Which statement accurately describes the shared responsibility model in cloud computing?

Security responsibilities are always split 50/50 between provider and customer.

The customer is responsible for all security controls, including physical security.

The cloud provider is responsible for securing everything, including customer data.

The provider secures the underlying infrastructure, and the customer secures its data and configurations.

A multinational corporation is defining its cloud governance strategy. They need to ensure that all Azure deployments comply with internal data residency requirements and that cost overruns are prevented. Which two actions should they prioritize?

Use Azure Blueprints to deploy a pre-configured environment and rely on manual reviews.

Create Azure Policy assignments that enforce allowed regions and apply budget alerts on subscriptions.

Assign the Owner role to all developers and use a single subscription.

Enable Azure Security Center and rely on its recommendations.

A development team is storing user passwords in a database. They want to ensure that even if the database is compromised, the passwords cannot be easily reversed. Which approach should they use?

Store a salted hash of each password

Store passwords in plain text for simplicity

Store passwords using base64 encoding

Store passwords in an encrypted column using a symmetric key

A healthcare organization stores patient records in Azure Blob Storage. They must protect the data from unauthorized access while it is stored and while it is transmitted between the application and storage. Which combination of controls should they implement?

Store data in a different Azure region.

Enable Azure Defender for Storage.

Enable encryption at rest for the storage account and require HTTPS for all client connections.

Use a shared access signature (SAS) token for all access.

An organization is implementing Zero Trust and must decide how to handle access for a partner company that needs to access a specific application. The partner's users are not in the organization's identity provider. Which approach aligns with Zero Trust?

Share the application's admin credentials with the partner

Grant the partner a VPN connection to the internal network

Put the application on the public internet without any access controls

Create guest accounts for partner users and require MFA and conditional access policies

Microsoft Certified:Security, Compliance, and Identity Fundamentals

Domain 1Objective 1

Describe Security and Compliance Concepts SC-900 Practice Questions (Page 3)

Part of the Describe the concepts of security, compliance, and identity domain, which accounts for 10–15% of the SC-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~2–5 in this domain), expect 1–3 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

8concepts

10–15%of the exam

Questions 11–15

11foundation · easy
Which statement accurately describes the shared responsibility model in cloud computing?
Select an answer first
12application · medium
A multinational corporation is defining its cloud governance strategy. They need to ensure that all Azure deployments comply with internal data residency requirements and that cost overruns are prevented. Which two actions should they prioritize?
Select an answer first
13application · medium
A development team is storing user passwords in a database. They want to ensure that even if the database is compromised, the passwords cannot be easily reversed. Which approach should they use?
Select an answer first
14application · medium
A healthcare organization stores patient records in Azure Blob Storage. They must protect the data from unauthorized access while it is stored and while it is transmitted between the application and storage. Which combination of controls should they implement?
Select an answer first
15expert · hard
An organization is implementing Zero Trust and must decide how to handle access for a partner company that needs to access a specific application. The partner's users are not in the organization's identity provider. Which approach aligns with Zero Trust?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-900” is a trademark of its owner, used for identification only.