Security entry-level certification covering fundamentals of Microsoft security, compliance, and identity solutions.
Zero Trust model, Shared responsibility model, Encryption concepts, Compliance concepts
Microsoft Entra ID, Authentication methods, MFA & Conditional Access, RBAC, Identity governance
Microsoft Defender XDR, Microsoft Sentinel, Azure Firewall, Azure DDoS Protection, Microsoft Defender for Cloud
Microsoft Purview, Compliance portal, Information protection & data lifecycle management, eDiscovery & Audit
Try real exam-style questions from the free sample set. Each answer comes with a full explanation.
A company's security team is reviewing a list of improvement actions in the Microsoft Defender portal to increase the organization's Secure Score.
Which result can be expected when the action to enable MFA for all users is completed?
Answer: B. Secure Score increases
Microsoft Secure Score represents an organization's security posture as a numerical value in the Microsoft Defender portal, and the score increases each time a recommended improvement action is completed. Enabling MFA for all users is a high-impact security improvement action that significantly reduces account takeover risk, and completing it increases the Secure Score.
The Secure Score system is determined by the sum of completed improvement action scores. Actions that strengthen security (enabling MFA, applying Conditional Access policies, etc.) raise the score, while weakened security settings or unimplemented recommendations lower it. This score covers multiple security areas including identity, devices, apps, data, and infrastructure.
You must distinguish between Secure Score and Compliance Score (Purview) as separate systems. Secure Score evaluates security posture, while Compliance Score assesses regulatory compliance levels such as GDPR and HIPAA. Enabling MFA is a Secure Score action, not a Compliance Score action.
A development team is managing database connection strings and API keys by hardcoding them directly in the source code of a web application running on Azure. The security team has recommended separating these sensitive secrets from the code and storing and managing them securely in a centralized location.
Which Azure service BEST meets these requirements?
Answer: C. Azure Key Vault
Azure Key Vault is a dedicated service for centrally storing and managing sensitive secrets such as connection strings, API keys, and passwords outside of source code, making it the BEST fit for this scenario. Applications can securely retrieve secrets from Key Vault at runtime without embedding them directly in code, fundamentally resolving the hardcoding problem.
Azure Key Vault manages three types of objects: Secrets (arbitrary text-based values such as connection strings and API keys), Keys (cryptographic keys for data encryption and decryption), and Certificates (SSL/TLS lifecycle management). When integrated with Managed Identity, applications can access Key Vault without storing separate credentials, further strengthening security.
In the exam, be careful not to confuse Azure Active Directory (Microsoft Entra ID) with Key Vault. Entra ID is an identity and access management service that does not provide secret storage capabilities. When you see the keywords 'centralized storage and management of secrets, keys, and certificates,' select Azure Key Vault; when you see 'user authentication, authorization, or SSO,' select Microsoft Entra ID.
A development team wants to configure an application deployed in Azure to be able to call the Microsoft Graph API. Without a human logging in directly, the application itself needs to authenticate with Microsoft Entra ID to access resources.
Which identity object allows the application to authenticate with Microsoft Entra ID and access resources in this manner?
Answer: C. Service Principal
Just as Amazon Kinesis Data Streams meets the conditions of that scenario, a service principal precisely satisfies the core requirement of this scenario: 'the application itself authenticates with Microsoft Entra ID without a human logging in directly to access the API.' A service principal is a non-human identity object representing an application registered in Entra ID, which uses a client ID with a secret or certificate to obtain an access token via the OAuth 2.0 client credentials flow and access protected resources such as the Microsoft Graph API.
A service principal is automatically created within an Entra ID tenant during App Registration. The application object (global definition) and service principal (specific tenant instance) are structured in a 1:N relationship, with permissions managed through role assignments and consent grants in each tenant. It is broadly used when CI/CD pipelines, backend services, or external apps need to access Azure resources.
Distinguishing service principals from managed identities is important in the exam. A managed identity is a special form of service principal granted to Azure-hosted resources such as Azure VMs and Functions, where the Azure platform automatically manages credentials, eliminating the need for secret management. In contrast, service principals apply to apps running outside Azure or scenarios where credential management is required. When keywords include 'app authenticating directly to Entra ID', 'API calls', or 'OAuth 2.0 credentials flow', select service principal.
A company's IT administrator wants to temporarily activate high-privilege roles such as Global Administrator only when needed for specific tasks, and requires an approval process and justification input upon activation to minimize standing privilege exposure.
Which Microsoft Entra ID feature provides this Just-In-Time privilege elevation and approval-based access control?
Answer: D. Privileged Identity Management
A company's IT administrator wants to temporarily activate high-privilege roles such as Global Administrator only when needed for specific tasks and requires approval and justification upon activation to minimize standing privilege exposure. The three keywords — Just-In-Time privilege elevation, temporary activation, and approval-based access — precisely describe the core capabilities of Privileged Identity Management (PIM). PIM enforces activation of permissions only when needed through Eligible Assignments, and requires approver approval, business justification, and MFA upon activation.
Microsoft Entra Privileged Identity Management is a core tool for implementing the least privilege principle and the Zero Trust security model. PIM distinguishes between Eligible assignments and Active assignments. Users with Eligible assignments must go through an explicit activation request and hold permissions only for a limited time to use a role. PIM also provides a complete audit log of all role activation history for tracking and monitoring privilege use.
For the SC-900 exam, you must distinguish Option 1 from Option 2. Conditional Access is a policy tool that controls access based on login conditions such as location, device, and risk level, and does not provide temporary role activation or approval workflows. RBAC is a basic permission management approach that assigns roles permanently to users, with no JIT activation, time limits, or approval features. If JIT, temporary activation, and approval-based privilege elevation are the keywords, select PIM.
Your IT administrator wants to grant a specific developer only read access to virtual machines in the Azure environment.
Which security principle does this approach follow, ensuring that no more permissions than necessary are granted while using role-based access control (RBAC) in Microsoft Entra ID?
Answer: B. Principle of Least Privilege
Granting a developer only read access to virtual machines while withholding administrative permissions is a direct implementation of the Principle of Least Privilege. This principle requires that users receive only the minimum permissions necessary to perform their job functions, and Azure RBAC enforces this through the Reader role, which allows viewing resources while blocking modification or deletion.
The Principle of Least Privilege is one of the three core pillars of the Zero Trust model, working alongside Assume Breach and Verify Explicitly. Azure RBAC provides built-in roles such as Reader, Contributor, and Owner, as well as custom roles, enabling granular permission control down to the individual resource level. Removing unnecessary permissions minimizes the blast radius in the event of an insider threat or compromised account.
When an exam question mentions "no more permissions than necessary" or "minimum access only," select the Principle of Least Privilege. Separation of duties is an internal control principle that distributes critical tasks across multiple people, while defense in depth is an architectural security strategy that layers multiple controls — neither concept is specifically about minimizing permissions.
The Microsoft Security, Compliance, and Identity Fundamentals (SC-900) exam consists of 45 questions with a 45-minute time limit.
The passing score for the SC-900 exam is 700 out of 1000.
The SC-900 sample set (20 questions with full explanations) is free. The full bank of 320+ questions is available with a CloudMasterIT subscription.