SC-900 · Sample questions

SC-900 sample questions with answers and explanations

10 real questions from the CertifyDeck SC-900 bank, spread across the domains of the official Microsoft Certified: Security, Compliance, and Identity Fundamentals skills outline, with the correct answer and a full explanation of why the other options are wrong. They are original questions written from the public syllabus, not exam dumps, and they are the same style you will find in the practice tests and mock exams.

1. Question 1Domain: Describe the capabilities of Microsoft security solutionsMedium

   A SaaS provider does not want responsibility for its customers' encryption keys. How can Azure Key Vault help?

   • A.Customers manage their own keys, and Key Vault performs cryptographic operations without the application seeing them
   • B.Key Vault lets Microsoft staff manage customer keys on behalf of the provider, so the provider never handles them
   • C.Key Vault copies each customer's keys into the application's memory so it can use them faster than calling the vault
   • D.Key Vault replaces the need to authenticate callers before they use the keys, because the vault trusts the network
   Show answer and explanation

   Correct answer: A. Customers manage their own keys, and Key Vault performs cryptographic operations without the application seeing them

   Explanation

   For SaaS developers, customers can import their own keys into Azure and manage them, and Key Vault performs the cryptographic operations for the application, which never sees the keys. Key Vault is also designed so that Microsoft does not see or extract keys, and access always requires authentication and authorization.

   Official references

   • What is Azure Key Vault?
   • Azure Key Vault Overview
2. Question 2Domain: Describe the capabilities of Microsoft security solutionsEasy

   A retail company wants to restrict which external domain names its Azure workloads can reach and to inspect traffic between spoke virtual networks, using a managed cloud service. Which Azure service fits?

   • A.Azure DDoS Protection
   • B.Azure Web Application Firewall
   • C.Azure Firewall
   • D.Microsoft Entra Conditional Access
   Show answer and explanation

   Correct answer: C. Azure Firewall

   Explanation

   Azure Firewall is a managed, stateful firewall as a service that filters outbound traffic by FQDN and inspects both north-south and east-west traffic. A web application firewall protects web apps from HTTP exploits, DDoS Protection defends public IP addresses from floods, and Conditional Access controls sign-ins.

   Official references

   • Azure Network Security: Firewall, DDoS, WAF
   • What is Azure Firewall?
3. Question 3Domain: Describe the capabilities of Microsoft EntraEasy

   The administrator of a new Microsoft Entra tenant asks what must be configured to start blocking commonly used weak passwords. What is the correct answer?

   • A.The list must be imported from third-party breach databases and uploaded to the tenant
   • B.Nothing: the global banned password list applies automatically to all users
   • C.The list must be enabled separately in each user's profile before it takes effect
   • D.Agents must be installed on every domain controller before any password is checked
   Show answer and explanation

   Correct answer: B. Nothing: the global banned password list applies automatically to all users

   Explanation

   The global banned password list is applied automatically to all users in a tenant; there is nothing to enable or configure and it cannot be disabled. It is built from Microsoft Entra security telemetry, not from third-party data, and agents on domain controllers are needed only to extend protection to on-premises AD DS.

   Official references

   • Password protection in Microsoft Entra ID
   • Describe password protection and management capabilities
4. Question 4Domain: Describe the capabilities of Microsoft EntraEasy

   A manufacturer works with several supplier companies. Business owners want supplier staff to request a bundle containing a group, an application and a SharePoint site, with approval and an expiry date. What should they use?

   • A.A Microsoft Entra ID Protection risk policy
   • B.Access reviews
   • C.Access packages in entitlement management
   • D.Azure role-based access control role assignments
   Show answer and explanation

   Correct answer: C. Access packages in entitlement management

   Explanation

   An access package bundles the resources a team or project needs, and its policies define who can request it (including connected organizations), who approves and when the access expires. Azure RBAC governs Azure resources, risk policies respond to detected risk, and access reviews recertify access that already exists instead of letting people request it.

   Official references

   • What is entitlement management?
5. Question 5Domain: Describe the capabilities of Microsoft EntraMedium

   In an access review, a reviewer sees a deny recommendation next to a user because of the sign-in-based decision helper. What does the recommendation indicate?

   • A.The user's credentials appeared in a known data breach, so access is risky
   • B.The user has not signed in recently, so the access may no longer be needed
   • C.The user holds a privileged administrator role, so the access is sensitive
   • D.The user has not registered for multifactor authentication, so access is risky
   Show answer and explanation

   Correct answer: B. The user has not signed in recently, so the access may no longer be needed

   Explanation

   The sign-in decision helper recommends approval for users who signed in recently and denial for users who have not, so a deny recommendation points to inactivity. Multifactor registration and privileged role membership are not inputs to this helper, and leaked credentials are a risk detection handled by Microsoft Entra ID Protection.

   Official references

   • Create an access review of groups and applications
6. Question 6Domain: Describe the capabilities of Microsoft compliance solutionsMedium

   A clinic keeps a database of patient records and wants to detect only exact values from that data in documents and email, with few false positives, without sending the raw values to the service. What should it create?

   • A.A built-in sensitive information type copied and edited
   • B.A pretrained trainable classifier
   • C.An exact data match (EDM) based sensitive information type
   • D.A named entity sensitive information type for person names
   Show answer and explanation

   Correct answer: C. An exact data match (EDM) based sensitive information type

   Explanation

   EDM-based sensitive information types refer to exact values in a database of sensitive information, give fewer false positives, work with structured data, and only hashed values are uploaded to the service. Named entities and copied built-in types detect by dictionaries and patterns, not by matching the clinic's own records, and pretrained classifiers learn content categories.

   Official references

   • Learn about exact data match based sensitive information types
7. Question 7Domain: Describe the capabilities of Microsoft compliance solutionsEasy

   Attorneys at a media company need to identify and collect the email, Teams chats and OneDrive files of specific employees as evidence for a lawsuit. Which Purview solution should they use?

   • A.Records management
   • B.eDiscovery
   • C.Insider Risk Management
   • D.Data loss prevention
   Show answer and explanation

   Correct answer: B. eDiscovery

   Explanation

   eDiscovery identifies, reviews and manages content in Exchange Online, Teams, OneDrive, SharePoint and other Microsoft 365 services as evidence for investigations and legal cases. Insider Risk Management detects risky user behavior, records management handles retention and disposition, and DLP prevents inappropriate sharing.

   Official references

   • Learn about eDiscovery
8. Question 8Domain: Describe the concepts of security, compliance, and identityMedium

   A manufacturer buys cyber insurance so that an insurer covers the financial losses of a possible ransomware attack. Which risk response is this?

   • A.Mitigate the risk
   • B.Transfer the risk
   • C.Avoid the risk
   • D.Accept the risk
   Show answer and explanation

   Correct answer: B. Transfer the risk

   Explanation

   Transferring a risk shifts its impact to another party, for example through insurance. Accepting is for low-impact risks, mitigating means implementing controls, and avoiding means changing the process that creates the risk.

   Official references

   • Describe governance, risk, and compliance (GRC) concepts
9. Question 9Domain: Describe the concepts of security, compliance, and identityMedium

   An administrator of an on-premises network wants to push configuration settings to every company device and to group users and computers into units for simpler management. Which AD DS capabilities does this rely on?

   • A.Group Policy and organizational units (OUs)
   • B.Issuing OAuth 2.0 and OpenID Connect tokens to SaaS applications
   • C.Conditional Access and Microsoft Entra ID Protection
   • D.Passkeys and Temporary Access Pass
   Show answer and explanation

   Correct answer: A. Group Policy and organizational units (OUs)

   Explanation

   AD DS lets organizations apply Group Policy settings to control device configuration and organize users and computers into organizational units. Conditional Access and ID Protection are Microsoft Entra capabilities, OAuth 2.0 and OpenID Connect are modern protocols that AD DS does not natively support, and passkeys and Temporary Access Pass are Microsoft Entra authentication methods.

   Official references

   • Describe the concept of directory services and Active Directory
10. Question 10Domain: Describe the concepts of security, compliance, and identityMedium

    A user signs in successfully. What has the system established at that point?

    • A.Who the user is, but not yet what the user may do
    • B.That the user's role allows access to every application
    • C.Which files the user may edit
    • D.That the user has administrator rights
    Show answer and explanation

    Correct answer: A. Who the user is, but not yet what the user may do

    Explanation

    Successful authentication only confirms identity. What the identity is allowed to do is decided afterwards by authorization, based on roles, permissions and attributes.

    Official references

    • Define authentication and authorization