An organization is moving from a traditional perimeter-based security model to Zero Trust. They have already implemented MFA and device compliance checks. However, they are struggling with legacy applications that do not support modern authentication protocols. Which approach best aligns with Zero Trust while accommodating these legacy applications?

Allow legacy applications to bypass MFA because they cannot support it.

Move legacy applications to a separate network segment and trust that segment.

Disable legacy applications until they are modernized.

Place legacy applications behind an application proxy that enforces access policies and requires modern authentication.

A software company needs to verify that a downloaded firmware update has not been tampered with during transmission. The vendor publishes a hash value for the update file. What should the company do to verify the file's integrity?

Check the file's digital signature using the vendor's private key

Compare the file size to the size listed on the vendor's website

Decrypt the file using the vendor's public key

Compute the hash of the downloaded file and compare it to the vendor's published hash

A company is assessing the risk of moving a legacy application to the cloud. The application contains sensitive data and has no redundancy. The risk assessment shows a high likelihood of a security breach due to known vulnerabilities. Which risk response is most appropriate?

Mitigate the risk by patching the vulnerabilities and adding redundancy before migration

Accept the risk because the cloud provider is responsible for security

Avoid the risk by not migrating the application

Transfer the risk by purchasing cyber insurance and migrate as-is

A company is moving from on-premises servers to Azure PaaS services. The compliance team asks which security responsibilities remain with the company. Which responsibility is still the customer's?

Managing user access and identity policies for the application

Configuring the network infrastructure of the cloud data center

Securing the physical servers in the data center

Patching the underlying operating system of the PaaS service

A financial services company must adhere to industry regulations that require customer data to be stored in a specific geographic region. They are planning to use Azure. What should they do to meet this compliance requirement?

Enable Azure Defender for Cloud to monitor for compliance

Use Azure Policy to tag all resources with the customer's name

Deploy the workloads to an Azure region located in the required geographic area

Store all data in Azure's global infrastructure without specifying a region

Microsoft Certified:Security, Compliance, and Identity Fundamentals

Domain 1Objective 1

Describe Security and Compliance Concepts SC-900 Practice Questions (Page 9)

Part of the Describe the concepts of security, compliance, and identity domain, which accounts for 10–15% of the SC-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~2–5 in this domain), expect 1–3 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

8concepts

10–15%of the exam

Questions 41–45

41expert · hard
An organization is moving from a traditional perimeter-based security model to Zero Trust. They have already implemented MFA and device compliance checks. However, they are struggling with legacy applications that do not support modern authentication protocols. Which approach best aligns with Zero Trust while accommodating these legacy applications?
Select an answer first
42application · medium
A software company needs to verify that a downloaded firmware update has not been tampered with during transmission. The vendor publishes a hash value for the update file. What should the company do to verify the file's integrity?
Select an answer first
43expert · hard
A company is assessing the risk of moving a legacy application to the cloud. The application contains sensitive data and has no redundancy. The risk assessment shows a high likelihood of a security breach due to known vulnerabilities. Which risk response is most appropriate?
Select an answer first
44application · medium
A company is moving from on-premises servers to Azure PaaS services. The compliance team asks which security responsibilities remain with the company. Which responsibility is still the customer's?
Select an answer first
45application · medium
A financial services company must adhere to industry regulations that require customer data to be stored in a specific geographic region. They are planning to use Azure. What should they do to meet this compliance requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-900” is a trademark of its owner, used for identification only.