SC-900 security, compliance and identity concepts explained
The concepts area is the smallest SC-900 skill area at 10–15%, and it supplies the vocabulary for the rest of the exam. It covers five security and compliance ideas (shared responsibility, defense in depth, Zero Trust, encryption and hashing, and governance, risk and compliance) and the core identity ideas: identity as the security perimeter, authentication, authorization, identity providers, directory services and federation. Questions here are short definitions or scenarios where you pick the right term.
Security and compliance concepts
Shared responsibility model
In the cloud, security duties are split between the provider and the customer. The provider always secures the physical datacenter, hosts and network. The customer always owns their data, their identities and their devices and accounts. In between, the split shifts with the service model: with infrastructure as a service you manage more (operating system, applications), and with software as a service you manage less (mainly data, users and configuration).
Defense in depth
Defense in depth layers controls so that one failure does not expose everything. The usual layers are physical security, identity and access, perimeter, network, compute, application and data. A scenario that describes several independent controls, such as a firewall, MFA and encryption, is describing defense in depth.
Zero Trust
Zero Trust replaces the idea of a trusted internal network with three principles: verify explicitly, use least-privilege access, and assume breach. Every request is evaluated using signals such as identity, device health, location and risk, no matter where it comes from.
Encryption and hashing
| Encryption | Hashing | |
|---|---|---|
| Reversible | Yes, with the right key | No |
| Purpose | Keep data confidential | Check integrity, store passwords |
| Example | Data at rest and in transit | Storing a password hash |
Symmetric encryption uses one key; asymmetric uses a public and private pair. Encryption at rest protects stored data, and encryption in transit protects data moving over a network.
Governance, risk and compliance
Governance is the set of policies and oversight that direct an organization. Risk management identifies and reduces threats to its objectives. Compliance means meeting external regulations and internal standards. The three work together: governance sets rules, risk drives priorities and compliance proves adherence.
Identity concepts
- Identity as the primary perimeter: with remote work and cloud apps, there is no clear network edge, so who you are, and the health of your device, decides access.
- Authentication proves who you are. Authorization decides what you may do after that. Authentication always comes first.
- Identity provider: a service that creates, maintains and verifies identities and issues tokens. Microsoft Entra ID is one.
- Directory services: a database of users, groups and devices. Active Directory Domain Services is the on-premises example.
- Federation: a trust between two identity providers, so a user authenticated by one can access resources controlled by the other without a second account. It enables single sign-on across organizations.
Example questions
Question 1. A cloud customer runs a virtual machine with a web application. According to the shared responsibility model, which item is always the customer's responsibility regardless of service type?
- A. The physical datacenter
- B. The data and the accounts that access it
- C. The physical network cabling
- D. Patching the hypervisor
Show answer
Answer: B
The customer always owns data, identities and accounts. The provider secures the physical hosts and datacenter in every service model. The physical network is the provider’s job as well. Patching the hypervisor is also the provider’s job; only the guest operating system on a VM is the customer’s.
Want more questions like this? Full SC-900 practice tests →
Question 2. An engineer stores user passwords so that the original password can never be recovered, yet a login attempt can still be checked. Which technique should be used?
- A. Symmetric encryption
- B. Asymmetric encryption
- C. Hashing
- D. Federation
Show answer
Answer: C
Hashing is one-way, and the hash of a login attempt can be compared to the stored hash. Symmetric and asymmetric encryption are reversible with a key, which would let anyone with the key recover the passwords. Federation links identity providers and does not store passwords.
Want more questions like this? Full SC-900 practice tests →
Question 3. Employees at Contoso sign in to a partner company's web application with their own Contoso credentials, without creating new accounts. Which concept makes this possible?
- A. Federation
- B. Authorization
- C. A directory service
- D. Hashing
Show answer
Answer: A
Federation is a trust relationship between identity providers that lets users from one organization access resources of another. Authorization decides permissions after sign-in. A directory service stores identities but does not create cross-organization trust by itself. Hashing is unrelated to account sharing.
Want more questions like this? Full SC-900 practice tests →
For more practice see the sample questions, and continue with Microsoft Entra explained.