Microsoft SC-900 Practice Test

SC-900 practice test: what's covered

• Security, Compliance & Identity Fundamentals

Free SC-900 sample questions

1. A hospital must guarantee that lab results cannot be altered by anyone except authorized staff, and that any tampering is detectable. Which element of the CIA triad does this requirement primarily address?

   • A. Integrity, which ensures data is accurate and has not been modified by unauthorized parties
   • B. Availability, which ensures systems and data are reachable when users need them
   • C. Confidentiality, which ensures data is only disclosed to authorized parties
   • D. Non-repudiation, which ensures a party cannot deny performing an action
   Show answer

   Correct: A. Integrity is the CIA pillar that guarantees data is accurate and unaltered except by authorized changes, so undetected tampering of lab results would be an integrity failure. Availability is incorrect because it concerns uptime and access, not unauthorized modification. Confidentiality is wrong because it deals with preventing disclosure, not preventing alteration. Non-repudiation, while related, is not one of the three CIA pillars.

2. Your security lead asks you to redesign network access so that no user or device is trusted simply because it sits inside the corporate LAN. Which guiding principle of the Zero Trust model directly supports removing implicit network trust?

   • A. Assume breach, treating every request as if it originates from an untrusted network
   • B. Trust the internal perimeter while inspecting only inbound internet traffic
   • C. Grant broad standing access to internal systems to reduce help-desk tickets
   • D. Rely on a strong firewall as the single primary boundary of defense
   Show answer

   Correct: A. Zero Trust's assume-breach principle treats every request as hostile regardless of network location, which is exactly why implicit LAN trust is removed. Trusting the internal perimeter is incorrect because it is the legacy castle-and-moat model Zero Trust replaces. Granting broad standing access contradicts least-privilege. Relying on a single firewall is wrong because Zero Trust uses layered, signal-driven verification, not one boundary.

3. When applying the defense-in-depth strategy in Azure, you place independent controls at multiple layers so a single failure does not expose data. Which of the following are recognized layers of the defense-in-depth model? (Choose THREE)

   • A. Physical security controlling access to the datacenter facility
   • B. Identity and access enforcing authentication and authorization
   • C. Data protection through encryption and access restrictions
   • D. Marketing approval of the published security brochure
   • E. Vendor invoice reconciliation in the finance department
   Show answer

   Correct: A and B and C. Defense in depth layers include physical, identity and access, perimeter, network, compute, application, and data, so physical security, identity and access, and data protection are all valid layers. Marketing approval of a brochure is incorrect because it is not a security control layer. Vendor invoice reconciliation is wrong because finance reconciliation is an accounting task, not a defense-in-depth layer protecting systems or data.

4. A user successfully signs in with their password and an MFA prompt, but is then blocked from opening a finance app they have no role for. Which statement correctly distinguishes the two identity processes at work?

   • A. Authentication verified who the user is, while authorization determined what the user may access
   • B. Authentication and authorization are identical and always evaluated as one step
   • C. Authorization happened first to verify identity, then authentication granted access
   • D. Authorization confirmed the password while authentication checked the user role
   Show answer

   Correct: A. Authentication proves identity (the password plus MFA), whereas authorization decides what resources that proven identity can use, which is why access to the finance app was denied. Saying they are identical is incorrect because they are distinct, sequential steps. The claim that authorization runs first is wrong because authentication always precedes authorization. The last option swaps the definitions, so it is incorrect.

5. An auditor asks how your organization protects customer records both while stored in Azure SQL Database and while moving between the application and the database. Which combination correctly maps to encryption at rest and encryption in transit?

   • A. Transparent Data Encryption protects data at rest, while TLS protects data in transit
   • B. TLS protects data at rest, while Transparent Data Encryption protects data in transit
   • C. Hashing protects data at rest, while compression protects data in transit
   • D. BitLocker protects data in transit, while IPsec protects data at rest
   Show answer

   Correct: A. Transparent Data Encryption encrypts the stored database files at rest, and TLS encrypts the connection as data moves over the network, correctly mapping both states. Swapping TDE and TLS is incorrect because TLS secures connections, not stored files. Hashing and compression are wrong because hashing is one-way and compression is not encryption. The BitLocker and IPsec pairing reverses the roles, making it incorrect.

Last updated: 2026-10-19

SC-900 practice test FAQ

Related practice tests

• Microsoft SC-200 practice test
• Microsoft SC-300 practice test
• Microsoft SC-100 practice test
• Microsoft SC-401 practice test
• Azure AZ-900 practice test
• ISC2 CC practice test