SC-900 Study Guide (Free Practice Test & Detailed Explanation)

SC-900 Microsoft Security, Compliance, and Identity Fundamentals

Preparing for the SC-900 Microsoft Security, Compliance, and Identity Fundamentals exam? Don’t know where to start? This post is the SC-900 Certificate Study Guide (with links to each exam objective).

I have curated a list of articles from Microsoft documentation for each objective of the SC-900 exam. Please share the post within your circles so it helps them to prepare for the exam.

I cleared the SC-900 exam. View my verified credentials. I created a Udemy SC-900 Exam Questions course (Refer to the below table).

SC-900 Practice Test [MS Security & Identity]

SC-900 MS Security, Compliance & Identity Prep

Looking for SC-900 Dumps? Read This!

Using sc-900 exam dumps can get you permanently banned from taking any future Microsoft certificate exam. Read the FAQ page for more information. However, I strongly suggest you validate your understanding with practice questions.

To view other Azure Certificate Study Guides, click here

Full Disclosure: Some of the links in this post are affiliate links. I receive a commission when you purchase through them.

Describe the Concepts of Security, Compliance, and Identity (5-10%)

Describe Security Methodologies

Which of the following uses a layered approach to security to slow the advance of an attack?

a. Shared responsibility model

b. Zero-trust methodology

c. CIA model

d. Defense in depth

Explanation: Defense in depth uses a layered approach to security to reduce the chances of a successful attack. You can use different Azure services to safeguard access to your data/configuration at different layers (Refer to the below image).

Option Defense in depth is the correct choice.

Reference Link:https://docs.microsoft.com/en-us/learn/modules/describe-security-concepts-methodologies/4-describe-defense-depth

CIA refers to principles (Confidentiality, Integrity, Availability) that help define a security posture. CIA does not provide a layered approach to security although, each of the defense in depth layers (see above) implements a CIA principle.

For example, the Physical security layer implements the Confidentiality principle because it grants access only to authorized personnel.

The Identity & Access layer implements the Integrity principle because it gives access only after verifying who the user they claim to be.

And so on.

Option CIA model is incorrect.

Reference Link:https://docs.microsoft.com/en-us/learn/modules/azure-well-architected-security/2-defense-in-depth#defense-in-depth-a-layered-approach-to-security

https://docs.microsoft.com/en-us/learn/modules/describe-security-concepts-methodologies/4-describe-defense-depth#confidentiality-integrity-availability-cia

The Zero Trust assumes that everything (both inside and outside of your network perimeter) is an untrusted network. By trusting no one, we enhance security. It is an incorrect choice.

Reference Link: https://docs.microsoft.com/en-us/learn/modules/describe-security-concepts-methodologies/2-describe-zero-trust-methodology

The shared responsibility model identifies security tasks controlled by the cloud provider and the tasks handled by the organization (you). It is an incorrect choice too.

Reference Link: https://docs.microsoft.com/en-us/learn/modules/describe-security-concepts-methodologies/3-describe-shared-responsibility-model

This question is part of my Udemy course SC-900 Exam Questions. It is copyrighted and cannot be reproduced elsewhere without permission.

Describe Security Concepts

Azure certification Frequently Asked Questions

Describe Microsoft Security and Compliance Principles

Describe Microsoft’s privacy principles

Describe Microsoft’s privacy principles

Microsoft Privacy principles

Describe the offerings of the service trust portal

Introducing the Service Trust Portal

Service Trust Portal offering

Describe the Capabilities of Microsoft Identity and Access Management Solutions (25-30%)

Define Identity Principles/Concepts

Define identity as the primary security perimeter

Identity as the primary security perimeter

The 4 pillars of Identity

Define authentication

What is Authentication?

Define authorization

What is Authorization?

Authentication vs. Authorization

Describe what identity providers are

What is an identity provider (IdP)?

Identity Providers for external identities

Describe what Active Directory is

Understanding Active Directory

Describe the concept of Federated services

Federated services

A user wants to listen to music. So, he logs into the Spotify app with his Google account. See the below image for more details.

SC-900 Federated authentication

Based on the above scenario, which of the following is NOT True?

a. Azure AD used by Spotify trusts Google identity provider.

b. Google identity provider trusts Azure AD used by Spotify.

c. There is a trust relationship between Azure AD used by Spotify and Google.

d. The user does not need a separate username and password to log into Spotify.

Explanation: The above scenario is an example of a federation that enables the access of services across organizational/domain boundaries by establishing trust relationships between the identity providers of Spotify & Google.

Here is a step-by-step process of how this works:

  1. Spotify uses Azure AD authentication
  2. The user authenticates with Google
  3. Spotify has a trust relationship with Google.
  4. So, Spotify trusts the user and allows access.

In the above example, a trust relationship is configured between Spotify and Google. Spotify trusts Google. But the opposite isn’t true. That is, Google doesn’t trust Spotify unless that trust relationship is configured.

So, option b is the correct answer

Reference Link: https://docs.microsoft.com/en-us/learn/modules/describe-identity-principles-concepts/5-describe-concept-federated-services

This question is part of my Udemy course SC-900 Exam Questions. It is copyrighted and cannot be reproduced elsewhere without permission.

Describe the Basic Identity Services and Identity Types of Azure AD

Describe what Azure Active Directory is

What is Azure Active Directory?

Describe what is Azure Active Directory

Describe Azure AD identities (users, devices, groups, service principals/applications)

Describe Azure AD identity types

Describe what hybrid identity is

The concept of hybrid identities

Describe the different external identity types (Guest Users)

Describe the types of external identities

sc-900 Mastering Identity and Access Management with Microsoft Azure

Amazon link (affiliate)

Describe the Authentication Capabilities of Azure AD

In which of the following scenarios are Azure Active Directory security defaults recommended to use?

a. Organizations with Azure AD Premium licenses

b. Organizations with complex security requirements

c. Organizations using Conditional Access policies

d. Organizations that do not know how to approach security

Explanation: Security defaults provide default security settings that Microsoft manages to keep your identities safe until you are ready to manage your own identities.

They are best suited for small/midsize organizations that aren’t ready to manage complex security requirements. So, option Organizations that do not know how to approach security is the correct answer.

Reference Link:https://docs.microsoft.com/en-us/learn/modules/explore-authentication-capabilities/2-describe-different-authentication-methods#security-defaults-and-multifactor-authentication

The option Organizations with Azure AD premium licenses is incorrect as security defaults come with the free Azure AD tier. Azure AD premium users should try and implement Conditional Access.

Both security defaults and Conditional Access are similar in what they do. For example, both require Multi-Factor Authentication. But with Conditional Access, you can implement more granular & advanced security controls for MFA. For example, with Conditional Access, you can:

  • Require MFA only when specific signals warrant it.
  • Exclude specific users
  • Or allow access only to compliant devices

Generally, enterprise organizations have these advanced security requirements. They would do well with Conditional Access.

Option Organizations with complex security requirements is incorrect because such organizations would use Conditional Access, not security defaults.

Reference Link: https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults#conditional-access

Option Organizations using Conditional Access policies is incorrect because security defaults are a precursor to Conditional Access.

Organizations should first take advantage of the out-of-the-box security settings provided by security defaults. As their security requirements become more complex, they can manage their own identities with Conditional Access.

Moreover, both Conditional Access and security defaults are mutually exclusive. If you have security defaults enabled, you cannot create a conditional access policy and vice-versa.

Conditional Access Policies vs. Security Defaults

This question is part of my Udemy course SC-900 Exam Questions. It is copyrighted and cannot be reproduced elsewhere without permission.

SC-900 Practice Tests

Describe Access Management Capabilities of Azure AD

Describe what conditional access is

What is Conditional Access?

Describe uses and benefits of conditional access

Conditional access and its benefits

Security benefits of Conditional Access

Describe the benefits of Azure AD roles

What is Azure role-based access control (RBAC)?

Understand different roles

Describe the Identity Protection & Governance Capabilities of Azure AD

You create an access package in entitlement management and a set of resources to help onboard new team members.

Which of the following types of resources can you define in an access package (Select four options)?

a. Azure AD enterprise apps

b. SharePoint Online sites

c. Azure resources

d. Microsoft 365 groups

e. Microsoft 365 licenses

f. Azure AD security groups

Explanation: You define access packages in Azure AD entitlement management to automate access request workflows, access assignments & access expiration. This is important because, often, users (either new employees or ones with recent role changes) do not know what access they need and whom to request access.

SC-900 Access packages in Entitlement management

As seen in the image above, the following are the types of resources defined in an access package:

  • Membership to Azure AD security groups, Microsoft 365 groups
  • Access to Azure AD apps, SaaS apps
  • Access to SharePoint Online sites

Although you cannot directly manage access to Microsoft 365 licenses or Azure resources, you can create an Azure AD security group in the access package and:

  • Give access to users who need Microsoft 365 licenses (via group-based licensing).
  • Create an Azure role assignment for that group

If it is difficult to understand, the below image will help.

SC-900 exam questions Access packages Entitmenent Management

So, options a,b,d,f are the correct answers.

Reference Link:

https://docs.microsoft.com/en-us/learn/modules/describe-identity-protection-governance-capabilities/3-describe-what-entitlement-management-access-reviews (check the video)

https://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-overview#what-are-access-packages-and-what-resources-can-i-manage-with-them

This question and the detailed explanation are part of my course SC-900 Exam Questions. It is copyrighted and cannot be reproduced elsewhere without permission.

Describe the Capabilities of Microsoft Security Solutions (30-35%)

Describe Basic Security Capabilities in Azure

Drag & match the appropriate Azure resources on the left column to its corresponding use case on the right

Microsoft Security Solutions

a.

Network security groups -> Filters Virtual Network traffic

Web Application Firewall -> Safeguards from SQL injection attacks

Azure Firewall -> Protects your VNet resources

Azure Bastion -> RDP connectivity from Azure portal

b.

Network security groups -> Protects your VNet resources

Web Application Firewall -> RDP connectivity from Azure portal

Azure Firewall -> Filters Virtual Network traffic

Azure Bastion -> Safeguards from SQL injection attacks

c.

Network security groups -> RDP connectivity from Azure portal

Web Application Firewall -> Protects your VNet resources

Azure Firewall -> Safeguards from SQL injection attacks

Azure Bastion -> Filters Virtual Network traffic

d.

Network security groups -> Safeguards from SQL injection attacks

Web Application Firewall -> RDP connectivity from Azure portal

Azure Firewall -> Filters Virtual Network traffic

Azure Bastion -> Protects your VNet resources

Explanation: The correct answer is the option:

Network security groups -> Filters Virtual Network traffic

Web Application Firewall -> Safeguards from SQL injection attacks

Azure Firewall -> Protects your VNet resources

Azure Bastion -> RDP connectivity from Azure portal

Detailed Explanation:

A Network Security Group (NSG) contains security rules that filter (allow/deny) inbound/outbound traffic to Azure resources in an Azure Virtual Network. Below, you can see default security rules in an NSG.

Network Security Group

Reference Link: https://docs.microsoft.com/en-us/learn/modules/describe-basic-security-capabilities-azure/2-describe-azure-network-security-groups

Web Application Firewall (WAF) provides centralized protection of your web apps from common exploits like SQL injection and cross-site scripting.

WAF is not a standalone resource. It is generally deployed with Application Gateway/Front Door.

In the below image, we create a WAF policy for Azure Application Gateway. Within the policy, you can find managed rules for common attacks like SQL Injection (highlighted) and XSS.

Reference Link: https://docs.microsoft.com/en-us/learn/modules/describe-basic-security-capabilities-azure/6-describe-what-web-application-firewall

While WAF for Application Gateway protects http/s protocols (only inbound), Azure Firewall protects non-HTTP protocols for both inbound and outbound connections. For example, Virtual Network resources.

Reference Link: https://docs.microsoft.com/en-us/learn/modules/describe-basic-security-capabilities-azure/4-describe-what-azure-firewall

Azure Firewall vs. WAF

Azure Bastion service lets you securely connect to a VM from the Azure portal with a browser. Refer to the below image.

Azure Bastion

Reference Link: https://docs.microsoft.com/en-us/learn/modules/describe-basic-security-capabilities-azure/5-describe-what-azure-bastion

This question and the detailed explanation are part of my course SC-900 Exam Questions. It is copyrighted and cannot be reproduced elsewhere without permission.

Describe Security Management Capabilities of Azure

Describe the Azure Security center

What is Azure Security Center?

Explore Azure Security center

Describe Azure Secure score

Secure score in Azure Security Center

Explore Azure Secure score

Describe the benefit and use cases of Azure Defender – previously the Cloud Workload Protection Platform (CWPP)

Benefits & use cases of Azure Defender

Benefits of Azure Defender for servers

Where can you enable Azure Defender in the Azure portal?

SC-900 Azure Defender

a. Advisor

b. Azure AD Security

c. Security Center

d. Azure Sentinel

Explanation: Microsoft offers a layered approach to security.

  • A base layer – Only Azure Security Center (free, basic level of protection)
  • An advanced layer – Azure Security Center with Azure Defender (paid, advanced protection with features like Just in time access, Adaptive application controls, vulnerability assessment, etc.)

Reference Link:https://techcommunity.microsoft.com/itops-talk-blog/whats-the-difference-between-azure-security-center-azure

You access Azure Defender from Azure Security Center. You get the below screen only after upgrading.

SC-900 Exam Azure Defender

Security Center is the correct choice.

This question is part of my Udemy course SC-900 Exam Questions. It is copyrighted and cannot be reproduced elsewhere without permission.

Describe Security Capabilities of Azure Sentinel

Microsoft Azure Sentinel is a scalable, cloud-native SIEM/SOAR solution. What do the acronyms stand for?

a. Security Incident Event Management (SIEM), Security Orchestration Autonomous Response (SOAR)

b. Security Information Event Management (SIEM), Security Orchestration Automated Response (SOAR)

c. Security Incident Event Management (SIEM), Security Orchestration Automated Response (SOAR)

d. Security Information Event Management (SIEM), Security Orchestration Autonomous Response (SOAR)

Explanation: SIEM(Security Information Event Management) is a centralized collection point for all the log entries generated by your infrastructure, resources, devices, firewall, and endpoints. It then correlates these logs to generate alerts and notifies the administrator.

SOAR (Security Orchestration Automated Response) takes these alerts and automates your threat response (with playbooks). So, SOAR decreases the incident response time.

Azure Sentinel SIEM SOAR solution

In a nutshell, SIEM raises an alert if it detects a malicious activity. SOAR deals with the alerts (including false positives) and prepares an automated response.

So, option b is the correct answer

Reference Link:https://docs.microsoft.com/en-us/azure/sentinel/overview

This question is part of my Udemy course SC-900 Exam Questions. It is copyrighted and cannot be reproduced elsewhere without permission.

Describe the role and value of Azure Sentinel to provide integrated threat protection

How Sentinel provides integrated threat protection?

Integrated threat protection with SIEM and XDR

Describe Threat Protection with Microsoft 365 Defender (Formerly Microsoft Threat Protection)

Describe Microsoft 365 Defender services

Microsoft 365 Defender services

Microsoft 365 Defender overview

Describe Microsoft Defender for Identity (formerly Azure ATP)

What is Microsoft Defender for Identity?

Microsoft Defender for Identity

Describe Microsoft Defender for Office 365 (formerly Office 365 ATP)

Microsoft Defender for Office 365

Microsoft Defender for Office 365 overview

Describe Microsoft Defender for Endpoint (formerly Microsoft Defender ATP)

What is Microsoft Defender for Endpoint?

Microsoft Defender for Endpoint

This question requires you to select the correct answer from the dropdown.

is a feature in Microsoft Defender for Endpoint that helps you proactively detect threats

a. Network protection

b. Advanced Hunting

c. Next-gen protection

d. Automated investigation

Explanation: Microsoft Defender for Endpoint offers several features that may be important from an exam point of view. The below video summarizes all of them.

Reference Link:https://www.youtube.com/watch?v=DjleZHwjxsE

Advanced Hunting is the correct choice, as it helps you write queries that proactively hunt for threats.

sc-900 Advanced Hunting

Reference Link: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/advanced-hunting-overview

Network protection reduces the surface attack of your devices from external attacks. It is incorrect.

Reference Link: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/network-protection

Your security team does not have time to investigate every alert from endpoints. Automated investigation runs multiple AI-based playbooks to examine and handle the threats. Option Automated investigation is an incorrect choice.

Reference Link: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/automated-investigations

Microsoft Defender for Antivirus is the next-generation protection component of Defender for Endpoint. Option Next-gen protection is incorrect too.

Reference Link: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-in-windows-10

To help you understand all the myriad of capabilities & features in Microsoft Defender for Endpoint, I created this image. It will help answer other queries related to Defender for Endpoint.

Defender for Endpoint

This question is part of my Udemy course SC-900 Exam Questions. It is copyrighted and cannot be reproduced elsewhere without permission.

Describe Security Management Capabilities of Microsoft 365

Describe Endpoint Security with Microsoft Intune

Describe what Intune is

What is Intune?

Microsoft Intune overview

Describe endpoint security with Intune

What is endpoint security with Intune?

Manage endpoint security in Microsoft Intune

Describe the endpoint security with the Microsoft Endpoint Manager admin center

Microsoft Endpoint Manager overview

Walkthrough Intune in Microsoft Endpoint Manager

Describe the Capabilities of Microsoft Compliance Solutions (25-30%)

Describe the Compliance Management Capabilities in Microsoft

When you log in to the Microsoft 365 compliance center as a compliance data administrator, which of the following compliance solution areas would you see in the Solutions catalog (Select any three options)?

Microsoft 365 Compliance center Solution Catalog

a. Communication compliance

b. Information protection & governance

c. Insider risk management

d. Data loss prevention

e. Discovery & response

f. Advanced eDiscovery

Explanation: Microsoft 365 solutions catalog helps you discover compliance & risk management solutions available to your organization.

The solutions catalog is organized into three compliance solution areas. Each solution area contains information on several compliance solutions.

See the below infographic for more details.

Microsoft 365 Solutions Catalog Classification

As evident, Insider risk management, Information protection& governance, and Discovery & responseare the only three compliance solution areas.

Data loss prevention is a compliance solution within the Information protection & governance solution area.

Advanced eDiscovery is a compliance solution within the Discovery & response solution area.

And Communication compliance is a compliance solution within the Insider risk management solution area.

data loss prevention Solution catalog Microsoft compliance center

ediscovery microsoft compliance center

Finally, the role compliance data manager doesn’t make any difference. All three roles (Global administrator, Compliance administrator, Compliance data administrator) get the same user experience when they access Microsoft Compliance Center.

Reference Link: https://docs.microsoft.com/en-us/microsoft-365/compliance/microsoft-365-solution-catalog?view=o365-worldwide

https://docs.microsoft.com/en-us/learn/modules/describe-compliance-management-capabilities-microsoft/3-describe-compliance-center

This question is part of my Udemy course SC-900 Exam Questions. It is copyrighted and cannot be reproduced elsewhere without permission.

Describe Information Protection and Governance Capabilities of Microsoft 365

Your teammate creates a retention label for applying to documents in OneDrive. He needs to ensure that no one can remove the label. He is presented with the following retention settings screen while creating the label.

Records management - set as record

Per the requirement, is he good to create the label?

a. Yes

b. No

Explanation: This question has several layers, so let’s uncover them

First, only the retention labels that mark content as a regulatory record cannot be removed by anyone, even the global administrator.

Reference Link:https://docs.microsoft.com/en-us/microsoft-365/compliance/records-management?view=o365-worldwide#compare-restrictions-for-what-actions-are-allowed-or-blocked

But, as evident from the image, your teammate can only create a retention label that marks items as records, not regulatory records.

Mark items as record

That’s because this is the default interface when trying to create retention labels under Records management (See the below image).

records management default

You don’t see the option to mark items as regulatory records because applying regulatory records to content is far more restrictive than applying records (Refer to the table in the above link).

Since Microsoft wants you to be sure about marking content as regulatory records before you do so, they require you to perform an extra step to display that option in the UI:

· Connect to the Office 365 Security & Compliance Center PowerShell

· Run a PowerShell command (details on them below)

After you perform these steps, you can see the option to mark items as a regulatory record

Records management - set as regulatory record

Per the requirement in the question, he cannot create a label that no one can delete. The correct answer isNo.

Reference Link:https://docs.microsoft.com/en-us/learn/modules/describe-information-protection-governance-capabilities-microsoft-365/7-describe-records-management

If you are curious about connecting to PowerShell and executing the command to display the option, continue reading.

First, install the PowerShell module Exchange Online Management by running this command:

Install-Module -Name ExchangeOnlineManagement

Reference Link: https://powershellgallery.com/packages/Exchange-OnlineManagement/2.0.4

And run the following PowerShell commands on your system:

Import the module

Import-Module ExchangeOnlineManagement

Specify username and password to connect to Microsoft 365 compliance in the window prompt

$UserCredential = Get-Credential

Connect to your Compliance center

Connect-IPPSSession -Credential $UserCredential

Command that enables the display mark content as regulatory records

Set-RegulatoryComplianceUI -Enabled $true

Reference Link:

https://docs.microsoft.com/en-us/powershell/exchange/connect-to-scc-powershell?view=exchange-ps#connect-to-security–compliance-center-powershell-using-modern-authentication (For connecting to Compliance center with PowerShell)

https://docs.microsoft.com/en-us/microsoft-365/compliance/declare-records?view=o365-worldwide#how-to-display-the-option-to-mark-content-as-a-regulatory-record (PowerShell command to display the option to mark content as a regulatory record)

This question is part of my Udemy course SC-900 Exam Questions. It is copyrighted and cannot be reproduced elsewhere without permission.

Describe Insider Risk Capabilities in Microsoft 365

Read the following two statements and select whether they are TRUE/FALSE.

i. Conditional Access policies are not required for administrator roles.
True False

ii. Conditional Access policies can trigger MFA if the user attempts to access the Azure portal.
True False

a. (i) – TRUE, (ii) – FALSE

b. (i) – TRUE, (ii) – TRUE

c. (i) – FALSE, (ii) – FALSE

d. (i) – FALSE, (ii) – TRUE

Explanation: Both PIM (Privileged Identity Management) and PAM (Privileged Access Management) provide time-bound, just-in-time access to do the job.

But,

  • PIM is defined at the role level, and,
  • PAM is defined at the task level.

For example, for PIM:

SC-900 Privileged Identity Management

For PAM:

SC-900 Privileged Access Management (PAM)

It is easy to remember.

(Privileged Identity Management) Identity -> Roles.

(Privileged Access Management) Access -> Tasks.

Both the given statements are swapped for each other. Both are FALSE statements.

So, the correct option is (i) – FALSE, (ii) – FALSE

Reference Link: https://docs.microsoft.com/en-us/learn/modules/describe-insider-risk-capabilities-microsoft-365/5-describe-privileged-access-management

This question is part of my Udemy course SC-900 Exam Questions. It is copyrighted and cannot be reproduced elsewhere without permission.

Describe the ediscovery Capabilities of Microsoft 365

Describe the Audit Capabilities in Microsoft 365

Describe the core audit capabilities of M365

What are the core audit capabilities of Microsoft 365?

Describe the purpose and value of Advanced Auditing

Advanced audit in Microsoft 365

The purpose and value of Advanced Auditing

Describe Resource Governance Capabilities in Azure

This brings us to the end of the SC-900 Microsoft Security, Compliance, and Identity Fundamentals exam study guide.

What do you think? Let me know in the comments section if I have missed out on anything. Also, I love to hear from you how your preparation is going on!

In case you are looking for other Azure certification exams check out this page

Follow Me to Receive Updates on SC-900 Exam

Want to be notified as soon as I post? Subscribe to RSS feed / leave your email address in the subscribe section. Share the article to your social networks with the below links so it can benefit others.

Share the SC-900 Study Guide in Your Network

  •  
  •  
  •  
  •  
  •  
  •  

You may also like