,Microsoft SC-900 Exam Prep 2026 — Security,
Compliance & Identity Fundamentals Practice
Questions & Answers
QUESTION 1
A security architect is designing a cloud strategy for a multinational corporation. The company is
migrating from on-premises infrastructure to a mix of IaaS, PaaS, and SaaS. During a design
review, the CISO asks: "In our SaaS deployment, who is responsible for securing the data and
managing user access?" Which statement BEST describes the shared responsibility model for
SaaS?
A. The cloud provider is responsible for securing everything, including customer data and user
access
B. The customer is responsible for securing everything, including the physical infrastructure
C. The cloud provider secures the physical infrastructure and application platform; the customer
is responsible for data, user access, and device security
D. Responsibility is split equally, with the provider managing encryption and the customer
managing network firewalls
Correct Answer: C. The cloud provider secures the physical infrastructure and application
platform; the customer is responsible for data, user access, and device security
Rationale: In SaaS, the cloud provider manages the physical infrastructure, network, and
application platform. The customer remains responsible for their data, user identities and
access, and endpoint devices. Option A incorrectly shifts all responsibility to the provider.
Option B reverses the model by making the customer responsible for the physical infrastructure.
Option D incorrectly describes network firewalls as customer-managed in SaaS. Key Takeaway:
Shared responsibility = provider secures the cloud; customer secures data, identities, and
devices. The higher the service model (IaaS→PaaS→SaaS), the more the provider takes on.
,QUESTION 2
A security administrator is configuring Microsoft Entra ID for a hybrid organization. The
company has on-premises Active Directory Domain Services (AD DS) and wants to synchronize
identities to the cloud. The administrator needs to choose an authentication method. The
requirement is that password hashes must never leave the on-premises environment. Which
authentication method BEST meets this requirement?
A. Password Hash Synchronization (PHS)
B. Pass-through Authentication (PTA)
C. Federation with Active Directory Federation Services (AD FS)
D. Cloud-only authentication
Correct Answer: B. Pass-through Authentication (PTA)
Rationale: Pass-through Authentication (PTA) validates passwords directly against on-premises
AD DS without storing password hashes in the cloud. PHS (A) synchronizes password hashes to
Entra ID. Federation (C) involves AD FS but does not inherently prevent password hash storage
— it delegates authentication. Cloud-only (D) does not support hybrid identity. Key Takeaway:
PTA = passwords validated on-premises; PHS = hashes synced to cloud. Choose PTA when
password hashes must never leave the premises.
QUESTION 3
, A security analyst is reviewing an incident where an attacker gained access to a user's account
through a password spray attack. The attacker tried a small number of common passwords
against many accounts. The organization has Microsoft Entra ID P1. Which feature should the
security team configure to block this attack?
A. Self-service password reset (SSPR)
B. Microsoft Entra Password Protection with a custom banned password list
C. Conditional Access with a sign-in risk policy
D. Microsoft Entra Identity Protection
Correct Answer: B. Microsoft Entra Password Protection with a custom banned password list
Rationale: Microsoft Entra Password Protection blocks weak and commonly used passwords,
including custom banned passwords. This directly prevents password spray attacks that rely on
common passwords. SSPR (A) allows users to reset passwords but does not block weak ones.
Conditional Access with sign-in risk (C) and Identity Protection (D) detect risk after
authentication attempts but do not prevent the use of weak passwords in the first place. Key
Takeaway: Password Protection = block weak/banned passwords at the source; use custom
banned lists for organization-specific terms.
QUESTION 4
A security operations team is evaluating Microsoft Sentinel for their organization. The CISO asks:
"What is the PRIMARY difference between SIEM and SOAR?" Which statement BEST describes
this difference?
A. SIEM collects and correlates log data; SOAR automates response actions based on those
insights
Compliance & Identity Fundamentals Practice
Questions & Answers
QUESTION 1
A security architect is designing a cloud strategy for a multinational corporation. The company is
migrating from on-premises infrastructure to a mix of IaaS, PaaS, and SaaS. During a design
review, the CISO asks: "In our SaaS deployment, who is responsible for securing the data and
managing user access?" Which statement BEST describes the shared responsibility model for
SaaS?
A. The cloud provider is responsible for securing everything, including customer data and user
access
B. The customer is responsible for securing everything, including the physical infrastructure
C. The cloud provider secures the physical infrastructure and application platform; the customer
is responsible for data, user access, and device security
D. Responsibility is split equally, with the provider managing encryption and the customer
managing network firewalls
Correct Answer: C. The cloud provider secures the physical infrastructure and application
platform; the customer is responsible for data, user access, and device security
Rationale: In SaaS, the cloud provider manages the physical infrastructure, network, and
application platform. The customer remains responsible for their data, user identities and
access, and endpoint devices. Option A incorrectly shifts all responsibility to the provider.
Option B reverses the model by making the customer responsible for the physical infrastructure.
Option D incorrectly describes network firewalls as customer-managed in SaaS. Key Takeaway:
Shared responsibility = provider secures the cloud; customer secures data, identities, and
devices. The higher the service model (IaaS→PaaS→SaaS), the more the provider takes on.
,QUESTION 2
A security administrator is configuring Microsoft Entra ID for a hybrid organization. The
company has on-premises Active Directory Domain Services (AD DS) and wants to synchronize
identities to the cloud. The administrator needs to choose an authentication method. The
requirement is that password hashes must never leave the on-premises environment. Which
authentication method BEST meets this requirement?
A. Password Hash Synchronization (PHS)
B. Pass-through Authentication (PTA)
C. Federation with Active Directory Federation Services (AD FS)
D. Cloud-only authentication
Correct Answer: B. Pass-through Authentication (PTA)
Rationale: Pass-through Authentication (PTA) validates passwords directly against on-premises
AD DS without storing password hashes in the cloud. PHS (A) synchronizes password hashes to
Entra ID. Federation (C) involves AD FS but does not inherently prevent password hash storage
— it delegates authentication. Cloud-only (D) does not support hybrid identity. Key Takeaway:
PTA = passwords validated on-premises; PHS = hashes synced to cloud. Choose PTA when
password hashes must never leave the premises.
QUESTION 3
, A security analyst is reviewing an incident where an attacker gained access to a user's account
through a password spray attack. The attacker tried a small number of common passwords
against many accounts. The organization has Microsoft Entra ID P1. Which feature should the
security team configure to block this attack?
A. Self-service password reset (SSPR)
B. Microsoft Entra Password Protection with a custom banned password list
C. Conditional Access with a sign-in risk policy
D. Microsoft Entra Identity Protection
Correct Answer: B. Microsoft Entra Password Protection with a custom banned password list
Rationale: Microsoft Entra Password Protection blocks weak and commonly used passwords,
including custom banned passwords. This directly prevents password spray attacks that rely on
common passwords. SSPR (A) allows users to reset passwords but does not block weak ones.
Conditional Access with sign-in risk (C) and Identity Protection (D) detect risk after
authentication attempts but do not prevent the use of weak passwords in the first place. Key
Takeaway: Password Protection = block weak/banned passwords at the source; use custom
banned lists for organization-specific terms.
QUESTION 4
A security operations team is evaluating Microsoft Sentinel for their organization. The CISO asks:
"What is the PRIMARY difference between SIEM and SOAR?" Which statement BEST describes
this difference?
A. SIEM collects and correlates log data; SOAR automates response actions based on those
insights
