Free Exam SC-900: Microsoft Security, Compliance, and Identity Fundamentals Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Exam SC-900: Microsoft Security, Compliance, and Identity Fundamentals practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An organization runs a virtual machine in an IaaS environment. Who is responsible for securing its guest operating system?

   1. A. The customer that operates the virtual machine
   2. B. The cloud provider that owns the physical host
   3. C. The datacenter operator that controls the building
   4. D. The hardware supplier that manufactures the server

   Answer: A

   Explanation: Microsoft states: "You're responsible for the operating systems, applications, network controls you configure, and your data." Guest operating-system security remains with the IaaS customer; physical hosting does not transfer that responsibility.

   Reference: Describe the shared responsibility model — Shared responsibility in the cloud — IaaS

2. 2What does a Microsoft Entra tenant represent in an organization's identity infrastructure?

   1. A. A collection of subnets that isolates network traffic
   2. B. An instance of Entra ID serving as an organization's identity boundary
   3. C. A license that assigns one user access to Microsoft 365
   4. D. A physical server that hosts an on-premises domain controller

   Answer: B

   Explanation: Microsoft states: "A Microsoft Entra tenant is an instance of Microsoft Entra ID in which information about a single organization resides including organizational objects such as users, groups, devices, and application registrations." The tenant holds an organization's identity objects and policies and serves as its security and administrative boundary. It is not a subnet, per-user license, or physical domain controller.

   Reference: Describe Microsoft Entra ID — Basic terminology — Tenant

3. 3Which Azure service is designed to detect and mitigate network and transport layer floods against protected public endpoints?

   1. A. Azure Key Vault
   2. B. Azure Bastion
   3. C. Azure DDoS Protection
   4. D. Azure Web Application Firewall

   Answer: C

   Explanation: Microsoft states: "Azure DDoS Protection drops attack traffic and forwards the remaining traffic to its intended destination." DDoS Protection analyzes and mitigates layer 3 and 4 attack traffic. WAF focuses on web application traffic; Bastion and Key Vault address remote access and secrets.

   Reference: Describe Azure DDoS protection — What is Azure DDoS Protection?

4. 4An organization wants independent audit reports about Microsoft's cloud service controls. Which resource is intended to provide those reports?

   1. A. The Microsoft Defender incidents queue
   2. B. The Entra access reviews page
   3. C. The Microsoft Service Trust Portal
   4. D. The Azure resource deployment history

   Answer: C

   Explanation: Microsoft states: "STP users can download audit reports produced by external auditors" STP publishes external audit reports and compliance information about Microsoft's services. Operational incident, access-review, and deployment records serve different evidence needs.

   Reference: Describe the offerings of the Service Trust portal — Introduction

5. 5Why does a defense-in-depth strategy use overlapping security controls?

   1. A. To make the network perimeter the sole trust boundary
   2. B. To let remaining layers protect resources if one control fails
   3. C. To replace application security with physical security
   4. D. To make every security layer enforce identical checks

   Answer: B

   Explanation: Microsoft states: "When multiple layers are in place, the failure of one layer doesn't immediately lead to a breach." Independent layers provide additional barriers. The strategy does not rely on a sole perimeter, replace other layers, or require identical controls.

   Reference: Describe defense in depth — Why layered defense matters

6. 6Which identity category represents an automated service that authenticates to an API without an interactive human sign-in?

   1. A. A guest user identity
   2. B. A member user identity
   3. C. A registered device identity
   4. D. A workload identity

   Answer: D

   Explanation: Microsoft states: "A workload identity is an identity you assign to a software workload to enable it to authenticate to and access other services and resources." The requesting actor is software. Human user identities and identities representing hardware are different categories.

   Reference: Describe types of identities — Workload identities

7. 7Which Azure capability provides a managed, centralized firewall for routed network traffic, including outbound application-rule filtering by FQDN?

   1. A. Azure Firewall
   2. B. A network security group
   3. C. Azure Bastion
   4. D. Azure DDoS Protection

   Answer: A

   Explanation: Microsoft states: "Azure Firewall can filter traffic based on the application-layer protocols such as HTTP/S. This means you can control access to fully qualified domain names (FQDNs)." Azure Firewall supports centralized network and application filtering, including outbound FQDN controls. NSGs filter network tuples; Bastion provides remote administration and DDoS Protection mitigates traffic floods.

   Reference: Describe Azure Firewall — Introduction; Key features — Network and application level filtering

8. 8How can a Service Trust Portal user receive email updates for selected documents?

   1. A. Save documents to My Library and configure its notification settings
   2. B. Download documents locally without subscribing through My Library
   3. C. Save documents to My Library while leaving its email notifications disabled
   4. D. Bookmark document links in a browser instead of configuring My Library alerts

   Answer: A

   Explanation: Microsoft states: "the notifications feature lets you configure your My Library so that an email message is sent to you whenever Microsoft updates a document that you've added to your My Library." The My Library notification feature sends document-update email when configured. A local download, a browser bookmark, or library storage with email notifications disabled does not set up that subscription.

   Reference: Describe the offerings of the Service Trust portal — My Library

9. 9Which access decision illustrates the Zero Trust principle of verifying explicitly?

   1. A. Trusting requests because they originate inside the office
   2. B. Treating a successful password check as permanent trust
   3. C. Evaluating identity, device health, and sign-in risk together
   4. D. Granting broad access because the user previously signed in

   Answer: C

   Explanation: Microsoft states: "Always authenticate and authorize based on all available signals, not just a single factor like a password or network location." Multiple relevant signals inform verification. Network location, a password alone, and a previous sign-in do not establish default trust.

   Reference: Describe the Zero Trust model — Zero Trust guiding principles — Verify explicitly

10. 10What is a key benefit of using a managed identity for an Azure application that accesses a resource supporting Entra authentication?

    1. A. Developers do not need to store and rotate that identity's credentials
    2. B. The application receives permission to every resource in the tenant
    3. C. The application can connect without any identity authentication
    4. D. Developers can reuse a user's password as the application secret

    Answer: A

    Explanation: Microsoft states: "Managed identities are automatically managed in Microsoft Entra ID and eliminate the need for developers to manage credentials." Credential management is handled by the platform. A managed identity still authenticates and requires appropriate permissions.

    Reference: Describe types of identities — Managed identities