A company is redesigning its network security strategy to adopt a Zero Trust model. The security team wants to ensure that every access request is verified, regardless of where it originates. Which approach best aligns with Zero Trust principles?

Use encryption for all data in transit and at rest

Trust all users once they are connected to the corporate VPN

Require multi-factor authentication and device compliance checks for every access request

Rely on a strong firewall to block external threats before they reach internal resources

A company is performing a risk assessment for its new cloud-based customer portal. They have identified that a misconfigured storage account could expose customer data. What is the next step in the risk management process?

Ignore the risk because the storage account is in the cloud

Analyze the likelihood and potential impact of the misconfiguration

Immediately delete the storage account to eliminate the risk

Purchase cyber insurance to transfer the risk without further analysis

A government agency is moving to Azure and must comply with strict data sovereignty laws. They are considering using Azure Government, which is physically separated from commercial Azure. The agency also requires customer-managed keys for encryption. Which responsibility falls on the agency, not on Microsoft?

Patching the hypervisor that hosts the agency's virtual machines.

Ensuring the physical separation of Azure Government datacenters.

Maintaining the compliance certifications for Azure Government.

Managing the lifecycle of the customer-managed keys used for encrypting their data.

Which option best defines risk in the context of information security?

The certainty of a security breach

The impact of a security incident

The number of vulnerabilities in a system

The likelihood that a threat will exploit a vulnerability

What is the primary purpose of implementing defense-in-depth in an organization's security strategy?

To eliminate the need for user training

To reduce the number of security controls needed

To comply with all regulatory requirements

To ensure that no single point of failure can compromise the entire system

Microsoft Certified:Security, Compliance, and Identity Fundamentals

Domain 1Objective 1

Describe Security and Compliance Concepts SC-900 Practice Questions (Page 5)

Part of the Describe the concepts of security, compliance, and identity domain, which accounts for 10–15% of the SC-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~2–5 in this domain), expect 1–3 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

8concepts

10–15%of the exam

Questions 21–25

21application · medium
A company is redesigning its network security strategy to adopt a Zero Trust model. The security team wants to ensure that every access request is verified, regardless of where it originates. Which approach best aligns with Zero Trust principles?
Select an answer first
22application · medium
A company is performing a risk assessment for its new cloud-based customer portal. They have identified that a misconfigured storage account could expose customer data. What is the next step in the risk management process?
Select an answer first
23expert · hard
A government agency is moving to Azure and must comply with strict data sovereignty laws. They are considering using Azure Government, which is physically separated from commercial Azure. The agency also requires customer-managed keys for encryption. Which responsibility falls on the agency, not on Microsoft?
Select an answer first
24foundation · easy
Which option best defines risk in the context of information security?
Select an answer first
25foundation · easy
What is the primary purpose of implementing defense-in-depth in an organization's security strategy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-900” is a trademark of its owner, used for identification only.