Free Microsoft SC-900 Practice Test 2026
Security, Compliance, and Identity Fundamentals — 500+ Questions

The Zero Trust security model is built on the principle of "never trust, always verify." It assumes breaches can happen and requires explicit verification for every access request, regardless of whether the request originates from inside or outside the network. Its three guiding principles are: verify explicitly, use least privilege access, and assume breach. While least privilege is a component of Zero Trust, it is not the model itself.

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access management service. It enables employees to sign in and access resources including Microsoft 365, the Azure portal, thousands of SaaS applications, and custom-built internal applications. It provides authentication, single sign-on (SSO), multifactor authentication (MFA), and conditional access capabilities.

Conditional Access policies in Microsoft Entra are if-then statements that bring signals together (such as user, device, location, and application) to make access decisions and enforce organizational policies. A Conditional Access policy can require MFA when users connect from outside the corporate network by evaluating the location signal. This is different from Identity Protection, which focuses on risk-based sign-in detection.

Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP). It provides a Secure Score to assess your security posture, actionable recommendations to harden resources, and advanced threat protection across Azure, hybrid, and multi-cloud workloads. Unlike Sentinel (which is a SIEM/SOAR tool), Defender for Cloud focuses specifically on security posture management and workload protection.

Microsoft Sentinel (formerly Azure Sentinel) is a scalable, cloud-native SIEM and SOAR solution. It provides intelligent security analytics and threat intelligence across the enterprise, enabling attack detection, threat visibility, proactive hunting, and automated threat response. Sentinel collects data from users, devices, applications, and infrastructure — both on-premises and across multiple clouds — using built-in connectors.

Microsoft Purview Compliance Manager helps organizations manage compliance requirements across multicloud environments. It provides pre-built assessments for common industry and regional regulations (such as GDPR, HIPAA, and ISO 27001), a risk-based compliance score, workflow capabilities, and step-by-step improvement actions. The compliance score measures your progress toward completing recommended actions that help reduce risks around data protection and regulatory standards.

Microsoft Purview Data Loss Prevention (DLP) helps prevent the unintentional sharing of sensitive information. DLP policies can detect sensitive data types (like credit card numbers, Social Security numbers, or health records) across Exchange email, SharePoint, OneDrive, Microsoft Teams, and endpoint devices. When a DLP policy match is detected, the system can block the content, warn the user, or generate an alert for administrators.

Data classification and accountability is always the customer's responsibility, regardless of the cloud deployment model. Whether you use IaaS, PaaS, or SaaS, you are always responsible for your data, endpoints, accounts, and access management. The cloud provider is always responsible for the physical datacenter, physical network, and physical hosts. Responsibilities like OS patching and network controls shift depending on the service model.

Microsoft Defender for Endpoint is an enterprise endpoint security platform designed to prevent, detect, investigate, and respond to advanced threats on devices. It uses endpoint behavioral sensors embedded in Windows, cloud security analytics, and threat intelligence to detect sophisticated attacks. It also includes automated investigation and remediation capabilities to resolve alerts at scale, reducing the workload on security operations teams.

The Compliance Manager compliance score measures your progress in completing recommended improvement actions within controls that are mapped to key data protection regulations and standards. It is a percentage-based score reflecting your overall compliance posture. Note: Microsoft Secure Score measures security posture, while the Compliance Manager compliance score specifically measures compliance posture against regulatory frameworks. They are different scores for different purposes.