I85PREP
⌘ K
Microsoft SC-900 study materials
Microsoft SC-900 study resources

Microsoft SC-900 practice questions

One question at a time. Build your Microsoft SC-900 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Describe the concepts of security, compliance, and identity

Which core principle of the Zero Trust model states that access decisions should be based on all available signals rather than a single trust assumption?

  1. Assume breach
  2. Use least privilege access
  3. Encrypt at rest
  4. Verify explicitly Correct answer.

Explanation

Zero Trust rests on three guiding principles: verify explicitly, use least privilege access, and assume breach. Verifying explicitly means authenticating and authorizing using every available data point, including identity, location, device health, and workload. The other principles address limiting access and minimizing blast radius rather than signal-based evaluation.

Question 2Describe the concepts of security, compliance, and identity

An organization wants to reduce the impact of a compromised account by segmenting networks and limiting lateral movement. Which Zero Trust principle does this most directly reflect?

  1. Data classification
  2. Verify explicitly
  3. Passwordless authentication
  4. Assume breach Correct answer.

Explanation

Assuming breach means operating as though an attacker already has a foothold, so designs emphasize micro-segmentation, least privilege, and rapid detection to limit lateral movement. Verifying explicitly is about evaluating signals at access time, not containing an existing compromise. The other options are specific controls rather than the guiding principle described.

Question 3Describe the concepts of security, compliance, and identity

Which statement best describes the shared responsibility model in cloud computing?

  1. The provider secures the cloud infrastructure while the customer secures data and identities in the cloud Correct answer.
  2. Responsibility for security transfers entirely to the customer
  3. The customer is always responsible for physical datacenter security
  4. The provider is responsible for all security controls once data is migrated

Explanation

In the shared responsibility model, the cloud provider is accountable for security of the cloud, such as physical facilities, hosts, and network infrastructure. The customer remains accountable for security in the cloud, including data, identities, endpoints, and configuration. The split varies by service model but never disappears for either party.

Question 4Describe the concepts of security, compliance, and identity

A team deploys a platform-as-a-service web application. Under the shared responsibility model, which area remains the customer's responsibility?

  1. Securing the hypervisor layer
  2. Managing user accounts and access permissions Correct answer.
  3. Patching the underlying operating system
  4. Maintaining the physical servers

Explanation

With platform as a service, the provider manages the operating system, runtime, servers, and virtualization layer. The customer still owns its data, identities, and access configuration, including account and permission management. This is why identity governance remains a customer duty across service models.

Question 5Describe the concepts of security, compliance, and identity

Which term describes the practice of confirming that a user is who they claim to be?

  1. Authentication Correct answer.
  2. Authorization
  3. Auditing
  4. Accounting

Explanation

Authentication is the process of proving an identity claim, typically through credentials such as a password, certificate, or biometric factor. Authorization happens afterward and determines what the authenticated identity may do. Auditing records activity for review and does not establish identity.

Question 6Describe the concepts of security, compliance, and identity

A user signs in successfully and then is denied access to a finance folder. Which concept explains the denial?

  1. Authorization Correct answer.
  2. Authentication
  3. Federation
  4. Provisioning

Explanation

Authentication confirms identity, while authorization evaluates whether that identity has permission for a specific resource. A successful sign-in followed by a denial indicates the identity was proven but lacked the required permission. Federation and provisioning relate to trust between systems and account creation, not permission checks.

Question 7Describe the concepts of security, compliance, and identity

What is the primary purpose of an identity provider in a federated environment?

  1. To scan endpoints for malware
  2. To authenticate users and issue tokens that relying parties trust Correct answer.
  3. To store and back up application databases
  4. To filter outbound internet traffic

Explanation

An identity provider authenticates users and issues security tokens asserting identity and claims. Relying party applications trust those tokens instead of handling credentials themselves. This separation centralizes authentication and enables single sign-on across many applications.

Question 8Describe the concepts of security, compliance, and identity

Which benefit most directly results from implementing single sign-on with federation?

  1. Users authenticate once and gain access to multiple trusted applications Correct answer.
  2. Each application stores its own separate password database
  3. Users must register a new account for each service
  4. Administrators must reset passwords for every application individually

Explanation

Federated single sign-on lets a user authenticate once with the identity provider and then access multiple relying party applications using trusted tokens. This reduces password sprawl and helpdesk resets. It also centralizes access revocation, since disabling the identity provider account removes access to connected apps.

Question 9Describe the concepts of security, compliance, and identity

Which authentication method relies on something the user possesses, such as a hardware token or phone app?

  1. Possession factor Correct answer.
  2. Inherence factor
  3. Location factor
  4. Knowledge factor

Explanation

Authentication factors fall into categories: something you know, something you have, and something you are. A hardware token or authenticator app is something the user has, making it a possession factor. Knowledge factors are memorized secrets, and inherence factors are biometric traits.

Question 10Describe the concepts of security, compliance, and identity

An organization requires users to sign in with a password plus a fingerprint scan. Which security concept does this implement?

  1. Multifactor authentication Correct answer.
  2. Just-in-time access
  3. Passwordless authentication
  4. Single sign-on

Explanation

Multifactor authentication requires two or more independent factor types, such as a knowledge factor and an inherence factor. Combining a password with a fingerprint satisfies that requirement because the factors come from different categories. Single sign-on and passwordless methods describe different access patterns.

Question 11Describe the concepts of security, compliance, and identity

Which statement best describes passwordless authentication?

  1. It removes the password and relies on stronger methods such as FIDO2 keys or biometrics Correct answer.
  2. It shortens passwords to improve user convenience
  3. It replaces authentication with anonymous access
  4. It stores passwords in a shared team vault

Explanation

Passwordless authentication eliminates the password as a credential and substitutes phishing-resistant methods such as FIDO2 security keys, platform biometrics, or authenticator apps. Because no shared secret is transmitted, credential theft and replay attacks are reduced. It does not weaken or bypass authentication.

Question 12Describe the concepts of security, compliance, and identity

What does the principle of least privilege require?

  1. Granting broad access to reduce administrative effort
  2. Giving every administrator permanent global rights
  3. Granting only the permissions necessary to perform a task, for only as long as needed Correct answer.
  4. Assigning permissions based on seniority rather than role

Explanation

Least privilege limits access rights to exactly what a task requires and revokes them when no longer needed. This reduces the attack surface and the potential damage from a compromised account. Broad permanent rights and seniority-based assignment contradict the principle.

Question 13Describe the concepts of security, compliance, and identity

Which approach grants elevated administrative access only for a limited window after approval?

  1. Permanent role assignment
  2. Just-in-time access Correct answer.
  3. Break-glass accounts left enabled
  4. Shared administrator accounts

Explanation

Just-in-time access elevates privileges on demand for a defined period after an approval or policy check. It supports least privilege by avoiding standing administrative rights. Permanent assignments and shared accounts increase risk by keeping powerful access available continuously.

Question 14Describe the concepts of security, compliance, and identity

Which concept describes granting access rights based on a user's job function rather than on individual requests?

  1. Role-based access control Correct answer.
  2. Attribute-based access control
  3. Mandatory access control
  4. Discretionary access control

Explanation

Role-based access control assigns permissions to roles and then places users in roles according to their job function. This simplifies administration and supports consistent least privilege. Discretionary control lets owners set permissions, mandatory control uses system labels, and attribute-based control evaluates multiple attributes.

Question 15Describe the concepts of security, compliance, and identity

Which term refers to the ongoing process of ensuring that user accounts and their access remain appropriate over time?

  1. Threat hunting
  2. Data loss prevention
  3. Vulnerability scanning
  4. Identity governance Correct answer.

Explanation

Identity governance covers lifecycle processes such as access requests, approvals, periodic access reviews, and entitlement management. It ensures accounts and permissions stay aligned with business need. Threat hunting, vulnerability scanning, and data loss prevention are security operations or data controls rather than identity lifecycle management.

Question 16Describe the concepts of security, compliance, and identity

A manager must periodically confirm that team members still need their assigned application access. Which governance activity is this?

  1. Incident triage
  2. Penetration test
  3. Access review Correct answer.
  4. Risk assessment

Explanation

An access review, sometimes called an access recertification, asks reviewers to confirm or remove existing entitlements on a schedule. It supports least privilege and audit compliance by catching accumulated permissions. Risk assessments, penetration tests, and incident triage address different security functions.

Question 17Describe the concepts of security, compliance, and identity

Which term describes the process of creating, updating, and removing user accounts automatically based on authoritative sources such as an HR system?

  1. Federation
  2. Encryption
  3. Conditional access
  4. Provisioning Correct answer.

Explanation

Provisioning automates account creation and attribute updates from an authoritative source of record such as HR. Deprovisioning removes access promptly when a user leaves, reducing orphaned accounts. Federation, conditional access, and encryption address trust, policy evaluation, and data protection respectively.

Question 18Describe the concepts of security, compliance, and identity

What is the main security benefit of deprovisioning accounts promptly when employees leave an organization?

  1. It improves application performance
  2. It removes a potential entry point that attackers could exploit using stale credentials Correct answer.
  3. It increases the number of active licenses
  4. It eliminates the need for multifactor authentication

Explanation

Orphaned accounts with valid credentials are attractive to attackers because unusual activity may go unnoticed. Prompt deprovisioning closes that entry point and enforces least privilege. It does not remove the need for other controls such as multifactor authentication.

Question 19Describe the concepts of security, compliance, and identity

Which security concept focuses on protecting data by understanding where sensitive information resides and who can access it?

  1. Network segmentation
  2. Data classification Correct answer.
  3. Endpoint hardening
  4. Log retention

Explanation

Data classification labels information by sensitivity and business value so appropriate protections and access rules can be applied. Knowing where sensitive data lives enables controls such as encryption, labeling, and loss prevention. Segmentation, hardening, and log retention are separate technical controls.

Question 20Describe the concepts of security, compliance, and identity

An organization must retain certain records for seven years to satisfy legal obligations. Which compliance concept does this describe?

  1. Data residency requirements
  2. Right to be forgotten
  3. Data minimization
  4. Data retention requirements Correct answer.

Explanation

Retention requirements specify how long records must be kept and when they must be destroyed. They often derive from laws, regulations, or industry standards. Residency concerns location, the right to be forgotten concerns erasure requests, and minimization concerns limiting collection.

Question 21Describe the concepts of security, compliance, and identity

Which regulation is primarily associated with protecting personal data of individuals in the European Union?

  1. PCI DSS
  2. HIPAA
  3. SOX
  4. GDPR Correct answer.

Explanation

The General Data Protection Regulation governs processing of personal data of individuals in the European Union and imposes duties on controllers and processors. HIPAA addresses health information in the United States, PCI DSS covers payment card data, and SOX concerns financial reporting controls.

Question 22Describe the concepts of security, compliance, and identity

Which term describes an organization's documented set of rules and expectations that govern acceptable use of its systems?

  1. Baseline
  2. Standard
  3. Procedure
  4. Policy Correct answer.

Explanation

A policy states management intent and mandatory rules at a high level, such as acceptable use of company systems. Standards define specific technical requirements, procedures give step-by-step instructions, and baselines are reference configurations. Policies sit at the top of this hierarchy.

Question 23Describe the concepts of security, compliance, and identity

An auditor asks for evidence that access to a system was reviewed quarterly. Which capability best provides this evidence?

  1. Audit logs and access review records Correct answer.
  2. Software license inventories
  3. Marketing analytics dashboards
  4. Network bandwidth reports

Explanation

Audit logs record who accessed what and when, while access review records document that entitlements were examined and approved. Together they provide the evidence auditors require for control operation. Analytics, bandwidth, and license reports do not demonstrate access review activity.

Question 24Describe the concepts of security, compliance, and identity

Which statement correctly distinguishes risk from a vulnerability?

  1. Risk applies only to physical assets, while vulnerability applies only to software
  2. Risk is a weakness, while a vulnerability is the potential for loss
  3. Risk and vulnerability are identical concepts
  4. Risk is the potential for loss, while a vulnerability is a weakness that could be exploited Correct answer.

Explanation

A vulnerability is a weakness in a system, process, or control. Risk combines the likelihood that a threat exploits a vulnerability with the resulting impact. Treating them as synonyms obscures the need to weigh likelihood and impact when prioritizing remediation.

Question 25Describe the capabilities of Microsoft Entra

A company wants its employees to sign in to Microsoft 365 with the same credentials they already use for an on-premises Active Directory. Which Microsoft Entra capability enables this without storing separate cloud passwords?

  1. Privileged Identity Management
  2. Self-service password reset
  3. Password hash synchronization Correct answer.
  4. Conditional Access

Explanation

Password hash synchronization copies a hash of on-premises password hashes to Microsoft Entra ID so users authenticate in the cloud with their familiar credentials. It requires no federation infrastructure and no separate cloud password store.

Question 26Describe the capabilities of Microsoft Entra

Which Microsoft Entra feature lets administrators require multi-factor authentication only when a sign-in is judged risky?

  1. Access reviews
  2. Entitlement management
  3. Identity Governance
  4. Conditional Access Correct answer.

Explanation

Conditional Access evaluates signals such as user, device, location, and sign-in risk, then applies controls like requiring MFA. Risk-based policies are a core Conditional Access scenario.

Question 27Describe the capabilities of Microsoft Entra

What is the primary purpose of Microsoft Entra ID Governance access reviews?

  1. To periodically verify that users still need their assigned access Correct answer.
  2. To rotate application client secrets automatically
  3. To block sign-ins from unfamiliar countries
  4. To encrypt data at rest in SharePoint

Explanation

Access reviews ask reviewers, such as managers or resource owners, to confirm or remove access on a recurring schedule. This reduces entitlement creep and supports compliance attestation.

Question 28Describe the capabilities of Microsoft Entra

Which Microsoft Entra ID feature provides single sign-on to thousands of pre-integrated cloud applications through a gallery?

  1. Microsoft Purview
  2. Azure Bastion
  3. Application gallery with SAML and OIDC federation Correct answer.
  4. Microsoft Defender for Identity

Explanation

The Microsoft Entra application gallery holds preconfigured templates that use SAML, OIDC, or password-based SSO to connect SaaS apps. Administrators add an app from the gallery and configure claims and assignments.

Question 29Describe the capabilities of Microsoft Entra

An administrator wants to give a helpdesk team the ability to reset user passwords without granting full administrative rights. Which Microsoft Entra capability should be used?

  1. Role-based access control with a least-privileged role Correct answer.
  2. Global Administrator assignment
  3. Security defaults
  4. Administrative units deletion

Explanation

Microsoft Entra RBAC assigns built-in or custom roles such as Password Administrator or Helpdesk Administrator, granting only the permissions needed. This follows least privilege.

Question 30Describe the capabilities of Microsoft Entra

Which statement accurately describes Microsoft Entra ID Free compared with Microsoft Entra ID P1?

  1. Free and P1 are identical in features
  2. Free includes Conditional Access risk policies; P1 does not
  3. Free includes Identity Protection; P1 removes it
  4. Free includes basic SSO and user management; P1 adds Conditional Access and group-based licensing Correct answer.

Explanation

Microsoft Entra ID Free provides core identity features such as user and group management and basic SSO. P1 adds premium capabilities including Conditional Access, group-based licensing, and self-service password reset for cloud users.

Question 31Describe the capabilities of Microsoft Entra

What does self-service password reset (SSPR) in Microsoft Entra ID allow end users to do?

  1. Reset or change their password without calling the helpdesk Correct answer.
  2. Create new tenant domains
  3. Disable Conditional Access policies
  4. Change their own role assignments

Explanation

SSPR lets users reset or change passwords after verifying identity through configured authentication methods. It reduces helpdesk load and can write back to on-premises Active Directory when enabled.

Question 32Describe the capabilities of Microsoft Entra

Which Microsoft Entra capability verifies a user's identity by requiring a second factor such as a phone app notification?

  1. Named locations
  2. Multi-factor authentication Correct answer.
  3. Cross-tenant synchronization
  4. Access packages

Explanation

Multi-factor authentication requires two or more independent evidence types, such as a password plus an authenticator app approval. It is the foundation for reducing credential compromise.

Question 33Describe the capabilities of Microsoft Entra

A security team wants to detect leaked credentials and automatically respond to risky sign-ins. Which Microsoft Entra ID P2 feature supports this?

  1. Microsoft Entra Connect Sync
  2. Application Proxy
  3. B2B collaboration
  4. Identity Protection Correct answer.

Explanation

Identity Protection uses signals such as leaked credential detection, anonymous IP use, and atypical travel to calculate user and sign-in risk. Policies can then require remediation such as password change or MFA.

Question 34Describe the capabilities of Microsoft Entra

What does Microsoft Entra B2B collaboration provide?

  1. Synchronization of on-premises groups to the cloud
  2. Guest access for external partners using their own credentials Correct answer.
  3. Just-in-time elevation of directory roles
  4. Automatic licensing of guest users with P2

Explanation

B2B collaboration lets partners, contractors, and other external users access shared resources as guests. They authenticate with their own work, school, or social identity, optionally redeeming an invitation.

Question 35Describe the capabilities of Microsoft Entra

An organization wants to publish an on-premises web application to remote users without exposing the internal network. Which Microsoft Entra service fits this requirement?

  1. Microsoft Entra Verified ID
  2. Microsoft Entra Connect Health
  3. Microsoft Entra Application Proxy Correct answer.
  4. Microsoft Entra Domain Services

Explanation

Application Proxy creates an outbound-only connector to the internal app and publishes it through Microsoft Entra ID with SSO and Conditional Access. No inbound firewall ports are required.

Question 36Describe the capabilities of Microsoft Entra

Which Microsoft Entra feature allows an eligible administrator to activate a privileged role for a limited time with approval?

  1. Self-service group management
  2. Privileged Identity Management Correct answer.
  3. Terms of use
  4. Access reviews

Explanation

Privileged Identity Management makes roles eligible rather than permanently active. Users activate them for a defined window, optionally with approval, justification, and MFA.

Question 37Describe the capabilities of Microsoft Entra

A company wants users to register a FIDO2 security key as a phishing-resistant sign-in method. Which Microsoft Entra setting area should the administrator configure?

  1. Tenant restrictions
  2. Conditional Access session controls
  3. Authentication methods policy Correct answer.
  4. Named locations

Explanation

The authentication methods policy controls which methods, such as FIDO2 security keys, are enabled and who may use them. It also governs registration and targeting.

Question 38Describe the capabilities of Microsoft Entra

What is the role of Microsoft Entra Connect in a hybrid identity deployment?

  1. It brokers guest invitations
  2. It synchronizes on-premises directory objects to Microsoft Entra ID Correct answer.
  3. It replaces Active Directory with a cloud-only directory
  4. It enforces device compliance policies

Explanation

Microsoft Entra Connect synchronizes users, groups, and attributes from on-premises Active Directory to Microsoft Entra ID. It can also enable password hash sync, pass-through authentication, or federation.

Question 39Describe the capabilities of Microsoft Entra

An administrator wants to require compliant devices for access to a finance application while allowing personal devices to reach only the intranet portal. Which capability should be used?

  1. Access packages
  2. Entra Domain Services
  3. Conditional Access with device state conditions Correct answer.
  4. Password Protection

Explanation

Conditional Access policies can target applications and evaluate device state, such as whether a device is compliant or hybrid joined. Different policies per app achieve differentiated access.

Question 40Describe the capabilities of Microsoft Entra

Which Microsoft Entra capability helps an organization prevent users from setting passwords that appear on a known-breach list?

  1. Microsoft Entra Password Protection Correct answer.
  2. Access reviews
  3. Identity Protection sign-in risk
  4. Entitlement management

Explanation

Microsoft Entra Password Protection enforces a global banned password list plus optional custom banned terms. It can be applied in the cloud and extended to on-premises Active Directory.

Question 41Describe the capabilities of Microsoft Entra

A partner user needs temporary access to a specific SharePoint site and a Teams channel. Which Microsoft Entra ID Governance feature streamlines requesting, approving, and expiring this access?

  1. Application Proxy
  2. Entitlement management access packages Correct answer.
  3. Password hash synchronization
  4. Security defaults

Explanation

Access packages bundle resources with policies that define who may request, who approves, and when access expires. Entitlement management automates the full request-to-expiry lifecycle.

Question 42Describe the capabilities of Microsoft Entra

Which Microsoft Entra feature enables users in one tenant to be provisioned automatically into another tenant for collaboration?

  1. Verified ID
  2. Access reviews
  3. Application Proxy
  4. Cross-tenant synchronization Correct answer.

Explanation

Cross-tenant synchronization provisions users into a target tenant so they can access resources there without separate invitations. It supports lifecycle automation across organizational boundaries.

Question 43Describe the capabilities of Microsoft Entra

What does Microsoft Entra Verified ID primarily enable?

  1. Issuance and verification of decentralized identity credentials Correct answer.
  2. Synchronization of on-premises attributes
  3. Automatic assignment of P1 licenses
  4. Passwordless access to legacy VPN appliances

Explanation

Verified ID lets organizations issue standards-based verifiable credentials and verify them during onboarding or access. The holder controls the credential and presents only requested claims.

Question 44Describe the capabilities of Microsoft Entra

A security analyst observes that a user signed in from two distant countries within minutes. Which Identity Protection signal does this most directly represent?

  1. Anonymous IP address
  2. Atypical travel Correct answer.
  3. Malware-linked IP address
  4. Leaked credentials

Explanation

Atypical travel flags sign-ins from geographically distant locations within a timeframe that makes physical travel implausible. Identity Protection factors this into sign-in risk.

Question 45Describe the capabilities of Microsoft Entra

An administrator needs to ensure that when a user is removed from an on-premises group, their access to cloud resources is revoked. Which capability is most relevant?

  1. Microsoft Entra Verified ID
  2. Self-service password reset
  3. Terms of use
  4. Group-based licensing with synchronized groups Correct answer.

Explanation

When groups are synchronized and used for group-based licensing and resource assignment, removing on-premises membership propagates to the cloud. Access tied to the group is then revoked automatically.

Question 46Describe the capabilities of Microsoft Entra

Which statement best describes the difference between Microsoft Entra ID and Active Directory Domain Services?

  1. Entra ID is a cloud identity provider using modern protocols; AD DS is an on-premises directory using Kerberos and LDAP Correct answer.
  2. Both are cloud directories with identical protocols
  3. Entra ID replaces Kerberos with NTLM
  4. AD DS is required to use Conditional Access

Explanation

Microsoft Entra ID is a cloud identity and access management service using protocols such as SAML, OIDC, and OAuth. AD DS is an on-premises directory service using Kerberos and LDAP for domain authentication.

Question 47Describe the capabilities of Microsoft Entra

A tenant administrator wants to block legacy authentication protocols that cannot enforce MFA. Which Microsoft Entra control should be configured?

  1. A named location for the corporate office
  2. A Conditional Access policy targeting legacy authentication clients Correct answer.
  3. An access review of guest users
  4. An entitlement management catalog

Explanation

Conditional Access can target client apps and legacy authentication conditions, blocking protocols that bypass MFA. This closes a common credential attack path.

Question 48Describe the capabilities of Microsoft Entra

An organization must prove to auditors that only approved users retained access to a sensitive application over the past year. Which two capabilities combined best satisfy this?

  1. Application Proxy and B2B
  2. Access reviews and sign-in log retention Correct answer.
  3. Password hash sync and SSPR
  4. Verified ID and MFA

Explanation

Recurring access reviews produce certification records showing who approved or removed access. Retained sign-in and audit logs provide evidence of actual access activity over the period.

Question 49Describe the capabilities of Microsoft Entra

A company federates with Microsoft Entra ID using SAML-based domain federation. A user reports successful authentication at the identity provider but a failure at the application. Which Microsoft Entra concept should be examined first?

  1. The device compliance policy
  2. The token signing certificate and claim configuration Correct answer.
  3. The user's password hash synchronization status
  4. The tenant's license count

Explanation

In federated SSO the identity provider signs tokens using a certificate and emits claims the application expects. Expired certificates or mismatched claim mappings commonly cause post-authentication failures.

Question 50Describe the capabilities of Microsoft Entra

Which Microsoft Entra ID edition is included at no cost with any Microsoft cloud subscription such as Microsoft 365 or Azure?

  1. Microsoft Entra ID P2
  2. Microsoft Entra ID P1
  3. Microsoft Entra ID Free Correct answer.
  4. Microsoft Entra ID Governance

Explanation

Microsoft Entra ID Free ships with any paid Microsoft cloud service subscription and provides core directory, user and group management, and basic security defaults. Higher-tier capabilities such as conditional access policies and Identity Protection require paid editions.