to identify specific types of content, such as resumes or source code. Content and Activity explorers only show where labels exist or how users interacted with data.

Correct answer: D. Customer Lockbox

Customer Lockbox provides an explicit approval workflow so organizations control when Microsoft engineers access their data for support. Privileged Access Management is for internal task approvals, not external vendor access.

Correct answer: C. Azure Key Vault

Azure Key Vault securely stores application secrets like API tokens and cryptographic keys. While Microsoft Entra ID Password Protection blocks weak passwords, it does not store application credentials.

Correct answer: A. A grouping of controls from a specific regulation, standard, or policy

An assessment groups controls from a specific regulation to help measure compliance. It provides a structured baseline, whereas policies enforce rules and data classification prevents sensitive sharing.

Correct answer: E. continuously

Compliance Manager continuously evaluates your Microsoft 365 environment against selected controls. This real-time scanning means your compliance score updates automatically rather than on a fixed monthly schedule.

Correct answer: A. Protect documents in Microsoft OneDrive that contain sensitive information. · C. Display policy tips to users who are about to violate organizational policies.

DLP policies protect sensitive items across Microsoft 365 locations and display policy tips to users before they violate rules. Device encryption and baselines are Intune features, not DLP functions.

Correct answer: B. Auditing

Auditing tracks user activities and records who accessed what resources within the environment. Authorization defines what permissions users have, while authentication simply verifies their identity during sign-in.

Correct answer: B. A retention policy

A retention policy preserves data for a specified period, preventing permanent deletion by users. Sensitivity labels classify and encrypt data, whereas DLP focuses on preventing external data sharing.

Correct answer: B. Microsoft Service Trust Portal

The Microsoft Service Trust Portal provides transparency by publishing audits, compliance reports, and security practices. The Microsoft Purview compliance portal is where you actively manage your organization's policies.

Correct answer: B. What watermark to add to files

Sensitivity labels apply visual markings like watermarks, headers, and footers, alongside encryption. Retention policies handle data preservation timing, not sensitivity labels.

Correct answer: C. Data loss prevention (DLP) policies

Data loss prevention policies detect and block sensitive information, like credit card numbers, from being shared via email. Conditional Access controls access based on user signals rather than email content.

Correct answer: A. User risk

Conditional Access evaluates Identity Protection risk levels to require MFA or block access. Device compliance is a separate condition usually checked through Intune, while group membership simply targets the policy scope.

Correct answer: B. Yes

FIDO2 security keys enable passwordless authentication using hardware-backed cryptographic credentials. Remember that passwordless methods, including Windows Hello and the Microsoft Authenticator app, never rely on a password at any step.

Correct answer: B. Microsoft respects local privacy laws applicable to its customers.

Microsoft respects local privacy laws like GDPR and LGPD as a core privacy principle. A strong exam cue is knowing Microsoft never uses enterprise customer data for targeted advertising.

Correct answer: D. The Microsoft 365 compliance center

The Microsoft Purview compliance portal is the central hub for configuring DLP policies to protect sensitive data. Defender handles threats, while the admin center manages basic setup and billing.

Correct answer: A. Yes

The foundational Cloud Security Posture Management features are free and enabled automatically on all Azure subscriptions. Enhanced security capabilities require Microsoft Defender for Cloud plans.

Correct answer: B. Yes

Windows Hello uses biometrics or a local PIN tied to the device, removing the need for a traditional password. True passwordless authentication methods never rely on passwords during the sign-in process.

Correct answer: A. No

Software tokens act as a second factor but still rely on a primary password, so they do not qualify as passwordless. True passwordless authentication replaces passwords entirely with biometrics or security keys.

Correct answer: A. Yes

Defender for Cloud includes Azure Storage security features that detect vulnerabilities and threats. Microsoft Defender for Storage specifically scans for malicious file uploads and sensitive data exposure.

Correct answer: B. A Conditional Access policy

Conditional Access policies enforce MFA requirements based on group assignments. Azure Policy manages Azure resource configurations, while security defaults apply MFA to all users without group targeting.

Correct answer: D. Secure Score

The free tier provides Secure Score to evaluate your security posture. Advanced threat protection, JIT access, and vulnerability scanning require Microsoft Defender plans enabled on the subscription.

Correct answer: B. Computer accounts

AD DS manages traditional network identities like computer accounts within an on-premises environment. Modern application authentication and SaaS integrations rely on Microsoft Entra ID rather than AD DS.

Correct answer: D. A Conditional Access policy

A Conditional Access policy targets specific groups to enforce MFA during sign-in. PIM only manages elevated privileged roles, while Azure RBAC handles resource authorization rather than authentication.

Correct answer: C. Azure Monitor workbook templates.

Azure Monitor workbook templates provide interactive dashboards for visualizing data and gaining quick insights. Playbooks automate incident response, while Azure Logic Apps serve as their underlying automation engine.

Correct answer: B. Enable limited experiences, such as blocking downloads of sensitive information

Session controls limit what users can do during an active connection, like blocking downloads on unmanaged devices. Requiring MFA is a grant control, while device compliance is evaluated as a condition.

Correct answer: B. Yes

Microsoft Defender for Cloud provides hybrid security, protecting workloads across both cloud and on-premises environments. Azure Arc enables this extended visibility, letting you secure servers regardless of location.

Correct answer: C. Microsoft Defender for Endpoint

Microsoft Defender for Endpoint provides the Secure Score for devices, assessing endpoint security configurations. The other Defender options focus on email, cloud apps, or identity protection rather than device configuration.

Correct answer: C. Accounts and identities

In the SaaS shared responsibility model, the provider manages operating systems, applications, and network controls. The customer remains solely responsible for data, accounts, and identity management.

Correct answer: A. Text message to a phone · B. Mobile app notification · D. Security questions

Self-service password reset verifies identity using methods like mobile app notifications, text messages, and security questions. Certificates and picture passwords are not valid SSPR authentication methods.

Correct answer: C. Users at risk · D. Devices at risk

Microsoft 365 Defender displays cards for risky users and devices based on active threat analytics. Compliance score and user management are portal features for Microsoft Purview, not the Defender portal.

Correct answer: B. Sensitive data against exposure to unauthorized users

Information protection classifies and protects sensitive data from unauthorized access. The other options represent threat protection features handled by Microsoft Defender services, not data compliance solutions.

Correct answer: G. Yes, no, and yes

Azure Entra ID B2C supports social logins and custom branding. However, it uses a separate directory from a standard Azure Entra ID tenant, meaning external consumers are not mixed with internal organizational users.

Correct answer: E. of security information and event management (SIEM)

A SIEM collects, correlates, and analyzes log data across systems to generate actionable security alerts. SOAR handles automated response, while TAXII is strictly a threat intelligence sharing protocol.