Microsoft Certified: Security, Compliance, and Identity Fundamentals — Practice Set 1

Question 1

Your organization is planning its cloud security strategy. Which model describes how security responsibilities are divided between a cloud provider and the customer?

Accepted Answer

The shared responsibility model defines which security tasks are handled by the cloud provider and which are handled by the customer. The division varies depending on the cloud service type (IaaS, PaaS, SaaS). The Zero Trust model is about never trusting by default, defense-in-depth layers security controls, and GRC covers governance processes.

Question 2

An identity architect states that 'identity is the new security perimeter.' What does this mean in the context of modern security?

Accepted Answer

In modern cloud and mobile environments, users access resources from anywhere on any device. Traditional network perimeters are insufficient, so verifying user identity becomes the primary control for protecting resources. This shifts security from 'where you are on the network' to 'who you are.'

Question 3

Your organization wants to implement a security strategy that assumes no user or device is trusted by default, even within the corporate network. Which security model should your organization adopt?

Accepted Answer

The Zero Trust model operates on the principle of 'never trust, always verify.' It assumes breach and verifies each request explicitly regardless of where it originates. Defense-in-depth layers multiple security controls but does not inherently assume distrust of internal network traffic. Perimeter-based security trusts internal traffic, which Zero Trust explicitly rejects.

Question 4

A new employee needs access to Microsoft 365 applications. Which Microsoft service provides identity and access management for cloud-based applications?

Accepted Answer

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access management service. It provides authentication and authorization for Microsoft 365, Azure, and thousands of third-party SaaS applications. Microsoft Defender for Identity focuses on detecting identity-based attacks, Sentinel is a SIEM/SOAR solution, and Purview handles compliance and data governance.

Question 5

Your organization has an on-premises Active Directory environment and a Microsoft Entra ID tenant. Users currently maintain separate credentials for on-premises and cloud resources. You need to allow users to use a single set of credentials for both environments. What should you implement?

Accepted Answer

Hybrid identity with Microsoft Entra Connect synchronizes on-premises Active Directory identities with Microsoft Entra ID, enabling users to use a single set of credentials for both on-premises and cloud resources. Entra ID Protection detects identity risks, Privileged Identity Management manages privileged role assignments, and External ID is for external user identities.

Question 6

You are a security administrator. You need to require users to complete additional verification steps when signing in from unrecognized locations. Which Microsoft Entra ID feature should you configure?

Accepted Answer

Conditional Access policies in Microsoft Entra ID allow you to enforce access controls based on conditions such as location, device compliance status, user risk, and application sensitivity. You can require multifactor authentication (MFA) when users sign in from unfamiliar locations. SSPR allows password resets, ID Protection detects risks, and access reviews periodically verify user access rights.

Question 7

Your organization wants to strengthen authentication for privileged administrator accounts. Which two authentication methods are available in Microsoft Entra ID to provide multifactor authentication? Choose 2.

Accepted Answer

Microsoft Entra ID supports multiple MFA methods including the Microsoft Authenticator app (push notifications, passwordless phone sign-in) and FIDO2 security keys (hardware-based passwordless authentication). Username/password alone is single-factor, shared group passwords violate security best practices, and anonymous tokens are not a supported authentication method.

Question 8

You are configuring governance for your Microsoft Entra ID environment. You need to ensure that users' privileged role assignments are time-limited and require approval before activation. Which feature should you configure?

Accepted Answer

Microsoft Entra Privileged Identity Management (PIM) provides just-in-time privileged access management. It allows you to make role assignments eligible rather than permanent, require justification and approval before activation, set time limits on active assignments, and receive notifications and audit logs of privileged activity. Conditional Access enforces access policies at sign-in, ID Protection detects compromised identities, and Access Reviews periodically recertify user access.

Question 9

Your organization needs to periodically verify that employees still require their assigned application access and group memberships. Which Microsoft Entra ID Governance feature should you use?

Accepted Answer

Access reviews in Microsoft Entra ID Governance allow organizations to efficiently manage group memberships, access to enterprise applications, and role assignments. Reviewers can certify or remove access on a recurring schedule. Entitlement management automates access request workflows, Conditional Access enforces sign-in policies, and Identity Protection detects compromised accounts.

Question 10

Your organization uses multiple SaaS applications. You need users to authenticate once and have access to all applications without re-entering credentials. Which capability does Microsoft Entra ID provide to meet this requirement?

Accepted Answer

Single sign-on (SSO) in Microsoft Entra ID allows users to sign in once and access multiple applications without needing to re-authenticate. MFA adds a verification step during authentication, SSPR allows users to reset their own passwords, and RBAC controls what actions a user can perform within applications.

Question 11

Your organization wants to protect its Azure virtual machines from distributed denial-of-service (DDoS) attacks. Which Azure service provides this protection?

Accepted Answer

Azure DDoS Protection provides defense against DDoS attacks at layers 3 and 4 of the network stack. It automatically detects and mitigates attacks targeting your Azure resources. Azure Firewall is a managed stateful firewall, Azure Bastion provides secure RDP/SSH access to VMs, and NSGs filter inbound and outbound traffic but do not provide DDoS-specific mitigation.

Question 12

You are a security engineer. Your organization runs web applications in Azure. You need to protect these applications from common web exploits such as SQL injection and cross-site scripting (XSS). Which Azure service should you use?

Accepted Answer

Web Application Firewall (WAF) provides protection against common web application vulnerabilities including SQL injection, cross-site scripting, and other OWASP Top 10 threats. WAF can be deployed with Azure Application Gateway or Azure Front Door. DDoS Protection addresses volumetric attacks, Key Vault manages secrets and keys, and NSGs filter network traffic but do not inspect HTTP application payloads.

Question 13

Your security team needs a centralized solution to store and manage application secrets, encryption keys, and certificates for Azure workloads. Which service should you recommend?

Accepted Answer

Azure Key Vault is a cloud service for securely storing and accessing secrets (API keys, passwords, certificates, cryptographic keys). It provides hardware security module (HSM) backed storage, access control via Microsoft Entra ID, and audit logging. Defender for Cloud provides security posture management, Sentinel is a SIEM/SOAR, and Azure Active Directory manages identities.

Question 14

Your organization needs to assess the security posture of its Azure workloads and receive actionable recommendations to reduce risk. Which Microsoft service provides Cloud Security Posture Management (CSPM) capabilities?

Accepted Answer

Microsoft Defender for Cloud provides Cloud Security Posture Management (CSPM) by continuously assessing your cloud resources against security best practices and compliance standards. It calculates a Secure Score and provides prioritized recommendations. Sentinel is a SIEM/SOAR for threat detection, Purview handles data governance and compliance, and Azure Policy enforces organizational standards.

Question 15

You are a security architect evaluating Microsoft Sentinel for your organization. Which two capabilities does Microsoft Sentinel provide? Choose 2.

Accepted Answer

Microsoft Sentinel is a cloud-native SIEM and SOAR solution. As a SIEM, it collects and analyzes security event data from across the enterprise for threat detection. As a SOAR, it automates responses to detected threats using playbooks. CSPM is provided by Defender for Cloud, identity lifecycle management is handled by Microsoft Entra ID Governance, and DLP is a Microsoft Purview capability.

Question 16

Your organization needs protection against email phishing, malicious attachments, and unsafe links in Microsoft 365. Which Microsoft Defender service should you use?

Accepted Answer

Microsoft Defender for Office 365 protects against email-based threats including phishing, malicious attachments (through Safe Attachments), and malicious links (through Safe Links). Defender for Endpoint protects devices, Defender for Identity detects attacks targeting on-premises Active Directory, and Defender for Cloud Apps is a Cloud Access Security Broker (CASB) for monitoring cloud app usage.

Question 17

You are a security operations analyst. Your organization suspects that an on-premises Active Directory account has been compromised and is being used for lateral movement. Which Microsoft service should you use to detect and investigate this threat?

Accepted Answer

Microsoft Defender for Identity is designed to detect, investigate, and respond to advanced threats, compromised identities, and malicious insider actions targeting on-premises Active Directory. It monitors domain controller traffic to detect lateral movement, pass-the-hash, and other identity-based attacks. Defender for Endpoint is for device protection, Defender for Cloud Apps monitors cloud application activity, and Defender for Office 365 focuses on email threats.

Question 18

Your organization wants a unified portal to view and manage security incidents, alerts, and investigations across Microsoft 365 services. Which portal provides this centralized security operations experience?

Accepted Answer

The Microsoft Defender portal (defender.microsoft.com) is the unified security operations center for Microsoft Defender XDR. It provides a centralized view of incidents, alerts, and investigations across Defender for Office 365, Defender for Endpoint, Defender for Identity, and Defender for Cloud Apps. The Azure portal manages Azure resources, the Microsoft 365 admin center handles administration, and the Purview portal focuses on compliance.

Question 19

You are evaluating cloud workload protection options. Your organization runs workloads in Azure, AWS, and Google Cloud Platform. Which Microsoft service provides unified threat protection across multi-cloud environments?

Accepted Answer

Microsoft Defender for Cloud provides cloud workload protection across Azure, AWS, and Google Cloud Platform. It offers CSPM to assess security posture and cloud workload protection (CWP) to detect and respond to threats across multi-cloud and hybrid environments. Azure Security Center was renamed to and integrated into Defender for Cloud. Sentinel is a SIEM, and Defender for Office 365 focuses on email and collaboration security.

Question 20

Your compliance team needs to access compliance reports, audit reports, and security assessments for Microsoft cloud services. Which Microsoft resource should they use?

Accepted Answer

The Microsoft Service Trust Portal provides access to security, compliance, and privacy information about Microsoft cloud services. It includes audit reports, compliance guides, and trust documents from independent third-party audits. The Purview compliance portal is where administrators configure compliance solutions within their own tenant, and the Defender portal is for security operations.

Question 21

Your organization needs to measure its compliance posture against regulatory requirements and receive a score indicating compliance health. Which Microsoft Purview feature provides this capability?

Accepted Answer

Microsoft Purview Compliance Manager helps organizations manage compliance activities, provides a compliance score that measures progress toward completing recommended actions, and includes prebuilt assessments for common regulations (GDPR, ISO 27001, NIST). Sensitivity labels classify and protect data, DLP prevents data leakage, and records management handles lifecycle of records.

Question 22

You are a compliance administrator. Your organization needs to classify documents containing personally identifiable information (PII) and apply visual markings and protection such as encryption automatically. Which Microsoft Purview feature should you configure?

Accepted Answer

Sensitivity labels in Microsoft Purview allow you to classify content and apply protection actions such as encryption, watermarks, and access restrictions. Labels can be applied manually by users or automatically based on sensitive content types. Retention policies manage how long content is kept, eDiscovery searches for legal evidence, and insider risk management detects risky user behavior.

Question 23

Your legal team is preparing for litigation and needs to preserve and search employee emails and files for relevant content. Which two Microsoft Purview capabilities support this requirement? Choose 2.

Accepted Answer

eDiscovery in Microsoft Purview allows legal teams to search, preserve, collect, and review content across Microsoft 365 services for litigation or investigations. Audit solutions in Microsoft Purview provide audit logs that track user and admin activities, which are essential for legal investigations. DLP prevents data from being shared inappropriately, sensitivity labels classify data, and insider risk management detects risky behavior — none of these are litigation discovery tools.

Question 24

Your organization needs to prevent users from sharing documents containing credit card numbers via email or uploading them to SharePoint. Which Microsoft Purview feature should you configure?

Accepted Answer

Data loss prevention (DLP) policies in Microsoft Purview detect and prevent the sharing of sensitive information such as credit card numbers, social security numbers, and health records across services including Exchange, SharePoint, Teams, and OneDrive. Insider risk management monitors for risky behavior patterns, retention policies manage content lifecycle, and records management handles long-term record retention.

Question 25

You are a compliance administrator. Your organization needs to identify employees who may be leaking confidential data to competitors based on behavioral signals and communication patterns. Which Microsoft Purview solution should you use?

Accepted Answer

Microsoft Purview Insider Risk Management uses machine learning to identify, investigate, and act on risky activities within an organization. It correlates signals from Microsoft 365 services (email, SharePoint, Teams, endpoints) to detect patterns indicative of data leakage, intellectual property theft, and other insider threats — without requiring full content access. eDiscovery is for legal holds, communication compliance reviews communications for policy violations, and audit solutions log activity.

SC-900 — Security, Compliance, and Identity Fundamentals