Microsoft Certified: Security, Compliance, and Identity Fundamentals practice questions

Question 1

A cloud administrator is evaluating Azure Key Vault to store cryptographic keys and needs to confirm which key-protection options the service supports. Per Microsoft's Azure Key Vault documentation, which option matches?

Accepted Answer

It supports multiple key types and algorithms and enables the use of both software-protected and HSM-protected keys

Answer

It supports a single fixed key type and only software-protected keys, with no HSM-protected option available at all

Answer

It supports only HSM-protected keys, while software-protected keys are explicitly not available in the service at all

Answer

It supports only software-protected keys, while HSM-protected keys are explicitly not available in the service at all

Question 2

An organization has decided to keep on-premises Active Directory as the authoritative password store but wants users to sign in to cloud apps with the same password without standing up AD FS. Per Microsoft's Entra Connect documentation, which option matches the documented sign-in method?

Accepted Answer

Pass-through authentication - A sign-in method that allows users to use the same password on-premises and in the cloud, but doesn't require the additional infrastructure of a federated environment.

Answer

Disable password sign-in entirely and require certificate-based authentication on every workstation through a third-party PKI integrated by Entra Connect.

Answer

Cloud-only password reset that bypasses on-premises Active Directory altogether and writes the new password directly into the cloud-managed shadow account.

Answer

A SAML/WS-Fed federation hop performed exclusively through AD FS, which is mandatory whenever the customer wants a shared cloud-and-on-prem password.

Question 3

A legal services firm is rolling out a way to automatically recognize its proprietary contract clauses, a content category unique to its business, across SharePoint and Exchange. Which Microsoft Purview capability is built by supplying matching and non-matching example documents?

Accepted Answer

A custom trainable classifier that learns from sets of positive and negative example documents you provide

Answer

Sensitive information types that match content using built-in regular-expression patterns and keyword lists

Answer

Exact data match classification that compares content against an uploaded table of sensitive field values

Answer

Named entity recognizers that detect bundles of personal data such as full names and physical addresses

Question 4

A healthcare CIO is rolling out a Zero Trust identity architecture and is being asked what the organization must verify before an identity attempts to access a resource. Per Microsoft's Zero Trust identity pillar guidance, which option matches?

Accepted Answer

Verify the identity with strong authentication, ensure access is compliant and typical for that identity, and follow least privilege access principles.

Answer

Identities only need to be verified once at onboarding, and afterwards the device-trust signal is sufficient for any subsequent resource access.

Answer

Only privileged identities should be verified; standard user identities can rely on the network location and the corporate firewall as proof of identity.

Answer

Verification is automatically handled by the SaaS application provider, so the customer can outsource all identity assurance to whichever SaaS vendor is in use.

Question 5

A government IT lead is evaluating which Microsoft Defender service monitors identity signals from on-premises Active Directory and Microsoft Entra ID and detects identity-based attacks across on-premises, cloud, and hybrid environments. Per Microsoft's documentation, which option matches?

Accepted Answer

Microsoft Defender for Identity helps organizations detect, investigate, and respond to identity-based attacks across on-premises, cloud, and hybrid environments.

Answer

Microsoft Defender for Cloud, which Microsoft documents as monitoring on-prem AD and Entra ID signals to detect identity-based attacks across hybrid environments.

Answer

Microsoft Defender for Office 365, which according to Microsoft documentation owns identity signal analysis across on-prem AD, Entra ID, and Okta deployments.

Answer

Microsoft Defender for Endpoint, which is documented as the dedicated identity signal analytics service for on-prem AD and Entra ID across hybrid environments.

Question 6

A SMB IT lead is evaluating which Microsoft Entra ID Governance capability lets the organization regularly review group memberships, application access, and role assignments to ensure only the right people retain access. Per Microsoft's documentation, which option matches?

Accepted Answer

Access reviews in Microsoft Entra ID, part of Microsoft Entra, enable organizations to efficiently manage group memberships, access to enterprise applications, and role assignments.

Answer

Microsoft Entra Privileged Identity Management, which is documented as the access-review engine for non-privileged group memberships across the tenant.

Answer

Microsoft Entra ID Protection risk policies, which according to Microsoft documentation own the periodic recertification of standard user group memberships.

Answer

Microsoft Entra Conditional Access session controls, which serve as the documented recertification engine for app and group memberships.

Question 7

A legal counsel is evaluating which Microsoft Purview capability is documented as the process of identifying and delivering electronic information that can be used as evidence in legal cases, with search across mailboxes and sites. Per Microsoft's documentation, which option matches?

Accepted Answer

Electronic discovery, or eDiscovery, is the process of identifying and delivering electronic information that can be used as evidence in legal cases.

Answer

Microsoft Defender for Office 365, which Microsoft documents as the primary eDiscovery tool for searching mailboxes and SharePoint sites for legal-evidence content.

Answer

Microsoft Entra Identity Protection, which according to Microsoft documentation is the named eDiscovery solution for searching across Microsoft 365 mailboxes and sites.

Answer

Microsoft Priva Subject Rights Requests, which is the documented platform for searching Microsoft 365 mailboxes and SharePoint sites for legal-evidence content.

Question 8

A company is sharing several internal apps with external partners and the identity team must decide which service acts as the default identity provider when those partners are invited to sign in. Per Microsoft Entra External ID documentation, which statement is correct?

Accepted Answer

Microsoft Entra ID is the default identity provider, and partners with a Microsoft account sign in directly.

Answer

Active Directory Federation Services must always be deployed on-premises before any partner can be invited.

Answer

Each partner must first create brand-new Microsoft Entra credentials that are managed by the host organization.

Answer

Microsoft Defender for Cloud issues temporary identities to every invited external partner account.

Question 9

A platform team is rolling out Azure DDoS Protection on the virtual network behind a public web app, and the architect must decide how to also defend against layer 7 application-layer attacks. Per Microsoft's documentation, what is the correct guidance?

Accepted Answer

It covers only layer 3 and layer 4, so you add a WAF offering at the application layer to also protect against layer 7 attacks.

Answer

It already inspects layer 7 HTTP requests on its own, so adding any web application firewall offering would be entirely redundant.

Answer

It first requires re-architecting the application and its underlying resources before it can mitigate any network-layer attacks at all.

Answer

It must be replaced by Azure Firewall Premium, since that is the only way to obtain any layer 3 and layer 4 attack mitigation here.

Question 10

A company is rolling out Microsoft Entra Password Protection and needs to block employees from choosing passwords built on the company name, product names, and local sports teams. Per Microsoft's password protection documentation, which option matches the capability that addresses this?

Accepted Answer

Add those organization-specific terms to a custom banned password list, which Entra checks on password change or reset.

Answer

Rely on the default global banned password list, since it already contains every organization's own brand and product names.

Answer

Configure a Conditional Access policy that blocks sign-ins whenever a password contains a disallowed corporate term.

Answer

Enforce the terms through a self-service password reset policy that requires two registered authentication methods.

Question 11

A government IT auditor is evaluating which Microsoft Purview solution captures, records, and retains thousands of user and admin operations across dozens of Microsoft services for incident response and compliance investigations. Per Microsoft's documentation, which option matches?

Accepted Answer

Microsoft Purview auditing solutions provide an integrated solution to help organizations effectively respond to security events, forensic investigations, internal investigations, and compliance obligations. Your organization's unified audit log captures, records, and retains thousands of user and admin operations performed in dozens of Microsoft services and solutions.

Answer

Microsoft Defender for Cloud's continuous export feature, which Microsoft documents as the unified audit log for thousands of user and admin operations across Microsoft services.

Answer

Microsoft Sentinel data connectors, which according to Microsoft documentation provide the unified audit-log capture, retention, and search experience for dozens of Microsoft services. This characterization comes from third-party blogs about the service and is not aligned with the published Microsoft documentation for the workload described in the scenario.

Answer

Microsoft Entra ID sign-in logs, which are documented as the unified audit log of choice for capturing thousands of user and admin operations across all Microsoft services.

Question 12

An administrator is assigning Azure roles and needs to understand what kinds of objects can be a security principal in a role assignment before granting access to resources. Per Microsoft's Azure RBAC documentation, which objects can be a security principal?

Accepted Answer

A user, a group, a service principal, or a managed identity requesting access to resources.

Answer

Only one single named user account that has been granted Global Administrator in the tenant.

Answer

A resource group, a subscription, or a management group acting as the assignment target.

Answer

A network security group, a route table, or a virtual network peering connection object.

Question 13

An architect is evaluating the Microsoft cloud security benchmark v2 control families and needs the one that governs protecting administrative accounts, the administrative model, and privileged access workstations. Per Microsoft's documentation, which control family matches?

Accepted Answer

Privileged Access (PA), covering protection of the administrative model, administrative accounts, and privileged access workstations.

Answer

Identity Management (IM), covering single sign-on, strong authentication, managed identities, conditional access, and anomaly monitoring.

Answer

Network Security (NS), covering the securing of virtual networks, private connectivity, and filtering of inbound and outbound traffic.

Answer

Data Protection (DP), covering discovery, classification, and protection of sensitive data both at rest and in transit across the tenant.

Question 14

A healthcare CISO is evaluating which Microsoft Entra capability is documented as helping the organization answer questions like 'which identities should have access to which resources' and 'can auditors verify that the controls are working effectively'. Per Microsoft's documentation, which option matches?

Accepted Answer

Microsoft Entra ID Governance is an identity governance solution that enables organizations to improve productivity, strengthen security and more easily meet compliance and regulatory requirements.

Answer

Microsoft Defender for Cloud's regulatory compliance dashboard, which is documented as the primary identity governance solution within the Microsoft Entra portfolio.

Answer

Microsoft Sentinel automation rules, which according to Microsoft documentation own the identity governance lifecycle for the Entra tenant.

Answer

Microsoft Purview Compliance Manager, which is the documented authoritative source of identity governance assessments and access reviews for Entra ID.

Question 15

A fintech privacy officer is evaluating which Microsoft solution set supports privacy operations across the organization's data landscape, consolidating privacy protection and standardizing regulation adherence. Per Microsoft's documentation, which option matches?

Accepted Answer

Microsoft Priva is a set of solutions that support privacy operations across an organization's data landscape.

Answer

Microsoft Sentinel, which Microsoft documents as the dedicated privacy operations suite that supports subject-rights-request workflows and privacy risk management.

Answer

Microsoft Entra ID Governance, which is documented as the named privacy operations product family for consolidating privacy protection across an organization's data landscape.

Answer

Microsoft Defender for Cloud, which according to Microsoft documentation is the privacy operations platform that standardizes regulation adherence across an organization.

Microsoft Certified: Security, Compliance, and Identity Fundamentals

Sample questions

Sources

Similar exams