Microsoft Security, Compliance, and Identity Fundamentals (SC-900) Practice Test – 233 Free Exam Questions with Answers

Correct answer: C. authenticated

Users must be authenticated first, which verifies their identity before anything else happens. Authorization comes later to determine what permissions they have, so always associate authentication with identity verification and authorization with access control.

Correct answer: D. Microsoft Cloud Adoption Framework for Azure

The Microsoft Cloud Adoption Framework for Azure provides proven guidance and best practices to accelerate your cloud adoption journey. Resource locks and Azure Policy are governance tools used to enforce rules rather than frameworks.

Correct answer: C. Microsoft Service Trust Portal

The Microsoft Service Trust Portal provides detailed compliance documentation and audit reports for Microsoft cloud services. The other portals handle billing or administration, while the Service Trust Portal is specifically dedicated to compliance.

Correct answer: B. No

No, Azure Entra ID is a fully managed cloud-based directory service. You never need to deploy or maintain underlying virtual machines. Remember that Entra ID operates natively as a multi-tenant SaaS solution managed entirely by Microsoft.

Correct answer: A. Compliance score

Compliance score tracks your progress in completing improvement actions aligned with data protection and regulatory standards. Do not confuse this with Secure Score, which specifically measures the implementation of security configurations across your environment.

Correct answer: C. Azure virtual machines · E. Azure virtual networks

Azure Firewall is a managed network security service designed to protect Azure virtual networks and the virtual machines connected to them. SaaS applications like SharePoint Online are protected at the application layer, not by Azure infrastructure firewalls.

Correct answer: D. Virtual networks

Azure DDoS Protection Standard is explicitly designed to safeguard virtual networks against distributed denial-of-service attacks. Remember that this service operates at the network layer, making resource groups and identity objects invalid targets.

Correct answer: A. Physical hardware management

Microsoft is solely responsible for managing physical hardware, including datacenters and host infrastructure. Customers always remain responsible for configuring data permissions and managing their own user accounts and devices in the cloud.

Correct answer: B. Reports

The Reports section in the Microsoft 365 Defender portal provides the visibility needed to track security trends and monitor identity protection status. Incidents are for active investigations, while reports aggregate historical data and metrics.

Correct answer: B. Defense in depth

Defense in depth uses multiple layers of security controls to protect data and infrastructure. If one layer fails, others remain to stop threats. Identity as a perimeter focuses only on authentication, not layered defenses.

Correct answer: A. a connector

Data connectors ingest logs from various sources into Azure Sentinel for real-time analysis. While a Log Analytics workspace stores the data, the connector itself establishes the actual integration pipeline for security alerts and events.

Correct answer: A. encrypting a virtual machine disk

Encrypting a virtual machine disk protects data stored on the physical storage media, which defines encryption at rest. HTTPS, encrypted emails, and VPNs represent encryption in transit, safeguarding data moving across networks.

Correct answer: A. service principal

Registering an application in Azure Entra ID automatically creates an application object and a service principal in the tenant. The service principal is the local instance used to define permissions and access policies.

Correct answer: A. No

No, in SaaS the cloud provider handles all underlying maintenance including service packs and patching. The customer organization only manages their data, user access, and devices connecting to the SaaS application.

Correct answer: A. Always explicitly verify user permissions. · B. Always assume the user system can be breached. · D. Use identity as the primary security perimeter.

Zero Trust requires explicit permission verification, assumes compromise, and uses identity as the primary security perimeter. Options citing the network or physical locations reflect legacy castle-and-moat models rather than modern Zero Trust concepts.

Correct answer: C. Conditional Access policies

Conditional Access policies evaluate device compliance and grants access only to Intune-managed devices. Network security groups filter network traffic but do not evaluate user identity or device compliance state.

Correct answer: A. Yes

Azure Policy supports automatic remediation by triggering deployment scripts to fix non-compliant resources. This feature enforces governance standards without requiring manual intervention for newly created or existing resources.

Correct answer: B. To restrict Microsoft Teams chats between certain groups within an organization

Information barriers restrict communication between specific groups to prevent conflicts of interest. The exam focuses on Teams chats and SharePoint, though Exchange email is technically affected too, making the intent the key differentiator.

Correct answer: C. Microsoft Defender for Office 365

Microsoft Defender for Office 365 uses Safe Attachments to scan files in a virtual environment before delivery. Defender for Endpoint handles endpoint threats, while Defender for Identity monitors on-premises signals.

Correct answer: B. Define strategy · E. Plan

The Microsoft Cloud Adoption Framework starts with the Define Strategy and Plan phases before reaching the Ready phase. A practical exam tip is to remember the lifecycle order: Strategy, Plan, Ready, Adopt, and Govern.

Correct answer: A. Yes

Microsoft Secure Score provides actionable recommendations across various services, including Microsoft Cloud App Security. Secure Score aggregates configuration states to measure and improve an organization's overall security posture across workloads.

Correct answer: A. No

Azure Policy compliance evaluation also occurs during an on-demand scan or when a policy is assigned. It is not strictly limited to resource creation or modification, ensuring continuous monitoring of your environment for governance.

Correct answer: A. Yes

Yes, the secure score evaluates resources across multiple Azure subscriptions. For the exam, remember that this aggregation provides a comprehensive view of your overall security posture, though the service is now known as Microsoft Defender for Cloud.

Correct answer: B. No

No, shared responsibility is a security and governance model dictating cloud obligations between Microsoft and the customer. The actual six fundamental Microsoft privacy principles are control, transparency, security, no content-based targeting, legal protection, and benefits.

Correct answer: B. Yes

Yes, applying system updates directly increases your secure score by resolving vulnerability recommendations. On the exam, remember that completing recommended remediation tasks, like patch management, actively raises your security posture.

Correct answer: B. Yes

Yes, transparency is a core Microsoft privacy principle. The company commits to being clear about data collection and usage. Expect to memorize the six privacy principles, as they are foundational for the compliance portion.

Correct answer: B. Yes

Yes, verify explicitly is a core Zero Trust principle. It means authenticating and authorizing based on all available data points. Remember the three Zero Trust principles: verify explicitly, use least privilege access, and assume breach.

Correct answer: B. Azure virtual machines

Azure Bastion provides secure and seamless RDP and SSH access to Azure virtual machines directly over TLS. It does not provide remote connectivity for databases or web apps, eliminating the strongest distractors.

Correct answer: B. No

No, Zero Trust assumes breach and never trusts anything by default, even behind a firewall. Traditional perimeter security relies on firewalls, but Zero Trust requires continuous verification for every request regardless of origin.

Correct answer: A. No

No, hybrid identity connects an on-premises Active Directory environment with Microsoft Entra ID using a single tenant. Tools like Entra Connect sync identities, allowing users to access both cloud and local resources seamlessly.

Correct answer: A. Yes

Yes, you can manage an Azure Entra ID tenant directly within the Azure portal. This portal provides a unified interface where administrators can handle directory objects, users, and groups. The Microsoft Entra admin center is another valid interface.

Correct answer: A. No

The correct answer is No because Microsoft Entra ID editions like Free, P1, and P2 offer different capabilities. For the exam, remember that advanced features such as Conditional Access and Identity Protection require the premium P1 or P2 tiers.

Correct answer: A. Yes

The correct answer is Yes because assuming breach is a core guiding principle of Zero Trust. For the exam, pair this with the verify explicitly principle, which ensures users and devices are continuously authenticated rather than trusted by default.

Correct answer: A. Electronic Discovery (eDiscovery)

eDiscovery is used to identify, hold, and export electronic information for legal or internal investigations. Data Loss Prevention prevents sensitive data sharing, while Customer Lockbox controls Microsoft engineer access.

Correct answer: C. Authorization

Authorization determines whether an authenticated user has the necessary permissions to access a specific resource. Authentication merely verifies user identity, while single sign-on simplifies the login prompt process.

Correct answer: A. Yes

A digital signature requires a private key to ensure authenticity and integrity. The corresponding public key is then used by recipients to validate the signature and confirm the document origin.

Correct answer: A. a trust relationship

Federation establishes a trust relationship between organizations, allowing secure sharing of identity information. Account synchronization is handled by directory sync tools, not by establishing a federation trust.

Correct answer: A. Yes

Hybrid identity synchronizes Active Directory Domain Services with Azure Entra ID to provide a common identity. This synchronization allows users to access both cloud and on-premises resources seamlessly.

Correct answer: A. Yes

Azure Entra Connect synchronizes identities between on-premises Active Directory and Azure Entra ID. This tool is the primary Microsoft solution for configuring and maintaining a hybrid identity environment.

Correct answer: A. Yes

Verifying a digital signature requires the signer's public key to mathematically confirm the signature was created with the matching private key. Public key cryptography ensures secure validation without exposing the private key.

Correct answer: C. 180 days

With Basic Auditing in a standard Microsoft 365 E3 subscription, audit records are retained for 180 days. Advanced Audit, typically licensed via E5, extends this retention period to a full year for long-term compliance needs.

Correct answer: C. Azure Defender

Microsoft Defender for Cloud provides advanced threat detection for Azure SQL Managed Instances. Although the older name Azure Defender appears, it correctly identifies the service. Secure Score only evaluates configurations, not live threats.

Correct answer: A. Microsoft Endpoint Manager admin center

The Microsoft Endpoint Manager admin center is the dedicated interface for managing Intune policies and devices. Note that Microsoft has renamed this to the Intune admin center, so a modern exam might use that updated terminology.

Correct answer: B. Yes

Control is indeed one of the six foundational Microsoft privacy principles, meaning users should have control over their data. The other principles are security, transparency, compliance, no content-based targeting, and legal protections.

Correct answer: B. Security baselines for Azure

Security baselines for Azure provide reference recommendations and guidance to help secure your Azure services. The distractors are monitoring tools, whereas security baselines specifically focus on applying cloud security best practices and hardening configurations.

Correct answer: B. Azure Entra ID business-to-business (B2B)

Microsoft Entra ID business-to-business allows external users to collaborate as guests in your directory. Use Entra ID B2C for consumer applications, not business partner collaboration. Formatting here is messy, but the concept holds.

Correct answer: A. Microsoft Entra ID Privileged Identity Management (PIM)

Privileged Identity Management provides Just-in-Time access by allowing eligible users to temporarily activate elevated privileges. This minimizes risk compared to standing access, which is a key exam objective.

Correct answer: B. Microsoft Entra ID Connect

Microsoft Entra Connect is the tool used to synchronize identities from on-premises Active Directory Domain Services to the cloud. It handles password hash synchronization and seamless single sign-on.

Correct answer: A. access reviews

Access reviews allow administrators to periodically verify group memberships and automatically remove users who no longer need access. Identity Protection is used for risk-based sign-in detection, not routine group membership validation.

Correct answer: C. sensitivity labels

Sensitivity labels can apply encryption automatically when specific content conditions or sensitive data types are detected. Retention policies handle data deletion and lifecycle management rather than encryption.

Correct answer: C. Content Search

The Content Search tool locates specific documents across Microsoft 365 locations like SharePoint Online using targeted keyword queries. Auditing tracks logged user actions rather than searching for specific file contents.

Correct answer: C. Microsoft Entra ID Privileged Identity Management (PIM)

Microsoft Entra ID Privileged Identity Management provides just-in-time access by letting eligible users activate administrative roles for a specific, time-bound window. Conditional Access is a strong distractor, but it enforces session rules rather than temporarily assigning the role itself.

Correct answer: B. Automated investigation and remediation · D. Attack surface reduction

Automated investigation and remediation, along with attack surface reduction, are core endpoint protection capabilities of Microsoft Defender for Endpoint. Shadow IT discovery is a distractor because it belongs to Microsoft Defender for Cloud Apps, not the endpoint solution.

Correct answer: A. Yes

Conditional Access uses signals like network location to allow, block, or require multi-factor authentication for specific applications. Administrators frequently create location-based policies to block access entirely from unauthorized or high-risk countries.

Correct answer: A. Yes

Conditional Access can enforce Multi-Factor Authentication when users target specific cloud applications, adding dynamic verification upon access. This ensures sensitive applications require stronger identity assurance during the sign-in event.

Correct answer: A. No

A Microsoft Entra ID user can be assigned multiple roles to grant different levels of access. For the exam, remember that role assignments are additive and not mutually exclusive.

Correct answer: C. Microsoft 365 compliance center.

Compliance Manager is accessed directly through the Microsoft Purview compliance portal, formerly the Microsoft 365 compliance center. The Defender portal is used for security operations instead of compliance tasks.

Correct answer: D. to prevent users from using specific words in their passwords

Microsoft Entra ID Password Protection prevents users from creating passwords containing easily guessed or banned terms. It expands native password policies beyond complexity rules by blocking weak custom words.

Correct answer: D. Information barriers

Information barriers restrict communication and collaboration between specific groups to prevent conflicts of interest. Sensitivity labels classify and protect data but do not block users from interacting.

Correct answer: B. Azure Blueprints

Azure Blueprints orchestrates deploying resources and policies consistently across multiple subscriptions. While Azure Policy enforces rules on existing resources, Blueprints packages those artifacts for repeatable deployments.

Correct answer: A. Yes

Microsoft Entra ID Identity Protection uses risk policies to automatically challenge users with multi-factor authentication when their session appears risky. Remember that Identity Protection is the primary engine for risk-based MFA.

Correct answer: A. Yes

Global Administrator is the highest privileged role in Microsoft Entra ID, granting full access to manage all administrative features. Expect questions mapping default roles to their specific administrative boundaries.

Correct answer: B. stored only on a local device.

Windows Hello for Business stores biometric authentication data locally on the device and never transmits it to external servers or the cloud. This prevents the data from being intercepted or stolen remotely.

Correct answer: A. Yes

Microsoft Entra ID Identity Protection continuously monitors for leaked credentials by checking public and dark web databases against your tenant. This feature allows administrators to automatically remediate compromised users.

Correct answer: A. Display policy tips to users who are about to violate your organization's policies. · B. Protect documents in Microsoft OneDrive that contain sensitive information.

DLP policies protect sensitive data across Microsoft 365 locations like OneDrive and show policy tips before a user accidentally leaks information. Disk encryption and security baselines are device management tasks handled by Intune, not DLP.

Correct answer: A. Yes

Sensitivity labels can apply visual markings like headers, footers, and watermarks to clearly classify and protect documents. This feature helps users instantly identify the handling requirements for sensitive data.

Correct answer: C. text message (SMS) · D. phone call · E. Microsoft Authenticator app

Azure MFA verifies identity using methods like the Microsoft Authenticator app, text messages, or voice calls. Security questions and standard email verification are not valid MFA verification methods under modern security standards.

Correct answer: B. Microsoft Defender for Identity

Microsoft Defender for Identity uses on-premises Active Directory signals to detect and investigate advanced targeted attacks. Defender for Endpoint focuses on devices, while Cloud App Security monitors SaaS applications.

Correct answer: A. Yes

Conditional Access evaluates device state signals, such as Microsoft Intune compliance, to ensure only healthy devices access resources. This signal can enforce stricter controls like blocking access from unmanaged devices.

Correct answer: A. No

Microsoft Entra ID is fundamentally a cloud-based identity and access management service rather than an on-premises directory. For the exam, remember that while it synchronizes with on-premises Active Directory via Entra Connect, the service itself runs entirely in the cloud.

Correct answer: A. Yes

A higher Microsoft Secure Score indicates that you have implemented more recommended security controls, directly lowering your risk exposure. The score measures your security posture against best practices, so completing more actions drives the identified risk down.

Correct answer: A. Yes

Sensitivity labels from Microsoft Purview Information Protection can apply visual markings like watermarks, headers, and footers to emails and documents. This metadata helps users instantly recognize data classification and ensures organizational compliance rules are enforced.

Correct answer: A. Yes

Advanced Auditing in Microsoft Purview provides MailItemsAccessed events to track when email items are accessed. This forensic capability is key for investigating potential data breaches.

Correct answer: A. Yes

Microsoft Purview Compliance Manager supplies predefined templates for various regulations and standards. These templates simplify the process of building assessments for your compliance needs.

Correct answer: A. Yes

Azure Bastion provides seamless RDP and SSH access to virtual machines directly through the Azure portal over TLS. It eliminates the need to expose public IP addresses to the internet.

Correct answer: A. Yes

Conditional Access policies actively target global administrators to enforce stricter security controls like MFA. Microsoft highly recommends configuring these policies to protect your most privileged accounts.

Correct answer: C. Detective

Auditing system access is a detective control because it actively monitors and identifies irregular behaviors or potential breaches after they happen. Preventive controls instead block an event before it occurs.

Correct answer: A. Corrective

Making configuration changes to fix a system after a security incident is a corrective control because it attempts to reverse damage and restore operations. Detective controls only identify issues, while corrective controls resolve them.

Correct answer: C. Preventive

Encrypting data at rest is a preventive control because it directly blocks unauthorized users from reading sensitive data if they bypass physical or network security. Detective controls only alert you after the fact.

Correct answer: C. incidents

Incidents in the Microsoft security portal aggregate multiple related alerts into a single comprehensive view of an attack. This grouping helps defenders understand the full scope of an attack rather than reviewing isolated alerts.

Correct answer: B. No

Microsoft Secure Score focuses heavily on security best practices and identity configurations rather than regulatory compliance. The phrasing is tricky, but the correct answer is yes because its controls ultimately map to data protection, unlike Microsoft Compliance Manager.

Correct answer: A. Yes

The foundational Cloud Security Posture Management features are enabled by default on all Azure subscriptions at no extra cost. Defender CSPM is an optional paid plan adding advanced risk prioritization.

Correct answer: C. Microsoft Sentinel

Microsoft Sentinel is the correct cloud-native SIEM and SOAR solution for threat detection and response across the enterprise. Azure Monitor or Advisor focus on infrastructure health and best practices rather than comprehensive security incident management.

Correct answer: A. incidents

Incidents in the Microsoft Defender portal group related alerts and affected entities, such as devices, into a single view for investigation. Policies are configuration rules, not active alert aggregators.

Correct answer: C. Multi-Factor Authentication (MFA)

Multi-Factor Authentication requires an additional verification factor, like a code sent to a mobile device, on top of the primary password. Pass-through authentication simply validates passwords against your on-premises Active Directory without requiring this extra step.

Correct answer: C. an identity provider

Microsoft Entra ID acts as a cloud-based identity provider responsible for authenticating users and authorizing their access to applications. A SIEM system is a strong distractor, but that security monitoring role belongs to Microsoft Sentinel.

Correct answer: A. No

Conditional Access policies are evaluated after the primary authentication completes but before granting access to the target application. This ensures the system can validate identity signals like location or device compliance before finalizing the session.

Correct answer: A. On-premises Active Directory Domain Services (AD DS)

Defender for Identity uses your on-premises Active Directory Domain Services signals to detect advanced threats. Remember that Microsoft Entra Connect is just the synchronization tool, not the primary source for these threat detections.

Correct answer: B. continuously

Compliance Manager continuously evaluates an organization's compliance posture to provide ongoing risk assessments. Avoid options like quarterly or on demand because the platform calculates your improvement actions and baseline assessments automatically in real time.

Correct answer: D. Azure Web Application Firewall

Azure Web Application Firewall provides centralized protection for web applications from common vulnerabilities like SQL injection. Azure Firewall protects network layers instead of application-specific web threats.

Correct answer: B. a service principal

Registering an application in Entra ID creates an application object and a corresponding service principal. The service principal is what actually gets assigned permissions to access resources.

Correct answer: B. Yes

Microsoft Defender for Cloud evaluates resources across multiple subscriptions simultaneously, providing a unified view of your security posture. This aggregation allows administrators to monitor security health across the entire organization.

Correct answer: A. Yes

Network security groups can evaluate and block outbound traffic to the Internet using customizable security rules. This basic filtering mechanism secures virtual machines by restricting unauthorized network communication.

Correct answer: A. Yes

Azure Bastion provides secure RDP and SSH access directly through the Azure portal without exposing public IP addresses. This service simplifies remote administration while protecting virtual machines from external threats.

Correct answer: B. Yes

Sensitivity labels can apply visual markings like headers and footers to Office documents to indicate their protection level. This feature helps users instantly recognize data classification and handling requirements.

Correct answer: C. Encryption at rest

Encryption at rest protects data stored on physical media like hard drives and SSDs from unauthorized access. This differs from encryption in transit, which safeguards data actively moving across networks.

Correct answer: C. know

A password represents something you know, which is one of the core authentication factors. For the exam, remember the triad: something you know, something you have, and something you are.

Correct answer: C. Encryption

Encryption encodes data so only users with the correct decryption keys can read it. Deduplication and compression manage storage efficiency, but they offer no security against unauthorized reading.

Correct answer: C. Identity Provider

Microsoft Entra ID acts as an Identity Provider, managing identities and controlling access to resources. A firewall filters network traffic, while a federation server handles trust relationships but does not serve as the core identity management service.

Correct answer: C. Microsoft Entra ID Privileged Identity Management (PIM)

Privileged Identity Management provides time-bound and approval-based activation for administrative roles. Access reviews periodically validate permissions, while Identity Protection focuses on risk detection rather than managing privileged role assignments.

Correct answer: B. Yes

Yes, Azure Blueprints can package role assignments, policy assignments, and resource templates together for repeatable deployments. This orchestration ensures your environment consistently complies with organizational standards every time the blueprint is applied to a new subscription.

Correct answer: A. No

No, Microsoft Entra ID is a fully managed cloud-based identity service that does not require you to deploy or maintain any virtual machines. You simply create the tenant and manage identities directly through the web-based admin center.

Correct answer: A. Fingerprint · C. PIN · D. Facial recognition

Windows Hello for Business replaces passwords with biometric and PIN credentials. Fingerprint, facial recognition, and PINs are valid because they are tied cryptographically to the local device, unlike standard email or security question recovery methods.

Correct answer: B. Yes

Yes, network security groups use rules to allow or deny inbound and outbound traffic based on source and destination IP addresses, ports, and protocols. This basic layer of filtering protects resources connected to your Azure virtual networks effectively.

Correct answer: B. Yes

Yes, NSGs can block inbound internet traffic by creating deny rules for specific source IP ranges or service tags like Internet. This prevents unauthorized external connections from reaching your protected subnets and associated virtual machines.

Correct answer: A. Yes

Yes, Microsoft Intune fully supports managing Android devices through native enrollment and Android Enterprise profiles. This allows administrators to enforce security compliance and separate personal data from corporate data effectively.

Correct answer: A. Yes

Privileged Identity Management provides time-based access to Azure resources by enabling just-in-time role assignments. For the exam, remember that PIM limits standing privileges rather than permanently granting administrative access.

Correct answer: A. Yes

Verify explicitly is a core principle of Zero Trust, requiring authentication and authorization for every access request. This approach evaluates all data points to ensure strict security before granting access.

Correct answer: A. The Microsoft Cloud Adoption Framework for Azure

The Microsoft Cloud Adoption Framework for Azure provides proven best practices, tools, and guidance for planning and deploying Azure solutions. For the exam, remember that Azure Policy is for governance, while this framework handles the broader cloud adoption journey.

Correct answer: B. Yes

Applying system updates directly increases your secure score because it remediates an active vulnerability recommendation. A strong exam cue is associating remediation steps with positive score impacts in Defender for Cloud.

Correct answer: A. No

Microsoft Intune is used for mobile device and application management, not for provisioning Azure subscriptions. Subscriptions are billing and administrative boundaries managed through the Azure portal.

Correct answer: A. Yes

Transparency is indeed one of the foundational Microsoft privacy principles. The others are control, strong legal protections, security, and no content-based targeting.

Correct answer: A. No

Azure Firewall filters network traffic but does not encrypt it; encryption requires services like VPN Gateways or Azure Virtual Network Encryption. Firewalls focus on threat prevention and routing.

Correct answer: A. Yes

Azure Policy can automatically remediate non-compliant resources using built-in effects like deployIfNotExists or modify. This ensures environments continuously meet your corporate standards.

Correct answer: B. Yes

Yes, Microsoft Defender for Endpoint protects Windows 10 computers by providing advanced threat protection, including endpoint detection and response. For the exam, associate Defender for Endpoint with securing client operating systems like Windows.

Correct answer: B. Yes

Yes, enabling MFA increases your secure score because it is a critical security control that protects user accounts. The secure score evaluates your configuration against best practices, and enabling MFA directly aligns with those recommended baseline security configurations.

Correct answer: B. Yes

Yes, Windows Hello for Business uses a PIN as user-provided entropy to unlock a cryptographic key stored in the Trusted Platform Module. Unlike a password, the PIN is local to the specific device and never travels across networks.

Correct answer: B. No

No, Microsoft Entra ID has multiple tiers like Free, Premium P1, and Premium P2, each offering progressively advanced features. Higher tiers include capabilities like conditional access and identity protection, which are unavailable in the free version.

Correct answer: A. Yes

Yes, Azure Bastion is deployed directly into a virtual network to provide secure RDP and SSH access without public IP addresses. You provision one Bastion host per virtual network to enable seamless and secure browser-based connectivity to your virtual machines.

Correct answer: B. No

No, the biometric and PIN credentials are stored locally and independently on each specific device. This design ensures that a compromise of one laptop or phone does not expose the user's authentication keys on their other registered hardware.

Correct answer: B. Yes

Identity Protection evaluates user and sign-in risk to enforce Conditional Access policies, securing access to Azure resources. It does not grant access directly, but works through Conditional Access to block risky authentications.

Correct answer: B. Azure Bastion

Azure Bastion provides secure and seamless RDP and SSH access to virtual machines directly from the Azure portal. It eliminates the need to expose public IP addresses on your virtual machines, reducing attack surfaces.

Correct answer: A. a trust relationship

Federation establishes a trust relationship between organizations, allowing users in one domain to authenticate and access resources in another. This avoids creating duplicate accounts in separate directories.

Correct answer: B. Azure Sentinel

Microsoft Sentinel is the cloud-native SIEM and SOAR solution providing intelligent security analytics and automated incident response. Entra ID handles authentication, not broad event orchestration.

Correct answer: C. Email · D. Mobile app notification · F. Mobile app code

Self-service password reset supports email, mobile app notifications, and mobile app codes for verification. Options like image messages or passport numbers are not valid authentication methods within the Microsoft Entra ID self-service password reset configuration.

Correct answer: A. Yes

Yes, you can apply multiple locks to a single Azure resource to prevent both modifications and deletions. When multiple locks are assigned, the strictest permission level always applies, ensuring the resource remains fully protected from unwanted changes.

Correct answer: B. playbooks

Playbooks automate responses to threats in Microsoft Sentinel by running predefined sequences of actions. Workbooks visualize data, while hunting tools actively search for threats, distinguishing them from automated remediation workflows.

Correct answer: B. Yes

Yes, Access Reviews allow you to periodically validate user access to groups, applications, and roles. This feature is essential for maintaining security and compliance by ensuring only the right people retain their permissions over time.

Correct answer: E. Azure Entra ID Connect

Microsoft Entra Connect synchronizes on-premises directory identities to Entra ID, acting as the bridge for hybrid environments. Other options handle access control but lack the specific synchronization capability.

Correct answer: A. No

No, Azure Entra ID editions do not all offer the same features. The Free tier provides basic identity management, while Premium tiers add advanced features like conditional access. Knowing the specific differences between these editions is essential.

Correct answer: B. Yes

Yes, Microsoft Intune manages both corporate and personal devices. It supports bring your own device scenarios by separating personal and corporate data. Remember that Intune is the core component for mobile device management.

Correct answer: B. No

No, global administrators are not automatically exempt from conditional access policies. These policies apply to all users, including admins. Microsoft actually recommends securing your global administrators with conditional access.

Correct answer: A. Yes

Yes, network security groups filter network traffic using rules based on source IP, destination IP, port, and protocol. This basic network filtering is a fundamental Azure networking concept. Expect questions mapping features to security tools.

Correct answer: A. Yes

Yes, Azure Bastion provides secure RDP and SSH access directly through the Azure portal. It connects you to virtual machines without exposing public IP addresses. Remember that Bastion secures remote connectivity.

Correct answer: B. No

Windows Hello for Business primarily relies on biometrics or PINs to authenticate users locally. The Microsoft Authenticator app is used separately for verifying identity during sign-ins.

Correct answer: H. Customer Lockbox

Customer Lockbox ensures any Microsoft support engineer access to Exchange Online data requires explicit approval from your organization. This approval workflow prevents unauthorized access during support tickets.

Correct answer: B. managed identity

A managed identity allows an Azure resource to authenticate to other services without storing credentials in code. This eliminates the need to manage secrets. Be prepared to identify managed identities as the secure authentication method.

Correct answer: A. Microsoft Service Trust Portal

The Microsoft Service Trust Portal provides compliance documentation and audit reports for Microsoft cloud services. For the exam, associate the Service Trust Portal directly with regulatory standards like ISO and GDPR.

Correct answer: D. Security baselines for Azure

Security baselines for Azure deliver predefined security recommendations based on best practices to protect Azure resources. The other options are monitoring tools rather than security configuration guides.

Correct answer: B. Preventing users from using specific words in their passwords

Azure Entra ID Password Protection prevents users from creating passwords that include specific weak or banned words. This feature blocks predictable passwords to reduce the risk of password spray attacks. It does not control expiration periods.

Correct answer: C. Microsoft Defender for Cloud

Microsoft Defender for Cloud contains the secure score dashboard to evaluate and improve your Azure security posture. While Azure Advisor offers general best practice recommendations, Defender for Cloud specifically handles security threats and scoring.

Correct answer: C. Authenticated

Users are always authenticated first to verify their identity when signing into the Azure portal. Authorization happens afterward to determine what resources they can access.

Correct answer: A. Security baselines for Azure

Security baselines for Azure provide benchmark recommendations and guidance to secure Azure services. The other options handle monitoring and analytics rather than security configuration guidance.

Correct answer: E. No, Yes, and No

Azure Entra ID editions have varying features, so statement one is No. You can manage tenants in the Azure portal, but it is a managed service requiring no virtual machines. Match the sequence correctly.

Correct answer: C. Use identity as the primary security boundary · D. Always explicitly verify a user's permissions · E. Always assume the user's system can be breached

Zero Trust relies on identity as the new perimeter, continuous explicit verification, and assuming breach to minimize impact. Traditional network perimeters are obsolete here, so eliminate any option relying on physical locations or legacy trust boundaries.

Correct answer: A. Strategy definition · E. Plan

The Cloud Adoption Framework dictates that defining strategy and planning occur before preparing infrastructure. Governance and management are ongoing phases that happen after readiness, so remember the flow: strategy, plan, ready, adopt, govern, manage.

Correct answer: D. Azure Entra ID Privileged Identity Management (PIM)

Privileged Identity Management provides time-based privileged access for specific administrative tasks. Conditional Access controls access based on conditions but does not grant temporary, time-bound role activations like PIM does.

Correct answer: B. Authorization

Authorization determines what level of access an authenticated user has to specific resources. A common distractor is authentication, but that only validates user identity without granting permissions to resources.

Correct answer: D. Access reviews

Access reviews let administrators periodically validate group memberships and automatically remove access when users no longer need it. Conditional Access and Identity Protection focus on real-time sign-in security rather than recurring access certification.

Correct answer: B. Authenticated

Authentication happens first because the system must validate user identities before checking permissions. Authorization follows authentication, determining which resources and actions the verified user is permitted to access.

Correct answer: C. Encryption

Applying encryption ensures data remains inaccessible without the correct cryptographic key. Archiving, compression, and deduplication simply organize or reduce file sizes. For the exam, associate cryptographic keys directly with the encryption process.

Correct answer: A. Authorization

Authorization determines whether an authenticated user has permission to access a specific resource. Authentication is the separate step of validating the user identity, while Single Sign-On manages the session.

Correct answer: B. Azure Entra ID Connect

Azure Entra ID Connect is the dedicated tool for synchronizing on-premises directories to the cloud, making it essential for hybrid setups. Remember that federation handles authentication pass-through, while PIM and Sentinel serve completely different security functions.

Correct answer: C. Azure Entra ID business-to-business (B2B)

Azure Entra ID B2B is designed specifically for collaborating with external partners by inviting them as guests into your primary directory. B2C handles consumer identity access for applications, while forest trusts are strictly for on-premises scenarios.

Correct answer: A. Managing the physical hardware

The cloud provider is always exclusively responsible for managing the physical hardware, datacenters, and host network. The customer remains responsible for configuring user permissions and managing their own stored data.

Correct answer: B. Yes

The customer is always responsible for managing their own information and data security across any deployment model. A reliable exam rule is that data accountability never shifts to the provider.

Correct answer: B. Yes

Yes. Assume breach is a core Zero Trust principle, meaning you should design security as if attackers are already inside the environment. Always use least privilege and encrypt sessions to limit the blast radius.

Correct answer: A. No

No. In SaaS, the cloud provider handles all underlying maintenance, including patching and service packs. The organization is only responsible for configuring data access and managing user identities within the application.

Correct answer: B. Yes

Authentication requires synchronized identities because the local directory hashes or pass-through connections validate cloud access. Remember that authentication configuration options in Entra ID Connect heavily depend on whether passwords or hashes are synced locally first.

Correct answer: A. Yes

Yes, the cloud provider manages the physical infrastructure, including the network, in an IaaS model. A key exam cue is that the provider always handles the physical hardware, while the customer handles operating systems and above.

Correct answer: D. Yes, No, and Yes

Azure Entra ID Connect synchronizes local Active Directory identities with Azure Entra ID, which is essential for hybrid identity. A single Microsoft 365 tenant is sufficient. Synchronization between on-premises AD DS and cloud directories is required.

Correct answer: D. are stored only on the local device.

Biometric data in Windows Hello for Business is never transmitted to the cloud and remains strictly on the local device's hardware. Options suggesting cloud storage or device replication are incorrect because the biometric signature unlocks a private key locally.

Correct answer: B. Yes

Control is one of the six core Microsoft privacy principles. Microsoft believes people should have control over their data, including the ability to access, modify, and delete it. Remember these foundational privacy tenets for the exam.

Correct answer: A. Yes

Azure Entra ID Connect is the primary Microsoft tool designed to synchronize on-premises Active Directory identities directly with Azure Entra ID. This synchronization is the foundational mechanism required to establish a functional hybrid identity environment.

Correct answer: A. No

Zero Trust operates on the explicit assumption of breach and never trusts any implicit location like an internal network. Every access request must be continuously verified regardless of origin, moving away from traditional perimeter-only defenses.

Correct answer: B. Yes

Transparency is a core Microsoft privacy principle. The company commits to providing clear information about data practices so users can make informed choices. Remember the other principles, like control and security, for your exam.

Correct answer: B. Encryption

Encryption uses cryptographic keys to make data readable only to authorized users who possess the correct key. For the exam, remember that archiving is simply long-term storage and does not provide data readability controls.

Correct answer: G. Yes, no, and yes

Conditional Access policies apply to all users including global admins and evaluate device platform signals, but they are enforced only after primary authentication succeeds. Remember that the policy enforcement happens post-authentication.

Correct answer: D. Microsoft Defender for Identity

Microsoft Defender for Identity uses on-premises Active Directory signals to detect advanced threats like lateral movement. The other Defender solutions focus on endpoints, email, or cloud apps rather than on-premises AD integration.

Correct answer: D. Service principal

Registering an application creates a service principal, which lets the app authenticate and access resources. Managed identities are special service principals automatically managed by Azure for specific resources.

Correct answer: A. Managed identity

A system-assigned managed identity lets an Azure resource authenticate to Entra ID without storing credentials. Service principals require manual secrets, so they fail the automatic access requirement.

Correct answer: B. Registration for MFA is required for all users. · E. Administrators must always use multifactor authentication (MFA).

Security defaults enforce MFA registration for everyone and require administrators to perform MFA on every sign-in. Passwordless or specific device logins are not globally forced by this baseline protection.

Correct answer: A. Microsoft Entra ID Privileged Identity Management (PIM)

Privileged Identity Management provides time-based and approval-based activation to grant temporary access. Conditional Access controls sign-in requirements but does not manage role activation.

Correct answer: C. A virtual network subnet · D. A network interface

Network security groups attach directly to subnets and network interfaces to filter traffic. You cannot assign an NSG to an entire virtual network or a resource group.

Correct answer: C. Multifactor authentication (MFA)

Multifactor authentication requires a second verification method, like a code sent to a phone. Single sign-on simplifies access but does not inherently provide a second verification step.

Correct answer: D. Content search

Content search locates specific keywords across SharePoint, Exchange, and OneDrive. Compliance Manager assesses regulatory posture rather than scanning file contents.

Correct answer: C. Incidents

The Incidents view in the Microsoft Defender portal correlates related alerts into a single investigative scenario, exposing affected devices and users. Secure score evaluates your security posture rather than mapping active alerts to specific compromised assets.

Correct answer: C. Service Principal

When you register an application in Microsoft Entra ID, a service principal is automatically created in your tenant to represent that application for permissions. Managed identities are a specialized service principal type automatically managed by Azure for supported resources.

Correct answer: C. Microsoft Defender for Office 365

Attack simulation training is included with Microsoft Defender for Office 365 to help train users against phishing. The other Defender plans focus on SQL, identity, or cloud apps, but email threats belong to Defender for Office 365.

Correct answer: A. Azure virtual machines

Azure Bastion provides secure and seamless RDP and SSH access to Azure virtual machines directly from the Azure portal. It does not secure access to PaaS services like App Service or Azure SQL.

Correct answer: B. Playbooks

Playbooks, powered by Azure Logic Apps, are used in Microsoft Sentinel to automate responses to security incidents. Workbooks are just for visualization, and hunting tools are strictly for manual threat probing.

Correct answer: A. Investigate risks related to user authentication. · B. Automate the detection and remediation of identity-based risks. · C. Export risk detections to third-party tools.

Identity Protection investigates user risk, automates remediation through policies, and exports risk data to third-party SIEMs. Configuring external partner access is handled by Entra B2B, not Identity Protection.

Correct answer: C. On-premises Active Directory Domain Services (AD DS)

Microsoft Defender for Identity analyzes on-premises Active Directory Domain Services signals to detect advanced threats. It does not monitor cloud identities directly, which is handled by Microsoft Entra ID Protection.

Correct answer: B. Conditional Access policies

Conditional Access policies evaluate device compliance and other signals to allow or block access. For the exam, remember that PIM only governs privileged role activation, while NSGs filter network traffic rather than authentication.

Correct answer: A. a virtual network subnet · C. a network interface

Network security groups attach to subnets or network interfaces to filter network traffic. They are not associated with entire virtual networks or resource groups, which is a common exam trap.

Correct answer: A. Reports

The Reports section in the Microsoft Defender portal provides dashboards for tracking security trends and protection statuses. Incidents are used for managing active alerts and investigating attacks, not for viewing long-term trends.

Correct answer: A. Network protection

Network protection acts proactively to block access to dangerous domains, shrinking the attack surface before threats execute. The other options handle post-detection activities like investigation and remediation.

Correct answer: D. Integration with Microsoft 365 Defender

Integrating with Microsoft 365 Defender brings XDR capabilities by correlating signals across endpoints and email. While threat hunting is supported, the specific XDR feature comes from this integration.

Correct answer: B. Multifactor authentication (MFA)

Enabling security defaults automatically requires all users to register for and use multifactor authentication. It does not enable premium features like Identity Protection or PIM.

Correct answer: C. Microsoft Defender for Endpoint

The Microsoft 365 Defender portal centralizes endpoint alerts for investigation and remediation. Cloud workload alerts like SQL or Storage are managed in Microsoft Defender for Cloud.

Correct answer: A. a virtual network subnet · E. a network interface

Network security groups attach directly to virtual network subnets or individual network interfaces to filter traffic. They cannot be assigned to resource groups or entire virtual networks, which is a common exam trap.

Correct answer: C. 180 days

Microsoft 365 E3 includes Standard Audit, which currently retains unified audit logs for 180 days. Remember this updated retention limit, as older documentation might incorrectly point to the previous 90-day default.

Correct answer: C. know

A password represents something you know in multi-factor authentication. For the exam, recall the other two factors: something you have, like a token, and something you are, like biometrics.

Correct answer: D. The Azure portal

Azure Bastion provides secure RDP and SSH access directly through the Azure portal over TLS. Because the connection happens in the browser, you do not need standalone remote desktop or SSH clients.

Correct answer: C. Microsoft 365 compliance center

The Microsoft Purview compliance portal provides the central hub for information protection, governance, and data loss prevention. Although the Microsoft 365 compliance center name is legacy, it remains the intended answer over device management portals.

Correct answer: B. Azure Sentinel

Azure Sentinel, now officially named Microsoft Sentinel, is the cloud-native SIEM and SOAR solution. While the product name changed, the concept remains identical for the exam.

Correct answer: G. Yes, yes, and no

Advanced Audit provides longer log retention and dedicated bandwidth, and allows tracking email access. Standard auditing lacks these premium capabilities, making the retention period different between the tiers.

Correct answer: A. Trainable classifiers

Trainable classifiers use machine learning to identify specific types of content, such as resumes or source code. Content and Activity explorers only show where labels exist or how users interacted with data.

Correct answer: D. Customer Lockbox

Customer Lockbox provides an explicit approval workflow so organizations control when Microsoft engineers access their data for support. Privileged Access Management is for internal task approvals, not external vendor access.

Correct answer: C. Azure Key Vault

Azure Key Vault securely stores application secrets like API tokens and cryptographic keys. While Microsoft Entra ID Password Protection blocks weak passwords, it does not store application credentials.

Correct answer: A. A grouping of controls from a specific regulation, standard, or policy

An assessment groups controls from a specific regulation to help measure compliance. It provides a structured baseline, whereas policies enforce rules and data classification prevents sensitive sharing.

Correct answer: E. continuously

Compliance Manager continuously evaluates your Microsoft 365 environment against selected controls. This real-time scanning means your compliance score updates automatically rather than on a fixed monthly schedule.

Correct answer: A. Protect documents in Microsoft OneDrive that contain sensitive information. · C. Display policy tips to users who are about to violate organizational policies.

DLP policies protect sensitive items across Microsoft 365 locations and display policy tips to users before they violate rules. Device encryption and baselines are Intune features, not DLP functions.

Correct answer: B. Auditing

Auditing tracks user activities and records who accessed what resources within the environment. Authorization defines what permissions users have, while authentication simply verifies their identity during sign-in.

Correct answer: B. A retention policy

A retention policy preserves data for a specified period, preventing permanent deletion by users. Sensitivity labels classify and encrypt data, whereas DLP focuses on preventing external data sharing.

Correct answer: B. Microsoft Service Trust Portal

The Microsoft Service Trust Portal provides transparency by publishing audits, compliance reports, and security practices. The Microsoft Purview compliance portal is where you actively manage your organization's policies.

Correct answer: B. What watermark to add to files

Sensitivity labels apply visual markings like watermarks, headers, and footers, alongside encryption. Retention policies handle data preservation timing, not sensitivity labels.

Correct answer: C. Data loss prevention (DLP) policies

Data loss prevention policies detect and block sensitive information, like credit card numbers, from being shared via email. Conditional Access controls access based on user signals rather than email content.

Correct answer: A. User risk

Conditional Access evaluates Identity Protection risk levels to require MFA or block access. Device compliance is a separate condition usually checked through Intune, while group membership simply targets the policy scope.

Correct answer: B. Yes

FIDO2 security keys enable passwordless authentication using hardware-backed cryptographic credentials. Remember that passwordless methods, including Windows Hello and the Microsoft Authenticator app, never rely on a password at any step.

Correct answer: B. Microsoft respects local privacy laws applicable to its customers.

Microsoft respects local privacy laws like GDPR and LGPD as a core privacy principle. A strong exam cue is knowing Microsoft never uses enterprise customer data for targeted advertising.

Correct answer: D. The Microsoft 365 compliance center

The Microsoft Purview compliance portal is the central hub for configuring DLP policies to protect sensitive data. Defender handles threats, while the admin center manages basic setup and billing.

Correct answer: A. Yes

The foundational Cloud Security Posture Management features are free and enabled automatically on all Azure subscriptions. Enhanced security capabilities require Microsoft Defender for Cloud plans.

Correct answer: B. Yes

Windows Hello uses biometrics or a local PIN tied to the device, removing the need for a traditional password. True passwordless authentication methods never rely on passwords during the sign-in process.

Correct answer: A. No

Software tokens act as a second factor but still rely on a primary password, so they do not qualify as passwordless. True passwordless authentication replaces passwords entirely with biometrics or security keys.

Correct answer: A. Yes

Defender for Cloud includes Azure Storage security features that detect vulnerabilities and threats. Microsoft Defender for Storage specifically scans for malicious file uploads and sensitive data exposure.

Correct answer: B. A Conditional Access policy

Conditional Access policies enforce MFA requirements based on group assignments. Azure Policy manages Azure resource configurations, while security defaults apply MFA to all users without group targeting.

Correct answer: D. Secure Score

The free tier provides Secure Score to evaluate your security posture. Advanced threat protection, JIT access, and vulnerability scanning require Microsoft Defender plans enabled on the subscription.

Correct answer: B. Computer accounts

AD DS manages traditional network identities like computer accounts within an on-premises environment. Modern application authentication and SaaS integrations rely on Microsoft Entra ID rather than AD DS.

Correct answer: D. A Conditional Access policy

A Conditional Access policy targets specific groups to enforce MFA during sign-in. PIM only manages elevated privileged roles, while Azure RBAC handles resource authorization rather than authentication.

Correct answer: C. Azure Monitor workbook templates.

Azure Monitor workbook templates provide interactive dashboards for visualizing data and gaining quick insights. Playbooks automate incident response, while Azure Logic Apps serve as their underlying automation engine.

Correct answer: B. Enable limited experiences, such as blocking downloads of sensitive information

Session controls limit what users can do during an active connection, like blocking downloads on unmanaged devices. Requiring MFA is a grant control, while device compliance is evaluated as a condition.

Correct answer: B. Yes

Microsoft Defender for Cloud provides hybrid security, protecting workloads across both cloud and on-premises environments. Azure Arc enables this extended visibility, letting you secure servers regardless of location.

Correct answer: C. Microsoft Defender for Endpoint

Microsoft Defender for Endpoint provides the Secure Score for devices, assessing endpoint security configurations. The other Defender options focus on email, cloud apps, or identity protection rather than device configuration.

Correct answer: C. Accounts and identities

In the SaaS shared responsibility model, the provider manages operating systems, applications, and network controls. The customer remains solely responsible for data, accounts, and identity management.

Correct answer: A. Text message to a phone · B. Mobile app notification · D. Security questions

Self-service password reset verifies identity using methods like mobile app notifications, text messages, and security questions. Certificates and picture passwords are not valid SSPR authentication methods.

Correct answer: C. Users at risk · D. Devices at risk

Microsoft 365 Defender displays cards for risky users and devices based on active threat analytics. Compliance score and user management are portal features for Microsoft Purview, not the Defender portal.

Correct answer: B. Sensitive data against exposure to unauthorized users

Information protection classifies and protects sensitive data from unauthorized access. The other options represent threat protection features handled by Microsoft Defender services, not data compliance solutions.

Correct answer: A. Threat Trackers → Provides intelligence on top current cybersecurity issues

Threat Trackers provide security admins with intelligence on the latest cybersecurity issues. Threat Explorer is used for real-time threat analysis, while anti-phishing protection detects spoofing and impersonation attempts targeting users.

Correct answer: G. No, yes, and yes

Compliance Manager tracks both Microsoft-managed and customer-managed controls, making the first statement false. It offers regulatory templates and assesses data against privacy standards like GDPR, making the remaining statements true.

Correct answer: G. Yes, no, and yes

Azure Entra ID B2C supports social logins and custom branding. However, it uses a separate directory from a standard Azure Entra ID tenant, meaning external consumers are not mixed with internal organizational users.

Correct answer: E. of security information and event management (SIEM)

A SIEM collects, correlates, and analyzes log data across systems to generate actionable security alerts. SOAR handles automated response, while TAXII is strictly a threat intelligence sharing protocol.

Correct answer: F. Triage → Review and filter alerts

The triage stage involves reviewing and filtering generated alerts to determine their validity. The investigate stage is where analysts create formal cases for deeper analysis and action.