SC-900 Exam Dumps - Microsoft Certified: Security Compliance and Identity Fundamentals Questions and Answers

In Microsoft’s shared responsibility model for Azure, responsibilities are divided between Microsoft and the customer. Microsoft Learn explains that Microsoft is responsible for security of the cloud, while customers are responsible for security in the cloud. The platform owner’s scope includes the underlying facilities and infrastructure. As the documentation states: “Microsoft is responsible for the security OF the cloud, which includes protecting the infrastructure that runs all of the services offered in Microsoft Azure,” and this encompasses “physical datacenters, physical hosts, and the physical network.” The customer, by contrast, is responsible for items within their tenant and workloads, including “data, endpoints, accounts, and access management,” as well as configuration of services, identities, and devices.

Applied to the options given: managing mobile devices (A), setting permissions for user data (B), and creating/managing user accounts (C) fall under the customer’s responsibility because they relate to identity, access, data, and endpoint management within the tenant. The one item that Microsoft solely manages is the physical layer—the “physical hardware and facilities” that host Azure services. Therefore, the correct answer is D. the management of the physical hardware.

Microsoft Defender for Office 365 includes Safe Attachments, a protection that “checks attachments in a secure, virtual environment to detect malicious behavior.” In Microsoft’s guidance, Safe Attachments is described as part of the anti-malware pipeline that “routes messages with attachments to a detonation chamber; if no suspicious activity is detected, the message is released to the recipient, and if malicious behavior is found, the attachment is blocked or removed.” Administrators can choose Block, Replace, Dynamic Delivery, or Monitor actions. The Dynamic Delivery option specifically supports the use case in the question: the email body is delivered while the attachment is scanned, and “the attachment is automatically reattached and forwarded to the recipient only when it is determined to be safe.” This capability is unique to Defender for Office 365’s Safe Attachments, not to be confused with endpoint antivirus or identity tools. Defender Antivirus protects Windows devices, Defender for Identity secures on-premises identities, and Defender for Endpoint focuses on endpoint detection and response. Therefore, the Microsoft service you use to scan email attachments and forward them only when clean is Microsoft Defender for Office 365 (Safe Attachments).

In Microsoft 365, the unified audit log retention depends on the audit tier included with the subscription. Current SCI/Compliance documentation states that Audit (Standard)—which is available with Microsoft 365 E3—retains audit records for 180 days. The docs describe that organizations with E3 receive “up to 180 days of audit log retention” for user and admin activities captured in the unified audit pipeline. Longer retention (for example 365 days and beyond with customizable policies) is part of Audit (Premium) features generally associated with E5/E5 Compliance. Because the scenario specifies a Microsoft 365 E3 subscription using the unified audit log and Basic/Standard Audit, the retention period for audit records is 180 days.

In the Microsoft Purview compliance portal, administrators can tailor the user experience to match the roles and responsibilities of users in the organization. One key feature provided to enable this customization is the “Customize navigation” option.

According to Microsoft’s Security, Compliance, and Identity (SCI) learning paths and SC-series certification materials (especially SC-400 and SC-900), the Customize navigation option in the Microsoft Purview compliance portal is used to add, remove, or rearrange features in the navigation pane. This is especially useful for compliance or security administrators who want to streamline the portal for ease of use or hide sections that are not relevant to their work.

The SCI documentation states:

“The Microsoft Purview compliance portal provides a Customize navigation option that allows admins to personalize the left-hand navigation pane. This feature supports removing unused features or rearranging the order in which services appear, improving navigation efficiency and reducing clutter.”

This setting does not change permissions or access to features but purely controls the visibility and layout for users. The other listed options like Compliance Manager, Policies, and Settings are functional sections of the portal, but only "Customize navigation" is explicitly designed to manage the visual layout and visibility of the features shown in the portal's navigation pane.

In Microsoft Sentinel, Logic Apps are used as playbooks for automation and orchestration (SOAR)—to take actions after alerts/incidents occur (notify, enrich, remediate). They are not the component that detects or identifies anomalies; detections come from analytics rules, UEBA (user and entity behavior analytics), Fusion (ML-powered correlation), and anomaly rules. Workbooks are interactive dashboards and visualizations for monitoring and reporting; they don’t correlate alerts. Correlation of alerts into incidents is handled by analytics rules (including alert grouping and Fusion) within Sentinel’s detection pipeline. Finally, Sentinel’s Hunting experience provides KQL-based queries and templates that are mapped to the MITRE ATT&CK tactics/techniques, enabling analysts to explore threats in a framework-aligned way. Thus, automation via Logic Apps ≠ anomaly detection; Workbooks ≠ incident correlation; Hunting tooling does align to MITRE ATT&CK.

In Microsoft’s Security, Compliance, and Identity guidance, multi-factor authentication (MFA) is based on combining independent categories of credentials to verify a user. Microsoft describes the three factor types as: something you know (knowledge), something you have (possession), and something you are (inherence). A password is explicitly categorized as “something you know,” because it relies on a secret the user memorizes and types during sign-in. MFA improves security by requiring two or more of these distinct factors—e.g., a password (know) plus a phone approval or hardware token (have), or a biometric like Windows Hello (are). Using factors from different categories mitigates common attacks such as password spray, credential stuffing, and phishing, because compromising one factor (for example, the password) does not grant access without the second, unrelated factor. Microsoft recommends enabling MFA broadly and pairing passwords with stronger possession or inherence methods to achieve a measurable reduction in account compromise risk. Therefore, in the MFA model used by Microsoft Entra ID (Azure AD), a password is considered something you know.

documents: =

Microsoft Entra ID Protection evaluates risk during authentication, not only after the user is authenticated. The service provides “real-time” assessment as part of the sign-in flow and also processes “offline” detections, enabling Conditional Access to act before a session is granted. In Microsoft’s terminology, “sign-in risk represents the probability that a given authentication request isn’t authorized by the identity owner,” while “user risk represents the probability that a given identity or account is compromised.” These risks are surfaced as risk detections and can be used to trigger MFA, block access, or require secure password reset. Each detection and calculated risk is classified by Microsoft Entra ID Protection with “Low, Medium, or High” levels so administrators can triage and automate policy responses appropriately. Because detections are calculated in real time as part of the sign-in evaluation (and also through subsequent analysis), it is incorrect to say they are generated once the user is authenticated. The accurate view is that Identity Protection continuously analyzes telemetry and produces detections and risk levels that may be acted upon before, during, and after sign-in, with user risk expressing the likelihood that the identity itself is compromised and sign-in risk expressing the likelihood that a particular authentication attempt is not legitimate.

Microsoft’s identity guidance for Azure resources states there are two kinds of managed identities: system-assigned and user-assigned. The documentation describes that a system-assigned identity is scoped to a single resource and follows its lifecycle: “A system-assigned managed identity is created in Microsoft Entra ID and is tied to the lifecycle of that Azure service instance. When the resource is deleted, Azure automatically deletes the identity.” By contrast, a user-assigned identity is reusable across resources: “A user-assigned managed identity is a standalone Azure resource… It can be assigned to one or more Azure service instances and is managed independently of the resources that use it.”

Because the scenario requires multiple Azure web apps to use the same identity, the only managed identity type that supports this sharing model is the user-assigned managed identity. This allows you to grant RBAC permissions once to the identity and then attach that same identity to several App Service instances, simplifying secretless access to Azure resources (Key Vault, Storage, SQL, etc.) and providing centralized lifecycle and rotation management. Certificates or generic service principals would reintroduce credential management, while a system-assigned identity cannot be shared across multiple apps. Therefore, a user-assigned managed identity is the correct choice.