SC-900: Security, Compliance, and Identity Fundamentals Practice Exam

What the SC-900 exam covers

• Describe Concepts of Security, Compliance, and Identity119 questions
• Describe Capabilities of Microsoft Entra252 questions
• Describe Capabilities of Microsoft Security Solutions325 questions
• Describe Capabilities of Microsoft Compliance Solutions230 questions

Free SC-900 sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 926.

1. Question 1Describe Concepts of Security, Compliance, and Identity

   Which security model assumes that all users, devices, and network traffic are untrusted by default, even if they are inside the corporate network?

   • AShared responsibility model
   • BPerimeter-based security model
   • CZero Trust modelCorrect
   • DDefense-in-depth model
   ✓ Correct answer: C

   Zero Trust treats network location as irrelevant to trust, so being inside the corporate firewall grants no implicit privileges. Every access request must be authenticated, authorized, and continuously validated against signals such as user identity, device health, and the resource being requested. This 'never trust, always verify' posture directly answers the scenario of treating all users, devices, and traffic as untrusted by default. It exists precisely because attackers who breach the perimeter would otherwise move freely across an implicitly trusted internal network.

   Why the other options are wrong

   • AShared responsibility model divides security duties between the cloud provider and the customer; it does not describe how much to trust users or network traffic.
   • BPerimeter-based security treats anything inside the network boundary as trusted, which is the exact opposite of assuming all internal entities are untrusted.
   • DDefense in depth layers multiple independent controls so a failure of one is caught by another, but it does not by itself declare every user and device untrusted by default.
2. Question 2Describe Concepts of Security, Compliance, and Identity

   An organization requires employees to use both a password and a verification code sent to their mobile phone when signing into corporate applications. Which concept does this requirement illustrate?

   • APasswordless authentication
   • BSingle-factor authentication
   • CMulti-factor authentication (MFA)Correct
   • DRole-based access control
   ✓ Correct answer: C

   Multi-factor authentication (MFA) requires users to provide two or more verification methods from different authentication categories before accessing systems. In this scenario, the combination of a password (something you know) and a mobile phone verification code (something you have) represents MFA. MFA significantly increases security by requiring attackers to compromise multiple authentication factors.

   Why the other options are wrong

   • APasswordless authentication is incorrect because the requirement still uses a password.
   • BSingle-factor authentication is incorrect because two factors are required.
   • DRole-based access control is incorrect because it manages authorization, not authentication methods.
3. Question 3Describe Capabilities of Microsoft EntraSelect all that apply

   Which THREE are capabilities of Microsoft Entra Privileged Identity Management (PIM)? (Choose three.)

   • AJust-in-time privileged accessCorrect
   • BApproval workflow for role activationCorrect
   • CAutomatic malware removal
   • DTime-bound role assignmentsCorrect
   • ENetwork traffic filtering
   ✓ Correct answer: A, B, D

   Privileged Identity Management (PIM) enables just-in-time (JIT) access where administrators activate roles only when needed rather than maintaining permanent access. Activation can require approval, include automatic expiration, and support time-limited assignments to enforce least privilege principles.

   Why the other options are wrong

   • CAutomatic malware removal is incorrect because malware remediation is provided by Microsoft Defender, not PIM.
   • ENetwork traffic filtering is incorrect because network filtering is handled by Azure Firewall and Network Security Groups.
4. Question 4Describe Capabilities of Microsoft Security Solutions

   Which Microsoft 365 Defender component protects against threats in email messages, links, and collaboration tools?

   • AMicrosoft Defender for Endpoint
   • BMicrosoft Defender for Identity
   • CMicrosoft Defender for Office 365Correct
   • DMicrosoft Defender for Cloud Apps
   ✓ Correct answer: C

   Microsoft Defender for Office 365 is the component of Microsoft Defender XDR that protects email and collaboration workloads such as Exchange Online, Teams, SharePoint, and OneDrive. It uses capabilities like Safe Attachments (detonating attachments in a sandbox) and Safe Links (time-of-click URL scanning and rewriting) to defend against phishing, malicious links, and malware delivered through messages and shared content. This focus on email, links, and collaboration tools distinguishes it from the endpoint, identity, and cloud-app Defender components.

   Why the other options are wrong

   • AMicrosoft Defender for Endpoint protects devices/endpoints (EDR), not email and collaboration messaging.
   • BMicrosoft Defender for Identity protects on-premises Active Directory identities, not email content.
   • DMicrosoft Defender for Cloud Apps is a CASB for SaaS visibility and control, not the email/link protection service.
5. Question 5Describe Capabilities of Microsoft Compliance Solutions

   VanArsdel Ltd. wants to discover, classify, and govern data across on-premises, multi-cloud, and SaaS environments. Which Microsoft Purview capability provides a unified data governance solution?

   • AMicrosoft Purview Data Loss Prevention
   • BMicrosoft Purview Data Map and Data CatalogCorrect
   • CMicrosoft Purview eDiscovery
   • DMicrosoft Purview Insider Risk Management
   ✓ Correct answer: B

   Microsoft Purview Data Map and Data Catalog provide unified data governance by creating a comprehensive map of data assets across on-premises, multi-cloud, and SaaS environments. Organizations can scan and catalog data sources, automatically classify data, and understand data lineage and relationships, enabling better data governance across their entire technology landscape.

   Why the other options are wrong

   • AMicrosoft Purview Data Loss Prevention is incorrect because DLP prevents data sharing, not governance and cataloging.
   • CMicrosoft Purview eDiscovery is incorrect because eDiscovery is for legal investigations, not unified data governance.
   • DMicrosoft Purview Insider Risk Management is incorrect because it detects risky activities, not discovers and catalogs data assets.
6. Question 6Describe Capabilities of Microsoft Compliance SolutionsSelect all that apply

   Which TWO of the following are capabilities of Microsoft Purview Data Lifecycle Management? (Choose two.)

   • ARetention labels to apply retention settings to individual itemsCorrect
   • BRetention policies to keep or delete content based on rulesCorrect
   • CNetwork traffic inspection and packet-level filtering rules
   • DReal-time endpoint threat detection and automated response
   ✓ Correct answer: A, B

   Microsoft Purview Data Lifecycle Management includes two primary capabilities: retention labels (which can be applied to individual items for granular retention control) and retention policies (which apply retention or deletion rules based on defined criteria). Both are essential components for managing data across Microsoft 365 services like Exchange, SharePoint, and Teams.

   Why the other options are wrong

   • CNetwork traffic inspection and packet-level filtering rules is incorrect because it is a networking security function provided by tools like Azure Firewall or NSGs, not a data lifecycle management capability.
   • DReal-time endpoint threat detection and automated response is incorrect because this is an endpoint protection function, typically provided by Microsoft Defender for Endpoint, not by a data retention management solution.
7. Question 7Describe Capabilities of Microsoft EntraSelect all that apply

   An administrator at Contoso Ltd is planning to use RBAC in Entra ID. Which two of the following are requirements or features of this solution? (Choose two.)

   • AIdentity types
   • BGuest usersCorrect
   • CID Entra in RBAC
   • DSSPRCorrect
   • EUser risk
   ✓ Correct answer: B, D

   Guest users are external identities that organizations invite for collaboration. SSPR enables users to reset passwords independently, reducing friction. When implementing RBAC, both guest user collaboration and self-service password reset are important usability and management features.

   Why the other options are wrong

   • AIdentity types is incorrect because while relevant, it is not a specific requirement.
   • CID Entra in RBAC is incorrect as a placeholder.
   • EUser risk is incorrect because while important for security, it is not specifically paired with RBAC.
8. Question 8Describe Capabilities of Microsoft Security Solutions

   What is the purpose of just-in-time (JIT) virtual machine access in Microsoft Defender for Cloud?

   • AIt reduces the attack surface by opening management ports only when access is requested and approved, for a limited timeCorrect
   • BIt encrypts the operating system and data disks of the virtual machine while they are at rest on the underlying storage
   • CIt creates scheduled backups of the entire virtual machine and stores those recovery points in an Azure Recovery Services vault
   • DIt distributes incoming network traffic evenly across a group of virtual machines to support high availability and scale
   ✓ Correct answer: A

   Inbound management ports such as RDP (3389) and SSH (22) left open continuously are a common target for brute-force attacks. JIT access, a feature of Defender for Cloud, locks these ports down by default and opens them only when a user requests access and the request is approved, automatically closing them again after a set time period. This greatly reduces the attack surface of virtual machines.

   Why the other options are wrong

   • BEncrypting VM disks at rest is Azure Disk Encryption, not JIT access, which limits when management ports are open to reduce exposure.
   • CScheduled VM backups are provided by Azure Backup and Recovery Services vaults, whereas JIT access controls temporary port access.
   • DDistributing traffic across VMs is done by Azure Load Balancer, not JIT access, whose purpose is to open management ports only on approved request.
9. Question 9Describe Capabilities of Microsoft Entra

   A regulated bank must ensure that all password validation for cloud sign-ins occurs against the on-premises Active Directory in real time, so that on-premises password policies and account states are enforced at the moment of authentication, without synchronizing any password hashes to the cloud and without deploying AD FS. Which Microsoft Entra Connect option meets this requirement?

   • APassword hash synchronization (PHS)
   • BPass-through authentication (PTA)Correct
   • CSeamless single sign-on with no validation component
   • DCloud-only accounts with no on-premises directory
   ✓ Correct answer: B

   PTA forwards the authentication request to an on-premises agent that validates it against AD, immediately enforcing on-premises policies and account state. It does not synchronize password hashes and does not require AD FS, making it the best fit when hashes must not leave the premises.

   Why the other options are wrong

   • APHS synchronizes a representation of the password hash to the cloud, which the bank prohibits.
   • CSeamless SSO improves sign-in convenience but does not by itself validate passwords.
   • DCloud-only accounts have no link to the on-premises directory and cannot enforce on-premises password validation.
10. Question 10Describe Capabilities of Microsoft Security Solutions

    A company discovers employees are uploading sensitive files to numerous unsanctioned cloud storage services. Leadership wants to discover this shadow IT, assess app risk, and apply session controls to risky cloud apps. Which Microsoft Defender XDR component delivers this cloud access security broker (CASB) functionality?

    • AMicrosoft Defender for Endpoint
    • BMicrosoft Defender for Cloud AppsCorrect
    • CMicrosoft Defender for Identity
    • DMicrosoft Sentinel
    ✓ Correct answer: B

    Microsoft Defender for Cloud Apps is a cloud access security broker. It provides Cloud Discovery to surface shadow IT, a cloud app catalog with risk scores, and app governance with policies and real-time session controls (via Conditional Access App Control) over how users interact with SaaS apps.

    Why the other options are wrong

    • ADefender for Endpoint protects devices and can feed discovery data, but it is not the CASB that governs cloud app sessions.
    • CDefender for Identity targets on-premises AD identity attacks, not SaaS app usage.
    • DSentinel is a SIEM/SOAR for analysis and response, not a CASB that brokers cloud app sessions.

Related Microsoft resources

• SC-900 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• SC-200 practice examRelated
• AZ-140 practice examRelated
• AZ-900 practice examRelated

SC-900 practice exam FAQ