SC-900 Describe the concepts of security, compliance, and identity: 135 practice questions

12 of the 135 Describe the concepts of security, compliance, and identity questions in the Certsqill SC-900 bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for SC-900? Take the free 5-min readiness check →

1. Patch the guest operating system: Which task remains the college’s responsibility?

1. Patch the guest operating system ✓

   In IaaS, the customer generally manages guest operating-system maintenance while the provider manages physical infrastructure.
2. Replace failed physical storage devices

   Replacing physical infrastructure components is normally the provider’s responsibility in IaaS.
3. Secure the provider’s data-center buildings

   Physical facilities are managed by the cloud provider under the shared-responsibility model.
4. Maintain the provider’s network facilities

   The provider operates and protects the underlying physical and network infrastructure.

IaaS customers generally patch and secure guest operating systems; providers secure underlying physical infrastructure.

2. Authentication proves identity: Which concept provides the clearest explanation?

1. A successful sign-in should provide access whenever the identity provider has authenticated the user, regardless of repository permissions.

   The relying service must still validate applicable identity information and enforce its own authorization rules.
2. Single sign-on reduces repeated prompts but does not grant repository permissions.

   Single sign-on simplifies sign-in for configured applications; it does not remove authorization checks or grant universal access.
3. Federation lets a relying service trust identity assertions from another provider.

   Federation establishes trust for identity assertions, but it does not automatically grant repository permissions or copy every password.
4. Authentication proves identity; authorization determines permitted repository actions. ✓

   Authentication establishes who the user is, while authorization determines which actions that identity may perform on the repository.

Authentication identifies the user; authorization separately determines permitted repository actions.

3. The customer generally does not patch the PaaS guest: Which statement identifies the misconception?

1. The provider cannot manage any operating-system components in PaaS

   PaaS shifts platform operating-system management to the provider as part of the managed service.
2. The customer owns physical server replacement in PaaS

   Physical infrastructure remains the provider’s responsibility in PaaS and other cloud service models.
3. PaaS transfers customer data ownership to the provider

   Customers retain responsibility for their data, identities, access, and applicable service configuration.
4. The customer generally does not patch the PaaS guest operating system ✓

   In PaaS, the provider generally manages the platform operating system, while customers manage application data and configuration.

PaaS generally shifts guest operating-system patching to the provider, while customers retain data, identity, access, and configuration duties.

4. A relying service validates accepted tokens and enforces: Select TWO statements that correctly describe author

Select two. More than one option is correct — every correct one is ticked below.

1. A relying service validates accepted tokens and enforces authorization ✓

   The relying service validates trusted tokens and applies authorization decisions for its protected resources.
2. Authentication determines which repository actions an identity may perform

   Authentication establishes identity; it does not by itself determine permitted repository actions.
3. Federation automatically grants every resource permission after trust is established

   Federation establishes trust for identity assertions but does not automatically grant all resource permissions.
4. Authorization determines which actions an identity may perform on resources ✓

   Authorization evaluates permissions and determines the actions an authenticated identity may perform on a resource.
5. Single sign-on replaces authorization checks for configured applications

   Single sign-on reduces repeated sign-ins but configured applications still enforce authorization decisions.

Authorization governs permitted resource actions, and relying services validate tokens before enforcing those permissions.

5. Define appropriate user access to the department’s records: What should the department conceptually address ne

1. Secure the provider’s physical server rooms

   The provider manages physical infrastructure and facility security for the hosted SaaS service.
2. Patch the provider’s application operating system

   The SaaS provider generally manages the application platform and underlying operating-system maintenance.
3. Replace the provider’s failed storage hardware

   Physical hardware replacement is handled by the provider as part of operating the SaaS service.
4. Define appropriate user access to the department’s records ✓

   Customers retain responsibility for identities, access decisions, data, and applicable configuration even when using SaaS.

Even in SaaS, customers must manage identities, access, data, and applicable configuration.

6. Identity provider: Which capability supplies that signal?

1. Identity provider ✓

   An identity provider authenticates the user and issues security tokens that trusted relying services can validate.
2. Relying service

   The relying service consumes and validates accepted tokens rather than issuing the organization’s identity token.
3. Directory group

   A directory group organizes identities and can support permissions, but it does not issue authentication tokens.
4. Resource authorization

   Authorization determines permitted actions after identity information is available; it does not issue tokens.

The identity provider authenticates users and issues security tokens for trusted relying services.

7. Physical security does not replace customer access: What limitation should the provider still recognize?

1. Physical security automatically encrypts every customer file

   Facility controls protect infrastructure but do not automatically provide customer data encryption.
2. Physical security transfers data governance to the provider

   Customers generally retain responsibility for data governance, identities, access, and configuration.
3. Physical security grants staff access to hosted applications

   Physical protection does not grant application permissions or determine customer authorization decisions.
4. Physical security does not replace customer access controls ✓

   Provider facility protection does not manage customer identities, permissions, or data access decisions.

Provider facility security protects infrastructure, but customers still control identities, permissions, and data governance.

8. Relying service: Which component performs that verification?

1. Directory group

   A directory group organizes identities and may support permissions, but it does not validate tokens.
2. Relying service ✓

   The relying service validates accepted tokens from a trusted provider before applying authorization to protected resources.
3. Identity provider

   The identity provider authenticates users and issues tokens; it does not validate them for the partner application.
4. Federation agreement

   Federation establishes trust between parties but does not itself execute token validation or authorization.

The relying service validates trusted tokens and then enforces authorization for the application’s resources.

9. Classify the data by sensitivity: Which activity best meets that requirement?

1. Classify the data by sensitivity ✓

   Data classification identifies sensitivity and helps organizations select appropriate protection and handling controls.
2. Authenticate each storage administrator

   Authentication verifies administrators’ identities but does not identify the sensitivity of stored information.
3. Replace the provider’s physical servers

   Physical server replacement addresses infrastructure operations rather than identifying sensitive customer information.
4. Federate the college’s application sign-ins

   Federation establishes trusted sign-in relationships but does not classify customer records by sensitivity.

Classifying data by sensitivity helps determine suitable handling and protection requirements.

10. Directory services manage identity objects and groups: Which capability supplies that evidence?

1. Authentication establishes identity during sign-in

   Authentication proves identity during access attempts but does not describe directory storage and group management.
2. Directory services manage identity objects and groups ✓

   Directory services store and manage identity objects, groups, and related information used by identity systems.
3. Federation creates trust between identity providers and applications

   Federation establishes trust for identity assertions but does not itself manage directory objects and groups.
4. Authorization determines permitted resource actions

   Authorization evaluates allowed actions on resources, while directories store and organize identity information.

Directory services manage identity objects and groups; authentication, federation, and authorization perform different identity functions.

11. Defense in depth uses multiple control layers so one: Which concept corrects this conclusion?

1. Shared responsibility means the provider handles every customer security decision.

   The provider manages applicable infrastructure responsibilities, while the customer retains responsibilities such as data, identities, access, and configuration.
2. Defense in depth uses multiple control layers so one failure need not expose everything. ✓

   Defense in depth combines complementary layers, limiting exposure when one safeguard fails.
3. Network filtering alone protects all hosted workloads.

   Firewalls provide network controls but do not replace application, host, identity, data, physical, or process controls.
4. Zero Trust requires every request to be explicitly verified, but it is not the same as assuming one firewall protects every asset.

   Zero Trust addresses verification, least privilege, and assumed breach; it does not describe the layered-control concept asked for here.

Defense in depth combines layers so one failed safeguard does not expose every protected asset.

12. Windows Server Active Directory Domain Services stores: Which service is being described?

1. Windows Server Active Directory Domain Services stores identity objects and supports domains, domain controllers, and domain protocols. ✓

   Active Directory Domain Services provides the on-premises domain and domain-controller capabilities described by the team.
2. A cloud identity provider that issues tokens to applications and manages cloud directory objects.

   Cloud identity providers manage cloud identities and tokens, but the scenario specifically describes Windows Server domains.
3. A federation service that lets a relying party accept assertions from a trusted identity provider.

   Federation establishes trust between identity providers and relying parties; it does not define domain controllers.
4. A resource authorization system that assigns permissions to cloud subscriptions, resource groups, and individual resources.

   Resource authorization controls access to cloud resources, but it is not an on-premises directory domain service.

Active Directory Domain Services supports on-premises Windows domains, domain controllers, and related domain protocols.

Other SC-900 domains

• Describe the capabilities of Microsoft security solutions — 405 questions →
• Describe the capabilities of Microsoft Entra — 297 questions →
• Describe the capabilities of Microsoft compliance solutions — 243 questions →
• All 1080 SC-900 questions →
• SC-900 certification: requirements, cost and exam format →