A company uses Microsoft Entra ID as its identity provider. They want to allow employees to sign in to a third-party application that does not support modern authentication protocols but does support SAML 2.0. What is the most appropriate way to enable this?

Use Microsoft Entra Connect to synchronize users to the third-party application's own directory.

Configure the third-party application as an enterprise application in Microsoft Entra ID and set up SAML-based single sign-on.

Create a local account in the third-party application for every user and manually manage passwords.

Use a custom application that only supports OAuth 2.0 and ignore the SAML requirement.

A company is migrating to a cloud-based identity provider (IdP) and wants to enforce a zero-trust model. They have a mix of legacy on-premises apps that only support Kerberos authentication and modern cloud apps that support modern authentication protocols. The security team wants to ensure that all access requests are authenticated and authorized based on user identity, regardless of the application. Which approach best meets this requirement?

Migrate all legacy apps to the cloud and rewrite them to support modern authentication.

Keep legacy apps on the on-premises network and rely on the network firewall to protect them.

Create separate identity stores for legacy and cloud apps to avoid integration complexity.

Use the cloud IdP as the single authentication authority and integrate legacy apps through an on-premises proxy or federation service that translates Kerberos to modern tokens.

A company has moved its customer-facing application to a public cloud and employees now access it from personal devices over the internet. The security team wants to reduce the risk of unauthorized access. Which approach best aligns with the concept of identity as the security perimeter?

Require strong authentication for every user and enforce authorization policies based on the verified identity.

Rely on the cloud provider's network firewall to block all traffic from unknown IP addresses.

Give each user a shared generic account so that individual identities are not tracked.

Disable access from personal devices and require all employees to use company-issued laptops connected to the corporate VPN.

An organization has an on-premises Active Directory domain. They want to implement a least-privilege model for file server access. Currently, all users are members of the 'Domain Users' group, which has full access to a shared folder. The security team wants to ensure that only the 'Sales' group can access the 'SalesData' folder. What is the most effective way to achieve this?

Disable the 'Domain Users' group in Active Directory.

Use Group Policy to deny access to the folder for all users except the 'Sales' group.

Create a new 'SalesData' share and move the folder, leaving the original share with the same permissions.

Remove the 'Domain Users' group from the folder's access control list (ACL) and grant 'Sales' group the appropriate permissions.

A university allows students to use their university-issued credentials to access a library database provided by an external vendor. The vendor does not maintain student accounts. Which concept makes this possible?

Local accounts in the vendor's database

Federation between the university and the vendor

Microsoft Certified:Security, Compliance, and Identity Fundamentals

Domain 1Objective 2

Define Identity Concepts SC-900 Practice Questions (Page 3)

Part of the Describe the concepts of security, compliance, and identity domain, which accounts for 10–15% of the SC-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~2–5 in this domain), expect 1–3 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

7concepts

10–15%of the exam

Questions 11–15

11expert · hard
A company uses Microsoft Entra ID as its identity provider. They want to allow employees to sign in to a third-party application that does not support modern authentication protocols but does support SAML 2.0. What is the most appropriate way to enable this?
Select an answer first
12expert · hard
A company is migrating to a cloud-based identity provider (IdP) and wants to enforce a zero-trust model. They have a mix of legacy on-premises apps that only support Kerberos authentication and modern cloud apps that support modern authentication protocols. The security team wants to ensure that all access requests are authenticated and authorized based on user identity, regardless of the application. Which approach best meets this requirement?
Select an answer first
13application · medium
A company has moved its customer-facing application to a public cloud and employees now access it from personal devices over the internet. The security team wants to reduce the risk of unauthorized access. Which approach best aligns with the concept of identity as the security perimeter?
Select an answer first
14expert · hard
An organization has an on-premises Active Directory domain. They want to implement a least-privilege model for file server access. Currently, all users are members of the 'Domain Users' group, which has full access to a shared folder. The security team wants to ensure that only the 'Sales' group can access the 'SalesData' folder. What is the most effective way to achieve this?
Select an answer first
15application · medium
A university allows students to use their university-issued credentials to access a library database provided by an external vendor. The vendor does not maintain student accounts. Which concept makes this possible?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-900” is a trademark of its owner, used for identification only.

Define Identity Concepts SC-900 Practice Questions (Page 3)

Questions 11–15

A company uses Microsoft Entra ID as its identity provider. They want to allow employees to sign in to a third-party application that does not support modern authentication protocols but does support SAML 2.0. What is the most appropriate way to enable this?

A company has moved its customer-facing application to a public cloud and employees now access it from personal devices over the internet. The security team wants to reduce the risk of unauthorized access. Which approach best aligns with the concept of identity as the security perimeter?

A university allows students to use their university-issued credentials to access a library database provided by an external vendor. The vendor does not maintain student accounts. Which concept makes this possible?

Keep studying — Describe the concepts of security, compliance, and identity