Microsoft Security, Compliance, and Identity Fundamentals (SC-900) practice questions

Domain coverage 4 domains

• Describe the concepts of security, compliance, and identity (10–15%)
• Describe the capabilities of Microsoft Entra (25–30%)
• Describe the capabilities of Microsoft security solutions (35–40%)
• Describe the capabilities of Microsoft compliance solutions (20–25%)

Sample questions 15 of 141 shown

1. Q1 Describe the concepts of security, compliance, and identity

   Which statement best describes the cloud shared responsibility model?

   1. The cloud provider is responsible for all security regardless of service model
   2. Security responsibilities are divided between the cloud provider and the customer based on the service model
   3. The customer is always responsible for the physical datacenter
   4. Responsibility shifts entirely to the customer once data is uploaded

   The shared responsibility model divides security responsibilities between the cloud provider and customer. The provider handles physical hosts, network, and datacenter. The customer always owns information and data, devices, and accounts/identities. Other responsibilities shift depending on whether the service is IaaS, PaaS, or SaaS.
2. Q2 Describe the concepts of security, compliance, and identity

   Under the shared responsibility model, who is ALWAYS responsible for information and data, devices, and accounts/identities?

   1. The cloud provider
   2. The customer
   3. It depends on the service model
   4. A neutral third party

   Across IaaS, PaaS, and SaaS, the customer always retains responsibility for information and data, devices (mobile and PCs), and accounts/identities. The cloud provider is always responsible for physical hosts, network, and datacenter.
3. Q3 Describe the concepts of security, compliance, and identity

   In the shared responsibility model for an Azure deployment, what is Microsoft solely responsible for managing?

   1. The management of mobile devices
   2. The permissions for the user data stored in Azure
   3. The creation and management of user accounts
   4. The management of the physical hardware

   Microsoft is always responsible for physical hosts, network, and datacenter in the shared responsibility model, regardless of service type.
4. Q4 Describe the concepts of security, compliance, and identity

   In the shared responsibility model for cloud security, which of the following is ALWAYS the responsibility of the customer, regardless of the cloud service model?

   1. Physical host security
   2. Network controls
   3. Operating system patching
   4. Data classification and accountability

   Data classification and accountability is always the customer's responsibility. Physical hosts are always the provider's responsibility. OS patching and network controls shift by service model.
5. Q5 Describe the concepts of security, compliance, and identity

   In infrastructure as a service (IaaS), managing the physical network is the responsibility of the cloud provider.

   1. Yes
   2. No

   The cloud provider is always responsible for the physical datacenter, physical network, and physical hosts regardless of service model.
6. Q6 Describe the concepts of security, compliance, and identity

   In all Azure cloud deployment types, managing the security of information and data is the responsibility of the organization.

   1. Yes
   2. No

   The customer is always responsible for their information and data, endpoints, and accounts/identities, regardless of deployment model (IaaS, PaaS, or SaaS).
7. Q7 Describe the concepts of security, compliance, and identity

   Your organization is migrating workloads to Azure using Platform as a Service (PaaS). Who is responsible for operating system security in a PaaS model?

   1. The customer is always responsible
   2. Microsoft is responsible for the operating system
   3. Responsibility is shared equally
   4. Neither party is responsible

   In PaaS, Microsoft manages the operating system, runtime, and middleware. The customer is responsible for applications and data.
8. Q8 Describe the concepts of security, compliance, and identity

   What is the core idea behind a defense in depth strategy?

   1. Rely on a single strong perimeter firewall
   2. Use multiple layers of security controls so no single failure exposes the asset
   3. Encrypt data only when it leaves the network
   4. Replace all on-premises controls with cloud-native ones

   Defense in depth uses a layered approach (physical, identity, perimeter, network, compute, application, data) so that if one control fails another still protects the asset.
9. Q9 Describe the concepts of security, compliance, and identity

   You plan to implement a security strategy and place multiple layers of defense throughout a network infrastructure. Which security methodology does this represent?

   1. Threat modeling
   2. Identity as the security perimeter
   3. Defense in depth
   4. The shared responsibility model

   Defense in depth places multiple layers of security controls throughout an IT infrastructure to protect assets from various attack vectors.
10. Q10 Describe the concepts of security, compliance, and identity

    Which three principles form the foundation of the Zero Trust model?

    1. Trust but verify, encrypt everything, audit annually
    2. Verify explicitly, use least privilege access, assume breach
    3. Build perimeter, monitor logs, patch systems
    4. Block by default, allow by exception, log everything

    The three Zero Trust guiding principles are: Verify Explicitly (always authenticate and authorize based on all available signals), Use Least Privilege Access (just-in-time and just-enough access), and Assume Breach (segment, encrypt, and use analytics).
11. Q11 Describe the concepts of security, compliance, and identity

    Which Zero Trust principle is best illustrated by network microsegmentation and end-to-end encryption?

    1. Verify explicitly
    2. Use least privilege access
    3. Assume breach
    4. Trust internal traffic

    Assume Breach drives the use of microsegmentation, end-to-end encryption, and continuous analytics. The premise is that an attacker may already be inside, so you limit blast radius.
12. Q12 Describe the concepts of security, compliance, and identity

    Which Zero Trust principle addresses limiting the impact of a breach?

    1. Verify explicitly
    2. Use least privilege access
    3. Assume breach
    4. Enable multi-factor authentication

    Assume Breach means designing security as if attackers are already in your environment, minimizing blast radius through segmentation, encryption, and analytics.
13. Q13 Describe the concepts of security, compliance, and identity

    Which three statements accurately describe the guiding principles of Zero Trust?

    1. Define the perimeter by physical locations
    2. Use identity as the primary security boundary
    3. Always verify the permissions of a user explicitly
    4. Always assume that the user system can be breached
    5. Use the network as the primary security boundary

    Zero Trust principles: identity is the primary security boundary (not the network perimeter), always verify explicitly, and assume breach.
14. Q14 Describe the concepts of security, compliance, and identity

    Which security model operates on the principle of 'never trust, always verify' and assumes that every request must be authenticated, authorized, and continuously validated?

    1. Defense in depth
    2. Zero Trust
    3. Least privilege access
    4. Perimeter-based security

    Zero Trust operates on 'never trust, always verify.' Every access request is authenticated, authorized, and continuously validated regardless of origin.
15. Q15 Describe the concepts of security, compliance, and identity

    What does the C in the CIA triad stand for?

    1. Compliance
    2. Confidentiality
    3. Continuity
    4. Cryptography

    The CIA triad consists of Confidentiality (protecting data from unauthorized disclosure), Integrity (preventing unauthorized modification), and Availability (ensuring authorized access when needed).

Answer all 141 questions with instant feedback →

Reader reviews 596 ratings

• Was on the fence about buying the SC-900 practice test, but man am I glad I did. Nailed my certification today.

  ★★★★★ Tyler M.

• SC-900 was harder than I expected but these questions prepared me well. The multi-select ones in particular were really close to the exam.

  ★★★★★★ Chloe D.

• My colleague recommended this for SC-900 and I’m glad I listened. Passed on my first go after two weeks of solid study.

  ★★★★★ Logan T.

• I used this alongside video courses for SC-900 prep. The questions helped solidify what I learned from the lectures.

  ★★★★★★ Aria N.

• I was struggling with SC-900 until I found this. The domain-based organization and instant feedback helped me identify weak areas quickly.

  ★★★★★★ David L.

• Used this SC-900 prep extensively for three weeks. The progress tracking feature kept me accountable.

  ★★★★★★ Violet W.

Frequently asked questions

Free study resources

Community-verified analysis of 23 questions from real test-taker discussions — 2 deep analyses and 0 FAQs.

More Microsoft exams