Microsoft SC-900 Practice Exam

• A. Network controls
• B. Host operating system patching
• C. Information and data Correct answer
• D. Physical datacenter security

Option C is correct because information and data (along with identities and users, and configurations and settings) is always the customer's responsibility, whatever the service model. Client devices are also the customer's, except in SaaS, where they are shared. Network controls and host OS patching shift to Microsoft as you move toward SaaS, and physical datacenter security is always Microsoft's.

• A. Defense in depth
• B. Least privilege
• C. Perimeter security
• D. Zero Trust Correct answer

Option D is correct because Zero Trust assumes no request is trustworthy by default and verifies every request explicitly before granting access (never trust, always verify). Defense in depth is layered protection, least privilege limits access rights, and perimeter security trusts anything inside the network boundary.

• A. Hashing
• B. Symmetric Correct answer
• C. Asymmetric
• D. Digital signing

Option B is correct because symmetric encryption uses one shared secret key for both encryption and decryption. Asymmetric encryption uses a public/private key pair, while hashing is one-way and digital signing relies on key pairs to prove origin and integrity.

• A. Data residency Correct answer
• B. Data classification
• C. Data sovereignty
• D. Data retention

Option A is correct because data residency describes the geographic location where data is physically stored. Data sovereignty is about the laws of the country that apply to that data, classification is about sensitivity labels, and retention is about how long data is kept.

• A. Encryption
• B. Monitoring
• C. Infrastructure Correct answer
• D. Compliance
• E. Data Correct answer

Options C and E are correct because Microsoft's Zero Trust model spans six foundational elements: identities, devices, applications, data, infrastructure and networks. Infrastructure and Data are two of them. Encryption, Monitoring and Compliance are practices or outcomes, not one of the six elements.

• A. Hybrid identity
• B. Managed identity Correct answer
• C. Registered device identity
• D. Guest user account

Option B is correct because a managed identity gives an Azure resource such as a virtual machine an identity in Microsoft Entra ID, so it can get tokens for Key Vault with no secret in code. Hybrid identity, device registration and guest accounts do not give a workload a credential-free identity.

• A. Microsoft Entra Verified ID
• B. Microsoft Entra Domain Services
• C. Microsoft Entra B2B collaboration Correct answer
• D. Microsoft Entra Connect cloud sync

Option C is correct because Microsoft Entra B2B collaboration lets external users sign in with their own work accounts and be invited as guests, so no new passwords are created in the tenant. Verified ID, Domain Services and Connect cloud sync do not provide guest access to a SharePoint site.

• A. Domain controllers deployed on Azure virtual machines
• B. Microsoft Entra Domain Services managed domain Correct answer
• C. Microsoft Entra Application Proxy with Kerberos delegation
• D. Microsoft Entra Connect Sync with an on-premises AD DS forest

Option B is correct because Microsoft Entra Domain Services provides a managed domain with LDAP and Kerberos, using accounts synchronized from Entra ID, with no domain controllers to build or patch. Self-built domain controllers need that maintenance, and Application Proxy and Connect Sync do not provide LDAP/Kerberos for VMs.

• A. Reset their own password after verifying identity Correct answer
• B. Register their own devices in the tenant
• C. Activate an eligible administrator role for themselves
• D. Request access to groups and apps through access packages

Option A is correct because self-service password reset lets users reset or change their own password after verifying their identity, which reduces help-desk calls. Registering devices, activating roles and requesting access packages are handled by other features.

• A. Microsoft Entra Domain Services
• B. Self-service password reset
• C. Access reviews Correct answer
• D. Entitlement management Correct answer
• E. Password protection

Options C and D are correct because access reviews and entitlement management are core Microsoft Entra ID Governance capabilities for controlling who has access and for how long. Microsoft Entra Domain Services provides managed domain services, while self-service password reset and password protection are authentication and password-hygiene features, not governance.

• A. Azure DDoS Protection Correct answer
• B. Azure Bastion
• C. Network security groups
• D. Azure Firewall

Option A is correct because Azure DDoS Protection defends public IP addresses against volumetric and protocol network-layer attacks. Azure Bastion provides secure remote access, network security groups filter traffic by rules, and Azure Firewall filters traffic but is not the DDoS mitigation service.

• A. Inspection of inbound web requests for SQL injection patterns
• B. Browser-based RDP and SSH to VMs without public IP addresses Correct answer
• C. Storage of secrets and certificates for applications
• D. Encryption of VM disks with customer-managed keys

Option B is correct because Azure Bastion gives browser-based RDP and SSH access to virtual machines over TLS without exposing public IP addresses. Inspecting web requests for SQL injection is a web application firewall task, secrets storage is Key Vault, and disk encryption is a separate feature.

• A. Azure Policy
• B. Azure Key Vault Correct answer
• C. Microsoft Entra Privileged Identity Management
• D. Microsoft Defender for Cloud

Option B is correct because Azure Key Vault securely stores secrets, certificates and keys and uses access policies or Azure RBAC to control which identities can retrieve them. Azure Policy enforces governance rules, Privileged Identity Management manages just-in-time role elevation, and Defender for Cloud assesses security posture.

• A. Azure DDoS Protection
• B. Azure Firewall network rules
• C. Azure Web Application Firewall Correct answer
• D. Network security group rules

Option C is correct because Azure Web Application Firewall on Application Gateway inspects HTTP(S) requests and blocks common web attacks such as SQL injection. DDoS Protection handles volumetric attacks, and Azure Firewall network rules and NSG rules filter by IP, port and protocol without inspecting request content.

• A. EDR (endpoint detection and response)
• B. CSPM (cloud security posture management for multicloud)
• C. SOAR (security orchestration, automation, and response) Correct answer
• D. SIEM (security information and event management) Correct answer
• E. CASB (cloud access security broker for SaaS apps)

Options C and D are correct because Microsoft Sentinel is a cloud-native SIEM that also provides SOAR through automation rules and playbooks. EDR is delivered by Defender for Endpoint, CSPM by Defender for Cloud, and CASB by Defender for Cloud Apps, so A, B and E do not describe Sentinel.

• A. Microsoft Purview Audit
• B. Microsoft Service Trust Portal Correct answer
• C. Microsoft Defender for Cloud regulatory compliance dashboard
• D. Microsoft Purview Compliance Manager

Option B is correct because the Microsoft Service Trust Portal is where customers download independent audit reports, certifications and compliance guides for Microsoft cloud services. Purview Audit records user and admin activity in a tenant, Defender for Cloud's regulatory dashboard assesses your own resources, and Compliance Manager scores your own compliance posture; none of them host Microsoft's third-party audit reports.

• A. Microsoft challenges government demands for customer data
• B. Customer email and files are not used to target advertising
• C. Customers decide how their data is collected and used Correct answer
• D. Microsoft explains what data it collects and why

Option C is correct because the Control principle means customers decide how their data is collected and used. Challenging government demands is Strong legal protections, not using email and files for advertising is No content-based targeting, and explaining what is collected and why is Transparency.

• A. Control
• B. No content-based targeting
• C. Transparency
• D. Strong legal protections Correct answer

Option D is correct because contesting government demands for customer data and respecting local privacy laws is the Strong legal protections principle. Control is about customers choosing how their data is used, Transparency is about explaining what is collected, and No content-based targeting is about not using customer content for advertising.

• A. Progress toward improving security posture through recommended security actions
• B. The number of risky user activities detected in the past week
• C. The share of tenant content that carries a sensitivity label
• D. Progress toward completing actions that satisfy regulatory control requirements Correct answer

Option D is correct because the Compliance Manager compliance score measures progress toward completing the improvement actions that satisfy regulatory control requirements. Option A describes Microsoft Secure Score, which tracks security posture, while B and C describe activity risk and labeling coverage, which are not what the compliance score measures.

• A. A sensitive information type linked to the action
• B. The test status of the action Correct answer
• C. An eDiscovery hold on the action's owner
• D. Evidence files showing the action is in place Correct answer
• E. A retention label that protects the evidence

Options B and D are correct because a customer-managed improvement action in Compliance Manager records its implementation and test status and holds the evidence files that show the control is in place. Sensitive information types, eDiscovery holds and retention labels are separate Purview capabilities and are not fields on an improvement action.