Chapter 1 of 4 · Microsoft SC-900
Security, Compliance and Identity Concepts
Shared responsibility, defense in depth, Zero Trust, encryption, GRC and identity.
- 3topics
- 15 minfast track
- 1diagrams and exhibits
- 10–15%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Shared Responsibility and Defense in DepthSC-900 shared responsibility model and defense in depth: what the customer and Microsoft each secure in IaaS, PaaS and SaaS, and…Diagram5 min
- 2Zero Trust, Encryption and GRCSC-900 Zero Trust, encryption and GRC: the three Zero Trust principles, symmetric and asymmetric encryption, hashing, and…5 min
- 3Identity ConceptsSC-900 identity concepts: identity as the security perimeter, authentication against authorization, identity providers, Active…5 min
About this chapter
What this chapter covers
This chapter sets out the ideas that every later chapter builds on. It explains who is responsible for what in the cloud, how layers of protection fit together, what Zero Trust means, how encryption and hashing protect data, and why identity is now the main security boundary.
It is the smallest domain on the exam, but its vocabulary appears in questions everywhere else, so it is worth learning well.
How the topics fit together
The pages move from the big security ideas to the specific idea of identity.
- Shared responsibility and defense in depth covers the split of duties with Microsoft and the seven layers of protection.
- Zero Trust, encryption and GRC covers the Zero Trust principles, how encryption and hashing work, and governance, risk and compliance.
- Identity concepts covers authentication, authorization, identity providers, directory services and federation.
The exam likes short definitions. For each term on these pages, be able to say it in one sentence and name one thing it is often confused with.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with examples and tables.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full Microsoft SC-900 question bank has 503 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.