CertSafari

    Free Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-900) Sample Questions

    35 free sample questions from our bank of 348+, covering every exam domain, with answers and detailed explanations. Updated September 2026.

    Practice all 348 questions in quiz mode

    Domain 1: Describe the concepts of security, compliance, and identity

    Subdomain 1.2: Define identity concepts

    1.Which statement best describes identity as the primary security perimeter in a modern security approach?

    1. A.Access decisions rely primarily on verifying who or what is requesting access, rather than on the network location of the request
    2. B.Access decisions rely primarily on the physical location of the datacenter hosting the resource being requested
    3. C.Access decisions rely primarily on whether the request originates from inside the corporate firewall
    4. D.Access decisions rely primarily on the strength of the encryption algorithm used to transmit the request
    Show answer & explanation

    Correct answer: A — Access decisions rely primarily on verifying who or what is requesting access, rather than on the network location of the request

    • A. Correct. As organizations move away from network-based perimeters, identity becomes the control point: access is granted based on verifying the requesting user, device, or workload rather than where the request originates.
    • B. Incorrect. Datacenter location is an infrastructure detail and does not verify who or what is making the request, so it cannot serve as a security perimeter.
    • C. Incorrect. Trusting requests simply because they come from inside a corporate network reflects the older network-perimeter model that identity-centric security replaces.
    • D. Incorrect. Encryption strength protects data in transit but says nothing about whether the requesting identity should be trusted, so it does not define the perimeter.

    Subdomain 1.2: Define identity concepts

    2.What best describes the general concept of a directory service?

    1. A.A centralized store that organizes and manages information about identities such as users, groups, and devices in a structured, searchable way
    2. B.A tool that encrypts data at rest so that only authorized applications can decrypt it
    3. C.A monitoring dashboard that displays real-time network traffic between virtual machines
    4. D.A backup system that copies identity records to a secondary datacenter for disaster recovery
    Show answer & explanation

    Correct answer: A — A centralized store that organizes and manages information about identities such as users, groups, and devices in a structured, searchable way

    • A. Correct. A directory service centrally organizes identity-related objects, such as user and device records, in a structured way that applications can query and use.
    • B. Incorrect. Encrypting data at rest is a data-protection function; it is unrelated to organizing and looking up identity information.
    • C. Incorrect. Displaying network traffic between virtual machines describes a network monitoring tool, not a store of identity information.
    • D. Incorrect. Copying records for disaster recovery describes a backup process, not the core function of organizing identity data for lookup and management.

    Subdomain 1.1: Describe security and compliance concepts

    3.In the shared responsibility model, which responsibility does a customer always retain regardless of whether they use on-premises, IaaS, PaaS, or SaaS?

    1. A.Managing and classifying their own data
    2. B.Maintaining the physical datacenter facilities
    3. C.Patching the underlying hypervisor
    4. D.Securing the physical network cabling
    Show answer & explanation

    Correct answer: A — Managing and classifying their own data

    • A. Customers always retain responsibility for their own data, including classification, protection, and encryption decisions, no matter which deployment model is used.
    • B. Physical datacenter facilities are managed by the cloud provider in every hosted deployment model, so this is never a customer responsibility once workloads move off-premises.
    • C. The hypervisor layer is managed by the cloud provider in IaaS, PaaS, and SaaS, so patching it is not a customer task.
    • D. Physical network cabling within a cloud provider's datacenter is managed by the provider, not the customer, in hosted deployment models.

    Subdomain 1.1: Describe security and compliance concepts

    4.Which encryption concept protects data while it is stored on a disk, database, or backup medium?

    1. A.Encryption at rest
    2. B.Encryption in transit
    3. C.Hashing
    4. D.Tokenization
    Show answer & explanation

    Correct answer: A — Encryption at rest

    • A. Encryption at rest protects data while it is stored, such as on a disk, database, or backup, so it remains unreadable without the correct decryption key.
    • B. Encryption in transit protects data as it moves across a network between systems, not while it is sitting in storage.
    • C. Hashing produces a one-way fixed-length value used for integrity verification, not for protecting stored data through reversible encryption.
    • D. Tokenization replaces sensitive data with a non-sensitive substitute value; it is a different technique from encrypting data at rest.

    Subdomain 1.1: Describe security and compliance concepts

    5.Hashing is a reversible process, meaning the original input data can always be recovered from its hash value using the correct key.

    1. A.True
    2. B.False
    Show answer & explanation

    Correct answer: B — False

    • A. This is not true: hashing is specifically designed to be a one-way, irreversible process, unlike encryption which can be reversed with a key.
    • B. This is false: hashing produces a fixed-length value that cannot be reversed back into the original input, regardless of any key, which is what makes it useful for integrity verification.

    Domain 2: Describe the capabilities of Microsoft Entra

    Subdomain 2.1: Describe function and identity types of Microsoft Entra ID

    6.Which Microsoft Entra product is described as the foundational product that provides authentication, policy enforcement, and protection for users, devices, apps, and resources, and is automatically included in every Microsoft 365, Azure, or Dynamics CRM Online tenant?

    1. A.Microsoft Entra ID
    2. B.Microsoft Entra Domain Services
    3. C.Microsoft Entra Workload ID
    4. D.Microsoft Entra Verified ID
    Show answer & explanation

    Correct answer: A — Microsoft Entra ID

    • A. Every Microsoft 365, Azure, or Dynamics CRM Online subscriber already has a directory in this foundational identity service, making it the correct match for the description.
    • B. This product provides managed domain services like group policy, LDAP, and Kerberos/NTLM for legacy applications, but it is not automatically included with every tenant.
    • C. This product secures identities for applications, services, and containers rather than serving as the tenant's foundational identity directory.
    • D. This product issues and verifies digital credentials based on decentralized identity standards, which is a narrower, opt-in capability.

    Subdomain 2.1: Describe function and identity types of Microsoft Entra ID

    7.A company's compliance team requires that all user password validation occur strictly on-premises, with no password data of any kind synchronized to the cloud. Which Microsoft Entra sign-in method satisfies this requirement?

    1. A.Federation with AD FS
    2. B.Password hash synchronization
    3. C.Pass-through authentication
    4. D.Seamless single sign-on
    Show answer & explanation

    Correct answer: A — Federation with AD FS

    • A. Federation with a service such as AD FS ensures that all user authentication occurs on-premises, satisfying a requirement that no password data be synchronized to the cloud at all.
    • B. Password hash synchronization synchronizes a hash of the password hash to the cloud, which conflicts with a requirement that no password data leave the on-premises environment.
    • C. Pass-through authentication validates passwords against on-premises Active Directory, but authentication still routes through the cloud sign-in flow rather than occurring entirely on-premises like federation.
    • D. Seamless single sign-on improves the sign-in experience on domain-joined devices but is a complementary feature, not a standalone method that keeps all password validation on-premises.

    Subdomain 2.1: Describe function and identity types of Microsoft Entra ID

    8.An administrator is deploying pass-through authentication for their organization. Which of the following are benefits of choosing this method over password hash synchronization? (Select all that apply.)(Select 3)

    1. A.On-premises passwords are validated in real time and are never stored in the cloud in any form
    2. B.It enforces on-premises Active Directory account lockout and password policies at the moment of sign-in
    3. C.It removes the need to install any lightweight agent software on any on-premises server
    4. D.It works seamlessly with Conditional Access policies such as multifactor authentication
    5. E.It eliminates the need for internet connectivity between the on-premises network and the cloud
    Show answer & explanation

    Correct answers: A, B, D — On-premises passwords are validated in real time and are never stored in the cloud in any form; It enforces on-premises Active Directory account lockout and password policies at the moment of sign-in; It works seamlessly with Conditional Access policies such as multifactor authentication

    • A. Pass-through authentication validates the password against Active Directory at the moment of sign-in, so no form of the password is stored in the cloud.
    • B. Because validation happens directly against on-premises Active Directory, current account lockout and password policies are enforced immediately, unlike a synchronized copy of a hash.
    • C. Pass-through authentication requires a lightweight on-premises agent to be installed to listen for and answer password validation requests, so this is not a benefit it provides.
    • D. Pass-through authentication is designed to work with Conditional Access features, including multifactor authentication, to help secure sign-ins.
    • E. The on-premises agent must make outbound connections to Microsoft Entra ID over the internet, so connectivity is still required rather than eliminated.

    Subdomain 2.2: Describe authentication capabilities of Microsoft Entra ID

    9.Which authentication method can serve as both a primary sign-in credential and a passwordless method in Microsoft Entra ID, using biometrics or a PIN tied to a specific Windows device?

    1. A.Windows Hello for Business
    2. B.Temporary Access Pass
    3. C.Software OATH token
    4. D.Voice call
    Show answer & explanation

    Correct answer: A — Windows Hello for Business

    • A. Windows Hello for Business replaces the password with a device-bound credential unlocked by biometrics or a PIN, supporting passwordless primary sign-in.
    • B. A Temporary Access Pass is a short-lived, time-limited passcode typically used for onboarding or recovery, not an everyday device-bound biometric credential.
    • C. A software OATH token generates time-based codes for secondary verification and is not a device-bound biometric primary credential.
    • D. Voice call is used only as a secondary or SSPR verification method and cannot serve as a primary sign-in credential.

    Subdomain 2.2: Describe authentication capabilities of Microsoft Entra ID

    10.Which statement about Microsoft Entra Password Protection licensing is correct?

    1. A.The global banned password list works for cloud-only users on Microsoft Entra ID Free, while a custom banned password list requires Microsoft Entra ID P1 or P2
    2. B.Both the global and custom banned password lists require Microsoft Entra ID P2 for all user types
    3. C.The custom banned password list is available on Microsoft Entra ID Free, but the global list requires P1
    4. D.Neither the global nor the custom banned password list requires any specific license tier
    Show answer & explanation

    Correct answer: A — The global banned password list works for cloud-only users on Microsoft Entra ID Free, while a custom banned password list requires Microsoft Entra ID P1 or P2

    • A. Cloud-only users get global banned password list protection on the Free tier, while enabling a custom banned password list requires Microsoft Entra ID P1 or P2 licensing.
    • B. The global list is available to cloud-only users without a P2 requirement, so demanding P2 for both features misstates the licensing model.
    • C. This reverses the actual requirement — the global list is the one available on the Free tier, while the custom list is the P1/P2 feature.
    • D. The custom banned password list specifically requires Microsoft Entra ID P1 or P2, so licensing does matter for at least one of these features.

    Subdomain 2.3: Describe access management capabilities of Microsoft Entra ID

    11.Which Microsoft Entra ID license edition is required to use Conditional Access?

    1. A.Microsoft Entra ID P1
    2. B.Microsoft Entra ID Free
    3. C.Microsoft Entra ID Basic
    4. D.Microsoft Entra ID Trial
    Show answer & explanation

    Correct answer: A — Microsoft Entra ID P1

    • A. Using Conditional Access requires Microsoft Entra ID P1 licenses, or the equivalent entitlement included with Microsoft 365 Business Premium. This is the baseline paid tier that unlocks the feature.
    • B. The Free edition does not include Conditional Access; organizations on Free tiers instead rely on baseline protections like security defaults. A paid P1 license is needed for full policy customization.
    • C. Microsoft Entra ID Basic is not a current licensing tier name for this capability, and no such edition grants Conditional Access. The correct requirement is the P1 tier.
    • D. A trial license may temporarily unlock premium features for evaluation purposes, but it is not the licensing tier that permanently grants Conditional Access. The feature is tied to P1 entitlement, not trial status.

    Subdomain 2.3: Describe access management capabilities of Microsoft Entra ID

    12.Conditional Access policies are enforced after ___ authentication is completed.

    1. A.first-factor
    2. B.biometric
    3. C.certificate-based
    Show answer & explanation

    Correct answer: A — first-factor

    • A. Conditional Access policies are enforced after first-factor authentication is completed, which is the documented point in the sign-in flow at which the policy engine evaluates signals. This is why it is not intended as a frontline defense against pre-authentication attacks.
    • B. Biometric authentication is one specific method a user might use as a factor, such as with Windows Hello, but the documented enforcement point is described generally as after first-factor authentication, not specifically after a biometric step.
    • C. Certificate-based authentication is another specific authentication method rather than the general term used to describe when Conditional Access is enforced. The documented phrase refers to first-factor authentication broadly.

    Subdomain 2.4: Describe identity protection and governance capabilities of Microsoft Entra

    13.An organization wants to guarantee it never loses the ability to administer Microsoft Entra ID because every eligible Global Administrator assignment was mistakenly removed at once. Which Privileged Identity Management protection addresses this?

    1. A.Preventing removal of the last active Global Administrator and Privileged Role Administrator assignments
    2. B.Guaranteeing that every user in the tenant automatically has administrator access
    3. C.Ensuring that guest accounts can never be assigned any administrative role
    4. D.Requiring every administrator to reauthenticate with a smart card each day
    Show answer & explanation

    Correct answer: A — Preventing removal of the last active Global Administrator and Privileged Role Administrator assignments

    • A. This is correct. Privileged Identity Management blocks the removal of the last active Global Administrator or Privileged Role Administrator so the tenant is never left without administrative access.
    • B. Granting every user administrator access would violate least privilege and is the opposite of what PIM is designed to enforce.
    • C. PIM does not categorically block guest accounts from administrative roles; access is governed by assignment and activation controls instead.
    • D. Smart card reauthentication is an authentication method choice, not the last-administrator protection PIM provides.

    Subdomain 2.4: Describe identity protection and governance capabilities of Microsoft Entra

    14.Which of the following are key features that Microsoft Entra Privileged Identity Management provides? (Select all that apply)(Select 3)

    1. A.Just-in-time privileged access
    2. B.Time-bound role assignment windows
    3. C.Automatic encryption of data
    4. D.Permanent access once assigned
    5. E.Real-time email attachment scanning
    6. F.Multifactor authentication at activation
    Show answer & explanation

    Correct answers: A, B, F — Just-in-time privileged access; Time-bound role assignment windows; Multifactor authentication at activation

    • A. Correct. PIM grants privileged access only when a user needs it, reducing standing exposure of sensitive roles.
    • B. Correct. PIM assignments can be scoped to start and end dates so access is only valid for a defined window.
    • C. Incorrect. Encrypting data is a data protection capability handled elsewhere, not a Privileged Identity Management feature.
    • D. Incorrect. PIM is built around time-bound and activation-based access rather than guaranteeing permanent access once granted.
    • E. Incorrect. Scanning email attachments is an email security function unrelated to privileged role management.
    • F. Correct. PIM can require multifactor authentication before a user is allowed to activate an eligible role.

    Subdomain 2.4: Describe identity protection and governance capabilities of Microsoft Entra

    15.Microsoft Entra ID Protection generates a sign-in ___ level during each sign-in, based on real-time detections, to indicate how likely the sign-in is compromised.

    1. A.risk
    2. B.compliance
    3. C.trust
    Show answer & explanation

    Correct answer: A — risk

    • A. Correct. Identity Protection runs real-time sign-in detections during each sign-in and generates a risk level used to decide what policies to apply.
    • B. Incorrect. Compliance level is not a concept Identity Protection generates during sign-in evaluation.
    • C. Incorrect. Identity Protection does not produce a "trust level" label for sign-ins; it produces a risk level.

    Domain 3: Describe the capabilities of Microsoft security solutions

    Subdomain 3.2: Describe security management capabilities of Azure

    16.____ lets security teams model how an attacker could combine multiple risks to reach a sensitive resource, and it is available only with the Defender CSPM plan.

    1. A.Secure score
    2. B.Attack path analysis
    3. C.Cloud security explorer
    Show answer & explanation

    Correct answer: B — Attack path analysis

    • A. This metric summarizes remediation progress as a number; it does not model chains of risk leading to a resource.
    • B. This is the correct fit because it specifically chains individual weaknesses together to show a realistic path an attacker could take.
    • C. This tool provides a queryable map of the environment for finding risks, but modeling a chained attacker path is a distinct capability.

    Subdomain 3.2: Describe security management capabilities of Azure

    17.Which capability in Microsoft Defender for Cloud continuously assesses resource configurations and issues recommendations to improve security posture?

    1. A.Cloud Security Posture Management (CSPM)
    2. B.Cloud Workload Protection Platform (CWPP)
    3. C.Security Information and Event Management (SIEM)
    4. D.Security Orchestration, Automation, and Response (SOAR)
    Show answer & explanation

    Correct answer: A — Cloud Security Posture Management (CSPM)

    • A. This is correct because assessing configuration and generating recommendations to close gaps is the defining job of posture management.
    • B. This capability defends running workloads such as VMs and containers from active threats rather than assessing baseline configuration.
    • C. This describes log aggregation and detection analytics, which is the role Microsoft Sentinel plays, not configuration assessment.
    • D. This describes automated incident response playbooks, which act after a threat is detected rather than assessing posture beforehand.

    Subdomain 3.1: Describe core infrastructure security services in Azure

    18.Which Azure networking feature lets two virtual networks, even in different Azure regions, connect so that resources in either network can communicate with each other?

    1. A.Virtual network peering
    2. B.Network security group
    3. C.Azure Bastion
    4. D.Application security group
    Show answer & explanation

    Correct answer: A — Virtual network peering

    • A. Virtual network peering is correct because it connects two virtual networks, regardless of region, so resources in either network can communicate directly with each other.
    • B. A network security group is incorrect because it filters traffic with allow/deny rules and does not itself connect two separate virtual networks.
    • C. Azure Bastion is incorrect because it provides remote administrative access to virtual machines and has no role in connecting virtual networks to each other.
    • D. An application security group is incorrect because it groups virtual machines for use in security rules and does not connect virtual networks together.

    Subdomain 3.1: Describe core infrastructure security services in Azure

    19.An administrator needs to let developers connect to a set of internal virtual machines by RDP for troubleshooting, but company policy forbids assigning public IP addresses to any VM. Which service meets this requirement without requiring a VPN client?

    1. A.Azure Bastion, which is deployed in the virtual network and brokers RDP/SSH sessions over TLS through the Azure portal
    2. B.A network security group, which only allows or denies traffic and cannot broker or proxy a remote desktop session itself
    3. C.Azure DDoS Protection, which mitigates volumetric attacks but does not provide any remote connectivity to virtual machines
    4. D.Azure Key Vault, which stores secrets and certificates but does not broker network connections to virtual machines
    Show answer & explanation

    Correct answer: A — Azure Bastion, which is deployed in the virtual network and brokers RDP/SSH sessions over TLS through the Azure portal

    • A. This is correct because Azure Bastion is deployed inside the virtual network and lets developers connect to VMs by RDP over TLS through the Azure portal, with no public IP or VPN client needed on the target machine.
    • B. This is incorrect because a network security group can only allow or deny traffic by rule; it cannot broker or proxy an actual remote desktop session.
    • C. This is incorrect because DDoS Protection defends against volumetric network attacks and has no capability to establish or broker remote administrative sessions.
    • D. This is incorrect because Key Vault securely stores secrets, keys, and certificates but does not broker or proxy network connections to virtual machines.

    Subdomain 3.3: Describe capabilities of Microsoft Sentinel

    20.Microsoft Sentinel is a cloud-native SIEM and SOAR solution that uses AI, analytics, and automation for threat detection, investigation, and response.

    1. A.True
    2. B.False
    Show answer & explanation

    Correct answer: A — True

    • A. This statement is accurate: Microsoft Sentinel is described as a cloud-native SIEM and SOAR solution that combines AI, automation, and threat intelligence.
    • B. This statement is not the correct evaluation, because Microsoft Sentinel is in fact marketed and documented as combining both SIEM and SOAR capabilities.

    Subdomain 3.3: Describe capabilities of Microsoft Sentinel

    21.Threat hunting in Microsoft Sentinel allows analysts to proactively search for suspicious activity before an alert has been triggered.

    1. A.True
    2. B.False
    Show answer & explanation

    Correct answer: A — True

    • A. This statement is accurate: hunting provides search-and-query tools that let analysts look for threats proactively, ahead of any triggered alert.
    • B. This statement is not the correct evaluation, because proactive, pre-alert searching is exactly what hunting is designed to provide.

    Subdomain 3.3: Describe capabilities of Microsoft Sentinel

    22.What is the primary purpose of automation rules in Microsoft Sentinel?

    1. A.To coordinate how incidents are handled and routed across different scenarios
    2. B.To centrally manage which analysts are granted read access to the workspace
    3. C.To centrally manage the retention period applied to ingested log data
    4. D.To centrally manage which data connectors appear in the content hub catalog
    Show answer & explanation

    Correct answer: A — To coordinate how incidents are handled and routed across different scenarios

    • A. Automation rules centrally define and coordinate how incidents are handled, assigned, and closed across different scenarios.
    • B. Managing analyst read access is an identity and role-based access control concern, not the function of an automation rule.
    • C. Managing log data retention periods is a workspace data-management setting, unrelated to automation rules.
    • D. Managing which connectors appear in the content hub is a catalog concern and not what automation rules do.

    Subdomain 3.4: Describe threat protection with Microsoft Defender XDR

    23.What is the primary purpose of Microsoft Defender XDR?

    1. A.Coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications in one suite
    2. B.Manages identity and access permissions for on-premises Active Directory domain controllers exclusively, with no cloud correlation
    3. C.Scans application source code repositories to find vulnerable open-source software packages before they reach production
    4. D.Encrypts and rotates certificates and keys used to protect virtual machine disks running in Azure subscriptions
    Show answer & explanation

    Correct answer: A — Coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications in one suite

    • A. This matches Defender XDR's role as a unified pre- and post-breach defense suite that natively coordinates protection across multiple workloads.
    • B. Managing on-premises AD identity permissions exclusively describes traditional directory administration, not the cross-workload correlation Defender XDR performs.
    • C. Scanning source code for vulnerable dependencies describes software composition analysis tooling, not Defender XDR's threat protection scope.
    • D. Rotating VM disk encryption keys describes Azure Key Vault-style key management, not Defender XDR's detection and response function.

    Subdomain 3.4: Describe threat protection with Microsoft Defender XDR

    24.What do Defender for Identity's proactive identity security posture assessments provide?

    1. A.Identification of risky identity configurations and lateral movement paths, surfaced through Microsoft Secure Score
    2. B.A list of every password reset performed by the helpdesk in the past year
    3. C.A ranked list of the organization's most frequently visited internal SharePoint sites
    4. D.A count of licensed Microsoft 365 seats currently assigned to guest accounts
    Show answer & explanation

    Correct answer: A — Identification of risky identity configurations and lateral movement paths, surfaced through Microsoft Secure Score

    • A. Posture assessments identify risky identity configurations and potential lateral movement paths, reported through Microsoft Secure Score.
    • B. A historical log of helpdesk password resets is an audit log detail, not a proactive posture assessment of identity risk.
    • C. SharePoint site visit rankings are a usage analytics metric, unrelated to identity security posture assessments.
    • D. Counting licensed guest seats is a licensing inventory task, not part of identity posture risk assessment.

    Domain 4: Describe the capabilities of Microsoft compliance solutions

    Subdomain 4.1: Describe Microsoft Service Trust Portal and privacy principles

    25.Which type of account must a user sign in with to access authenticated documents on the Service Trust Portal?

    1. A.A local Windows administrator account
    2. B.A GitHub developer account
    3. C.A personal Microsoft consumer account
    4. D.A Microsoft Entra organizational account
    Show answer & explanation

    Correct answer: D — A Microsoft Entra organizational account

    • A. A local Windows administrator account is scoped to a single device and has no relationship to Microsoft's cloud identity system, so it cannot be used to sign in to the portal.
    • B. A GitHub developer account authenticates against GitHub's identity system and is unrelated to Microsoft's cloud services sign-in, so it does not grant access to authenticated portal content.
    • C. A personal Microsoft consumer account (such as an Outlook.com account) is intended for individual consumer services and is not recognized for accessing organization-scoped compliance documentation.
    • D. This is correct: authenticated resources on the portal require signing in with a Microsoft Entra organizational account tied to a Microsoft cloud services subscription.

    Subdomain 4.1: Describe Microsoft Service Trust Portal and privacy principles

    26.Which Service Trust Portal industry resource area provides guidance for organizations in the medical field?

    1. A.Media and Entertainment
    2. B.United States Government
    3. C.Financial Services
    4. D.Healthcare and Life Sciences
    Show answer & explanation

    Correct answer: D — Healthcare and Life Sciences

    • A. This resource area addresses compliance topics relevant to media and entertainment organizations, not medical or clinical data handling.
    • B. This resource area is reserved exclusively for United States government customers and their specific regulatory frameworks, not general medical organizations.
    • C. This resource area elaborates regulatory compliance guidance for the financial services industry by country and region, not for medical organizations.
    • D. This is correct: this resource area addresses capabilities Microsoft offers for the healthcare industry, making it the relevant category for medical organizations.

    Subdomain 4.1: Describe Microsoft Service Trust Portal and privacy principles

    27.Which international standard does Microsoft comply with to reinforce customer control over data stored in Microsoft cloud services?

    1. A.PCI DSS
    2. B.SOC 2 Type II
    3. C.ISO/IEC 27001
    4. D.ISO/IEC 27018
    Show answer & explanation

    Correct answer: D — ISO/IEC 27018

    • A. PCI DSS governs the handling of payment card data and is not the standard specifically cited for reinforcing customer control over personal data in the cloud.
    • B. SOC 2 Type II is an attestation of a service organization's controls over a period of time, but it is not the code of practice cited for cloud privacy and customer data control.
    • C. ISO/IEC 27001 is a general information security management standard, not the specific code of practice for cloud privacy that reinforces customer control over data.
    • D. This is correct: ISO/IEC 27018 is the world's first international code of practice for cloud privacy, and Microsoft's compliance with it reinforces customer control over their data.

    Subdomain 4.3: Describe information protection, data lifecycle management, and data governance capabilities of Microsoft Purview

    28.What distinguishes a trainable classifier from a sensitive information type (SIT) in Microsoft Purview data classification?

    1. A.A trainable classifier is trained on sample content to recognize categories of information that don't fit a simple pattern, while a SIT matches predefined patterns such as a credit card number format
    2. B.A trainable classifier only scans content stored in SharePoint document libraries, while a sensitive information type only scans content stored in Exchange Online mailboxes and archives
    3. C.A trainable classifier automatically encrypts every matching item, while a sensitive information type only flags content for manual administrator review afterward
    4. D.A trainable classifier is configured separately for each individual user account, while a sensitive information type is configured once for the entire tenant
    Show answer & explanation

    Correct answer: A — A trainable classifier is trained on sample content to recognize categories of information that don't fit a simple pattern, while a SIT matches predefined patterns such as a credit card number format

    • A. This is correct. Trainable classifiers use machine learning on sample positive and negative content to recognize categories that are hard to define with rules, while sensitive information types rely on pattern matching (regular expressions, keywords, checksums) for structured data like credit card numbers.
    • B. This is incorrect. Both classification methods can evaluate content across the same set of locations, such as Exchange, SharePoint, OneDrive, and Teams, rather than being restricted to a single workload each.
    • C. This is incorrect. Neither classification method applies encryption by itself; classification results feed into DLP policies or sensitivity label auto-labeling, which are the mechanisms that can trigger protection actions.
    • D. This is incorrect. Both classification methods are configured once at the tenant level (or scoped by policy) and then applied to matching content across users, not configured per individual user.

    Subdomain 4.3: Describe information protection, data lifecycle management, and data governance capabilities of Microsoft Purview

    29.Which of the following would appear as an event in Microsoft Purview Activity explorer?

    1. A.A user downgrading a document's sensitivity label from Confidential to General
    2. B.The total storage quota configured for a SharePoint site
    3. C.The number of Microsoft 365 E5 licenses currently assigned to users
    4. D.The published uptime percentage of the Exchange Online service
    Show answer & explanation

    Correct answer: A — A user downgrading a document's sensitivity label from Confidential to General

    • A. This is correct. Activity explorer logs label-related and DLP-related user activities, including when a user changes or downgrades a sensitivity label on an item, along with any justification the user provided.
    • B. This is incorrect. Storage quota is a SharePoint site configuration setting, not a labeling or DLP-related user activity tracked by Activity explorer.
    • C. This is incorrect. License assignment counts are managed in the Microsoft 365 admin center and are unrelated to the labeling and DLP activity events that Activity explorer records.
    • D. This is incorrect. Service uptime is reported through Microsoft 365 service health, not through Activity explorer, which focuses on user actions on labeled or sensitive content.

    Subdomain 4.3: Describe information protection, data lifecycle management, and data governance capabilities of Microsoft Purview

    30.What is the main purpose of records management in Microsoft Purview?

    1. A.To help an organization manage regulatory, legal, and business-critical records and demonstrate compliance through consistent retention and disposition
    2. B.To provide real-time translation of chat messages exchanged in Microsoft Teams
    3. C.To encrypt every email attachment automatically before it leaves the organization
    4. D.To monitor sign-in risk levels for accounts holding privileged roles
    Show answer & explanation

    Correct answer: A — To help an organization manage regulatory, legal, and business-critical records and demonstrate compliance through consistent retention and disposition

    • A. This is correct. Records management lets organizations label, retain, and dispose of items that must be kept for regulatory, legal, or business reasons, supporting compliance obligations and improving efficiency through regular disposition.
    • B. This is incorrect. Chat message translation is a Teams collaboration feature and is unrelated to declaring, retaining, or disposing of records.
    • C. This is incorrect. Automatic attachment encryption is a sensitivity label or DLP protection action, not a function of the records management capability.
    • D. This is incorrect. Monitoring sign-in risk for privileged accounts is an identity protection capability, not part of records management.

    Subdomain 4.2: Describe compliance management capabilities of Microsoft Purview

    31.True or False: The Microsoft Purview portal provides unified access to Purview's data governance, data security, and data compliance solutions.

    1. A.True
    2. B.False
    Show answer & explanation

    Correct answer: A — True

    • A. The Purview portal is designed as a single, streamlined interface for navigating the data governance, data security, and data compliance solution areas.
    • B. This statement describes the actual purpose of the Purview portal, so rejecting it as false would be incorrect.

    Subdomain 4.2: Describe compliance management capabilities of Microsoft Purview

    32.Compliance Manager gives an organization an initial compliance score based on the ____.

    1. A.Microsoft 365 data protection baseline
    2. B.Azure Well-Architected Framework
    3. C.NIST Cybersecurity Framework tier rating
    Show answer & explanation

    Correct answer: A — Microsoft 365 data protection baseline

    • A. Compliance Manager gives an initial score based on the Microsoft 365 data protection baseline, a set of controls covering key data protection and governance regulations.
    • B. The Well-Architected Framework guides Azure workload design decisions; it is not the baseline used to calculate an initial Compliance Manager score.
    • C. A NIST tier rating is a separate cybersecurity maturity model and is not the baseline Compliance Manager uses to set the initial compliance score.

    Subdomain 4.4: Describe insider risk, eDiscovery, and audit capabilities in Microsoft Purview

    33.Which Insider Risk Management policy template requires configuring a Microsoft 365 HR connector to detect risk from employees who are leaving the organization?

    1. A.Data theft by departing users
    2. B.Data leaks by priority users
    3. C.Security policy violations
    4. D.Risky AI usage
    Show answer & explanation

    Correct answer: A — Data theft by departing users

    • A. This template automatically detects activities typically associated with data theft by users who are leaving the organization, and it requires an HR connector to identify resignation or termination dates.
    • B. This template scores data leak risk indicators for users placed in priority groups, such as executives, and does not require an HR connector to function.
    • C. This template uses Microsoft Defender for Endpoint alerts to score security-related risk indicators and does not depend on HR departure data.
    • D. This template scores indicators related to risky use of AI tools and is unrelated to employee departure events or HR connector data.

    Subdomain 4.4: Describe insider risk, eDiscovery, and audit capabilities in Microsoft Purview

    34.What is the unified audit log in Microsoft Purview used for?

    1. A.Searching thousands of recorded user and admin activities across Microsoft services
    2. B.Automatically classifying files based on the sensitive information they contain
    3. C.Encrypting email messages before they leave the organization's mail flow
    4. D.Applying retention labels to records that must be kept for compliance reasons
    Show answer & explanation

    Correct answer: A — Searching thousands of recorded user and admin activities across Microsoft services

    • A. The unified audit log captures, records, and retains thousands of user and admin operations across dozens of Microsoft services, and it can be searched by security, IT, and compliance investigators.
    • B. Automatically classifying files by sensitive information type is performed by data classification features like content explorer and sensitivity labels, not the audit log.
    • C. Encrypting outbound email is handled by message encryption and information protection controls, not by the audit log, which only records activity events.
    • D. Applying retention labels to enforce how long records are kept is a records management function, separate from the audit log's role of recording activity history.

    Subdomain 4.4: Describe insider risk, eDiscovery, and audit capabilities in Microsoft Purview

    35.True or False: Microsoft Purview Insider Risk Management pseudonymizes user identities by default to help protect privacy during investigations.

    1. A.True
    2. B.False
    Show answer & explanation

    Correct answer: A — True

    • A. Insider Risk Management is built with privacy by design, and users are pseudonymized by default, with role-based access controls and audit logs in place to help ensure user-level privacy.
    • B. This is incorrect. Pseudonymization by default is an explicitly documented privacy protection built into the solution, not an optional add-on.

    Want the full experience?

    These are just samples. Practice the full Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-900) question bank in quiz mode — free, no signup, with domain practice and exam simulation.

    Practice all 348 questions in quiz mode