In the shared responsibility model for cloud computing, which of the following is typically the responsibility of the cloud customer?

Ensuring the availability of the cloud service

Managing user access to data and applications

Patching the host operating system

Physical security of the data center

A company is migrating its customer relationship management (CRM) system to Azure IaaS. The security team wants to ensure that the CRM application is protected even if an attacker gains access to the application layer. They plan to implement network security groups, application-level authentication, and regular patching. Which additional control best aligns with the shared responsibility model and defense-in-depth to protect the data stored by the CRM?

Enable transparent data encryption on the CRM database.

Use Azure DDoS Protection for the CRM's public endpoint.

Increase the CRM's virtual machine size.

Move the CRM to a different Azure region.

Which activity is an example of IT governance?

Monitoring network traffic for anomalies

Installing security patches on servers

Defining a framework for IT decision-making and accountability

A security team is designing a defense-in-depth strategy for a web application. They have implemented a web application firewall (WAF), network security groups, and encryption. What additional layer would best complete the strategy?

Implement strong authentication and authorization controls

Remove all logging to reduce the attack surface

Disable encryption to improve performance

Use a single physical firewall for all traffic

A large enterprise is adopting a cloud governance framework. They must balance the need for agility (developers want to deploy quickly) with the need for compliance (auditors require approval for changes). Which approach best satisfies both?

Create a separate cloud subscription for each developer to avoid governance

Implement automated policy checks and approval workflows for changes that affect compliance

Allow developers full access to all resources and audit after deployment

Require manual approval for every change, no matter how small

Microsoft Certified:Security, Compliance, and Identity Fundamentals

Domain 1Objective 1

Describe Security and Compliance Concepts SC-900 Practice Questions (Page 8)

Part of the Describe the concepts of security, compliance, and identity domain, which accounts for 10–15% of the SC-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~2–5 in this domain), expect 1–3 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

8concepts

10–15%of the exam

Questions 36–40

36foundation · easy
In the shared responsibility model for cloud computing, which of the following is typically the responsibility of the cloud customer?
Select an answer first
37application · medium
A company is migrating its customer relationship management (CRM) system to Azure IaaS. The security team wants to ensure that the CRM application is protected even if an attacker gains access to the application layer. They plan to implement network security groups, application-level authentication, and regular patching. Which additional control best aligns with the shared responsibility model and defense-in-depth to protect the data stored by the CRM?
Select an answer first
38foundation · easy
Which activity is an example of IT governance?
Select an answer first
39expert · hard
A security team is designing a defense-in-depth strategy for a web application. They have implemented a web application firewall (WAF), network security groups, and encryption. What additional layer would best complete the strategy?
Select an answer first
40expert · hard
A large enterprise is adopting a cloud governance framework. They must balance the need for agility (developers want to deploy quickly) with the need for compliance (auditors require approval for changes). Which approach best satisfies both?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-900” is a trademark of its owner, used for identification only.