SC-900 Study Guide (Free Practice Test & Detailed Explanation)

SC-900 Microsoft Security, Compliance, and Identity Fundamentals

SC-900 Preparation Details

Preparing for the SC-900 Microsoft Security, Compliance, and Identity Fundamentals exam? Don’t know where to start? This post is the SC-900 Certificate Study Guide (with links to each exam objective).

I have curated a list of articles from Microsoft documentation for each objective of the SC-900 exam. Please share the post within your circles so it helps them to prepare for the exam.

I cleared the SC-900 exam. View my verified credentials. I created a Udemy SC-900 Exam Questions course (Refer to the below table).

SC-900 Practice Test [MS Security & Identity]

Udemy Practice Tests 160+ Exam Questions [with Discount Coupon]
Amazon e-book (PDF) Master Azure Identity & Access Management

SC-900 MS Security, Compliance & Identity Prep

Pluralsight Microsoft Security, Compliance, and Identity
LinkedIn Learning (Free trial) Implement Security and Threat Management
Udemy MS Security, Compliance, Identity Basics

SC-900 Sample Exam Questions

SC-900 Microsoft Security, Compliance, and Identity Fundamentals

Looking for SC-900 Dumps? Read This!

Using sc-900 exam dumps can get you permanently banned from taking any future Microsoft certificate exam. Read the FAQ page for more information. However, I strongly suggest you validate your understanding with practice questions.

Check out all the other Azure certificate study guides

Full Disclosure: Some of the links in this post are affiliate links. I receive a commission when you purchase through them.

Describe the Concepts of Security, Compliance, and Identity (10-15%)

Describe Security and Compliance Concepts & Methodologies

Describe the Zero-Trust methodology

Zero-trust methodology

Describe the shared responsibility model

Shared responsibility model

Define defense in depth

Defense in depth


Test your knowledge on Defense in depth

Q] Which of the following uses a layered approach to security to slow the advance of an attack?

  1. Shared responsibility model
  2. Zero-trust methodology
  3. CIA model
  4. Defense in depth

Explanation: Defense in depth uses a layered approach to security to reduce the chances of a successful attack. You can use different Azure services to safeguard access to your data/configuration at different layers (Refer to the below image).

Defense in Depth

Option Defense in depth is the correct choice.

Reference Link: https://docs.microsoft.com/en-us/learn/modules/describe-security-concepts-methodologies/4-describe-defense-depth

CIA refers to principles (Confidentiality, Integrity, Availability) that help define a security posture. CIA does not provide a layered approach to security although, each of the defense-in-depth layers (see above) implements a CIA principle.

For example, the Physical security layer implements the Confidentiality principle because it grants access only to authorized personnel.

The Identity & Access layer implements the Integrity principle because it gives access only after verifying who the user they claim to be.

And so on.

Option CIA model is incorrect.

Reference Link: https://docs.microsoft.com/en-us/learn/modules/azure-well-architected-security/2-defense-in-depth#defense-in-depth-a-layered-approach-to-security

https://docs.microsoft.com/en-us/learn/modules/describe-security-concepts-methodologies/4-describe-defense-depth#confidentiality-integrity-availability-cia

The Zero Trust assumes that everything (both inside and outside of your network perimeter) is an untrusted network. By trusting no one, we enhance security. It is an incorrect choice.

Reference Link: https://docs.microsoft.com/en-us/learn/modules/describe-security-concepts-methodologies/2-describe-zero-trust-methodology

The shared responsibility model identifies security tasks controlled by the cloud provider and the tasks handled by the organization (you). It is an incorrect choice too.

Reference Link: https://docs.microsoft.com/en-us/learn/modules/describe-security-concepts-methodologies/3-describe-shared-responsibility-model

This question is part of my Udemy course SC-900 Exam Questions. It is copyrighted and cannot be reproduced elsewhere without permission.


Describe common threats

Understanding malware & other threats

10 common security threats in the enterprise

Describe encryption

What is encryption, and how does it work?

Encryption hashing and signing

Describe cloud adoption framework

Microsoft Cloud Adoption Framework for Azure

What is the cloud adoption framework?

Azure certification Frequently Asked Questions

Define Identity Concepts

Define identity as the primary security perimeter

Identity as the primary security perimeter

The 4 pillars of Identity

Define authentication

What is Authentication?

Define authorization

What is Authorization?

Authentication vs. Authorization

Describe what identity providers are

What is an identity provider (IdP)?

Identity Providers for external identities

Describe what Active Directory is

Understanding Active Directory

Describe the concept of Federated services

Federated services


Test your knowledge on Federated services

Q] A user wants to listen to music. So, he logs into the Spotify app with his Google account. See the below image for more details.

SC-900 Federated authentication

Based on the above scenario, which of the following is NOT True?

  1. Azure AD used by Spotify trusts Google
  2. Google trusts Spotify’s Azure AD
  3. There is a trust relationship between Spotify’s Azure AD & Google
  4. The user does not need a separate username and password to log into Spotify.

Explanation:

<<This is a NOT question>>

The above scenario is an example of a federation that enables the access of services across organizational/domain boundaries by establishing trust relationships between the identity providers of Spotify & Google.

Here is a step-by-step process of how this works:

  1. Spotify uses Azure AD authentication
  2. The user authenticates with Google
  3. Spotify has a trust relationship with Google. That means Spotify trusts Google.

(So, the options ‘There is a trust relationship between Spotify’s Azure AD & Google’ and ‘Azure AD used by Spotify trusts Google’ are incorrect).

  1. Spotify trusts the user and allows access.
Federation

Corroborate the image with the above four bullet points

In the above example, Spotify’s Azure AD trusts Google. But the opposite isn’t true. That is, Google doesn’t trust Spotify unless that trust relationship is configured. So, the option ‘Google trusts Spotify’s Azure AD’ is the correct answer.

The user accesses Spotify with his Google account. Thanks to the trust relationship, he doesn’t need a separate username and password to log into Spotify. The option ‘The user does not need a separate username and password to log into Spotify’ is incorrect too.

So, option 2 is the correct answer

Reference Link: https://docs.microsoft.com/en-us/learn/modules/describe-identity-principles-concepts/5-describe-concept-federated-services

This question is part of my Udemy course SC-900 Exam Questions. It is copyrighted and cannot be reproduced elsewhere without permission.


Define common Identity Attacks

5 identity attacks that exploit your broken authentication

Describe the Capabilities of Microsoft Identity and Access Management
Solutions (30-35%)

Describe the Basic Identity Services and Identity Types of Azure AD

Describe what Azure Active Directory is

What is Azure Active Directory?

Describe what is Azure Active Directory

Describe Azure AD identities (users, devices, groups, service principals/applications)

Describe Azure AD identity types

Describe what hybrid identity is

The concept of hybrid identities

Describe the different external identity types (Guest Users)

Describe the types of external identities

sc-900 Mastering Identity and Access Management with Microsoft Azure

Amazon link (affiliate)

Describe the Authentication Capabilities of Azure AD

Describe the different authentication methods

Different authentication methods in Azure AD

Authentication & verification methods in Azure AD


Test your knowledge of Security Defaults

Q] In which of the following scenarios are Azure Active Directory security defaults recommended to use?

  1. Organizations with Azure AD Premium licenses
  2. Organizations with complex security requirements
  3. Organizations using Conditional Access policies
  4. Organizations that do not know how to approach security

Explanation: Security defaults provide default security settings that Microsoft manages to keep your identities safe until you are ready to manage your own identities.

They are best suited for small/midsize organizations that aren’t ready to manage complex security requirements. So, option Organizations that do not know how to approach security is the correct answer.

Reference Link: https://docs.microsoft.com/en-us/learn/modules/explore-authentication-capabilities/2-describe-different-authentication-methods#security-defaults-and-multifactor-authentication

The option Organizations with Azure AD premium licenses is incorrect as security defaults come with the free Azure AD tier. Azure AD premium users should try and implement Conditional Access.

Both security defaults and Conditional Access are similar in what they do. For example, both require Multi-Factor Authentication. But with Conditional Access, you can implement more granular & advanced security controls for MFA. For example, with Conditional Access, you can:

  • Require MFA only when specific signals warrant it.
  • Exclude specific users
  • Or allow access only to compliant devices

Generally, enterprise organizations have these advanced security requirements. They would do well with Conditional Access.

The Option Organizations with complex security requirements is incorrect because such organizations would use Conditional Access, not security defaults.

Reference Link: https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults#conditional-access

Option Organizations using Conditional Access policies are incorrect because security defaults are a precursor to Conditional Access.

Organizations should first take advantage of the out-of-the-box security settings provided by security defaults. As their security requirements become more complex, they can manage their own identities with Conditional Access.

Moreover, both Conditional Access and security defaults are mutually exclusive. If you have security defaults enabled, you cannot create a conditional access policy and vice-versa.

Conditional Access Policy

This question is part of my Udemy course SC-900 Exam Questions. It is copyrighted and cannot be reproduced elsewhere without permission.


Describe self-service password reset

Self-service Password Reset (SSPR)

How does Azure AD self-service password reset works?

Describe password protection and management capabilities

Password protection & management capabilities of Azure AD

Describe Multi-factor Authentication

Multi-factor authentication (MFA) in Azure AD

Describe Windows Hello for Business

Windows Hello for Business

SC-900 Practice Tests

Describe Access Management Capabilities of Azure AD

Describe what conditional access is

What is Conditional Access?

Describe uses and benefits of conditional access

Conditional access and its benefits

Security benefits of Conditional Access

Describe the benefits of Azure AD roles

What is Azure role-based access control (RBAC)?

Understand different roles

Describe the Identity Protection & Governance Capabilities of Azure AD

Describe what identity governance is

What is Azure AD Identity Governance?

Describe Identity Governance

Describe what entitlement management and access reviews is

What is Azure AD entitlement management?

What are Azure AD access reviews?

Describe entitlement management & access reviews


Test Your Knowledge on Entitlement Management

Q] You create an access package in entitlement management and a set of resources to help onboard new team members.

Which of the following types of resources can you define in an access package (Select four options)?

  1. Azure AD enterprise apps
  2. SharePoint Online sites
  3. Azure resources
  4. Microsoft 365 groups
  5. Microsoft 365 licenses
  6. Azure AD security groups

Explanation: You define access packages in Azure AD entitlement management to automate access request workflows, access assignments & access expiration. This is important because, often, users (either new employees or ones with recent role changes) do not know what access they need and whom to request access.

Access packages

As seen in the image above, the following are the types of resources defined in an access package:

  • Membership to Azure AD security groups, Microsoft 365 groups
  • Access to Azure AD apps, SaaS apps
  • Access to SharePoint Online sites

Although you cannot directly manage access to Microsoft 365 licenses or Azure resources, you can create an Azure AD security group in the access package and:

  • Give access to users who need Microsoft 365 licenses (via group-based licensing).
  • Create an Azure role assignment for that group

If it is difficult to understand, the below image will help.

SC-900 exam questions Access packages Entitmenent Management

So, options 1, 2, 4, 6 are the correct answers.

Reference Link:

https://docs.microsoft.com/en-us/learn/modules/describe-identity-protection-governance-capabilities/3-describe-what-entitlement-management-access-reviews (check the video)

https://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-overview#what-are-access-packages-and-what-resources-can-i-manage-with-them

This question and the detailed explanation are part of my course SC-900 Exam Questions. It is copyrighted and cannot be reproduced elsewhere without permission.


Describe the capabilities of PIM

Privileged Identity Management

Capabilities of Privileged Identity Management

Describe Azure AD Identity Protection

What is Identity Protection?

What is Azure Identity Protection?

Describe the Capabilities of Microsoft Security Solutions (35-40%)

Describe Basic Security Capabilities in Azure

Describe Azure Network Security groups

Network security groups

Describe Azure Network Security groups

Describe Azure DDoS protection

Azure DDoS protection

DDoS Protection Standard overview

Describe what Azure Firewall is

What is Azure Firewall?

Azure Firewall overview

Describe what Azure Bastion is

What is Azure Bastion?

Azure Bastion overview

Describe what Web Application Firewall is

What is a Web Application Firewall?

Web Application Firewall overview

Describe ways Azure encrypts data

Encryption options in Azure

Azure encryption overview


Test Your Knowledge of Microsoft Security Solutions

Q] Drag & match the appropriate Azure resources on the left column to its corresponding use case on the right

Microsoft Security Solutions

a.

Network security groups -> Filters Virtual Network traffic

Web Application Firewall -> Safeguards from SQL injection attacks

Azure Firewall -> Protects your VNet resources

Azure Bastion -> RDP connectivity from Azure portal

b.

Network security groups -> Protects your VNet resources

Web Application Firewall -> RDP connectivity from Azure portal

Azure Firewall -> Filters Virtual Network traffic

Azure Bastion -> Safeguards from SQL injection attacks

c.

Network security groups -> RDP connectivity from Azure portal

Web Application Firewall -> Protects your VNet resources

Azure Firewall -> Safeguards from SQL injection attacks

Azure Bastion -> Filters Virtual Network traffic

d.

Network security groups -> Safeguards from SQL injection attacks

Web Application Firewall -> RDP connectivity from Azure portal

Azure Firewall -> Filters Virtual Network traffic

Azure Bastion -> Protects your VNet resources

Explanation: The correct answer is the option:

Network security groups -> Filters Virtual Network traffic

Web Application Firewall -> Safeguards from SQL injection attacks

Azure Firewall -> Protects your VNet resources

Azure Bastion -> RDP connectivity from Azure portal

Detailed Explanation:

A Network Security Group (NSG) contains security rules that filter (allow/deny) inbound/outbound traffic to Azure resources in an Azure Virtual Network. Below, you can see default security rules in an NSG.

Network Security Groups

Reference Link: https://docs.microsoft.com/en-us/learn/modules/describe-basic-security-capabilities-azure/2-describe-azure-network-security-groups

Web Application Firewall (WAF) provides centralized protection of your web apps from common exploits like SQL injection and cross-site scripting.

WAF is not a standalone resource. It is generally deployed with Application Gateway/Front Door.

In the below image, we create a WAF policy for Azure Application Gateway. Within the policy, you can find managed rules for common attacks like SQL Injection (highlighted) and XSS.

Web Application Firewall

Reference Link: https://docs.microsoft.com/en-us/learn/modules/describe-basic-security-capabilities-azure/6-describe-what-web-application-firewall

While WAF for Application Gateway protects http/s protocols (only inbound), Azure Firewall protects non-HTTP protocols for both inbound and outbound connections. For example, Virtual Network resources.

Reference Link: https://docs.microsoft.com/en-us/learn/modules/describe-basic-security-capabilities-azure/4-describe-what-azure-firewall

Azure Firewall vs. WAF

Azure Bastion service lets you securely connect to a VM from the Azure portal with a browser. Refer to the below image.

Azure Bastion

Reference Link: https://docs.microsoft.com/en-us/learn/modules/describe-basic-security-capabilities-azure/5-describe-what-azure-bastion

This question and the detailed explanation are part of my course SC-900 Exam Questions. It is copyrighted and cannot be reproduced elsewhere without permission.


Describe Security Management Capabilities of Azure

Describe the Azure Security center

What is Azure Security Center?

Explore Azure Security center

Describe Azure Secure score

Secure score in Azure Security Center

Explore Azure Secure score

Describe the benefit and use cases of Azure Defender – previously the Cloud Workload Protection Platform (CWPP)

Benefits & use cases of Azure Defender

Benefits of Azure Defender for servers


Test Your Knowledge of Azure Defender

Q] Where can you enable Azure Defender in the Azure portal?

Secure score
  1. Advisor
  2. Azure AD Security
  3. Security Center
  4. Azure Sentinel

Explanation: Microsoft offers a layered approach to security.

  • A base layer – Only Azure Security Center (free, basic level of protection)
  • An advanced layer – Azure Security Center with Azure Defender (paid, advanced protection with features like Just in time access, Adaptive application controls, vulnerability assessment, etc.)

Reference Link: https://techcommunity.microsoft.com/itops-talk-blog/whats-the-difference-between-azure-security-center-azure

You access Azure Defender from Azure Security Center. You get the below screen only after upgrading.

Azure Defender

Security Center is the correct choice.

This question is part of my Udemy course SC-900 Exam Questions. It is copyrighted and cannot be reproduced elsewhere without permission.


Describe Cloud Security Posture Management (CSPM)

Cloud Security Posture Management with Azure Security Center

Cloud security posture management – part 2

Describe security baselines for Azure

Security baselines for Azure

Describe Security Capabilities of Azure Sentinel

Define the concepts of SIEM, SOAR, XDR

Define the concepts of SIEM, SOAR, XDR

SIEM, SOAR & XDR Defined


Test Your Knowledge of Azure Sentinel

Q] Microsoft Azure Sentinel is a scalable, cloud-native SIEM/SOAR solution. What do the acronyms stand for?

  1. Security Incident Event Management (SIEM), Security Orchestration Autonomous Response (SOAR)
  2. Security Information Event Management (SIEM), Security Orchestration Automated Response (SOAR)
  3. Security Incident Event Management (SIEM), Security Orchestration Automated Response (SOAR)
  4. Security Information Event Management (SIEM), Security Orchestration Autonomous Response (SOAR)

Explanation: SIEM (Security Information Event Management) is a centralized collection point for all the log entries generated by your infrastructure, resources, devices, firewall, and endpoints. It then correlates these logs to generate alerts and notifies the administrator.

SOAR (Security Orchestration Automated Response) takes these alerts and automates your threat response (with playbooks). So, SOAR decreases the incident response time.

Azure Sentinel SIEM SOAR solution

In a nutshell, SIEM raises an alert if it detects a malicious activity. SOAR deals with the alerts (including false positives) and prepares an automated response.

So, option 2 is the correct answer

Reference Link: https://docs.microsoft.com/en-us/azure/sentinel/overview

This question is part of my Udemy course SC-900 Exam Questions. It is copyrighted and cannot be reproduced elsewhere without permission.


Describe the role and value of Azure Sentinel to provide integrated threat protection

How Sentinel provides integrated threat protection?

Integrated threat protection with SIEM and XDR

Describe Threat Protection with Microsoft 365 Defender

Describe Microsoft 365 Defender services

Microsoft 365 Defender services

Microsoft 365 Defender overview

Describe Microsoft Defender for Identity (formerly Azure ATP)

What is Microsoft Defender for Identity?

Microsoft Defender for Identity

Describe Microsoft Defender for Office 365 (formerly Office 365 ATP)

Microsoft Defender for Office 365

Microsoft Defender for Office 365 overview

Describe Microsoft Defender for Endpoint (formerly Microsoft Defender ATP)

What is Microsoft Defender for Endpoint?

Microsoft Defender for Endpoint


Test Your Knowledge on Microsoft Defender for Endpoint

Q] This question requires you to select the correct answer from the dropdown.

  is a feature in Microsoft Defender for Endpoint that helps you proactively detect threats
  1. Network protection
  2. Advanced Hunting
  3. Next-gen protection
  4. Automated investigation

Explanation: Microsoft Defender for Endpoint offers several features that may be important from an exam point of view.

Advanced Hunting is the correct choice, as it helps you write queries that proactively hunt for threats.

Advanced Hunting

Reference Link: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/advanced-hunting-overview

Network protection reduces the surface attack of your devices from external attacks. It is incorrect.

Reference Link: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/network-protection

Your security team does not have time to investigate every alert from endpoints. Automated investigation runs multiple AI-based playbooks to examine and handle the threats. Option Automated investigation is an incorrect choice.

Reference Link: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/automated-investigations

Microsoft Defender for Antivirus is the next-generation protection component of Defender for Endpoint. Option Next-gen protection is incorrect too.

Reference Link: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-in-windows-10

To help you understand all the myriad of capabilities & features in Microsoft Defender for Endpoint, I created this image. It will help answer other queries related to Defender for Endpoint.

Defender for Endpoint

This question is part of my Udemy course SC-900 Exam Questions. It is copyrighted and cannot be reproduced elsewhere without permission.


Describe Microsoft Cloud App Security

Microsoft Cloud App Security overview

Microsoft Cloud App Security

Describe Security Management Capabilities of Microsoft 365

Describe the Microsoft 365 Defender portal

The unified Microsoft 365 security center overview

Microsoft 365 Defender Portal now combines security signals from endpoints & emails

Describe how to use Microsoft Secure Score

What is Microsoft Secure Score?

How to use Microsoft Secure Score?

Describe security reports and dashboards

Explore security reports and dashboards

Security dashboard overview

Describe incidents and incident management capabilities

Describe incidents capabilities

Incident management overview

Describe Endpoint Security with Microsoft Intune

Describe what Intune is

What is Intune?

Microsoft Intune overview

Describe endpoint security with Intune

What is endpoint security with Intune?

Manage endpoint security in Microsoft Intune

Describe the endpoint security with the Microsoft Endpoint Manager admin center

Microsoft Endpoint Manager overview

Walkthrough Intune in Microsoft Endpoint Manager

Describe the Capabilities of Microsoft Compliance Solutions (25-30%)

Describe the Compliance Management Capabilities in Microsoft

Describe the offerings of the Service Trust portal

Introducing the Service Trust Portal

Service Trust Portal offering

Describe Microsoft’s privacy principles

Describe Microsoft’s privacy principles

Microsoft Privacy principles

Describe the compliance center

What is Compliance Center?

Microsoft 365 compliance center overview


Test Your Knowledge of Microsoft Compliance Center

Q] When you log in to the Microsoft 365 compliance center as a compliance data administrator, which of the following compliance solution areas would you see in the Solutions catalog (Select any three options)?

Microsoft 365 Compliance center Solution Catalog
  1. Communication compliance
  2. Information protection & governance
  3. Insider risk management
  4. Data loss prevention
  5. Discovery & response
  6. Advanced eDiscovery

Explanation: Microsoft 365 solutions catalog helps you discover compliance & risk management solutions available to your organization.

The solutions catalog is organized into three compliance solution areas. Each solution area contains information on several compliance solutions.

See the below infographic for more details.

Microsoft 365 Solutions Catalog Classification

As evident, Insider risk management, Information protection & governance, and Discovery & response are the only three compliance solution areas.

Data loss prevention is a compliance solution within the Information protection & governance solution area.

Advanced eDiscovery is a compliance solution within the Discovery & response solution area.

And Communication compliance is a compliance solution within the Insider risk management solution area.

data loss prevention
Communication Compliance

Finally, the role of the compliance data manager doesn’t make any difference. All three roles (Global administrator, Compliance administrator, Compliance data administrator) get the same user experience when they access Microsoft Compliance Center.

Reference Link: https://docs.microsoft.com/en-us/microsoft-365/compliance/microsoft-365-solution-catalog

https://docs.microsoft.com/en-us/learn/modules/describe-compliance-management-capabilities-microsoft/3-describe-compliance-center

This question is part of my Udemy course SC-900 Exam Questions. It is copyrighted and cannot be reproduced elsewhere without permission.


Describe compliance manager

What is Compliance Manager?

Microsoft Compliance Manager overview

Describe use and benefits of compliance score

Understanding your compliance score

Use and benefits of compliance score

Describe Information Protection and Governance Capabilities of Microsoft 365

Describe data classification capabilities

Understand data classification

Data classification capabilities in Microsoft 365 Compliance Center

Describe the value of content and activity explorer

Get started with content explorer

Get started with activity explorer

Describe sensitivity labels

Learn about sensitivity labels

What are sensitivity labels and policies?

Describe Retention Policies and Retention Labels

Learn about retention policies & labels

What are retention policies and retention labels?

Describe Records Management

Learn about records management in Microsoft 365

What is records management?


Test Your Knowledge of Records Management

Q] Your teammate creates a retention label for applying to documents in OneDrive. He needs to ensure that no one can remove the label. He is presented with the following retention settings screen while creating the label.

Records management - set as record

Per the requirement, is he good to create the label?

  1. Yes
  2. No

Explanation: This question has several layers, so let’s uncover them

First, only the retention labels that mark content as a regulatory record cannot be removed by anyone, even the global administrator.

Reference Link: https://docs.microsoft.com/en-us/microsoft-365/compliance/records-management?view=o365-worldwide#compare-restrictions-for-what-actions-are-allowed-or-blocked

But, as evident from the image, your teammate can only create a retention label that marks items as records, not regulatory records.

Mark items as record

 

That’s because this is the default interface when trying to create retention labels under Records management (See the below image).

Records management default

You don’t see the option to mark items as regulatory records because applying regulatory records to content is far more restrictive than applying records (Refer to the table in the above link).

Since Microsoft wants you to be sure about marking content as regulatory records before you do so, they require you to perform an extra step to display that option in the UI:

· Connect to the Office 365 Security & Compliance Center PowerShell

· Run a PowerShell command (details on them below)

After you perform these steps, you can see the option to mark items as a regulatory record

Records management - set as regulatory record

Per the requirement in the question, he cannot create a label that no one can delete. The correct answer is No.

Reference Link: https://docs.microsoft.com/en-us/learn/modules/describe-information-protection-governance-capabilities-microsoft-365/7-describe-records-management


The answer ends in the previous section. However, if you are curious about connecting to PowerShell and executing the command to display the option, continue reading:

First, install the PowerShell module Exchange Online Management by running this command

Install-Module -Name ExchangeOnlineManagement

Reference Link: https://powershellgallery.com/packages/Exchange-OnlineManagement/2.0.4

And run the following PowerShell commands on your system:

Import the module

Import-Module ExchangeOnlineManagement

Specify username and password to connect to Microsoft 365 compliance in the window prompt

$UserCredential = Get-Credential

Connect to your Compliance center

Connect-IPPSSession -Credential $UserCredential

Command that enables the display mark content as regulatory records

Set-RegulatoryComplianceUI -Enabled $true

Reference Link:

https://docs.microsoft.com/en-us/powershell/exchange/connect-to-scc-powershell?view=exchange-ps#connect-to-security–compliance-center-powershell-using-modern-authentication (For connecting to Compliance center with PowerShell)

https://docs.microsoft.com/en-us/microsoft-365/compliance/declare-records?view=o365-worldwide#how-to-display-the-option-to-mark-content-as-a-regulatory-record (PowerShell command to display the option to mark content as a regulatory record)

This question is part of my Udemy course SC-900 Exam Questions. It is copyrighted and cannot be reproduced elsewhere without permission.


Describe Data Loss Prevention

What is Data loss prevention?

Overview of data loss prevention

Data loss prevention

Describe Insider Risk Capabilities in Microsoft 365

Describe Insider Risk Management solution

What is an Insider risk management solution?

Learn about insider risk management in M365

Describe communication compliance

What is communication compliance?

Learn about communication compliance

Describe information barriers

What are the different information barriers?

Describe privileged access management

What is Privileged Access Management (PIM)?

Privileged access management in Microsoft 365


Test your knowledge on Privileged Access Management

Q] Read the following two statements and select whether they are TRUE/FALSE.

i. Privileged access management is defined at the role level.


ii. Privileged identity management apply for protection at the task level


  1. (i) – TRUE, (ii) – FALSE
  2. (i) – TRUE, (ii) – TRUE
  3. (i) – FALSE, (ii) – FALSE
  4. (i) – FALSE, (ii) – TRUE

Explanation: Both PIM (Privileged Identity Management) and PAM (Privileged Access Management) provide time-bound, just-in-time access to do the job.

But,

  • PIM is defined at the role level, and,
  • PAM is defined at the task level.

For example, for PIM:

Privileged Identity Management

For PAM:

Priliveged Access Management

It is easy to remember.

(Privileged Identity Management) Identity -> Roles.

(Privileged Access Management) Access -> Tasks.

Both the given statements are swapped for each other. Both are FALSE statements.

So, the correct option is (i) – FALSE, (ii) – FALSE

Reference Link: https://docs.microsoft.com/en-us/learn/modules/describe-insider-risk-capabilities-microsoft-365/5-describe-privileged-access-management

This question is part of my Udemy course SC-900 Exam Questions. It is copyrighted and cannot be reproduced elsewhere without permission.


Describe customer lockbox

What is a Customer Lockbox?

Describe the ediscovery and Audit Capabilities of Microsoft 365

Describe the purpose of eDiscovery

What’s the purpose of eDiscovery?

eDiscovery solutions in Microsoft 365

Describe the capabilities of the content search tool

Content Search

What are the capabilities of the content search tool?

Describe the core eDiscovery workflow

Explore the Core eDiscovery workflow

What is the core eDiscovery workflow?

Describe the advanced eDiscovery workflow

What’s the advanced eDiscovery workflow?

Overview of Microsoft 365 Advanced eDiscovery

Describe the core audit capabilities of M365

What are the core audit capabilities of Microsoft 365?

Describe the purpose and value of Advanced Auditing

Advanced audit in Microsoft 365

The purpose and value of Advanced Auditing

Describe Resource Governance Capabilities in Azure

Describe the use of Azure Resource locks

Azure Resource Manager locks

Lock resources to prevent unexpected changes

Describe what Azure Blueprints is

What is Azure Blueprint?

What’s the use of Azure Blueprints?

Define Azure Policy and describe its use cases

What is an Azure Policy?

Azure Policy use cases

This brings us to the end of the SC-900 Microsoft Security, Compliance, and Identity Fundamentals exam study guide.

What do you think? Let me know in the comments section if I have missed out on anything. Also, I love to hear from you how your preparation is going on!

In case you are preparing for other Azure certification exams, check out the Azure study guide for those exams.

Follow Me to Receive Updates on SC-900 Exam


Want to be notified as soon as I post? Subscribe to the RSS feed / leave your email address in the subscribe section. Share the article to your social networks with the below links so it can benefit others.

Share the SC-900 Study Guide in Your Network

You may also like