SC-900 Security, Compliance, and Identity Fundamentals Study Guide

Exam Overview and Domain Weightings

• Effective Date: Updated for skills measured effective July 28, 2026.
• Exam Nature: Independent study aid aligned with Microsoft's official exam outline.
• Domain Weightings:
  • Security, compliance, and identity concepts: $10\% - 15\%$
  • Microsoft Entra: $25\% - 30\%$
  • Microsoft security solutions: $35\% - 40\%$
  • Microsoft compliance solutions: $20\% - 25\%$
• Study Method and Strategy:
  • Identify the primary problem each security, identity, or compliance product solves.
  • Aim for at least $80\%$ on fresh practice assessment questions.
  • Ensure full understanding of why correct choices are correct and why incorrect choices are wrong.
  • Time allocation during preparation should be prioritized based on domain weights: Microsoft Security Solutions ($35\% - 40\%$) > Microsoft Entra ($25\% - 30\%$) > Microsoft Compliance Solutions ($20\% - 25\%$) > Core Concepts ($10\% - 15\%$).
• Official Resources:
  • Official Study Guide: https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/sc-900
  • Certification Portal & Practice Assessment: https://learn.microsoft.com/en-us/credentials/certifications/security-compliance-and-identity-fundamentals/

Security, Compliance, and Identity Concepts

• Shared Responsibility Model:

  • Cloud Provider (Microsoft) Responsibility: Physical datacenters, physical server hardware, datacenter facilities, and the foundational cloud host infrastructure/platform.
  • Customer Responsibility: Data classification, data protection, user identities, account management, endpoint device configuration, and access control decisions.
  • Responsibility Division across Cloud Models:
  • Infrastructure as a Service (IaaS): Customer maintains the largest degree of control and responsibility (OS management, patches, network configuration).
  • Platform as a Service (PaaS): Responsibility is shared equally; Microsoft manages host infrastructure and OS, while customer manages application code and data.
  • Software as a Service (SaaS): Customer responsibility is smallest, limited primarily to data, identities, accounts, and access settings.

• Defense in Depth:

  • Definition: A holistic security strategy that implements multiple redundant, independent layers of security controls.
  • Core Security Layers: Physical security, Identity & Access, Perimeter, Network, Compute, Application, and Data.
  • Purpose: Ensures that if any single control or layer is breached, subsequent layers prevent or minimize damage.

• Zero Trust Model:

  • Core Principles:
  1. Verify explicitly: Always authenticate and authorize based on all available data points.
  2. Use least privilege access: Limit user access using Just-In-Time (JIT) and Just-Enough-Access (JEA) risk-based policies.
  3. Assume breach: Minimize blast radius, segment access, and employ end-to-end encryption.
  • Signal Evaluation: Continuous risk evaluation based on identity, device posture, location, real-time risk scores, application context, and data sensitivity.

• Encryption vs. Hashing:

  • Encryption: Reversible cryptographic protection requiring a secret key. Ensures data confidentiality. Applies to data at rest (storage) and data in transit (network delivery).
  • Hashing: One-way cryptographic transformation that cannot be reversed. Used for integrity verification and password validation (e.g., matching hash values).

• Governance, Risk Management, and Compliance (GRC):

  • Governance: Sets organizational direction, rules, decision-making rights, and accountability frameworks.
  • Risk Management: Identifies, evaluates, prioritizes, and mitigates strategic or operational uncertainties.
  • Compliance: Demonstrates adherence to external laws, industry regulations, contractual obligations, and internal organizational standards.

• Identity Fundamentals:

  • Authentication (AuthN): Verifies and proves the identity of a user, service, or device.
  • Authorization (AuthZ): Establishes permissions and determines what actions or resources an authenticated identity can access.
  • Identity Provider (IdP): Creates, manages, and authenticates identity principal information.
  • Directory: Centralized database storing identity objects, attributes, and relationship metadata.
  • Federation: Establishes a formal trust relationship across separate identity domains or organizations to enable secure cross-boundary single sign-on.

Microsoft Entra

• Microsoft Entra ID:

  • Cloud-native identity and access management (IAM) solution.
  • Manages authentication, authorization, single sign-on (SSO), application access, device management, and access lifecycle.
  • Note: Fully cloud-based and functionally distinct from legacy, on-premises Active Directory Domain Services (AD DS).

• Identity Types:

  • Human Identities: Member accounts (internal staff/employees) and Guest accounts (external vendors or partners).
  • Workload Identities: Non-human accounts representing applications, software services, or scripts (e.g., Service Principals and Managed Identities).
  • Device Identities: Physical or virtual endpoints managed via Registered, Entra Joined, or Hybrid Entra Joined states.
  • Agent Identities: Specialized identities assigned to autonomous AI agents to ensure proper access governance.

• Hybrid Identity:

  • Links local on-premises directories with Microsoft Entra ID.
  • Provides a single, unified user identity across on-premises and cloud resources.
  • Utilizes various synchronization (e.g., Entra Connect) and authentication architecture configurations.

• Authentication Methods and Passwordless Solutions:

  • Authentication Factors:
  • Knowledge: Something you know (e.g., passwords, PINs).
  • Possession: Something you have (e.g., mobile phone, hardware security key, physical token).
  • Inherence: Something you are (e.g., biometrics like fingerprint scans or facial recognition).
  • Multifactor Authentication (MFA): Enforces requirement of two or more distinct factor categories.
  • Passwordless Authentication Methods: Windows Hello for Business, Microsoft Authenticator app, Passkeys / FIDO2 hardware keys, Certificate-Based Authentication (CBA).

• Password Management Capabilities:

  • Self-Service Password Reset (SSPR): Enables users to reset credentials or unlock accounts without helpdesk intervention after completing verification challenges.
  • Password Protection: Prevents users from choosing weak, easily guessed, or custom-banned passwords.
  • Smart Lockout: Detects and mitigates brute-force credential-guessing attacks without locking out valid users.

• Conditional Access:

  • If-then policy engine enforcing conditional access controls after initial authentication.
  • Serves as the central policy decision point for Zero Trust architectures.
  • Evaluates real-time signals (user identity, location, app, device compliance, real-time risk level) to output access decisions (allow, block, require MFA, require managed device, or limit session privileges).

• Role-Based Access Control (RBAC):

  • Enforces least privilege access control through fine-grained role assignments at defined scopes.
  • Azure Roles: Manage access to Azure platform infrastructure and cloud resources (e.g., Virtual Machines, Storage Accounts).
  • Microsoft Entra Roles: Manage access to identity resources, objects, and directory configurations (e.g., User management, Billing, Domain settings).

• Identity Governance:

  • Automates and governs the identity lifecycle and access rights.
  • Entitlement Management: Bundles application rights, group memberships, and SharePoint access into Access Packages managed via approval rules and expiration lifecycles.
  • Access Reviews: Automates periodic re-certification of active permissions to audit ongoing access necessity.

• Privileged Identity Management (PIM) and Entra ID Protection:

  • Privileged Identity Management (PIM): Delivers Just-In-Time (JIT) administrative role activation with time limits, mandatory approval workflows, and step-up MFA.
  • Entra ID Protection: Uses machine learning algorithms to detect identity-based anomalies, classifying user risk and sign-in risk for automated remediation.

Microsoft Security Solutions

• Azure Network and Edge Defenses:

  • Azure DDoS Protection: Protects Azure hosted applications against volumetric layer 3 and layer 4 Distributed Denial-of-Service attacks.
  • Azure Firewall: Fully managed, stateful network firewall protecting cloud resources with native high availability and scaling.
  • Web Application Firewall (WAF): Centralized application-layer (Layer 7) protection for web applications against vulnerabilities like SQL Injection (SQLi) and Cross-Site Scripting (XSS).
  • Virtual Networks (VNets) and Subnets: Private, isolated network perimeters; subnets divide address spaces into logical segments.
  • Network Security Groups (NSGs): Stateful network filtering rules applied at the subnet or network interface level to permit or deny inbound and outbound traffic.

• Azure Bastion and Key Vault:

  • Azure Bastion: Fully managed PaaS service enabling private, browser-based RDP and SSH connectivity to virtual machines without exposing public IP addresses.
  • Azure Key Vault: Centralized secure store for managing and protecting cryptographic keys, secrets (passwords, connection strings), and SSL/TLS certificates.

• Microsoft Defender for Cloud:

  • Cloud-Native Application Protection Platform (CNAPP) securing resources across Azure, AWS, GCP, and on-premises environments.
  • Cloud Security Posture Management (CSPM): Continually analyzes cloud configurations against security standards, assigns a Secure Posture Score, and delivers hardening recommendations.
  • Cloud Workload Protection (CWP): Provides real-time threat detection and advanced defenses for workloads like virtual servers, containers, databases, and storage.
  • Posture Score Note: Used for prioritization and risk measurement; a high or maximum score does not guarantee absolute security.

• Microsoft Sentinel:

  • Cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) platform.
  • SIEM Functions: Collects, aggregates, correlates, and analyzes security telemetry across enterprise environments.
  • SOAR Functions: Orchestrates response actions and automates incident mitigation.
  • Core Components:
  • Analytics Rules: Generate alerts and incidents from custom or out-of-the-box search patterns.
  • Workbooks: Interactive visualization dashboards for security metrics.
  • Hunting Queries: Proactive, manual search queries used to detect unknown security threats before alerts fire.
  • Playbooks: Automated remediation workflows built on Azure Logic Apps.

• Microsoft Defender XDR:

  • Unified security operations platform that natively correlates threat signals across endpoints, identities, email, collaboration tools, and cloud apps into structured incidents.

• Microsoft Defender Product Family:

  • Defender for Endpoint: Secures enterprise client and server devices (EDR, endpoint protection).
  • Defender for Office 365: Protects email systems and collaboration applications (Teams, SharePoint, OneDrive) from phishing, malicious links, and attachments.
  • Defender for Identity: Monitors local Active Directory Domain Services signals to detect identity compromise and insider threats.
  • Defender for Cloud Apps: Cloud Access Security Broker (CASB) offering SaaS discovery, visibility, shadow IT tracking, and data protection.
  • Defender Vulnerability Management: Assesses, prioritizes, and remediates software vulnerabilities.
  • Defender Threat Intelligence: Delivers raw and curated threat actor profiling and infrastructure intelligence.
  • Microsoft Defender Portal: Unified single pane of glass for monitoring security operations across all Defender services.

Microsoft Compliance Solutions

• Service Trust Portal and Microsoft Privacy Principles:

  • Service Trust Portal (STP): Publicly accessible site containing Microsoft third-party audit reports, compliance guides, SOC assessments, and ISO certifications.
  • Microsoft Privacy Principles: Control, Transparency, Strong Legal Protections, No Content-Based Advertising, Security.

• Microsoft Purview and Compliance Manager:

  • Microsoft Purview: Comprehensive portfolio governing, protecting, and managing data compliance and data risk across enterprise estates.
  • Compliance Manager: Tool mapping organizational controls to global regulations, providing improvement recommendations and action steps.
  • Compliance Score: Quantified measurement tracking execution of recommended compliance actions. Note: It serves as a progress tool and risk metric, not a legal certification or guarantee of legal compliance.

• Data Classification and Explorers:

  • Sensitive Information Types (SITs): Pattern-based identifiers (e.g., regex checks for credit card numbers, national identification numbers, bank accounts).
  • Trainable Classifiers: Machine learning models trained on structural context to recognize document types (e.g., source code, legal agreements, financial documents).
  • Content Explorer: Grants permissioned administrators visibility into files containing sensitive information or applied labels.
  • Activity Explorer: Provides historical visibility into user and system actions performed on labeled or sensitive content.

• Sensitivity Labels:

  • Used to classify and protect files, emails, and container boundaries.
  • Protection capabilities: Enforce encryption, restrict access permissions, apply visual watermarks/headers/footers, and configure container security.
  • Label Policies: Publish sensitivity labels to specific scopes/users.
  • Auto-labeling: Automatically applies sensitivity labels when specific SITs or condition patterns are detected.

• Data Loss Prevention (DLP):

  • Detects, audits, warns, or blocks unauthorized sharing or transfer of sensitive information across endpoints, apps, email, and cloud locations.
  • Evaluates policies based on data content and context regardless of location.

• Retention and Records Management:

  • Retention Policies: Broad lifecycle management rules applied broadly across entire locations or workloads (e.g., entire SharePoint sites or Exchange mailboxes).
  • Retention Labels: Granular, item-level retention or deletion classifications applied to specific documents or emails.
  • Records Management: Imposes legal, strict retention rules, immutability protections, and disposition workflows for official corporate or regulatory records.

High-Yield Technical Comparisons

Practice Questions, Answers, and Explanations

• Question 1: Which responsibility always remains with a cloud customer?

  • A. Physical datacenter security
  • B. Protecting and classifying its data
  • C. Replacing failed host hardware
  • D. Securing the cloud hypervisor
  • Answer: B
  • Explanation: Under the Shared Responsibility Model, the customer always retains full responsibility for protecting and classifying data, identity governance, and access decisions across all cloud service types (IaaS, PaaS, SaaS).

• Question 2: An organization applies controls at the identity, network, application, and data layers. What concept is this?

  • A. Federation
  • B. Defense in depth
  • C. Single sign-on
  • D. Data residency
  • Answer: B
  • Explanation: Defense in depth uses multiple independent, layered controls across physical, identity, perimeter, network, compute, application, and data boundaries so that the failure of one layer does not compromise the entire environment.

• Question 3: Which action best demonstrates Zero Trust?

  • A. Trust all traffic on the corporate LAN
  • B. Verify identity and device signals for every access request
  • C. Give permanent admin rights to speed up work
  • D. Disable logging after a successful sign-in
  • Answer: B
  • Explanation: Zero Trust relies on explicitly verifying every access request using all available contextual signals (identity, device state, location, risk) rather than trusting network boundaries.

• Question 4: Which statement about hashing is correct?

  • A. It is designed to be reversed with a key
  • B. It provides a one-way value useful for integrity checks
  • C. It replaces authorization
  • D. It hides data only while in transit
  • Answer: B
  • Explanation: Hashing is a one-way mathematical function that converts input data into a fixed-length value. Because it cannot be reversed, it is used for verifying data integrity and password matching.

• Question 5: A user signs in successfully but cannot edit a file. Which process denied the edit?

  • A. Authentication
  • B. Authorization
  • C. Federation
  • D. Hashing
  • Answer: B
  • Explanation: Authentication verified who the user was (successful sign-in). Authorization evaluates permissions to determine what actions or resources the user may access, and thus denied the edit action.

• Question 6: What does federation provide?

  • A. A trust relationship between identity systems
  • B. A backup of every user password
  • C. Network segmentation
  • D. Data retention
  • Answer: A
  • Explanation: Federation establishes a secure trust relationship between separate identity providers, allowing users to access resources across organizational boundaries without needing separate credentials.

• Question 7: What is Microsoft Entra ID primarily?

  • A. A cloud identity and access management service
  • B. A packet-filtering firewall
  • C. A data warehouse
  • D. An endpoint operating system
  • Answer: A
  • Explanation: Microsoft Entra ID is Microsoft's multi-tenant, cloud-based identity and access management (IAM) platform.

• Question 8: Which identity best allows an Azure resource to access another resource without storing credentials in code?

  • A. Guest user
  • B. Managed identity
  • C. Distribution list
  • D. Local administrator
  • Answer: B
  • Explanation: Managed identities provide Azure services with an automatically managed identity in Entra ID, eliminating the need for developers to embed credentials or secrets in code.

• Question 9: Which is a workload identity?

  • A. A service principal used by an application
  • B. A human employee account
  • C. A registered laptop
  • D. A security group
  • Answer: A
  • Explanation: Workload identities represent non-human software entities, such as application service principals or managed identities.

• Question 10: What does hybrid identity mean?

  • A. Only cloud accounts exist
  • B. On-premises and cloud identity environments are connected
  • C. All users share one account
  • D. Authentication is disabled offline
  • Answer: B
  • Explanation: Hybrid identity bridges local directories (like on-premises Active Directory Domain Services) with Microsoft Entra ID to establish a common identity for access across cloud and local resources.

• Question 11: A password plus a fingerprint is what?

  • A. Two knowledge factors
  • B. Multifactor authentication
  • C. Federation
  • D. Authorization
  • Answer: B
  • Explanation: A password is a knowledge factor ("something you know") and a fingerprint is an inherence factor ("something you are"). Using two different factor categories fulfills Multifactor Authentication (MFA).

• Question 12: Which feature lets users reset their own passwords after verification?

  • A. SSPR
  • B. PIM
  • C. WAF
  • D. DLP
  • Answer: A
  • Explanation: Self-Service Password Reset (SSPR) allows users to reset their credentials or unlock accounts without helpdesk intervention.

• Question 13: What is the main purpose of Conditional Access?

  • A. Store encryption keys
  • B. Use signals and conditions to enforce access controls
  • C. Scan email attachments
  • D. Retain records
  • Answer: B
  • Explanation: Conditional Access evaluates operational signals (user, location, device state, app, risk) to apply access decisions like forcing MFA, requiring compliance, or blocking access.

• Question 14: Which control best follows least privilege for administrators?

  • A. Permanent Global Administrator for everyone
  • B. PIM eligible assignment with time-limited activation
  • C. One shared admin account
  • D. No MFA for emergency access
  • Answer: B
  • Explanation: Privileged Identity Management (PIM) allows users to hold eligible administrative assignments that require time-bound, justified Just-In-Time (JIT) activation rather than standing, permanent admin rights.

• Question 15: A manager must periodically confirm that contractors still need group membership. What should be used?

  • A. Access reviews
  • B. Azure Firewall
  • C. Secure Score
  • D. DDoS Protection
  • Answer: A
  • Explanation: Access reviews enable organizations to recertify group memberships, application assignments, and privileged roles on a recurring schedule.

• Question 16: Which service detects risky users and risky sign-ins?

  • A. Entra ID Protection
  • B. Azure Bastion
  • C. Compliance Manager
  • D. Content explorer
  • Answer: A
  • Explanation: Entra ID Protection uses machine learning and telemetry to detect identity risks, distinguishing user risk and real-time sign-in risk.

• Question 17: Which statement correctly distinguishes roles?

  • A. Azure roles manage identity objects only
  • B. Entra roles manage identity resources; Azure roles manage Azure resources
  • C. Both are identical
  • D. RBAC is only for networks
  • Answer: B
  • Explanation: Microsoft Entra roles govern directory objects and identity operations (users, domains, app registrations), whereas Azure RBAC roles govern Azure platform resources (virtual networks, storage, compute).

• Question 18: Which service is designed to mitigate large-scale volumetric network attacks?

  • A. Azure DDoS Protection
  • B. Microsoft Purview
  • C. PIM
  • D. Defender for Office 365
  • Answer: A
  • Explanation: Azure DDoS Protection protects applications hosted in Azure against volumetric Layer 3 and Layer 4 network attacks.

• Question 19: Which service filters managed network traffic using stateful rules?

  • A. Azure Firewall
  • B. Sensitivity labels
  • C. Microsoft Sentinel
  • D. Service Trust Portal
  • Answer: A
  • Explanation: Azure Firewall is a cloud-native, fully managed stateful network security system that filters network and application traffic.

• Question 20: Which service is tailored to protect web apps from SQL injection and cross-site scripting?

  • A. WAF
  • B. NSG
  • C. Key Vault
  • D. Access review
  • Answer: A
  • Explanation: Web Application Firewall (WAF) inspects Layer 7 web traffic to defend web applications from common web exploits like SQL injection (SQLi) and Cross-Site Scripting (XSS).

• Question 21: What do network security groups do?

  • A. Apply allow/deny rules to inbound and outbound network traffic
  • B. Store certificates
  • C. Classify documents
  • D. Automate incident response
  • Answer: A
  • Explanation: Network Security Groups (NSGs) filter IP and port traffic arriving at or leaving Azure Virtual Network subnets or individual network interfaces.

• Question 22: An admin needs browser-based RDP to an Azure VM without a public IP. What should be used?

  • A. Azure Bastion
  • B. Azure DDoS Protection
  • C. Defender for Identity
  • D. Activity explorer
  • Answer: A
  • Explanation: Azure Bastion streams secure, direct browser-based RDP and SSH connectivity directly to private virtual machines through HTML5 without exposing public IP addresses.

• Question 23: Where should an application securely store secrets, keys, and certificates?

  • A. Azure Key Vault
  • B. Microsoft Sentinel workbook
  • C. Compliance Manager
  • D. A public repository
  • Answer: A
  • Explanation: Azure Key Vault provides central key management, secret storage, and certificate management secured by hardware or software modules.

• Question 24: Which service combines cloud security posture management and cloud workload protection?

  • A. Microsoft Defender for Cloud
  • B. Defender for Office 365
  • C. Entra ID
  • D. Service Trust Portal
  • Answer: A
  • Explanation: Microsoft Defender for Cloud combines CSPM (posture scoring, misconfiguration assessment) and CWP (threat detection across compute, storage, databases, and containers).

• Question 25: What is the purpose of CSPM recommendations?

  • A. Improve misconfigurations and security posture
  • B. Assign permanent admin access
  • C. Deliver marketing email
  • D. Replace retention policies
  • Answer: A
  • Explanation: Cloud Security Posture Management recommendations provide guided steps to correct security misconfigurations and improve overall cloud security posture.

• Question 26: Which term describes collecting and correlating security events for analysis?

  • A. SIEM
  • B. SOAR
  • C. DLP
  • D. RBAC
  • Answer: A
  • Explanation: Security Information and Event Management (SIEM) aggregates and correlates event log data across systems for threat detection and response.

• Question 27: Which term describes automated security response workflows?

  • A. SOAR
  • B. SIEM
  • C. GRC
  • D. SSPR
  • Answer: A
  • Explanation: Security Orchestration, Automation, and Response (SOAR) automates response tasks and orchestrates incident resolution workflows.

• Question 28: In Microsoft Sentinel, what automates a response to an incident?

  • A. Playbook
  • B. Sensitivity label
  • C. Access package
  • D. Network security group
  • Answer: A
  • Explanation: Playbooks in Microsoft Sentinel use Logic Apps workflows to execute automated security operations and mitigation actions.

• Question 29: Which Sentinel feature is commonly used to visualize security data?

  • A. Workbook
  • B. Retention label
  • C. Key vault
  • D. Password protection
  • Answer: A
  • Explanation: Workbooks provide interactive visualization dashboards for querying, analyzing, and reporting security telemetry collected inside Sentinel.

• Question 30: Which solution correlates alerts across endpoints, identities, email, and cloud apps?

  • A. Microsoft Defender XDR
  • B. Azure Bastion
  • C. Compliance Manager
  • D. Azure DDoS Protection
  • Answer: A
  • Explanation: Microsoft Defender XDR integrates and correlates alerts from endpoint, identity, email, and SaaS app security components into unified threat incidents.

• Question 31: Which product protects email and collaboration tools from threats?