SC-900 Exam Study Guide (Microsoft Security, Compliance, and Identity Fundamentals)

SC-900 Microsoft Security, Compliance, and Identity Fundamentals

Preparing for the SC-900 Microsoft Security, Compliance, and Identity Fundamentals exam? Don’t know where to start? This post is the SC-900 Certificate Study Guide (with links to each exam objective).

I have curated a list of articles from Microsoft documentation for each objective of the SC-900 exam. Please share the post within your circles so it helps them to prepare for the exam.

SC-900 MS Security, Compliance & Identity Prep

SC-900 Practice Test [MS Security & Identity]

Looking for SC-900 Dumps? Read This!

Using sc-900 exam dumps can get you permanently banned from taking any future Microsoft certificate exam. Read the FAQ page for more information. However, I strongly suggest you validate your understanding with practice questions.

To view other Azure Certificate Study Guides, click here

Full Disclosure: Some of the links in this post are affiliate links. I receive a commission when you purchase through them.

Describe the Concepts of Security, Compliance, and Identity (5-10%)

Describe Security Methodologies

Describe Security Concepts

Describe Microsoft Security and Compliance Principles

Describe Microsoft’s privacy principles

Describe Microsoft’s privacy principles

Microsoft Privacy principles

Describe the offerings of the service trust portal

Introducing the Service Trust Portal

Service Trust Portal offering

Describe the Capabilities of Microsoft Identity and Access Management Solutions (25-30%)

Define Identity Principles/Concepts

Define identity as the primary security perimeter

Identity as the primary security perimeter

The 4 pillars of Identity

Define authentication

What is Authentication?

Define authorization

What is Authorization?

Authentication vs. Authorization

Describe what identity providers are

What is an identity provider (IdP)?

Identity Providers for external identities

Describe what Active Directory is

Understanding Active Directory

Describe the concept of Federated services

Federated services

A user wants to listen to music. So, he logs into the Spotify app with his Google account. See the below image for more details.

SC-900 Federated authentication

Based on the above scenario, which of the following is NOT True?

a. Azure AD used by Spotify trusts Google identity provider.

b. Google identity provider trusts Azure AD used by Spotify.

c. There is a trust relationship between Azure AD used by Spotify and Google.

d. The user does not need a separate username and password to log into Spotify.

Explanation: The above scenario is an example of a federation that enables the access of services across organizational/domain boundaries by establishing trust relationships between the identity providers of Spotify & Google.

Here is a step-by-step process of how this works:

  1. Spotify uses Azure AD authentication
  2. The user authenticates with Google
  3. Spotify has a trust relationship with Google.
  4. So, Spotify trusts the user and allows access.

In the above example, a trust relationship is configured between Spotify and Google. Spotify trusts Google. But the opposite isn’t true. That is, Google doesn’t trust Spotify unless that trust relationship is configured.

So, option b is the correct answer

Reference Link: https://docs.microsoft.com/en-us/learn/modules/describe-identity-principles-concepts/5-describe-concept-federated-services

This question is part of my Udemy course SC-900 Exam Questions

Describe the Basic Identity Services and Identity Types of Azure AD

Describe what Azure Active Directory is

What is Azure Active Directory?

Describe what is Azure Active Directory

Describe Azure AD identities (users, devices, groups, service principals/applications)

Describe Azure AD identity types

Describe what hybrid identity is

The concept of hybrid identities

Describe the different external identity types (Guest Users)

Describe the types of external identities

sc-900 Mastering Identity and Access Management with Microsoft Azure

Amazon link (affiliate)

Describe the Authentication Capabilities of Azure AD

Describe Access Management Capabilities of Azure AD

Describe what conditional access is

What is Conditional Access?

Describe uses and benefits of conditional access

Conditional access and its benefits

Security benefits of Conditional Access

Describe the benefits of Azure AD roles

What is Azure role-based access control (RBAC)?

Understand different roles

Describe the Identity Protection & Governance Capabilities of Azure AD

You create an access package in entitlement management and a set of resources to help onboard new team members.

Which of the following types of resources can you define in an access package (Select more than one option)?

a. Azure AD enterprise apps

b. SharePoint Online sites

c. Azure resources

d. Microsoft 365 groups

e. Microsoft 365 licenses

f. Azure AD security groups

Explanation: You define access packages in Azure AD entitlement management to automate access request workflows, access assignments & access expiration. This is important because, often, users (either new employees or ones with recent role changes) do not know what access they need and whom to request access.

SC-900 Access packages in Entitlement management

As seen in the image above, the following are the types of resources defined in an access package:

  • Membership to Azure AD security groups, Microsoft 365 groups
  • Access to Azure AD apps, SaaS apps
  • Access to SharePoint Online sites

Although you cannot directly manage access to Microsoft 365 licenses or Azure resources, you can create an Azure AD security group in the access package and:

  • Give access to users who need Microsoft 365 licenses (via group-based licensing).
  • Create an Azure role assignment for that group

If it is difficult to understand, the below image will help.

SC-900 exam questions Access packages Entitmenent Management

So, options a,b,d,f are the correct answers.

Reference Link:

https://docs.microsoft.com/en-us/learn/modules/describe-identity-protection-governance-capabilities/3-describe-what-entitlement-management-access-reviews (check the video)

https://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-overview#what-are-access-packages-and-what-resources-can-i-manage-with-them

This question and the detailed explanation is part of my Udemy course SC-900 Exam Questions

Describe the Capabilities of Microsoft Security Solutions (30-35%)

Describe Basic Security Capabilities in Azure

Describe Security Management Capabilities of Azure

Describe Security Capabilities of Azure Sentinel

Microsoft Azure Sentinel is a scalable, cloud-native SIEM/SOAR solution. What do the acronyms stand for?

a. Security Incident Event Management (SIEM), Security Orchestration Autonomous Response (SOAR)

b. Security Information Event Management (SIEM), Security Orchestration Automated Response (SOAR)

c. Security Incident Event Management (SIEM), Security Orchestration Automated Response (SOAR)

d. Security Information Event Management (SIEM), Security Orchestration Autonomous Response (SOAR)

Explanation: SIEM(Security Information Event Management) is a centralized collection point for all the log entries generated by your infrastructure, resources, devices, firewall, and endpoints. It then correlates these logs to generate alerts and notifies the administrator.

SOAR (Security Orchestration Automated Response) takes these alerts and automates your threat response (with playbooks). So, SOAR decreases the incident response time.

Azure Sentinel SIEM SOAR solution

In a nutshell, SIEM raises an alert if it detects a malicious activity. SOAR deals with the alerts (including false positives) and prepares an automated response.

So, option b is the correct answer

Reference Link:https://docs.microsoft.com/en-us/azure/sentinel/overview

This question is part of my Udemy course SC-900 Exam Questions

Describe the role and value of Azure Sentinel to provide integrated threat protection

How Sentinel provides integrated threat protection?

Integrated threat protection with SIEM and XDR

Describe Threat Protection with Microsoft 365 Defender (Formerly Microsoft Threat Protection)

Describe Microsoft 365 Defender services

Microsoft 365 Defender services

Microsoft 365 Defender overview

Describe Microsoft Defender for Identity (formerly Azure ATP)

What is Microsoft Defender for Identity?

Microsoft Defender for Identity

Describe Microsoft Defender for Office 365 (formerly Office 365 ATP)

Microsoft Defender for Office 365

Microsoft Defender for Office 365 overview

Describe Microsoft Defender for Endpoint (formerly Microsoft Defender ATP)

What is Microsoft Defender for Endpoint?

Microsoft Defender for Endpoint

Describe Microsoft Cloud App Security

Microsoft Cloud App Security overview

Microsoft Cloud App Security

Describe Security Management Capabilities of Microsoft 365

Describe Endpoint Security with Microsoft Intune

Describe what Intune is

What is Intune?

Microsoft Intune overview

Describe endpoint security with Intune

What is endpoint security with Intune?

Manage endpoint security in Microsoft Intune

Describe the endpoint security with the Microsoft Endpoint Manager admin center

Microsoft Endpoint Manager overview

Walkthrough Intune in Microsoft Endpoint Manager

Describe the Capabilities of Microsoft Compliance Solutions (25-30%)

Describe the Compliance Management Capabilities in Microsoft

When you log in to the Microsoft 365 compliance center as a compliance data administrator, which of the following compliance solution areas would you see in the Solutions catalog (Select more than one option)?

Microsoft 365 Compliance center Solution Catalog

a. Communication compliance

b. Information protection & governance

c. Insider risk management

d. Data loss prevention

e. Discovery & response

f. Advanced eDiscovery

Explanation: Microsoft 365 solutions catalog helps you discover compliance & risk management solutions available to your organization.

The solutions catalog is organized into three compliance solution areas. Each solution area contains information on several compliance solutions.

See the below infographic for more details.

Microsoft 365 Solutions Catalog Classification

As evident, Insider risk management, Information protection& governance, and Discovery & responseare the only three compliance solution areas.

Data loss prevention is a compliance solution within the Information protection & governance solution area.

Advanced eDiscovery is a compliance solution within the Discovery & response solution area.

And Communication compliance is a compliance solution within the Insider risk management solution area.

data loss prevention Solution catalog Microsoft compliance center

ediscovery microsoft compliance center

Finally, the role compliance data manager doesn’t make any difference. All three roles (Global administrator, Compliance administrator, Compliance data administrator) get the same user experience when they access Microsoft Compliance Center.

Reference Link: https://docs.microsoft.com/en-us/microsoft-365/compliance/microsoft-365-solution-catalog?view=o365-worldwide

https://docs.microsoft.com/en-us/learn/modules/describe-compliance-management-capabilities-microsoft/3-describe-compliance-center

This question is part of my Udemy course SC-900 Exam Questions

Describe Information Protection and Governance Capabilities of Microsoft 365

Your teammate creates a retention label for applying to documents in OneDrive. He needs to ensure that no one can remove the label. He is presented with the following retention settings screen while creating the label.

Records management - set as record

Per the requirement, is he good to create the label?

a. Yes

b. No

Explanation: This question has several layers, so let’s uncover them

First, only the retention labels that mark content as a regulatory record cannot be removed by anyone, even the global administrator.

Reference Link:https://docs.microsoft.com/en-us/microsoft-365/compliance/records-management?view=o365-worldwide#compare-restrictions-for-what-actions-are-allowed-or-blocked

But, as evident from the image, your teammate can only create a retention label that marks items as records, not regulatory records.

Mark items as record

That’s because this is the default interface when trying to create retention labels under Records management (See the below image).

records management default

You don’t see the option to mark items as regulatory records because applying regulatory records to content is far more restrictive than applying records (Refer to the table in the above link).

Since Microsoft wants you to be sure about marking content as regulatory records before you do so, they require you to perform an extra step to display that option in the UI:

· Connect to the Office 365 Security & Compliance Center PowerShell

· Run a PowerShell command (details on them below)

After you perform these steps, you can see the option to mark items as a regulatory record

Records management - set as regulatory record

Per the requirement in the question, he cannot create a label that no one can delete. The correct answer isNo.

Reference Link:https://docs.microsoft.com/en-us/learn/modules/describe-information-protection-governance-capabilities-microsoft-365/7-describe-records-management

If you are curious about connecting to PowerShell and executing the command to display the option, continue reading.

First, install the PowerShell module Exchange Online Management by running this command:

Install-Module -Name ExchangeOnlineManagement

Reference Link: https://powershellgallery.com/packages/Exchange-OnlineManagement/2.0.4

And run the following PowerShell commands on your system:

Import the module

Import-Module ExchangeOnlineManagement

Specify username and password to connect to Microsoft 365 compliance in the window prompt

$UserCredential = Get-Credential

Connect to your Compliance center

Connect-IPPSSession -Credential $UserCredential

Command that enables the display mark content as regulatory records

Set-RegulatoryComplianceUI -Enabled $true

Reference Link:

https://docs.microsoft.com/en-us/powershell/exchange/connect-to-scc-powershell?view=exchange-ps#connect-to-security–compliance-center-powershell-using-modern-authentication (For connecting to Compliance center with PowerShell)

https://docs.microsoft.com/en-us/microsoft-365/compliance/declare-records?view=o365-worldwide#how-to-display-the-option-to-mark-content-as-a-regulatory-record (PowerShell command to display the option to mark content as a regulatory record)

This question is part of my Udemy course SC-900 Exam Questions

Describe Insider Risk Capabilities in Microsoft 365

Describe the ediscovery Capabilities of Microsoft 365

Describe the Audit Capabilities in Microsoft 365

Describe the core audit capabilities of M365

What are the core audit capabilities of Microsoft 365?

Describe the purpose and value of Advanced Auditing

Advanced audit in Microsoft 365

The purpose and value of Advanced Auditing

Describe Resource Governance Capabilities in Azure

This brings us to the end of the SC-900 Microsoft Security, Compliance, and Identity Fundamentals exam study guide.

What do you think? Let me know in the comments section if I have missed out on anything. Also, I love to hear from you how your preparation is going on!

In case you are looking for other Azure certification exams check out this page

Follow/Like ravikirans.com to Receive Updates

Want to be notified as soon as I post? Subscribe to RSS feed / leave your email address in the subscribe section. Share the article to your social networks with the below links so it can benefit others.

Share the Article in Your Social Media Networks

  •  
  •  
  •  
  •  
  •  
  •  

You may also like

1 Comment

Leave a Reply

Your email address will not be published. Required fields are marked *