A multinational company is defining a governance framework for Azure. They must balance the need for centralized control with the agility of individual business units. They also need to meet regulatory requirements that vary by region. Which governance approach is most effective?

Give each business unit complete autonomy over its own subscriptions with no central policies.

Use only Azure Blueprints to deploy environments and rely on manual compliance reviews.

Apply a single set of strict policies to all subscriptions without exceptions.

Use a management group hierarchy with Azure Policy applied at the top level and allow exemptions for specific regulatory requirements.

A software company wants to verify that a downloaded installation file has not been tampered with during transmission. They publish a hash value of the file on their website. Which property of hashing makes this verification possible?

The hash can be reversed to recover the original file.

The hash is a fixed-length string that changes if the input changes.

The hash is unique to the file and never repeats for different files.

The hash is encrypted with a private key.

A company is subject to both GDPR and local data protection laws. They are using Azure and need to ensure that personal data is processed lawfully and that they can demonstrate compliance. They are considering using Microsoft Purview Compliance Manager and Azure Policy. Which combination of actions best supports their compliance obligations?

Use Compliance Manager to assess controls and Azure Policy to enforce data residency and protection rules.

Rely on Microsoft's compliance certifications for all obligations.

Use only Azure Policy to enforce all GDPR requirements.

Use only Compliance Manager and rely on its recommendations.

A company is using Azure SaaS applications for email and collaboration. The security team is reviewing the shared responsibility model to determine which security controls they must implement. Which responsibility is the customer's?

Managing user identities and access to the SaaS applications

Configuring the network load balancers for the SaaS

Securing the physical data center hosting the SaaS

Patching the underlying application servers

Microsoft Certified:Security, Compliance, and Identity Fundamentals

Domain 1Objective 1

Describe Security and Compliance Concepts SC-900 Practice Questions (Page 6)

Part of the Describe the concepts of security, compliance, and identity domain, which accounts for 10–15% of the SC-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~2–5 in this domain), expect 1–3 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

8concepts

10–15%of the exam

Questions 26–30

26expert · hard
A multinational company is defining a governance framework for Azure. They must balance the need for centralized control with the agility of individual business units. They also need to meet regulatory requirements that vary by region. Which governance approach is most effective?
Select an answer first
27application · medium
A software company wants to verify that a downloaded installation file has not been tampered with during transmission. They publish a hash value of the file on their website. Which property of hashing makes this verification possible?
Select an answer first
28expert · hard
A company is subject to both GDPR and local data protection laws. They are using Azure and need to ensure that personal data is processed lawfully and that they can demonstrate compliance. They are considering using Microsoft Purview Compliance Manager and Azure Policy. Which combination of actions best supports their compliance obligations?
Select an answer first
29expert · hard
A company is using Azure SaaS applications for email and collaboration. The security team is reviewing the shared responsibility model to determine which security controls they must implement. Which responsibility is the customer's?
Select an answer first
30application · medium
A large enterprise is adopting Azure and wants to ensure that all subscriptions are governed consistently. They need to enforce tagging, region restrictions, and resource naming conventions across all subscriptions. Which governance tool should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-900” is a trademark of its owner, used for identification only.

Describe Security and Compliance Concepts SC-900 Practice Questions (Page 6)

Questions 26–30

A multinational company is defining a governance framework for Azure. They must balance the need for centralized control with the agility of individual business units. They also need to meet regulatory requirements that vary by region. Which governance approach is most effective?

A software company wants to verify that a downloaded installation file has not been tampered with during transmission. They publish a hash value of the file on their website. Which property of hashing makes this verification possible?

A company is using Azure SaaS applications for email and collaboration. The security team is reviewing the shared responsibility model to determine which security controls they must implement. Which responsibility is the customer's?

A large enterprise is adopting Azure and wants to ensure that all subscriptions are governed consistently. They need to enforce tagging, region restrictions, and resource naming conventions across all subscriptions. Which governance tool should they use?

Keep studying — Describe the concepts of security, compliance, and identity