SC-900 Security Fundamentals Study Guide & Exam Questions

What do you want to practice?

These are the questions on the free pages. Test yourself below, and tick the pages to include in a practice session.

• 1. Part 1: Introduction to security, compliance, and identity concepts 44 questions
  • 1.1 Describe security and compliance concepts44 questions

    1. A student logs in to a finance system from a new country on an unknown laptop. What does verify explicitly require in a Zero Trust approach?

    • Trusting any request that arrives from inside the corporate network
    • Evaluating identity, device compliance, location, application, data sensitivity, and anomalies for each request
    • Granting permanent administrator rights after one successful login
    • Disabling monitoring once a user has authenticated

    Show answer and explanation

    • Evaluating identity, device compliance, location, application, data sensitivity, and anomalies for each request

    Explicit verification combines identity, device state, location, app, data classification, and anomalies to judge each request.

    2. A lab needs temporary database access for a two-hour maintenance task. How do just-in-time access and just-enough-access implement least privilege?

    • Giving all interns permanent broad access in case it is needed later
    • Granting only the specific permissions needed and only for the time needed
    • Sharing one administrator account to simplify auditing
    • Removing authentication for low-risk applications

    Show answer and explanation

    • Granting only the specific permissions needed and only for the time needed

    Just-in-time limits duration and just-enough-access limits scope, reducing standing privilege that attackers could abuse.

    3. The Zero Trust principle of ____ means segmenting access, encrypting data end to end, and monitoring so an intruder who gets inside cannot move freely.

    • Assume breach
    • Avoid segmentation
    • Trust the network
    • Verify explicitly

    Show answer

    • The Zero Trust principle of Assume breach means segmenting access, encrypting data end to end, and monitoring so an intruder who gets inside cannot move freely.

    4. A clinic meets all requirements of a health-data regulation but still runs unpatched software. How do compliance and security differ in this situation?

    • They are identical, so passing an audit guarantees no exploitable weaknesses remain
    • Compliance defines minimum required standards, while security is broader protection that may demand more
    • Security is only about encryption, while compliance covers all other controls
    • Compliance is voluntary, while security is legally mandated

    Show answer and explanation

    • Compliance defines minimum required standards, while security is broader protection that may demand more

    Regulations set floors that must be met, while security includes all additional practices needed to resist real threats.

    5. Arrange the four risk-management activities in the order they are performed.

    • Assess impact and likelihood to prioritize risks
    • Identify potential risks to systems, data, and operations
    • Monitor risks and control effectiveness over time
    • Respond by accepting, mitigating, transferring, or avoiding each significant risk

    Show answer

    1. Identify potential risks to systems, data, and operations
    2. Assess impact and likelihood to prioritize risks
    3. Respond by accepting, mitigating, transferring, or avoiding each significant risk
    4. Monitor risks and control effectiveness over time

    6. A university stores applicant records collected in one country in datacenters in another country. What distinguishes data residency from data sovereignty for those records?

    • They both mean encrypting personal data before storage
    • Residency governs where data may be stored and transferred, while sovereignty determines which country or region laws apply to it
    • Residency applies only on premises, while sovereignty applies only in public cloud
    • They both grant individuals the right to delete their data on request

    Show answer and explanation

    • Residency governs where data may be stored and transferred, while sovereignty determines which country or region laws apply to it

    Residency governs permitted storage and movement locations, while sovereignty determines which jurisdictions' laws apply based on collection, holding, or processing location.

    7. Data privacy applies to any information relating to an identifiable person, including indirect identifiers such as location history, and requires transparency, appropriate consent, individual rights over data, and protection from unauthorized exposure.

    • True
    • False

    Show answer and explanation

    • True

    Privacy covers direct identifiers like names and indirect linkable data like location history, with duties of transparency, consent, individual rights, and protection.

    8. Arrange the defense-in-depth layers from outermost protection to innermost asset.

    • Application
    • Compute
    • Data
    • Identity and access
    • Network
    • Perimeter
    • Physical security

    Show answer

    1. Physical security
    2. Identity and access
    3. Perimeter
    4. Network
    5. Compute
    6. Application
    7. Data

    9. A lab network contains student laptops, research servers, and building controls. Which network-layer control best limits damage if one laptop is compromised?

    • Encrypting backups so stolen disks cannot be read
    • Dividing the network into isolated zones with rules that restrict host-to-host traffic
    • Requiring longer passwords only for administrators
    • Publishing application source code for public review

    Show answer and explanation

    • Dividing the network into isolated zones with rules that restrict host-to-host traffic

    Segmentation and traffic rules isolate zones, so a compromised host cannot freely reach unrelated systems.

    10. Defense in depth overlaps controls so that if one control fails, the ____ layer still blocks progress, with ____ protected as the innermost asset.

    • Data
    • firewall
    • next
    • password
    • perimeter

    Show answer

    • Defense in depth overlaps controls so that if one control fails, the next layer still blocks progress, with Data protected as the innermost asset.

    11. A university helpdesk connects its AI assistant to student records and public web pages. Which customer-side approach best reduces prompt injection, where hidden instructions in user input or retrieved data try to manipulate the assistant?

    • Replacing platform content filters with longer encryption keys
    • Validating inputs, restricting data connectors and permissions, and monitoring AI activity
    • Disabling all logging to reduce stored prompts
    • Giving every user administrative access to simplify oversight

    Show answer and explanation

    • Validating inputs, restricting data connectors and permissions, and monitoring AI activity

    Prompt injection works through malicious instructions in prompts or connected content, so the customer must validate input, limit connectors and privileges, and monitor use.

    12. When a college uses a SaaS AI assistant, the provider typically secures model hosting and platform safety controls, while the college still controls what data the assistant can access and who is allowed to use it.

    • True
    • False

    Show answer and explanation

    • True

    Platform hosting and built-in safeguards belong to the provider, while decisions about data access, user access, configuration, and oversight belong to the customer.

    13. An undergraduate club uses a SaaS email service where the provider manages servers and the application. Who remains responsible for classifying club member data, managing logins with multifactor authentication, securing members' laptops, and setting sharing permissions?

    • The provider, because SaaS means all security accountability transfers to the vendor
    • The customer, for data, identities, endpoints, and tenant configuration
    • The device manufacturer, because endpoints originate the risk
    • No one, because SaaS applications are isolated from attacker access

    Show answer and explanation

    • The customer, for data, identities, endpoints, and tenant configuration

    Even with SaaS email or collaboration tools, the customer decides what data is stored, who may access it, and how the tenant is configured.

    14. Moving from Infrastructure as a Service to Software as a Service gives the cloud provider more underlying infrastructure duties while the customer keeps responsibility for its data, identities, endpoints, and configuration choices.

    • True
    • False

    Show answer and explanation

    • True

    Moving from IaaS toward SaaS increases provider duties for infrastructure and platform, but data, identity, endpoint, and configuration duties stay with the customer.

    15. Match each cloud service model to the extent of provider responsibility for the underlying stack.

    • IaaS provider duties
    • PaaS provider duties
    • SaaS provider duties

    • Above plus entire application stack
    • Above plus operating system and runtime environment
    • Physical datacenter, physical network, and physical hosts

    Show answer and explanation

    • IaaS provider duties: Physical datacenter, physical network, and physical hosts
    • PaaS provider duties: Above plus operating system and runtime environment
    • SaaS provider duties: Above plus entire application stack

    With IaaS the provider covers only building, network hardware, and hosts.

    PaaS adds operating system and runtime to provider duties, leaving code and data to the customer.

    With SaaS the provider operates the full application stack and infrastructure.

    16. Why is symmetric encryption well suited to encrypting a large research database yet challenging for communicating with a new partner across the internet?

    • It uses a public key for encryption and a private key for decryption, which is ideal for bulk storage
    • It is fast for large data but requires securely sharing one secret key
    • It is one-way and needs no key, so it cannot decrypt stored files
    • It verifies sender identity without encrypting content

    Show answer and explanation

    • It is fast for large data but requires securely sharing one secret key

    One key makes bulk encryption fast, but both sides must obtain that secret without exposing it.

    17. In asymmetric encryption, data encrypted with someone's public key can only be decrypted with that person's corresponding private key.

    • True
    • False

    Show answer and explanation

    • True

    The key pair is designed so only the holder of the private key can reverse encryption performed with the public key.

    18. Secure password storage keeps only the ____ of each password and adds a unique random ____ before hashing so identical passwords produce different stored values.

    • firewall
    • hash
    • private key
    • salt

    Show answer

    • Secure password storage keeps only the hash of each password and adds a unique random salt before hashing so identical passwords produce different stored values.

    19. What is the fixed-length, one-way fingerprint produced by a hash algorithm called?

    Show answer and explanation

    • hash, digest, hash value, message digest

    Hashing produces a fixed-length fingerprint that cannot be reversed to reveal the original input.

    20. Match each attack effect to the CIA property it primarily violates.

    • Attacker copies unreleased admissions files
    • Attacker alters grades in a registrar database
    • Attacker floods a library catalog until it goes offline

    • Availability
    • Confidentiality
    • Integrity

    Show answer and explanation

    • Attacker copies unreleased admissions files: Confidentiality
    • Attacker alters grades in a registrar database: Integrity
    • Attacker floods a library catalog until it goes offline: Availability

    Stealing readable records violates authorized-only access.

    Quietly changing values violates accuracy and authorized modification.

    Flooding a service until it stops responding violates accessibility to legitimate users.

    21. A research group encrypts all field data for confidentiality. Why could that same encryption harm availability?

    • Encryption always improves all three properties equally without tradeoffs
    • Encryption improves availability by creating extra copies of data
    • If decryption keys are lost, strongly encrypted data can become permanently inaccessible
    • Encryption prevents hardware failures from occurring

    Show answer and explanation

    • If decryption keys are lost, strongly encrypted data can become permanently inaccessible

    Encryption protects confidentiality only while keys remain available to legitimate users; losing all copies removes access.

    22. Comparing the hash of a downloaded installer to the value published by its creator is an integrity check that can reveal tampering.

    • True
    • False

    Show answer and explanation

    • True

    A hash is a fingerprint; comparing a computed hash to the publisher value reveals any modification.

    23. Which three statements correctly describe Zero Trust guiding principles?

    • Define the perimeter by physical locations.
    • Use identity as the primary security boundary.
    • Always verify the permissions of a user explicitly.
    • Always assume that the user system can be breached.
    • Use the network as the primary security boundary.

    Show answer and explanation

    • Use identity as the primary security boundary.
    • Always verify the permissions of a user explicitly.
    • Always assume that the user system can be breached.

    Zero Trust verifies explicitly, enforces least privilege, and assumes breach, and it uses identity rather than the network as the primary boundary. Defining a perimeter by physical location or relying on the network boundary reflects the traditional model Zero Trust replaces.

    24. In software as a service (SaaS), the organization is responsible for applying service packs to applications.

    • True
    • False

    Show answer and explanation

    • False

    In software as a service, the provider operates and patches the application, operating system, and infrastructure. The customer configures the application and manages access but does not apply service packs.

    25. In infrastructure as a service (IaaS), the cloud provider is responsible for managing the physical network.

    • True
    • False

    Show answer and explanation

    • True

    Physical hosts, network, and datacenter are the provider's duty in IaaS, PaaS, and SaaS alike.

    26. In every Azure cloud deployment type, the organization is responsible for securing its information and data.

    • True
    • False

    Show answer and explanation

    • True

    Information and data, along with devices and accounts and identities, always remain the customer's duty in every Azure deployment type.

    27. The operation that turns a file's contents into a form readable only by holders of the proper key is ____ the file.

    • Archiving
    • Compressing
    • Deduplicating
    • Encrypting

    Show answer

    • The operation that turns a file's contents into a form readable only by holders of the proper key is Encrypting the file.

    28. You intend to adopt a security approach that positions several defensive layers across network infrastructure. Which methodology is this?

    • threat modeling
    • identity as the security perimeter
    • defense in depth
    • the shared responsibility model

    Show answer and explanation

    • defense in depth

    Defense in depth layers defenses so that if one layer is breached the next layers still slow or stop the intruder. Threat modeling identifies and prioritizes threats, identity as the security perimeter centers on identity controls, and the shared responsibility model splits duties between provider and customer.

    29. Asymmetric encryption employs a paired public key and private key.

    • True
    • False

    Show answer and explanation

    • True

    Asymmetric cryptography relies on a linked pair where content locked with the public key is opened with the corresponding private key.

    30. Symmetric encryption employs a paired public key and private key.

    • True
    • False

    Show answer and explanation

    • False

    Symmetric cryptography relies on one shared secret applied to both locking and unlocking the data.

    31. Decryption can recover source material from its content hash.

    • True
    • False

    Show answer and explanation

    • False

    Hashing is one-way and keyless, so the original content cannot be recovered from its hash; hashes only support integrity checks.

    32. Confirming that retrieved data matches what was stored demonstrates preservation of ____

    • availability.
    • confidentiality.
    • integrity.
    • transparency.

    Show answer

    • Confirming that retrieved data matches what was stored demonstrates preservation of integrity.

    33. Sort the cloud models from greatest customer duty to smallest customer duty under shared responsibility.

    • infrastructure as a service (IaaS)
    • on-premises datacenter
    • platform as a service (PaaS)
    • software as a service (SaaS)

    Show answer

    1. on-premises datacenter
    2. infrastructure as a service (IaaS)
    3. platform as a service (PaaS)
    4. software as a service (SaaS)

    34. Verifying explicitly is one of the guiding principles of Zero Trust.

    • True
    • False

    Show answer and explanation

    • True

    Verify explicitly, always authenticating and authorizing from all available data points, is one of the three Zero Trust guiding principles.

    35. Assuming breach is one of the guiding principles of Zero Trust.

    • True
    • False

    Show answer and explanation

    • True

    Assume breach, limiting blast radius through segmentation and detecting threats with analytics, is a Zero Trust guiding principle alongside verify explicitly and use least privilege.

    36. The Zero Trust model presumes that a firewall keeps the internal network safe from outside threats.

    • True
    • False

    Show answer and explanation

    • False

    Zero Trust does not treat the internal network as safe because of a firewall. It treats every request as coming from an uncontrolled network and always verifies.

    37. Under the shared responsibility model for Azure, what is solely Microsoft's duty to manage?

    • administering mobile devices
    • setting permissions on user data held in Azure
    • creating and administering user accounts
    • administering the physical hardware

    Show answer and explanation

    • administering the physical hardware

    In every cloud model, Microsoft is responsible for physical hosts, the physical network, and the physical datacenter. Devices, accounts and identities, and data plus access to data remain customer responsibilities.

    38. Creating a digital signature on a document needs the signer's private key.

    • True
    • False

    Show answer and explanation

    • True

    A digital signature is created with the signer's private key, which only the signer possesses.

    39. Checking a digitally signed document for authenticity needs the signer's public key.

    • True
    • False

    Show answer and explanation

    • True

    Anyone holding the signer's public key can check the signature, confirming the signer's identity and that the document is unchanged.

    40. Checking a digitally signed document for authenticity needs the signer's private key.

    • True
    • False

    Show answer and explanation

    • False

    The private key is never shared. Requiring it for verification would prevent proving who signed.

    41. A cloud app will be managed by you only for its data, user accounts, and user devices. Which cloud model fits that plan?

    • SaaS
    • PaaS
    • IaaS

    Show answer and explanation

    • SaaS

    With software as a service the vendor operates everything from the datacenter through the application, so the customer looks after only data, identities and accounts, and devices. Platform as a service returns application duties to the customer, and infrastructure as a service also returns operating system and networking duties.

    42. Under the software as a service (SaaS) cloud model, which area remains the customer's duty when reviewing security?

    • operating systems
    • network controls
    • applications
    • accounts and identities

    Show answer and explanation

    • accounts and identities

    In the shared responsibility model customers always keep responsibility for information and data, devices, and accounts and identities, whatever the deployment type. In software as a service Microsoft is responsible for operating systems and network controls, while applications are shared with Microsoft running the app and the customer responsible only for configuration and access.

    43. Link each Zero Trust pillar to its corresponding demand.

    • Needs to be divided into segments
    • Needs to be confirmed through robust authentication
    • Needs to be categorized, tagged, and encrypted according to its properties

    • Data
    • Identities
    • Networks

    Show answer and explanation

    • Needs to be divided into segments: Networks
    • Needs to be confirmed through robust authentication: Identities
    • Needs to be categorized, tagged, and encrypted according to its properties: Data

    The networks pillar uses segmentation and micro-perimeters to limit lateral movement.

    The identities pillar requires each identity to be verified with strong authentication before accessing resources.

    The data pillar keeps data protected wherever it goes by classifying, labeling, and encrypting it according to sensitivity.

    44. Under the shared responsibility model, what stays Microsoft's duty for Azure virtual machines?

    • Applying firmware updates to the disk controller
    • Applying updates to installed applications
    • Setting permissions on shared folders
    • Applying updates to the operating system

    Show answer and explanation

    • Applying firmware updates to the disk controller

    Virtual machines are infrastructure as a service, so Microsoft owns the physical datacenter, hosts, and host firmware such as disk controllers. The customer owns the guest operating system, installed programs, and in-VM configuration including shared-folder permissions.

In what order?