A security team is conducting a risk assessment for a new cloud application. They have identified that the application has a high likelihood of being targeted by DDoS attacks and a high impact if the application becomes unavailable. They are considering several risk treatment options. Which option represents risk mitigation?

Accept the risk because DDoS attacks are unlikely to affect the business.

Implement Azure DDoS Protection and design the application for high availability.

Purchase cyber insurance to cover potential losses from downtime.

Move the application to a different cloud provider.

A multinational corporation is defining a governance framework to ensure that its cloud deployments align with business objectives and regulatory requirements. Which practice is a core element of IT governance?

Establishing policies and procedures that guide decision-making and resource usage

Purchasing the most expensive security tools available

Deploying all workloads to a single cloud region

Granting all employees full administrative access to cloud resources

An organization wants to implement defense-in-depth for its Azure workloads. They have already implemented network security groups and Azure Firewall. Which additional layer should they add to protect against application-layer attacks?

Deploy a web application firewall (WAF) in front of the application.

Add more network security group rules.

Use a VPN gateway for all incoming traffic.

A company is implementing Zero Trust and wants to protect its data in a hybrid environment. They plan to use conditional access policies and encryption for data at rest and in transit. Which additional practice is essential to complete a Zero Trust data protection strategy?

Move all data to on-premises storage.

Classify data and apply labels to control access based on sensitivity.

Use a single strong password for all users.

A financial services company must comply with GDPR and needs to demonstrate that its Azure environment meets the required security controls. They want to use a Microsoft service that provides a centralized dashboard for compliance assessments. Which service should they use?

Microsoft Purview Compliance Manager

Microsoft Certified:Security, Compliance, and Identity Fundamentals

Domain 1Objective 1

Describe Security and Compliance Concepts SC-900 Practice Questions (Page 2)

Part of the Describe the concepts of security, compliance, and identity domain, which accounts for 10–15% of the SC-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~2–5 in this domain), expect 1–3 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

8concepts

10–15%of the exam

Questions 6–10

6expert · hard
A security team is conducting a risk assessment for a new cloud application. They have identified that the application has a high likelihood of being targeted by DDoS attacks and a high impact if the application becomes unavailable. They are considering several risk treatment options. Which option represents risk mitigation?
Select an answer first
7application · medium
A multinational corporation is defining a governance framework to ensure that its cloud deployments align with business objectives and regulatory requirements. Which practice is a core element of IT governance?
Select an answer first
8application · medium
An organization wants to implement defense-in-depth for its Azure workloads. They have already implemented network security groups and Azure Firewall. Which additional layer should they add to protect against application-layer attacks?
Select an answer first
9application · medium
A company is implementing Zero Trust and wants to protect its data in a hybrid environment. They plan to use conditional access policies and encryption for data at rest and in transit. Which additional practice is essential to complete a Zero Trust data protection strategy?
Select an answer first
10application · medium
A financial services company must comply with GDPR and needs to demonstrate that its Azure environment meets the required security controls. They want to use a Microsoft service that provides a centralized dashboard for compliance assessments. Which service should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-900” is a trademark of its owner, used for identification only.