CertiConcept map
Shared responsibility splits duties. Defense in depth stacks layers. Zero Trust verifies, limits privilege, and assumes breach. Encryption reverses with a key. Hashing does not.
Study guide · Flashcards & memory notes
Security, Compliance, and Identity Fundamentals Flashcards & Memory Notes
40 recall cards for the facts SC-900 keeps asking you to separate: concepts, Microsoft Entra, security services, and Microsoft Purview.
How to use these cards: Say the answer out loud before you flip the card, and mark it honestly. Revisit the cards you missed tomorrow rather than rereading them right away. Progress is kept only while this page is open. For the full explanations, see the core notes.
Study mode
Choose a deck, flip each card, and mark what you already know.
You marked every card in this deck as known. Shuffle and run through it again, or choose another deck.
All flashcards
Select a question to reveal its answer.
Deck 1 · Concepts
Shared responsibility, Zero Trust, and identity vocabulary.
1.1What is the shared responsibility model?
The customer and Microsoft each own specific security tasks. Customers remain responsible for data, identities, and access.
1.2What is defense in depth?
Several independent security layers, so one failed control does not expose the whole environment.
1.3What are the Zero Trust principles?
Verify explicitly, use least privilege access, and assume breach.
1.4How do encryption, hashing, and encoding differ?
Encryption protects confidentiality and is reversible with the appropriate key. A cryptographic hash supports integrity checks. Encoding such as Base64 is not encryption.
1.5What does GRC mean?
Governance, Risk, and Compliance: policies, risk treatment, and meeting requirements.
1.6Authentication versus authorization?
Authentication proves who you are. Authorization decides what you can access.
1.7What is an identity provider?
A service that creates, maintains, and authenticates identity information.
1.8What is federation?
A trust that lets users authenticate with their home identity provider.
1.9Why is identity called the primary security perimeter?
Cloud resources are reached from many networks, so identity gates access.
1.10Are AD DS and Microsoft Entra ID the same directory service?
No. Both organize identities, but on-premises AD DS and cloud-based Microsoft Entra ID provide different capabilities. Hybrid identity can connect the environments.
Deck 2 · Microsoft Entra
Identity types, sign-in, and privileged access.
2.1What is Microsoft Entra ID?
Cloud identity and access management for Microsoft cloud services.
2.2Does a managed identity automatically grant resource access?
No. It is a workload identity that avoids developer-managed credentials. The target service must still authorize its operations at an appropriate scope.
2.3What is hybrid identity?
A common identity across on-premises Active Directory and Microsoft Entra ID, usually synchronized.
2.4What makes authentication multifactor?
Evidence from at least two different factor categories: something you know, have, or are. Two passwords are still one category; one sign-in method can combine factors.
2.5Does Conditional Access grant application permissions?
No. It evaluates signals and enforces access conditions, such as MFA or a block. Application and resource permissions remain separate authorization decisions.
2.6Entra roles versus Azure RBAC?
Entra roles manage the directory. Azure RBAC manages access to Azure resources.
2.7How does PIM relate to ID Governance?
PIM is a governance capability for privileged access. Eligible assignments can require time-bound activation; PIM does not mean every assignment is automatically eligible.
2.8Does denying an access review always remove access immediately?
No. Review results must be applied, automatically or by an authorized administrator. Verify the affected assignment instead of assuming the review decision completed removal.
2.9How do user risk and sign-in risk differ?
User risk concerns possible compromise of an identity. Sign-in risk concerns a particular authentication attempt. ID Protection provides signals that access policies can use.
2.10Password Protection versus smart lockout versus SSPR?
Password Protection evaluates weak passwords at change or reset. Smart lockout limits repeated failed sign-ins. Self-service password reset enables verified account recovery.
Deck 3 · Security solutions
Azure controls, Defender, and Sentinel.
3.1Azure Firewall versus a web application firewall?
Azure Firewall centralizes network and supported application traffic controls. A WAF specializes in malicious HTTP/HTTPS requests. Capabilities depend on configuration and tier.
3.2Does creating two subnets automatically isolate them?
No. Subnets organize address space. Routing and security rules, including NSGs, determine permitted traffic; separate subnet names are not deny rules.
3.3What is Azure Bastion?
Browser-based RDP or SSH without a public IP on the virtual machine.
3.4What does Key Vault protect, and what does it not fix automatically?
It stores and controls access to secrets, keys, and certificates. It does not remove copies committed to source code or automatically grant applications access.
3.5CSPM recommendation versus a workload attack alert?
CSPM identifies posture gaps and recommends changes. Workload protection detects threats on supported resources. A recommendation does not mean remediation has already occurred.
3.6Does starting a SOAR playbook prove mitigation succeeded?
No. SIEM detects and analyzes; SOAR orchestrates response. A playbook can fail on permissions or downstream actions, so verify its result.
3.7What is Microsoft Sentinel?
A cloud-native SIEM and SOAR solution.
3.8Defender for Office 365 versus Defender for Endpoint?
Office 365 protects email and collaboration. Endpoint protects devices.
3.9What does Defender for Identity monitor?
On-premises Active Directory signals and identity-based attacks.
3.10Does the Microsoft Defender portal identify XDR alone?
No. The portal supports Defender XDR and Sentinel experiences. Distinguish the requested capability, such as Defender signal correlation or broader SIEM analytics.
Deck 4 · Compliance solutions
Trust documents, labels, and Purview investigations.
4.1What is the Service Trust Portal?
The Microsoft site for audit reports, trust documents, and compliance resources.
4.2What is Compliance Manager?
A Purview tool that assesses controls and tracks improvement actions.
4.3What is a compliance score?
A measure of progress on improvement actions. It is not a certification.
4.4Does a label named Confidential guarantee encryption?
No. Sensitivity labels classify and can protect content when configured. Check the protection settings. Retention labels address lifecycle rather than reader permissions.
4.5Does a DLP match always block sharing?
No. Scope, policy conditions, configured actions, and simulation versus enforcement determine the outcome. DLP can monitor or warn as well as restrict or block.
4.6Content explorer versus Activity explorer?
Content explorer shows where sensitive data is. Activity explorer shows what people did with it.
4.7Does an insider risk alert prove misconduct?
No. It identifies potentially risky behavior for authorized investigation. Review context and protect user privacy before drawing conclusions.
4.8Can held content disappear from the normal user view?
Yes. An eDiscovery hold can preserve a copy even when the user deletes an item from the visible mailbox or site. User-visible deletion is not proof of permanent erasure.
4.9What outcomes can retention settings specify?
Retain, delete after a period, or retain then delete. Policies address selected locations and labels address items; applicable retention or holds can prevent permanent deletion.
4.10What does Purview Audit provide?
Search of user and admin activity records.
Memory notes
Short maps to rebuild before a timed set.
Entra map
Users, guests, and workload identities. Conditional Access decides the sign-in. PIM activates privilege for a window. ID Protection supplies risk. Governance reviews access over time.
Security map
WAF for HTTP, Firewall and NSGs for the network, Bastion for admin access, Key Vault for secrets. Sentinel is SIEM plus SOAR. Match each Defender product to its asset.
Compliance map
Service Trust Portal describes Microsoft. Compliance Manager tracks your actions. Sensitivity labels can protect when configured. Retention controls keeping and deletion. DLP can monitor, warn, or block according to policy. eDiscovery and audit investigate.
Continue the Security, Compliance, and Identity Fundamentals study path
Test what you have learned with a timed practice exam.
Overview
Exam format, the 700 passing score, domain weights, and a study plan.
Core Notes
Reference notes for concepts, Entra, Defender, Sentinel, and Purview.
Flashcards & Memory Notes
40 recall cards in four decks, plus memory notes for identity, security, and compliance.
Practice Exams
80 original questions with custom exams, explanations, and a score report by domain.
Related Tools
Useful companions while you study.
Password Generator
Generate strong random passwords with custom length, characters, symbols, and security options.
Base64 Converter
Encode text and files to Base64 or decode Base64 data with UTF-8 support.
Diff Checker
Compare two text blocks and highlight added, removed, and changed content.
JSON YAML Converter
Convert structured data between JSON and YAML with formatting and validation.
Legal Disclaimer
Certicab provides general informational, educational, and convenience resources. Calculations, conversions, estimates, and learning materials may contain errors or become outdated. Financial, tax, medical, legal, and travel information is not professional advice. Verify important results and current requirements with qualified professionals or authoritative sources. Protect sensitive files and personal information, review each tool’s privacy limitations, and use only content you are authorized to process. You are responsible for how you use and share results. Study resources are independent and do not guarantee exam success or imply certification-provider endorsement. Microsoft, Azure, and related marks are trademarks of Microsoft Corporation. Certicab is not affiliated with, endorsed by, or sponsored by Microsoft.