Microsoft SC-900: Microsoft Security, Compliance, and Identity Fundamentals

Last checked October 22, 2026 against the official Microsoft exam page.

1. Question 1Describe the concepts of security, compliance, and identity

   Which security principle means that users and services receive only the access they need to do their work?

   1. ALeast privilege
   2. BZero-day patching
   3. CData residency
   4. DSingle sign-on
   Show answer and explanationHide answer

   Correct answer: A

   Least privilege limits access to the minimum required for a task, which reduces the impact of compromise. Single sign-on is an authentication convenience, data residency concerns location, and zero-day patching is a response to vulnerabilities.

2. Question 2Describe the capabilities of Microsoft Entra

   Which Microsoft Entra capability allows a user to sign in once and access multiple applications without signing in again to each?

   1. ASingle sign-on
   2. BDynamic groups
   3. CAccess reviews
   4. DPassword writeback
   Show answer and explanationHide answer

   Correct answer: A

   Single sign-on lets a user authenticate once and access many applications with that session. Password writeback syncs password changes, dynamic groups manage membership, and access reviews check access.

3. Question 3Describe the capabilities of Microsoft security solutions

   Which Azure service provides a cloud-native SIEM and SOAR platform to collect logs, detect threats, and automate responses?

   1. AAzure CDN
   2. BMicrosoft Sentinel
   3. CAzure Blob Storage
   4. DAzure Backup
   Show answer and explanationHide answer

   Correct answer: B

   Microsoft Sentinel collects security data, detects threats, and automates responses with playbooks. Backup, CDN, and Blob Storage do not provide SIEM or SOAR capabilities.

4. Question 4Describe the capabilities of Microsoft compliance solutions

   Which Microsoft Purview capability classifies and protects documents and emails by applying labels that travel with the content?

   1. ACalendar meeting tags
   2. BSensitivity labels
   3. CNetwork printer labels
   4. DTeams chat emoji packs
   Show answer and explanationHide answer

   Correct answer: B

   Sensitivity labels classify content and can apply protections such as encryption and access restrictions that travel with it. Printer labels, calendar tags, and emojis do not protect content.

5. Question 5Describe the concepts of security, compliance, and identity

   Which term describes the practice of verifying an identity explicitly using multiple signals, rather than trusting a network location?

   1. AFlat network
   2. BAir gap
   3. CZero Trust
   4. DPerimeter-only security
   Show answer and explanationHide answer

   Correct answer: C

   Zero Trust verifies every access request explicitly using identity, device health, and other signals, regardless of network location. Air gaps, perimeter-only defence, and flat networks rely on location trust.