Microsoft
SC-900 Security Fundamentals
Security, Compliance & Identity Concepts — Microsoft Security Solutions
Exam: SC-900
48 Questions & Verified Answers
Microsoft SC-900 Security Fundamentals — 48 Exam
Questions
Covers all exam domains: Security/Compliance/Identity Concepts, Microsoft Entra ID, Microsoft
Security Solutions, and Microsoft Compliance Solutions.
Q01. What does the Zero Trust security model assume?
A. Trust everyone inside the corporate network
B. Only external users are untrusted
C. Never trust, always verify — no implicit trust is granted based on network location; every
user, device, and request must be continuously verified
D. Zero Trust applies only to cloud resources
Answer: C. Never trust, always verify — no implicit trust based on location; every user,
device, and request must be continuously verified
Traditional perimeter model: trust everything inside the network. Zero Trust: trust nothing by default.
Zero Trust principles: Verify explicitly (authenticate and authorize every request), Use least
privilege, Assume breach.
Applied to: identity, endpoints, applications, network, infrastructure, and data.
Microsoft's implementation: Microsoft Entra ID, Conditional Access, Microsoft Defender for
Endpoint.
Q02. What is Microsoft Entra ID (formerly Azure Active Directory)?
A. A Windows Server Active Directory clone
B. Microsoft's cloud-based identity and access management service for authenticating users to
Azure, Microsoft 365, and third-party applications
C. A physical directory server in Microsoft data centers
D. A paid add-on for Microsoft 365 only
Answer: B. Microsoft's cloud-based IAM service for authenticating users to Azure, Microsoft
365, and third-party apps
, Entra ID features: SSO (Single Sign-On), MFA, Conditional Access, identity protection, B2B/B2C.
Different from Windows Server AD: Entra ID is cloud-native using HTTPS/OAuth2/SAML — not
LDAP/Kerberos.
Every Microsoft 365 tenant includes Entra ID Free. Premium plans (P1, P2) add advanced features.
Every Azure subscription requires an Entra ID tenant — it is the identity foundation for all Microsoft
cloud.
Q03. What are the three pillars of the CIA triad?
A. Compliance, Integrity, Authorization
B. Cybersecurity, Information, Access
C. Confidentiality (only authorized parties access data), Integrity (data is accurate and
unmodified), and Availability (systems and data are accessible when needed)
D. Classification, Identity, Authentication
Answer: C. Confidentiality, Integrity, and Availability
Confidentiality: prevent unauthorized access — encryption, access controls, MFA.
Integrity: ensure data has not been tampered with — hashing, digital signatures, audit logs.
Availability: ensure systems are operational when needed — redundancy, backups, DDoS
protection.
Security controls are evaluated against which CIA property they protect.
Q04. What is Multi-Factor Authentication (MFA) and why is it important?
A. Using two different passwords for one account
B. A security process requiring two or more verification factors — something you know,
something you have, or something you are — significantly reducing account compromise risk
even if a password is stolen
C. Logging in from two different devices simultaneously
D. MFA is only for administrator accounts
Answer: B. Two or more verification factors (know/have/are) — reduces account
compromise even if password stolen
Something you know: password, PIN.
Something you have: authenticator app, SMS code, hardware token, smart card.
Something you are: fingerprint, face recognition, iris scan.
Microsoft Authenticator: free app for push notifications and TOTP codes. FIDO2 keys: most
phishing-resistant.
Q05. What is Conditional Access in Microsoft Entra ID?
A. A basic password reset feature
B. A firewall rule for network access
C. A feature that grants or blocks access based on specific conditions — user role, device
compliance, location, risk level — enforcing security policies dynamically rather than with static
rules
D. A user license management feature
Answer: C. Grants or blocks access based on conditions — user role, device compliance,
location, risk level
, Policy example: 'If user is not on corporate network AND device is not compliant, require MFA.'
Requires: Entra ID P1 license (included in Microsoft 365 Business Premium and E3+).
Named locations: define trusted IP ranges (corporate office) to grant or restrict access.
Sign-in risk: Entra ID Identity Protection calculates real-time risk — Conditional Access can block
high-risk logins.
Q06. What is Microsoft Defender for Identity?
A. An antivirus for on-premises servers
B. A cloud service that monitors on-premises Active Directory signals to detect and investigate
advanced threats, compromised identities, and malicious insider actions
C. A firewall for domain controllers
D. A patch management service for Active Directory
Answer: B. Cloud service monitoring on-premises Active Directory signals for advanced
threats and compromised identities
Defender for Identity uses a sensor installed on domain controllers — captures and analyzes AD
traffic.
Detects: Pass-the-Hash, Pass-the-Ticket, Golden Ticket attacks, reconnaissance, lateral
movement.
Timeline: shows full attack path — how an attacker moved from an initial compromise to domain
admin.
Integrates with: Microsoft Sentinel, Microsoft 365 Defender portal for unified investigation.
Q07. What is the principle of least privilege and how does it reduce security risk?
A. Give all users the same access level
B. Only administrators need restricted access
C. Least privilege is only for cloud environments
D. Grant users only the minimum permissions required for their specific job function — if an
account is compromised or misused, the attacker can only do what that account is authorized
to do
Answer: D. Minimum permissions for specific job function — limits damage if account is
compromised or misused
Implementation: use standard user accounts (not admin) for daily tasks; separate admin accounts
for admin tasks.
Role-Based Access Control (RBAC): assign permissions to roles, assign users to roles — not to
individual users.
Periodic review: remove permissions when employees change roles or leave.
Privileged Identity Management (PIM): just-in-time admin access — users activate elevated rights
only when needed.
Q08. What is Microsoft Purview and what does it manage?
A. A networking tool for managing VPN connections
B. A database management service
C. A physical document archive service
SC-900 Security Fundamentals
Security, Compliance & Identity Concepts — Microsoft Security Solutions
Exam: SC-900
48 Questions & Verified Answers
Microsoft SC-900 Security Fundamentals — 48 Exam
Questions
Covers all exam domains: Security/Compliance/Identity Concepts, Microsoft Entra ID, Microsoft
Security Solutions, and Microsoft Compliance Solutions.
Q01. What does the Zero Trust security model assume?
A. Trust everyone inside the corporate network
B. Only external users are untrusted
C. Never trust, always verify — no implicit trust is granted based on network location; every
user, device, and request must be continuously verified
D. Zero Trust applies only to cloud resources
Answer: C. Never trust, always verify — no implicit trust based on location; every user,
device, and request must be continuously verified
Traditional perimeter model: trust everything inside the network. Zero Trust: trust nothing by default.
Zero Trust principles: Verify explicitly (authenticate and authorize every request), Use least
privilege, Assume breach.
Applied to: identity, endpoints, applications, network, infrastructure, and data.
Microsoft's implementation: Microsoft Entra ID, Conditional Access, Microsoft Defender for
Endpoint.
Q02. What is Microsoft Entra ID (formerly Azure Active Directory)?
A. A Windows Server Active Directory clone
B. Microsoft's cloud-based identity and access management service for authenticating users to
Azure, Microsoft 365, and third-party applications
C. A physical directory server in Microsoft data centers
D. A paid add-on for Microsoft 365 only
Answer: B. Microsoft's cloud-based IAM service for authenticating users to Azure, Microsoft
365, and third-party apps
, Entra ID features: SSO (Single Sign-On), MFA, Conditional Access, identity protection, B2B/B2C.
Different from Windows Server AD: Entra ID is cloud-native using HTTPS/OAuth2/SAML — not
LDAP/Kerberos.
Every Microsoft 365 tenant includes Entra ID Free. Premium plans (P1, P2) add advanced features.
Every Azure subscription requires an Entra ID tenant — it is the identity foundation for all Microsoft
cloud.
Q03. What are the three pillars of the CIA triad?
A. Compliance, Integrity, Authorization
B. Cybersecurity, Information, Access
C. Confidentiality (only authorized parties access data), Integrity (data is accurate and
unmodified), and Availability (systems and data are accessible when needed)
D. Classification, Identity, Authentication
Answer: C. Confidentiality, Integrity, and Availability
Confidentiality: prevent unauthorized access — encryption, access controls, MFA.
Integrity: ensure data has not been tampered with — hashing, digital signatures, audit logs.
Availability: ensure systems are operational when needed — redundancy, backups, DDoS
protection.
Security controls are evaluated against which CIA property they protect.
Q04. What is Multi-Factor Authentication (MFA) and why is it important?
A. Using two different passwords for one account
B. A security process requiring two or more verification factors — something you know,
something you have, or something you are — significantly reducing account compromise risk
even if a password is stolen
C. Logging in from two different devices simultaneously
D. MFA is only for administrator accounts
Answer: B. Two or more verification factors (know/have/are) — reduces account
compromise even if password stolen
Something you know: password, PIN.
Something you have: authenticator app, SMS code, hardware token, smart card.
Something you are: fingerprint, face recognition, iris scan.
Microsoft Authenticator: free app for push notifications and TOTP codes. FIDO2 keys: most
phishing-resistant.
Q05. What is Conditional Access in Microsoft Entra ID?
A. A basic password reset feature
B. A firewall rule for network access
C. A feature that grants or blocks access based on specific conditions — user role, device
compliance, location, risk level — enforcing security policies dynamically rather than with static
rules
D. A user license management feature
Answer: C. Grants or blocks access based on conditions — user role, device compliance,
location, risk level
, Policy example: 'If user is not on corporate network AND device is not compliant, require MFA.'
Requires: Entra ID P1 license (included in Microsoft 365 Business Premium and E3+).
Named locations: define trusted IP ranges (corporate office) to grant or restrict access.
Sign-in risk: Entra ID Identity Protection calculates real-time risk — Conditional Access can block
high-risk logins.
Q06. What is Microsoft Defender for Identity?
A. An antivirus for on-premises servers
B. A cloud service that monitors on-premises Active Directory signals to detect and investigate
advanced threats, compromised identities, and malicious insider actions
C. A firewall for domain controllers
D. A patch management service for Active Directory
Answer: B. Cloud service monitoring on-premises Active Directory signals for advanced
threats and compromised identities
Defender for Identity uses a sensor installed on domain controllers — captures and analyzes AD
traffic.
Detects: Pass-the-Hash, Pass-the-Ticket, Golden Ticket attacks, reconnaissance, lateral
movement.
Timeline: shows full attack path — how an attacker moved from an initial compromise to domain
admin.
Integrates with: Microsoft Sentinel, Microsoft 365 Defender portal for unified investigation.
Q07. What is the principle of least privilege and how does it reduce security risk?
A. Give all users the same access level
B. Only administrators need restricted access
C. Least privilege is only for cloud environments
D. Grant users only the minimum permissions required for their specific job function — if an
account is compromised or misused, the attacker can only do what that account is authorized
to do
Answer: D. Minimum permissions for specific job function — limits damage if account is
compromised or misused
Implementation: use standard user accounts (not admin) for daily tasks; separate admin accounts
for admin tasks.
Role-Based Access Control (RBAC): assign permissions to roles, assign users to roles — not to
individual users.
Periodic review: remove permissions when employees change roles or leave.
Privileged Identity Management (PIM): just-in-time admin access — users activate elevated rights
only when needed.
Q08. What is Microsoft Purview and what does it manage?
A. A networking tool for managing VPN connections
B. A database management service
C. A physical document archive service
