SC-900 Practice Worksheets & Answer Key

Answer: Microsoft takes over operating-system maintenance; the workshop retains responsibility for its data-access decisions

1. Separate the two responsibilities instead of treating a service-model change as transfer of the whole security program.
2. The retained model distinguishes provider-managed operating systems in PaaS from customer responsibility for data, identities and access controls.
3. The first proposal makes that split. Recheck the data-access row: choosing a managed platform has not transferred the workshop’s decision about its readers.

Answer: A device identity

1. The question names the tablet as the subject of the identity record, rather than the person or application using it.
2. Device identities represent devices and are distinct from human and workload identities.
3. Choose device identity. If the reviewed subject changed to the volunteer or the software service, the category could change; merely running software does not change the subject named here.

Answer: Azure Web Application Firewall

1. Identify the positive requirement: protect the web front end against common exploits expressed in HTTP application-request patterns.
2. Azure WAF supplies centralized web-application exploit protection. NSGs use basic 5-tuple packet filtering, DDoS Protection addresses DDoS availability threats, and Azure Firewall supplies a broader network-firewall capability.
3. Choose WAF as the direct fit for this specialized web-request protection requirement. Azure Firewall is a real adjacent control and may complement it, but the requirement’s web-application purpose selects WAF rather than merely any network-security service.

Answer: The customer’s access-review decisions and implementation records for the named review

1. The missing evidence concerns a specific customer-operated review, not whether the provider has an assurance report.
2. The shared-responsibility model retains customer access responsibilities, and access reviews produce decisions about continued access.
3. Choose evidence of that customer review. Scope and date matter when evaluating provider reports, but neither supplies the absent record that the customer’s staff performed this review.

Answer: The application’s authorization decision is separate from the successful authentication

1. Accept the stated successful sign-in as evidence of authentication rather than inventing a failed identity check.
2. Authorization specifies what data an authenticated party may access and what actions it may perform. The collection-reading permission is separately absent.
3. Therefore the refusal is consistent with successful authentication and missing authorization. Check the strongest alternative: an access refusal does not by itself reverse the explicit statement that identity verification succeeded.

Answer: Microsoft Entra self-service password reset

1. Extract the positive task: the eligible user forgot the account password, the relevant recovery feature is enabled and verification methods are registered. The required outcome is user-driven credential recovery.
2. SSPR supplies the recovery workflow under those conditions. Password Protection instead evaluates weak password choices; MFA requirements strengthen identity proof.
3. Select SSPR. Administrator-performed recovery is a genuine competing route to a usable password, but it does not satisfy the stated self-service requirement.

Answer: Cloud Security Posture Management

1. The evidence requested is configuration weakness and posture improvement, not a particular running-workload threat alert or a user sign-in decision.
2. Defender for Cloud includes CSPM for checking and improving cloud-resource posture and CWPP for workload threat protection.
3. Choose CSPM for this task. Workload protection is the strongest adjacent alternative, but its threat-protection role does not replace the specified posture review. Neither result is a guarantee of complete protection.

Answer: An assessment grouping the relevant controls

1. The grouping must represent controls for a standard or policy and their progress.
2. A Compliance Manager assessment groups controls from a regulation, standard or policy with an in-scope service context and progress measure.
3. Choose an assessment. An incident, labeled item or activity query can be a valid object for another task, but its grouping basis is not this control-assessment scope.