Free SC-900 practice test: 30 questions with answers

Least privilege limits access to the minimum required for a task, which reduces the impact of compromise. Single sign-on is an authentication convenience, data residency concerns location, and zero-day patching is a response to vulnerabilities.

Zero Trust verifies every access request explicitly using identity, device health, and other signals, regardless of network location. Air gaps, perimeter-only defence, and flat networks rely on location trust.

Authentication verifies identity. Authorization decides what an authenticated identity can do, auditing records activity, and encryption at rest protects stored data.

Authorization determines permissions after identity is verified. Authentication confirms identity, while backup and replication are data protection functions.

Compliance means meeting external regulations or internal standards and demonstrating that you do so. Key rotation, load balancing, and caching are technical practices that may support compliance but do not describe it.

Detective and responsive controls identify and respond to active threats, complementing preventive measures. Preventive controls stop attacks before they happen, and locks and documents do not detect active attacks by themselves.

Defence in depth uses several layers so that a single failure does not expose all data. One control is rarely sufficient, cloud services still need layers, and perimeter-only security is a single layer.

Shared credentials make it impossible to know which person performed an action. Redundancy, scalability, and latency are not the principle at stake.

Single sign-on lets a user authenticate once and access many applications with that session. Password writeback syncs password changes, dynamic groups manage membership, and access reviews check access.

Multi-factor authentication adds a second verification factor to the sign-in. Directory editions, naming rules, and device tags do not add a verification step.

Conditional access evaluates signals such as user, location, device state, and risk to allow, block, or require controls. Macros, printer queues, and file share permissions do not make sign-in decisions.

External identities and B2B collaboration manage guest access to shared resources. Printer management, device encryption, and mailbox quotas are different areas.

Privileged Identity Management provides just-in-time, time-bound role activation with approvals and auditing. Password registration, printer sharing, and mailbox delegation do not manage privileged roles this way.

Access reviews have reviewers confirm continued need for access, which removes unnecessary permissions. Password reset, hybrid join, and passwordless sign-in are different capabilities.

Identity Protection detects risky sign-ins and users, and it can trigger policies that require stronger verification or password change. The other products do not detect identity risk.

Passkeys and Windows Hello for Business use device-bound cryptographic credentials that resist phishing. Longer reused passwords, written notes, and shared PINs remain vulnerable.

Microsoft Sentinel collects security data, detects threats, and automates responses with playbooks. Backup, CDN, and Blob Storage do not provide SIEM or SOAR capabilities.

Azure DDoS Protection defends public endpoints against network-layer attacks that overwhelm capacity. Key Vault stores secrets, Monitor collects telemetry, and Cost Management tracks spending.

Defender for Cloud provides security posture recommendations and threat protection for workloads across environments. Excel, Project, and Lists are productivity tools.

Defender for Endpoint provides endpoint detection and response on devices. The others focus on cloud apps, identity signals, and email and collaboration threats.

Defender for Identity analyses on-premises Active Directory traffic and events to detect identity-based attacks. The other products cover endpoints, email, or network filtering.

Defender for Office 365 protects email and collaboration tools with filtering, safe links, and safe attachments. Load balancers, DNS, and storage tools do not filter messages.

Azure Firewall is a managed stateful firewall with centralized rules for network traffic. Front Door is a global web entry point, Blob Storage stores data, and Lab Services provides labs.

Sensitivity labels classify content and can apply protections such as encryption and access restrictions that travel with it. Printer labels, calendar tags, and emojis do not protect content.

DLP policies detect sensitive information types and block or warn when they are shared inappropriately. Retention labels manage how long content is kept, Compliance Manager assesses controls, and audit search looks at activity records.

Retention policies and labels keep content for a defined period and can preserve deleted items as required. Hiding content, printing, and turning off backups do not meet a legal retention need.

eDiscovery searches and preserves content relevant to legal matters across Microsoft 365 sources. Batch, Forms, and Lists do not support legal discovery.

Compliance Manager assesses controls against regulatory frameworks and provides a score with improvement actions. DNS, chat, and cost analysis are unrelated to compliance assessment.

Audit records activity events across services for investigations and compliance. Paint, Bookings, and Forms are productivity applications.

Insider risk management identifies risky activity patterns such as data exfiltration indicators and surfaces them for investigation. Load balancers, printers, and calendar sync are unrelated.