SC-500 flashcards
SC-500 · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- CIA triad
- Confidentiality, integrity, and availability: the three foundational security objectives used to classify controls and evaluate whether a system is adequately protected.
- Zero Trust model
- A security strategy built on verify explicitly, use least privilege access, and assume breach, treating every request as untrusted regardless of network location.
- Defense in depth
- A layered control strategy spanning identity, network, compute, application, and data so that failure of one layer does not expose the whole environment.
- Shared responsibility model
- A division of security duties where the cloud provider secures physical and platform layers and the customer always retains responsibility for data, identities, and access configuration.
- Authentication versus authorization
- Authentication verifies a principal's identity, while authorization determines which resources and actions that verified principal is permitted to use.
- Risk treatment options
- Four ways to handle identified risk: mitigate it with controls, transfer it to another party, avoid the activity, or formally accept the residual risk.
- Compliance versus governance
- Governance defines the rules and policies an organization follows, while compliance demonstrates that the organization actually meets those rules and external obligations.
- Microsoft Entra ID
- Microsoft's cloud identity provider that authenticates users and issues tokens for Microsoft 365, Azure, and integrated applications, separate from on-premises Active Directory.
- Conditional Access
- An Entra ID policy engine that evaluates signals such as user, device, location, and risk, then enforces grant controls like MFA or block, or session controls.
- Entra ID P2 features
- The edition that includes everything in P1 plus Identity Protection risk-based policies and Privileged Identity Management for just-in-time privileged role activation.
- Privileged Identity Management
- An Entra ID service providing just-in-time role activation, approvals, time-bound assignments, and access reviews for privileged administrative roles.
- Passwordless authentication
- Sign-in methods that remove the password entirely, such as FIDO2 security keys, Windows Hello for Business, and Microsoft Authenticator phone sign-in.
- Identity Protection
- An Entra ID capability that detects risky users and risky sign-ins and can automatically require password reset or block access based on risk level.
- Entra Connect
- A synchronization tool that replicates on-premises Active Directory users and objects to Microsoft Entra ID to enable hybrid identity scenarios.
- Entitlement management
- An Entra ID Governance feature using access packages and approval workflows so users can request and receive time-bound access to groups, apps, and sites.
- B2B versus B2C
- B2B collaboration invites partners as guest accounts in your tenant, while B2C provides consumer-facing sign-up and sign-in experiences for customers.
- Microsoft Defender for Cloud
- A cloud security posture management and workload protection service offering Secure Score, regulatory compliance dashboards, and threat protection for servers, containers, and data.
- Microsoft Sentinel
- A cloud-native SIEM and SOAR platform that ingests logs into a Log Analytics workspace, correlates them with analytics rules, and automates response using playbooks.
- Defender XDR
- A correlated incident experience across identities, endpoints, email, and cloud apps that unifies signals and supports automatic attack disruption.
- Defender for Endpoint
- An endpoint detection and response service providing attack surface reduction rules, threat and vulnerability management, and automated investigation for devices.
- Defender for Identity
- A service that monitors on-premises Active Directory domain controller traffic to detect credential theft, reconnaissance, and lateral movement attacks.
- Defender for Office 365
- Email and collaboration protection using Safe Attachments, Safe Links, and anti-phishing; Plan 2 adds automated investigation and response and attack simulation training.
- Defender for Cloud Apps
- A cloud access security broker that discovers shadow IT, enforces session and app controls, and detects anomalous behavior across SaaS applications.
- Secure Score
- A numeric measure in Defender for Cloud quantifying security posture against recommended controls, used to prioritize remediation by potential score gain.
- Sensitivity labels
- Purview labels that classify and protect content by applying encryption, content marking, and access restrictions, distributed to users through label policies.
- Data Loss Prevention
- Purview policies that detect sensitive information across Exchange, SharePoint, OneDrive, Teams, and endpoints, and can block, warn, or allow override with justification.
- Insider Risk Management
- A Purview solution that uses policy templates and indicators to detect risky user activity, with privacy controls such as pseudonymization enabled by default.
- Retention label versus policy
- A retention label is applied to individual items by users or automatically, while a retention policy applies broadly to entire locations such as mailboxes or sites.
- eDiscovery Premium
- The Purview tier adding custodian management, review sets, and machine-learning-assisted review on top of search, hold, and export capabilities of Standard.
- Compliance Manager
- A Purview tool that maps controls to regulations such as GDPR and ISO 27001 and calculates an improvement-action score reflecting compliance posture.
- Audit Premium
- A Purview tier providing longer retention, including up to ten-year audit retention policies for selected record types, plus higher API bandwidth.
- Sensitive information types
- Pattern definitions, typically regular expressions plus supporting evidence like keywords, used by Purview to detect content such as credit card or national ID numbers.