SC-900 Practice Questions & Answers

Security models and data-protection goals

A fictional workshop moves its application from Azure VMs to a PaaS service that manages the operating system. Its review separates operating-system maintenance from decisions about who may read workshop data. Which ownership statement fits the move?

1. Microsoft takes over operating-system maintenance; the workshop retains responsibility for its data-access decisions
2. Microsoft takes over both operating-system maintenance and the workshop’s data-access decisions
3. The workshop retains both operating-system maintenance and data-access decisions
4. The workshop retains operating-system maintenance; Microsoft takes over the workshop’s data-access decisions

Reference basis: Shared responsibility in the cloud - Microsoft Azure | Microsoft Learn. These are original learning questions, not questions reproduced from the references.

Entra identity types and hybrid identity

A fictional institute distinguishes two hybrid-identity jobs: create and maintain a cloud user object when its lifecycle conditions apply, and keep corresponding on-premises user/group information matched with cloud information. Which TWO classifications fit those jobs? Select exactly TWO.

Select all answers that apply.

1. Treat matching the corresponding directory information as role activation
2. Classify lifecycle-based creation and maintenance of the user object as provisioning
3. Classify that object-creation lifecycle as multifactor authentication
4. Classify keeping corresponding directory information matched as synchronization
5. Classify matching directory information as an application-specific permission grant

Reference basis: Authentication vs. authorization - Microsoft identity platform | Microsoft Learn; What is hybrid identity with Microsoft Entra ID? - Microsoft Entra ID | Microsoft Learn; Microsoft Entra multifactor authentication overview - Microsoft Entra ID | Microsoft Learn. These are original learning questions, not questions reproduced from the references.

Infrastructure security by protection purpose

A fictional organization needs centralized protection for its supported web front end against common exploits expressed in malicious HTTP application-request patterns. Which Azure security capability is the most direct fit for that requirement?

1. Azure DDoS Protection
2. A network security group
3. Azure Web Application Firewall
4. Azure Firewall

Reference basis: Azure network security overview | Microsoft Learn; Introduction to Azure Web Application Firewall | Microsoft Learn. These are original learning questions, not questions reproduced from the references.

Provider trust evidence and privacy principles

A fictional assurance review has two requests: obtain provider external-audit information and evaluate the customer’s own access-management implementation. Which TWO evidence choices match those separate requests? Select exactly TWO.

Select all answers that apply.

1. Provider external-audit information — the customer’s sign-in prompt count
2. Customer access-management implementation — customer access assignments and review records for the evaluated scope
3. Provider external-audit information — relevant Service Trust Portal audit material
4. Customer access-management implementation — the provider report’s service list used as the customer’s implementation record
5. Provider external-audit information — the customer’s collaboration-group membership list

Reference basis: What are access reviews? - Microsoft Entra - Microsoft Entra ID Governance | Microsoft Learn; Get started with the Microsoft Service Trust Portal | Microsoft Learn; Shared responsibility in the cloud - Microsoft Azure | Microsoft Learn. These are original learning questions, not questions reproduced from the references.

Identity proof, permissions, and federation

A fictional user has successfully completed the organization’s sign-in checks. An application still refuses a request to read a collection because the user has no permission for that collection. Which distinction explains the result?

1. The application’s authorization decision is separate from the successful authentication
2. The collection permission should be treated as another proof of the user’s identity
3. Successful sign-in should be used as the permission decision for the collection
4. The access refusal should be classified as an authentication failure despite the completed sign-in checks

Reference basis: Authentication vs. authorization - Microsoft identity platform | Microsoft Learn. These are original learning questions, not questions reproduced from the references.

Authentication methods and multifactor evidence

A fictional organization uses a documented passkey configuration combining a device-held credential with a local biometric check. No account password is typed. The reviewer is evaluating authentication factors and, separately, permission to read a protected resource. Which TWO statements are supported? Select exactly TWO.

Select all answers that apply.

1. Because no account password is typed, classify the sign-in as single-factor by definition
2. The stated passkey-plus-biometric configuration can serve as an MFA method
3. Count the number of visible sign-in prompts as the number of factor categories
4. Treat successful MFA as the resource-reading permission decision
5. Evaluate the resource-reading permission separately from the authentication-factor evidence

Reference basis: Authentication vs. authorization - Microsoft identity platform | Microsoft Learn; Microsoft Entra multifactor authentication overview - Microsoft Entra ID | Microsoft Learn; Passkeys (FIDO2) authentication method in Microsoft Entra ID - Microsoft Entra ID | Microsoft Learn. These are original learning questions, not questions reproduced from the references.

Cloud posture and workload protection

A fictional cloud team wants a view of configuration weaknesses and prioritized cloud-resource posture improvements before considering individual threat alerts. Which security capability is the direct fit for that stated task?

1. Cloud Security Posture Management
2. Cloud Workload Protection focused on threats to running workloads
3. DevSecOps code-level security across development pipelines
4. Sentinel SIEM analysis of security events across connected sources

Reference basis: Microsoft Defender for Cloud Overview - Microsoft Defender for Cloud | Microsoft Learn; What is Microsoft Sentinel SIEM? | Microsoft Learn. These are original learning questions, not questions reproduced from the references.

Purview Compliance Manager and score limits

A fictional organization uses Compliance Manager to track recommended improvement actions. Its reviewers must decide how to interpret a rising compliance score while still evaluating their own controls. Which TWO interpretations are supported? Select exactly TWO.

Select all answers that apply.

1. Use the score as a measure of progress on recommended improvement actions
2. Use the score’s increase as the customer-control effectiveness evaluation itself
3. Continue evaluating customer controls rather than treating the score as a guarantee of compliance
4. Treat Microsoft-managed actions in the score as evidence that the customer’s corresponding procedures have been tested
5. Use the score alone as the decision that the organization satisfies its specific regulatory obligations

Reference basis: Compliance Manager scoring | Microsoft Learn. These are original learning questions, not questions reproduced from the references.

Conditional Access and role scope

A fictional team already assigns the required Azure resource-action permissions to its users. It now needs a separate rule that evaluates sign-in and device signals and requires MFA when the rule’s conditions apply. Which capability directly addresses the newly stated requirement?

1. An Azure RBAC role assignment that changes the allowed resource actions
2. A Microsoft Entra directory role assignment for managing users
3. Microsoft Entra Conditional Access policy evaluation
4. Choosing an authentication method without a rule governing when it is required

Reference basis: Microsoft Entra Conditional Access: Zero Trust Policy Engine - Microsoft Entra ID | Microsoft Learn; Microsoft Entra multifactor authentication overview - Microsoft Entra ID | Microsoft Learn; Azure roles, Microsoft Entra roles, and classic subscription administrator roles | Microsoft Learn. These are original learning questions, not questions reproduced from the references.

Sentinel detection, investigation, and response

A fictional Sentinel design separates two jobs: bring an additional supported event source into the analysis environment, then connect related alerts into potential incidents. Which TWO pairings fit? Select exactly TWO.

Select all answers that apply.

1. Bring in the event source — a response playbook
2. Connect related alerts into incidents — analytics
3. Bring in the event source — a data connector
4. Connect related alerts into incidents — a data-source connector
5. Bring in the event source — a workbook visualization

Reference basis: What is Microsoft Sentinel SIEM? | Microsoft Learn; Automation in Microsoft Sentinel | Microsoft Learn. These are original learning questions, not questions reproduced from the references.