Free SC-900 Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

Microsoft Entra ID is a cloud-based identity and access management (IAM) service. Its primary function is to serve as an identity provider (IdP). It manages user identities and facilitates secure access to resources by handling authentication (verifying a user's identity, typically through sign-in) and authorization (granting the verified user appropriate permissions). The other options represent different categories of services: Microsoft Sentinel is a SIEM, Microsoft Defender XDR is an XDR system, and management groups are an Azure resource hierarchy construct.

Microsoft Entra documentation: "Microsoft Entra ID is a cloud-based identity and access management (IAM) solution... Microsoft Entra ID enables your employees to securely access both external and internal resources. It is the central point for managing identities and access control."

Source: Microsoft. (2024). What is Microsoft Entra ID?. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/entra/fundamentals/whatis (Introduction section).

Microsoft Entra documentation on federation: "Microsoft Entra ID can act as the identity provider (IdP) for applications."

Source: Microsoft. (2023). Federation with a SAML/WS-Fed identity provider (IdP) for B2B. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/entra/external-id/direct-federation (Overview section).

Microsoft Sentinel documentation: "Microsoft Sentinel is a scalable, cloud-native solution that provides security information and event management (SIEM) and security orchestration, automation, and response (SOAR)."

Source: Microsoft. (2024). What is Microsoft Sentinel?. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/azure/sentinel/overview (Introduction section).

Yes. Microsoft Defender for Cloud includes Microsoft Defender for Storage, a specific plan designed to detect anomalous activities and potential threats against Azure Storage accounts, such as malware uploads or access from suspicious IP addresses.

Yes. Foundational Cloud Security Posture Management (CSPM) capabilities are enabled by default and are free for all Azure subscriptions. These features provide a Secure Score and basic security recommendations to help strengthen cloud security posture.

Yes. Microsoft Defender for Cloud (formerly Azure Security Center) can extend its security posture management and threat protection to on-premises and other cloud environments. This is achieved by onboarding these non-Azure machines using Azure Arc.

Microsoft Corporation. (2024). Overview of Microsoft Defender for Storage. Microsoft Docs. Retrieved from https://docs.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-introduction. (This document confirms that Defender for Storage "detects unusual and potentially harmful attempts to access or exploit your storage accounts.")

Microsoft Corporation. (2024). Cloud Security Posture Management (CSPM). Microsoft Docs. Retrieved from https://docs.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management. (This source states, "The foundational CSPM capabilities in Defender for Cloud are free.")

Microsoft Corporation. (2024). Connect your non-Azure machines to Microsoft Defender for Cloud. Microsoft Docs. Retrieved from https://docs.microsoft.com/en-us/azure/defender-for-cloud/connect-on-premises-machines. (This article details the process of using Azure Arc to onboard on-premises servers for security evaluation by Defender for Cloud.)

Microsoft Intune is a cloud-based unified endpoint management (UEM) solution for managing both corporate-owned and personally-owned devices and applications. The primary administrative interface for configuring and managing Intune is the Microsoft Endpoint Manager admin center. This web-based console unifies the management experience for Intune and Configuration Manager, providing a single place to create policies and manage devices. While Intune integrates heavily with Azure Active Directory for identity and access management, its specific device and application management functions are performed within the Endpoint Manager portal. The security and compliance centers serve different purposes related to threat protection and data governance, respectively.

Microsoft Intune Documentation: "The Microsoft Endpoint Manager admin center is a one-stop shop where you can manage all your endpoints. It brings together the functionality of Microsoft Intune and Configuration Manager."

Source: Microsoft Docs, "Walkthrough the Microsoft Endpoint Manager admin center," Get Started section.

Microsoft Intune Documentation: "Microsoft Intune is a cloud-based service that focuses on mobile device management (MDM) and mobile application management (MAM). You control how your organization’s devices are used... You connect to Intune using the Microsoft Endpoint Manager admin center."

Source: Microsoft Docs, "What is Microsoft Intune?," How to get Intune section.

The Microsoft Cloud Adoption Framework for Azure (CAF) is a collection of documentation, implementation guidance, best practices, and tools designed to help organizations accelerate their cloud adoption journey. It is based on the experiences and best practices from Microsoft employees, partners, and customers. The framework provides a structured approach to cloud adoption, covering strategy, planning, readiness, migration, and governance.

• Azure Blueprints is a service for deploying and updating cloud environments in a repeatable manner using composable artifacts like resource groups, policies, and role assignments.
• Azure Policy is a service for creating, assigning, and managing policies to enforce organizational standards and assess compliance.
• A resource lock is a feature that prevents accidental deletion or modification of Azure resources.

Microsoft Learn. (n.d.). What is the Microsoft Cloud Adoption Framework for Azure?. Retrieved from https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/overview.

Reference Point: The overview section states, "The Microsoft Cloud Adoption Framework for Azure is proven guidance that's designed to help you create and implement the business and technology strategies necessary for your organization to succeed in the cloud. It provides best practices, documentation, and tools that cloud architects, IT professionals, and business decision makers need to successfully achieve their short- and long-term objectives."

Microsoft Learn. (n.d.). What is Azure Blueprints?. Retrieved from https://learn.microsoft.com/en-us/azure/governance/blueprints/overview.

Reference Point: The documentation explains that Azure Blueprints enables cloud architects to define a repeatable set of Azure resources that implements and adheres to an organization's standards, patterns, and requirements.

Microsoft Learn. (n.d.). Lock resources to prevent unexpected changes. Retrieved from https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources.

Reference Point: The documentation states, "As an administrator, you may need to lock a subscription, resource group, or resource to prevent other users in your organization from accidentally deleting or modifying critical resources."

Statement 1: No. Azure Active Directory (now Microsoft Entra ID) is available in several editions: Free, Microsoft 365 Apps, Premium P1, and Premium P2. Each subsequent edition includes more advanced features. For example, features like Conditional Access and Privileged Identity Management (PIM) are only available in the Premium editions.

Statement 2: Yes. The Azure portal is a primary web-based user interface for creating, managing, and monitoring Azure resources, which includes the components of an Azure AD tenant like users, groups, and application registrations.

Statement 3: No. Azure Active Directory is a fully managed, multi-tenant cloud service (Identity as a Service - IDaaS) provided by Microsoft. Microsoft is responsible for hosting and managing the underlying infrastructure. Customers consume the service and do not need to deploy or maintain any virtual machines to run the Azure AD tenant itself. This is a fundamental difference from traditional on-premises Active Directory Domain Services (AD DS).

Microsoft Entra pricing page: This official Microsoft documentation provides a detailed comparison table showing the different features available across the Free, Premium P1, and Premium P2 editions of Microsoft Entra ID (formerly Azure AD).

Source: Microsoft, "Microsoft Entra pricing," Microsoft Security, Accessed October 13, 2025.

What is Azure Active Directory?: This fundamental documentation explains that Azure AD is a cloud-based identity service and mentions the Azure portal as a tool for management.

Source: Microsoft Learn, "What is Azure Active Directory?," Azure Active Directory Fundamentals, Last reviewed May 23, 2023. See the section "How can I get started with Azure AD?".

Compare Active Directory to Azure Active Directory: This document explicitly clarifies the architectural differences, stating that Azure AD is a managed cloud service, contrasting it with the server-based infrastructure required for on-premises AD DS.

Source: Microsoft Learn, "Compare Active Directory to Azure Active Directory," Azure Architecture Center, Last updated February 28, 2023. See the section "Architectural differences."

Microsoft Cloud App Security (now part of Microsoft Defender for Cloud Apps) integrates with Azure AD Conditional Access to enable real-time monitoring and control over user sessions in cloud applications. This feature, called Conditional Access App Control, acts as a reverse proxy. When a user session is routed through it, administrators can enforce granular policies, such as blocking file downloads, protecting files on download with sensitivity labels, or monitoring specific user activities within the app. This provides a powerful way to prevent data leakage and enforce security compliance in real time for sanctioned applications.

Microsoft Learn. "Deploy Conditional Access App Control for featured apps." Microsoft Defender for Cloud Apps Documentation. States, "Session controls in Microsoft Defender for Cloud Apps work with Azure AD Conditional Access to monitor and control user app sessions in real time, based on access and session policies."

Microsoft Learn. "Conditional Access - Session." Azure Active Directory Documentation. Under the "Use Conditional Access App Control" section, it explains, "Conditional Access App Control uses signals from Microsoft Defender for Cloud Apps to apply access controls on an organization's cloud apps."

Microsoft Learn. "What is a session policy?" Microsoft Defender for Cloud Apps Documentation. Describes the capability: "Defender for Cloud Apps session policies enable real-time session-level monitoring, granting you granular visibility into cloud apps and the ability to control different actions depending on the user, location, device, and app."

Azure DDoS Protection Standard is configured at the virtual network (VNet) level. When a DDoS protection plan is associated with a VNet, all resources within that VNet that have a public IP address are automatically protected. This includes resources such as virtual machines, load balancers, and application gateways. The protection is not applied to logical management containers like resource groups or identity services such as Azure Active Directory users or applications.

Microsoft Learn, Azure DDoS Protection Documentation: In the "Overview of Azure DDoS Protection" section, it states, "You can enable DDoS protection on any new or existing virtual network, and it requires no application or resource changes. It has several advantages over the Basic service, including telemetry, alerting, and tuning through machine learning algorithms." This confirms that the service is enabled on virtual networks.

Source: Microsoft Corporation. (2024). What is Azure DDoS Protection? Retrieved from Microsoft Learn. (See Section: "Azure DDoS Protection tiers")

Microsoft Learn, Quickstart: Create and configure Azure DDoS Protection Standard: The tutorial steps explicitly demonstrate this process. Step 2 is "Create a DDoS protection plan," and Step 4 is "Enable DDoS protection for a virtual network." The procedure involves associating the created plan directly with a VNet.

Source: Microsoft Corporation. (2024). Quickstart: Create and configure Azure DDoS Protection Standard using the Azure portal. Retrieved from Microsoft Learn. (See Section: "Enable DDoS protection for a virtual network")

Encrypting is the process of converting plaintext data into a scrambled, unreadable format called ciphertext. This transformation is done using a cryptographic algorithm and a specific 'key'. The primary purpose of encryption is to ensure confidentiality. The data remains unreadable and unusable to anyone who does not possess the corresponding key to decrypt it back into its original, readable form. The other options are incorrect; compressing reduces file size, archiving is for long-term storage, and deduplicating eliminates redundant data to save space.

Stallings, W., & Brown, L. (2018). Computer Security: Principles and Practice (4th ed.). Pearson. In Chapter 2, Section 2.1, "Symmetric Encryption Principles," the text defines encryption as the process where "the original message, referred to as plaintext, is converted into a random-looking ciphertext. The encryption process consists of an algorithm and a key... The key is a value independent of the plaintext... A corresponding key and algorithm are used to decrypt the ciphertext and recover the original plaintext."

Katz, J., & Lindell, Y. (2021). Introduction to modern cryptography (3rd ed.). CRC Press. Chapter 2, "Perfectly Secret Encryption," formally defines an encryption scheme as involving a key-generation algorithm, an encryption algorithm that takes a key and a message (plaintext) to produce a ciphertext, and a decryption algorithm that takes the key and a ciphertext to output the original message. DOI: https://doi.org/10.1201/9781351137322

Azure AD Connect can be used to implement hybrid identity. (Yes) Azure AD Connect is the specific Microsoft tool designed to meet and accomplish hybrid identity goals. It facilitates the synchronization of identity data between an on-premises Active Directory Domain Services (AD DS) environment and Azure Active Directory (Azure AD), which is the core mechanism of a hybrid identity solution.

Hybrid identity requires the implementation of two Microsoft 365 tenants. (No) A standard hybrid identity implementation involves connecting a single on-premises AD DS forest to a single Azure AD tenant. While more complex multi-tenant configurations are possible, they are not a requirement for establishing a hybrid identity. The fundamental model is one on-premises directory linked to one cloud directory.

Hybrid identity refers to the synchronization of Active Directory Domain Services (AD DS) and Azure Active Directory (Azure AD). (Yes) This statement provides the fundamental definition of hybrid identity. It is the practice of creating a common user identity by connecting and synchronizing an on-premises directory (AD DS) with a cloud-based directory (Azure AD). This allows users to use a single set of credentials to access resources in both environments.

Microsoft Entra documentation, "What is hybrid identity with Azure Active Directory?," Microsoft Learn. Retrieved October 13, 2025.

Reference for Statements 1 & 3: Under the section "What is Azure AD Connect?", it states, "Azure AD Connect is the Microsoft tool designed to meet and accomplish your hybrid identity goals... The tool provides the following features: ... Password hash synchronization ... Pass-through authentication ... Federation integration ... Synchronization." This confirms Azure AD Connect as the implementation tool and synchronization as the core concept.

Microsoft Entra documentation, "Topologies for Azure AD Connect," Microsoft Learn. Retrieved October 13, 2025.

Reference for Statement 2: The section "Single forest, single Azure AD tenant" describes the most common and simplest topology: "The most common topology is a single on-premises forest, with one or multiple domains, and a single Azure AD tenant." This explicitly contradicts the notion that two tenants are required.

Authorization is the security process that determines a user's level of access or the permissions they have to specific system resources. This process occurs after a user's identity has been successfully verified through authentication. The question specifies a "signed-in user," indicating authentication has already been completed. Therefore, the subsequent step of checking whether that user can access a particular resource is authorization.

• Authentication answers the question, "Who are you?".
• Authorization answers the question, "What are you allowed to do?".
• Federation and Single sign-on (SSO) are mechanisms related to authentication across different systems, not the process of granting access to a specific resource within a system.

Microsoft Official Documentation: "Authorization is the process of giving a user permission to access a resource. For example, after a user authenticates to a web application, the application would authorize the user to access a specific set of pages or perform certain actions like creating, reading, editing, or deleting data."

Source: Microsoft identity platform documentation, "Authentication vs. authorization". Retrieved from https://learn.microsoft.com/en-us/entra/identity-platform/authentication-vs-authorization, Section: "Authorization".

NIST Glossary: "Authorization: The process of verifying that a requested action or service is approved for a specific entity."

Source: National Institute of Standards and Technology (NIST) Computer Security Resource Center, Glossary. Retrieved from https://csrc.nist.gov/glossary/term/authorization.

IEEE Xplore Digital Library: "Authentication is a mechanism by which a system verifies the identity of a user. Once a user is authenticated, the system uses an authorization mechanism to decide whether the user will be granted access to a resource."

Source: Al-Sinani, M., & Al-Washahi, M. (2020). A Review of Authentication and Authorization Techniques in Online Social Networks. 2020 3rd International Conference on Computer Applications & Information Security (ICCAIS). IEEE. https://doi.org/10.1109/ICCAIS48893.2020.9096839, Section III-A.

Azure AD Connect is the Microsoft tool designed to meet and accomplish hybrid identity goals. Its primary function is to synchronize identity data, such as users and groups, from an on-premises Active Directory Domain Services (AD DS) environment to a cloud-based Azure Active Directory (Azure AD) tenant. It also facilitates authentication methods like Password Hash Synchronization (PHS), Pass-through Authentication (PTA), and federation integration, enabling a unified identity for users across both on-premises and cloud resources.

A. Active Directory Federation Services (AD FS): AD FS is a service that provides federated identity for single sign-on (SSO) but does not perform the synchronization of identity objects itself.

B. Azure Sentinel: Azure Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution, used for threat detection and response, not identity synchronization.

D. Azure AD Privileged Identity Management (PIM): PIM is an Azure AD service for managing, controlling, and monitoring access to privileged roles. It does not synchronize identities from on-premises directories.

1. Microsoft Learn. "What is Azure AD Connect?" Microsoft Entra Documentation. This document explicitly states

"Azure AD Connect is the Microsoft tool designed to meet and accomplish your hybrid identity goals. It provides the following features: ... Synchronization - Responsible for creating users

groups

and other objects. As well as

making sure identity information for your on-premises users and groups is matching the cloud."

2. Microsoft Learn. "Describe the function and identity types of hybrid identity." SC-900: Microsoft Security

Compliance

and Identity Fundamentals. In the "Explore Azure AD Connect" section

it details that "Azure AD Connect is the tool you use to connect your on-premises Active Directory infrastructure to Microsoft Azure AD."

3. Microsoft Learn. "What is hybrid identity with Azure Active Directory?" Microsoft Entra Documentation. This article clarifies the role of different components in a hybrid setup

identifying Azure AD Connect as the core component for synchronization. It states

"To synchronize the users from your on-premises environment to your cloud environment you install Azure AD Connect."

Network protection is a core component of the Attack Surface Reduction (ASR) capabilities within Microsoft Defender for Endpoint. It serves as a first line of defense by preventing employees from accessing dangerous domains through any application. It blocks access to malicious IP addresses, domains, and URLs at the network level, effectively reducing the attack surface by cutting off a primary vector for phishing scams, exploits, and malware delivery before they can impact the endpoint.

A. automated remediation: This is a response action that occurs after a threat has been detected and investigated to clean up malicious artifacts.

B. automated investigation: This is a post-detection capability that analyzes alerts and evidence to determine the scope and root cause of a threat.

C. advanced hunting: This is a proactive query-based tool used by security analysts to hunt for threats, not an automated, preventative protection feature.

---

1. Microsoft Learn. "Network protection." Microsoft Defender for Endpoint Documentation. Accessed May 20

2024. In the overview section

it states

"Network protection helps protect devices from internet-based events. Network protection is an attack surface reduction capability."

2. Microsoft Learn. "Overview of attack surface reduction in Microsoft Defender for Endpoint." Microsoft Defender for Endpoint Documentation. Accessed May 20

2024. This document lists "Network protection" as a key ASR capability and explains that ASR capabilities "help prevent actions and apps that are typically used by threat actors and malware to infect devices."

3. Microsoft Learn. "Automated investigation and response in Microsoft Defender for Endpoint." Microsoft Defender for Endpoint Documentation. Accessed May 20

2024. This document describes automated investigation and remediation as response actions that "run automatically to investigate and remediate threats on devices

" confirming they are not a preventative first line of defense.

Microsoft Defender for Cloud is a comprehensive cloud security posture management (CSPM) and cloud workload protection platform (CWPP). It includes specific plans for various resource types, such as "Microsoft Defender for SQL." This plan provides Advanced Threat Protection for Azure SQL Managed Instance by continuously monitoring for anomalous database activities, potential vulnerabilities, and security threats like SQL injection and unusual access patterns. It alerts security teams to suspicious events, enabling a rapid response to potential attacks on the database.

A. Microsoft Secure Score is a security posture assessment tool that provides recommendations; it does not perform active, real-time threat detection.

B. Application security groups are used to group virtual machines and define network security policies for them, not for detecting threats within a PaaS database service.

D. Azure Bastion is a managed service that provides secure RDP and SSH access to virtual machines, which is unrelated to database threat detection.

1. Microsoft Learn. "Overview of Microsoft Defender for SQL." Microsoft Docs. Accessed May 20

2024. In the "What does Microsoft Defender for SQL protect?" section

it explicitly lists "Azure SQL Managed Instance" as a protected resource. The document states

"It includes functionality for... detecting anomalous activities that could indicate a threat to your databases."

2. Microsoft Learn. "Advanced Threat Protection for Azure SQL Managed Instance." Microsoft Docs. Accessed May 20

2024. This document details the feature

stating

"Advanced Threat Protection for Azure SQL Managed Instance detects anomalous activities indicating unusual and potentially harmful attempts to access or exploit your databases. Advanced Threat Protection is part of the Microsoft Defender for Azure SQL offering."

3. Microsoft Learn. "Microsoft Secure Score." Microsoft Docs. Accessed May 20

2024. This source defines Secure Score as "a measurement of an organization's security posture" and focuses on "improvement actions

" confirming it is not a threat detection service.

4. Microsoft Learn. "Application security groups." Microsoft Docs. Accessed May 20

2024. This document explains that ASGs "enable you to configure network security as a natural extension of an application's structure

allowing you to group virtual machines

" confirming their role in network filtering

not threat analysis.

A primary characteristic of a sensitivity label is its persistence. When a label is applied to a document or email, it is embedded as clear-text metadata that travels with the content. This ensures that the classification and any associated protection settings (such as encryption or content markings) remain with the data, regardless of where it is stored, used, or shared. This persistence allows applications and services to read the label and enforce the appropriate policies consistently.

B. encrypted: Encryption is a protection that a sensitivity label can apply, but it is not an inherent characteristic of all labels. Some labels may only apply visual markings or no protection at all.

C. restricted to predefined categories: Administrators can create and customize their own sensitivity labels and categories to match their organization's specific data classification schema; they are not limited to a fixed set of predefined categories.

1. Microsoft Learn

"Learn about sensitivity labels

" Microsoft Purview documentation.

Reference for Correct Answer (A): Under the section "What sensitivity labels are

" the documentation states

"When you apply a sensitivity label to content

the label is stored in clear text in the metadata of that content. The label and its protection settings are persistent

and roam with the content..."

Reference for Incorrect Answer (B): Under the section "What sensitivity labels can do

" "Encrypt emails and documents" is listed as one of several possible actions

confirming it is an optional capability

not a universal characteristic.

Reference for Incorrect Answer (C): The entire document details how administrators can "Create and configure sensitivity labels

" which demonstrates that they are customizable and not restricted.

2. Microsoft Learn

"Get started with sensitivity labels

" Microsoft Purview documentation.

Reference for Correct Answer (A): In the introductory paragraph

it explains

"After a sensitivity label is applied to an email

document

or site

any configured protection settings for that label are enforced on the content. The label also persists with the content..."

Conditional Access policies in Azure Active Directory (Azure AD) are the primary tool for enforcing organizational access rules. They function as if-then statements. An administrator can define a policy where the "if" condition targets a specific group of users, and the "then" action, or access control, is to grant access but require multi-factor authentication (MFA). This directly fulfills the requirement of ensuring all users in a designated group must use MFA to sign in.

A. Azure Policy: This service enforces rules and compliance for Azure resources (like virtual machines or storage), not for user sign-in and identity access control.

B. a communication compliance policy: This is a Microsoft Purview feature used to monitor and manage risks in user communications (e.g., email, Teams messages), not for authentication.

D. a user risk policy: This is a specific type of policy within Azure AD Identity Protection that enforces controls based on a calculated user risk level, not simply on group membership.

---

1. Microsoft Learn. "What is Conditional Access in Azure Active Directory?". Microsoft Entra documentation. This document states

"Conditional Access policies at their simplest are if-then statements

if a user wants to access a resource

then they must complete an action... Common signals... include... User or group membership... Common decisions... include... Require multi-factor authentication." This directly supports using Conditional Access to require MFA for a specific group.

2. Microsoft Learn. "Tutorial: Secure user sign-in events with Azure AD Multi-Factor Authentication". Microsoft Entra documentation. This tutorial provides a step-by-step guide on creating a Conditional Access policy. Step 4

"Create a Conditional Access policy

" explicitly shows how to select a specific user group under "Assignments" and then select "Require multi-factor authentication" under "Access controls."

3. Microsoft Learn. "What is Azure Policy?". Azure Governance documentation. This source clarifies that Azure Policy "evaluates resources in Azure by comparing the properties of those resources to business rules." This confirms its focus is on resource governance

not identity access.

4. Microsoft Learn. "Configure and enable risk policies". Microsoft Entra documentation. This document explains

"The user risk policy detects the probability that a user account is compromised and allows administrators to configure an automated response... such as... requiring a secure password change or requiring multi-factor authentication." This shows that user risk policies are triggered by risk

not just group membership.

Azure Multi-Factor Authentication (MFA), now part of Microsoft Entra, enhances security by requiring two or more verification methods. The supported methods provide a second layer of security to user sign-ins and transactions. The three primary and most common methods available for users to verify their identity are receiving an automated voice call to a registered phone, receiving a text message (SMS) with a verification code, and using the Microsoft Authenticator app for a push notification or a verification code. These methods represent different factors of authentication ("something you have," like a phone) to secure access.

C. email verification: Email is considered a less secure method and is primarily used for Self-Service Password Reset (SSPR), not as a second factor for MFA during sign-in.

E. security question: Security questions are a "something you know" factor, similar to a password, and are used for SSPR, not for the multi-factor authentication process during sign-in.

1. Microsoft Learn. (2023). What authentication and verification methods are available in Microsoft Entra ID? Microsoft Docs. Retrieved from https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-methods.

Reference Details: The table under the section "Methods and their strengths" explicitly lists "SMS" and "Voice call" as usable for MFA. It also lists "Microsoft Authenticator" as a primary method for MFA. The same table indicates that "Email OTP" and "Security questions" are only usable for Self-Service Password Reset (SSPR).

2. Microsoft Learn. (2023). How it works: Microsoft Entra multifactor authentication. Microsoft Docs. Retrieved from https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mfa-howitworks.

Reference Details: The section "Available verification methods" lists the following options: "Microsoft Authenticator

" "Windows Hello for Business

" "FIDO2 security key

" "OATH hardware token (preview)

" "OATH software token

" "SMS

" and "Voice call." This list confirms the correct answers and omits email and security questions as MFA methods.

Azure Firewall is a managed, cloud-native network security service designed to protect resources within an Azure Virtual Network (VNet). It functions by filtering inbound and outbound traffic based on configured network and application rules. As it is deployed within a VNet, its primary role is to safeguard the network itself and the resources contained within it, such as Azure virtual machines. It can inspect and control traffic flowing between virtual networks, from on-premises networks, and to the internet, thereby providing a centralized protection layer for VNet-based workloads.

B. Azure Active Directory (Azure AD) users are identity objects, not network resources. They are protected by identity-centric services like Azure AD Identity Protection and Conditional Access.

C. Microsoft Exchange Online is a Software as a Service (SaaS) application. It is protected by dedicated services like Exchange Online Protection, not by a customer-managed VNet firewall.

E. Microsoft SharePoint Online is a Software as a Service (SaaS) application. Its security is managed within the Microsoft 365 ecosystem, not by Azure Firewall in a customer's VNet.

1. Microsoft Learn. (2023). What is Azure Firewall? "Azure Firewall is a cloud-native and intelligent network firewall security service that provides the best of breed threat protection for your cloud workloads running in Azure... It allows you to create

enforce

and log application and network connectivity policies across subscriptions and virtual networks."

2. Microsoft Learn. (2023). SC-900: Describe the security capabilities of Azure. "Azure Firewall is a managed

cloud-based network security service that protects your Azure Virtual Network resources." This module explicitly states that resources like virtual machines within a VNet are what Azure Firewall is designed to protect.

3. Microsoft Learn. (2023). Azure Firewall features. This document details features like network traffic filtering rules and DNAT (Destination Network Address Translation)

which are used to control traffic to resources such as virtual machines inside a virtual network.

Cloud security posture management (CSPM) solutions are designed to continuously discover and assess the security configuration and compliance of cloud resources against security best practices and frameworks. They automatically identify misconfigurations, vulnerabilities, and policy violations, generating alerts to notify security teams. This allows organizations to proactively identify and remediate risks in their cloud environment. Microsoft Defender for Cloud is a primary example of a tool that provides CSPM capabilities, offering security recommendations and alerts based on its continuous assessments.

B. DevSecOps: This is a cultural methodology and practice that integrates security into the software development lifecycle, not a specific type of solution that performs continuous posture assessments.

C. cloud workload protection platform (CWPP): This focuses on protecting specific workloads (e.g., virtual machines, containers) at runtime with features like anti-malware and threat detection, rather than assessing the overall cloud configuration posture.

D. security information and event management (SIEM): A SIEM (like Microsoft Sentinel) aggregates, correlates, and analyzes log data and alerts from various sources for threat detection and response, but it does not perform the initial security assessments itself.

1. Microsoft Learn. "What is cloud security posture management (CSPM)?". Microsoft Defender for Cloud documentation. "CSPM provides you with hardening recommendations that help you improve your security posture. CSPM also gives you visibility into your security situation. Defender for Cloud continually assesses your resources against the security standards enabled in your subscription."

2. Microsoft Learn. "Describe the security concepts of Microsoft Sentinel". SC-900: Describe the capabilities of Microsoft security solutions. "A SIEM system collects data from across the entire organization's estate... to detect

investigate

and respond to security threats." This clarifies that a SIEM analyzes data from other sources

rather than performing the initial assessment.

3. Microsoft Learn. "Cloud workload protection in Defender for Cloud". Microsoft Defender for Cloud documentation. "Microsoft Defender for Cloud's cloud workload protection platform (CWPP) provides threat detection and advanced defenses for your multicloud and hybrid workloads..." This highlights the focus on workload-specific threat protection

distinguishing it from the broader configuration assessment of CSPM.

Information Barriers are policies in Microsoft 365 designed to prevent specific groups of users from communicating and collaborating with each other. This feature is used to avoid conflicts of interest or protect internal information by segmenting users, for example, by department. It restricts actions in Microsoft Teams, SharePoint, and OneDrive, directly addressing the need to control communication and information sharing between defined groups. This is often referred to as creating an "ethical wall."

A. sensitivity label policies: These classify and protect data itself (e.g., via encryption) but do not restrict communication channels between user groups.

B. Customer Lockbox: This provides an audit trail and control over Microsoft support engineer access to your data, not internal user communication.

D. Privileged Access Management (PAM): This manages and controls just-in-time access for administrative roles, not communication between general users.

1. Microsoft Learn. (n.d.). Information barriers in Microsoft 365. Microsoft Purview documentation. Retrieved from https://learn.microsoft.com/en-us/purview/information-barriers. In the "Information barriers in Microsoft 365" section

it states

"Information barriers are policies that an admin can configure to prevent individuals or groups from communicating with each other."

2. Microsoft Learn. (n.d.). Describe information protection and governance capabilities in Microsoft Purview. SC-900: Microsoft Security

Compliance

and Identity Fundamentals. Retrieved from https://learn.microsoft.com/en-us/training/modules/describe-information-protection-governance-capabilities-microsoft-365/4-describe-information-barriers. The "Information barriers" section provides a direct example: "...you can use information barriers to prevent the sales department from talking to the research department..."

3. Microsoft Learn. (n.d.). Learn about information barriers. Microsoft Purview documentation. Retrieved from https://learn.microsoft.com/en-us/purview/information-barriers-solution-overview. The "How information barriers can help your organization" section states

"With information barriers

you can define policies that are designed to prevent certain segments of users from communicating with each other..."

Encryption at rest refers to the cryptographic protection of data that is stored in a non-volatile state on physical media, such as hard drives, SSDs, or in a database. Encrypting a virtual machine disk is a direct example of this principle. The data on the disk is rendered unreadable to anyone who might gain unauthorized physical or logical access to the storage medium, as it can only be accessed with the correct decryption keys. This protects the data while it is inactive or "at rest."

A. A site-to-site VPN encrypts data in transit as it travels across a public network between two private networks.

C. An HTTPS connection encrypts data in transit between a user's web browser and the web server.

D. Sending an encrypted email protects the message content while it is in transit from the sender to the recipient.

---

1. Microsoft Learn. (n.d.). Describe encryption and hashing. In SC-900: Microsoft Security

Compliance

and Identity Fundamentals. Retrieved from https://learn.microsoft.com/en-us/training/modules/describe-encryption-hashing/2-what-is-encryption. In the section "States of data

" this module defines data at rest as "inactive data that's stored physically in a database

or on a drive."

2. Microsoft Azure Documentation. (2023

September 21). Azure data encryption at rest. Retrieved from https://learn.microsoft.com/en-us/azure/security/fundamentals/encryption-atrest. This document explicitly lists "Azure Disk Encryption" as a service that provides encryption at rest

stating it "helps you encrypt your Windows and Linux IaaS virtual machine disks."

3. Microsoft Azure Documentation. (2023

September 21). Azure encryption overview. Retrieved from https://learn.microsoft.com/en-us/azure/security/fundamentals/encryption-overview. This overview clearly distinguishes between the two states

categorizing technologies like TLS (used by HTTPS) and VPNs under "Encryption in transit."