Concepts of Security, Compliance, and Identity

Describe foundational security and compliance concepts including shared responsibility, Zero Trust, defense-in-depth, encryption, GRC, and core identity principles.

5 minutes 5 Questions

Microsoft Security, Compliance, and Identity Fundamentals revolves around three core pillars essential to modern cybersecurity and organizational governance. **Security** focuses on protecting systems, networks, and data from cyber threats. Key concepts include the Zero Trust model, which operates…

Concepts covered
Zero Trust Model and Guiding PrinciplesGovernance, Risk, and Compliance (GRC) ConceptsAuthentication Concepts and MethodsIdentity Providers and Their RoleFederation ConceptsShared Responsibility ModelDefense-in-Depth StrategyEncryption and Hashing FundamentalsIdentity as the Primary Security PerimeterAuthorization Concepts and Access ControlDirectory Services and Active Directory
Test mode:
Start practice test

SC-900 - Concepts of Security, Compliance, and Identity Example Questions

Test your knowledge of Concepts of Security, Compliance, and Identity

Question 1

In the Zero Trust model, what is the default assumption about all network traffic and access requests, regardless of their origin?

Correct Answer: All traffic is treated as untrusted until verified through authentication and authorization

The Zero Trust model operates on the principle of "never trust, always verify," meaning all network traffic and access requests are treated as untrusted by default, regardless of origin, and must be authenticated and authorized before access is granted.

Trusting internal traffic after perimeter validation reflects the outdated perimeter-based security model, not Zero Trust. Treating only external cloud traffic as untrusted contradicts the "regardless of origin" principle of Zero Trust. Evaluating traffic based on reputation scores alone is insufficient since Zero Trust requires explicit verification through authentication and authorization, not just passive scoring.

The key concept tested is the foundational "never trust, always verify" principle of the Zero Trust security model.

Question 2

In Microsoft Entra ID, what does the term 'something you have' refer to as an authentication factor?

Correct Answer: A physical or digital device in the user's possession, such as a phone or security key

In the context of authentication factors, 'something you have' refers to a physical or digital device in the user's possession, such as a mobile phone receiving a verification code, a hardware security key, or an authenticator app, which proves identity by demonstrating ownership of that device.

A biometric characteristic like a fingerprint falls under 'something you are,' not 'something you have.' A memorized passphrase or security question is 'something you know.' A location-based signal is a contextual signal used in Conditional Access policies, not a traditional authentication factor category.

The key concept tested is understanding the three categories of authentication factors: something you know, something you have, and something you are.

Question 3

In Microsoft Entra ID, what does multi-factor authentication (MFA) require a user to provide during sign-in?

Correct Answer: Two or more verification methods from different authentication factor categories

Multi-factor authentication (MFA) in Microsoft Entra ID requires a user to provide two or more verification methods from different authentication factor categories, specifically something you know (like a password), something you have (like a phone or hardware token), and something you are (like a fingerprint or face scan).

Using two methods from the same category does not qualify as MFA because it does not increase security across different factor types. A single verification method, regardless of its strength, is single-factor authentication. Multiple passwords are still the same factor category (something you know) and do not constitute true MFA.

The key concept tested is the definition and requirements of multi-factor authentication using distinct factor categories.

More Concepts of Security, Compliance, and Identity questions
459 questions (total)
Practice 100 questions
One session at a time, always new questions