Microsoft SC-900 flashcards
Microsoft SC-900 · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Shared responsibility model
- A division of security duties between cloud provider and customer. The provider secures the physical infrastructure; the customer always secures data, identities, and access.
- Defense in depth
- A layered security strategy that applies controls at physical, identity, network, compute, application, and data layers so one failed control does not expose the whole system.
- Zero Trust
- A security model built on three principles: verify explicitly, grant least privilege access, and assume breach. Network location never grants automatic trust.
- CIA triad
- Three core security objectives: confidentiality, meaning only authorized parties read data; integrity, meaning data stays accurate; and availability, meaning systems remain accessible.
- Authentication versus authorization
- Authentication verifies who a subject is, such as a password plus code. Authorization determines what that verified subject may do, such as reading a specific file.
- Encryption versus hashing
- Encryption is reversible with a key and protects confidentiality. Hashing is one-way, produces a fixed-length value, and supports integrity checks and password storage.
- Workload identity
- An identity assigned to software rather than a person, such as a service principal or managed identity, so applications can authenticate without embedded credentials.
- Governance versus compliance
- Compliance is meeting legal, regulatory, and contractual requirements. Governance is the policies, roles, and processes an organization uses to sustain that compliance.
- Microsoft Entra ID
- Microsoft's cloud identity provider. It delivers authentication, single sign-on, conditional access, and identity governance for cloud and on-premises applications.
- Conditional Access
- A policy engine that evaluates signals such as user, device, location, application, and risk, then grants access, blocks it, or requires controls like multifactor authentication.
- Multifactor authentication
- Authentication requiring factors from at least two categories: something you know, something you have, or something you are. A password plus an SMS code qualifies.
- Privileged Identity Management
- An Entra ID P2 feature providing just-in-time role activation, approvals, time-bound assignments, and access reviews for privileged administrative roles.
- Entra ID Protection
- A feature that detects risky users and risky sign-ins using behavioral signals and feeds risk levels into Conditional Access policies for automatic response.
- Microsoft Entra Connect
- A tool that synchronizes on-premises Active Directory users and groups into Microsoft Entra ID, enabling hybrid identities to access cloud resources with one account.
- B2B collaboration
- A Microsoft Entra external identities capability where partner guests sign in with their own credentials and receive governed access to shared organizational resources.
- Entra Verified ID
- A service issuing cryptographically signed verifiable credentials that holders present as proof of a claim without exposing the underlying source data.
- Microsoft Defender for Cloud
- A platform offering cloud security posture management and cloud workload protection across Azure, other clouds, and on-premises environments.
- Secure score
- A Defender for Cloud metric that measures posture against recommended security controls. Remediating recommendations raises the score.
- Microsoft Defender XDR
- A correlated defense suite spanning identity, email, endpoints, and cloud apps that unifies signals into incidents with automated investigation and response.
- Defender for Endpoint
- A workload protection service delivering endpoint detection and response, attack surface reduction, and threat and vulnerability management for devices.
- Defender for Identity
- A service monitoring on-premises Active Directory domain controller signals to detect identity attacks such as credential theft, recon, and lateral movement.
- Defender for Office 365
- An email and collaboration protection service using safe links, safe attachments, and anti-phishing policies to block malicious messages and URLs.
- Microsoft Sentinel
- A cloud-native SIEM and SOAR platform that ingests logs from many sources, detects threats with analytics rules, and automates response with playbooks.
- Defender for Cloud Apps
- A cloud access security broker that discovers shadow IT, governs SaaS application usage, and detects anomalous behavior and data exfiltration.
- Data Loss Prevention
- A Microsoft Purview capability that detects sensitive information across email, collaboration services, and endpoints, then blocks or warns on policy violations.
- Sensitivity labels
- Purview classification tags applied to content that can enforce encryption and access restrictions, and that travel with the file outside the organization.
- Retention labels
- Purview labels that keep or delete content for a defined period, and can optionally start a disposition review before final deletion.
- eDiscovery
- A Purview process to identify, preserve, and collect content for legal cases. Premium adds custodian management, review sets, and deeper analytics.
- Insider Risk Management
- A Purview solution using policy templates and anonymized behavioral signals to detect risky user activity such as data exfiltration or leaks.
- Compliance Manager
- A Purview tool that maps controls to regulations, tracks improvement actions, and calculates a compliance score reflecting assessment progress.
- Microsoft Priva
- A privacy management product family addressing privacy risk assessment and subject rights requests for personal data across organizational systems.
- Service Trust Portal
- A Microsoft site publishing audit reports, compliance certifications, and the Data Protection Addendum used to verify provider compliance claims.