SC-900 — frequently asked questions

Because MFA is often described using three factor categories (know, have, are). Azure AD MFA still enforces only two factors at sign-in, so 3 is not the required count.

Not as the baseline definition. Extra verification comes from step-up or Conditional Access risk policies, which are separate from the standard two-factor MFA requirement.

eDiscovery collects, holds, and exports content for legal or regulatory cases on demand; it does not proactively surface the insider risk signals that indicate data leakage.

No. Compliance Manager scores your compliance posture against regulations and proposes improvement actions, but it does not monitor user activity for leakage.

No. SIEM aggregates logs to detect incidents but does not actively scan for or assess vulnerabilities/misconfigurations like CSPM does.

CSPM secures the overall cloud configuration and posture, while CWPP protects specific workloads (servers/containers) from runtime threats.

Defender for Cloud Apps is a CASB that discovers SaaS usage and applies session or anomaly policies; it does not rewrite or detonate URLs inside email and Teams messages the way Safe Links does.

Yes. Safe Links covers email plus Microsoft Teams messages, channels, and supported Office apps, applying time-of-click verification so a link weaponized after delivery is still blocked.

Defender for Identity monitors Active Directory and identity signals, so it has no device onboarding or vulnerability data to compute a device hardening score.

No. The overall Microsoft Secure Score aggregates tenant-wide recommendations across services, while Secure Score for Devices is scoped to device configuration and lives in Defender for Endpoint.

Purview is where your own organization manages compliance settings like DLP, eDiscovery, and Compliance Manager; Microsoft's ISO certifications for its cloud services are published on the Service Trust Portal instead.

Independent audit reports, ISO/IEC 27001 and 27018 certificates, SOC 1/2/3 reports, FedRAMP packages, and regulatory compliance guides covering Microsoft cloud services.

Detection rules need data to analyze. You must connect data sources so telemetry flows into the workspace before rules can trigger.

No. While the workspace is the storage component, Sentinel requires active data connections via connectors to become operational.

Key Vault stores software-managed keys and secrets, while Managed HSM provides dedicated hardware modules for FIPS 140-2 Level 3 compliance.

No, it protects secrets and keys. General cyber threat protection is handled by services like Microsoft Defender for Cloud.

No. ARM templates should be stored in version control systems like GitHub or Azure DevOps. Key Vault is for sensitive data, not infrastructure code.

No. DDoS protection is handled by Azure DDoS Protection Standard, a networking service. Key Vault focuses on secret and key management.

No. A case is required to define the scope, manage permissions, and track the export process within the eDiscovery framework.

A hold preserves data to prevent deletion, while a case is the workspace used to search, review, and export that preserved data.

Endpoint DLP enforcement requires the Purview onboarding agent, which Microsoft documents only for Windows 10/11 and macOS, so Linux devices cannot receive Endpoint DLP policies.

No. Mobile platforms are handled by Intune app protection and Purview data protection policies, not by the Endpoint DLP device agent used for Windows and macOS.

No, DLP policies cannot be applied directly to Exchange Online public folders.

No, DLP policies cannot be scoped to Microsoft Viva Engage (Yammer) messages.

Standard SITs do not natively scan images. You would need Azure AI Vision or OCR services integrated to extract text from images before applying SITs.

Yes, PDFs are considered documents and are fully supported by sensitive information type classifiers for pattern matching and classification.

A VNet is the foundational isolated network environment, while an NSG is a set of security rules that control traffic flow within or between subnets in that VNet.

No, Azure primarily uses software-defined networking. While physical hardware exists, the segmentation logic is handled virtually through VNets and NSGs.

It refers to the entire user lifecycle: provisioning new access (get), reviewing existing permissions (keep), and removing access upon role change or termination (lose).

Yes, it is a capability within Microsoft Entra ID focused on managing identities and their access rights securely and efficiently.

Biometrics like fingerprints are typically used for device unlock or primary sign-in (Windows Hello). SSPR is a web-based process that relies on out-of-band channels like SMS, Email, or Push Notifications.

Yes, if configured. However, in this specific question's options, only SMS, App Notification, and Security Questions were listed as valid choices among the distractors.

B2B is for business-to-business collaboration where external users (partners/vendors) use their own organizational credentials. B2C is for consumer applications where users create personal accounts.

It is a feature within Microsoft Entra External ID, which is now part of the broader Microsoft Entra family of identity solutions.

Route Server uses BGP and incurs hourly costs. UDRs are free and sufficient for static internet routing.

When creating the UDR, the next hop type must be set to 'Virtual Appliance' pointing to the firewall's private IP.

Azure Monitor collects metrics but doesn't natively parse DDoS-specific signals like SYN floods without a dedicated provider like DDoS Protection feeding that data.

No, Packet Capture is a manual diagnostic tool for troubleshooting existing issues, not for automated real-time alerting.

It uses analytics rules and built-in correlation engines like Fusion to group related alerts into single incidents.

Fusion is a correlation engine that detects multi-stage attacks by correlating alerts across different data sources.

Sentinel is a SIEM/SOAR tool for centralized log analysis and threat hunting. Defender XDR is a unified platform for protecting endpoints, identity, email, and apps against attacks.

No, Sentinel does not replace endpoint antivirus. It aggregates logs from endpoints (like those protected by Defender) to provide broader visibility and automated response capabilities.

Bicep files are used for Infrastructure as Code to deploy Azure resources, not for managing compliance assessments or controls.

There is a library of over 360 regulatory standards and frameworks available as templates to help organizations align their compliance posture.

No, sensitivity labels focus on classifying and protecting data through encryption and access restrictions. They do not have the capability to mark an item as a regulatory record.

Retention labels are used to manage the lifecycle of content by specifying how long it should be retained and what actions to take after retention expires, including marking it as a regulatory record.