Microsoft SC-900 Practice Test 1

Question 1

Keep tenant user access, data classification, and configuration controls under the customer's governance while the provider operates the SaaS service.
Establish a trusted federation relationship so the external identity provider can authenticate the partner users.
Perform authentication using an appropriate credential or authenticator before treating the claimant as the user.
Use an identity provider to authenticate identities and provide trusted identity claims to relying applications.

Explanation

Correct Answer

Keep tenant user access, data classification, and configuration controls under the customer's governance while the provider operates the SaaS service. Using SaaS shifts underlying service operation to the provider but does not transfer responsibility for customer identities or data use. To verify, inspect the tenant access assignments, information protection rules, and provider documentation for the responsibility boundary.

Incorrect Answers

Establish a trusted federation relationship so the external identity provider can authenticate the partner users. That addresses a different task: a partner's staff should use its existing organizational identity to access a separate service. The present requirement concerns shared responsibility in SaaS.

Perform authentication using an appropriate credential or authenticator before treating the claimant as the user. That addresses a different task: a user enters a username but the service still needs assurance that the claimant owns the account. The present requirement concerns shared responsibility in SaaS.

Use an identity provider to authenticate identities and provide trusted identity claims to relying applications. That addresses a different task: several applications must rely on one trusted service to issue identity assertions for users. The present requirement concerns shared responsibility in SaaS.

Question 2

During a migration readiness meeting at a nonprofit association, the compliance analyst records this concrete requirement: A subscriber to a SaaS application must decide who governs employees' access and the information they upload. The solution must address this requirement directly, without replacing unrelated controls. The team implements the following response: Keep tenant user access, data classification, and configuration controls under the customer's governance while the provider operates the SaaS service. Which evidence BEST verifies that the action met its stated purpose?

Test access as authorized and unauthorized identities and verify permission evaluations differ correctly.
Inspect the tenant access assignments, information protection rules, and provider documentation for the responsibility boundary.
Verify that access decisions still enforce identity-centric requirements from home, office, and mobile networks.
Trace a sign-in through the provider and validate the relying application's accepted identity assertion.

Explanation

Correct Answer

Inspect the tenant access assignments, information protection rules, and provider documentation for the responsibility boundary. Using SaaS shifts underlying service operation to the provider but does not transfer responsibility for customer identities or data use.

Incorrect Answers

Test access as authorized and unauthorized identities and verify permission evaluations differ correctly. This would test authorization, whereas the required evidence is: Inspect the tenant access assignments, information protection rules, and provider documentation for the responsibility boundary.

Verify that access decisions still enforce identity-centric requirements from home, office, and mobile networks. This would test identity as security perimeter, whereas the required evidence is: Inspect the tenant access assignments, information protection rules, and provider documentation for the responsibility boundary.

Trace a sign-in through the provider and validate the relying application's accepted identity assertion. This would test identity provider, whereas the required evidence is: Inspect the tenant access assignments, information protection rules, and provider documentation for the responsibility boundary.

Question 3

Following a control design challenge at a local government agency, the IT operations director has to defend a design against oversimplified assumptions. The requirement is: A subscriber to a SaaS application must decide who governs employees' access and the information they upload. The review is limited to the control and concept described by this requirement. Which security, identity, or compliance principle MOST directly explains the appropriate approach?

Single sign-on reuses an established authentication context across participating applications.
Authentication establishes who or what is making an identity claim; it precedes authorization decisions.
Using SaaS shifts underlying service operation to the provider but does not transfer responsibility for customer identities or data use.
Modern cloud security commonly treats identity as a central control point rather than the physical network edge.

Explanation

Correct Answer

Using SaaS shifts underlying service operation to the provider but does not transfer responsibility for customer identities or data use. It explains why the selected measure—Keep tenant user access, data classification, and configuration controls under the customer's governance while the provider operates the SaaS service—fits the specific requirement. It should be verified by checking: Inspect the tenant access assignments, information protection rules, and provider documentation for the responsibility boundary.

Incorrect Answers

Single sign-on reuses an established authentication context across participating applications. This describes single sign-on concept; the governing concept here is: Using SaaS shifts underlying service operation to the provider but does not transfer responsibility for customer identities or data use.

Authentication establishes who or what is making an identity claim; it precedes authorization decisions. This describes authentication; the governing concept here is: Using SaaS shifts underlying service operation to the provider but does not transfer responsibility for customer identities or data use.

Modern cloud security commonly treats identity as a central control point rather than the physical network edge. This describes identity as security perimeter; the governing concept here is: Using SaaS shifts underlying service operation to the provider but does not transfer responsibility for customer identities or data use.

Question 4

Following a control design challenge at a local government agency, the IT operations director has to defend a design against oversimplified assumptions. The requirement is: A subscriber to a SaaS application must decide who governs employees' access and the information they upload. The review is limited to the control and concept described by this requirement. Which unsupported assumption would MOST directly undermine this requirement?

Treating corporate IP address membership as the sole security perimeter for cloud resources.
Assuming every authenticated employee has permission to read every organizational file.
Assuming single sign-on automatically gives a user authorization to every connected application.
Treating provider-hosted SaaS as permission to ignore tenant access and data governance.

Explanation

Correct Answer

Treating provider-hosted SaaS as permission to ignore tenant access and data governance. This belief conflicts with this control principle: Using SaaS shifts underlying service operation to the provider but does not transfer responsibility for customer identities or data use. The appropriate response instead is: Keep tenant user access, data classification, and configuration controls under the customer's governance while the provider operates the SaaS service.

Incorrect Answers

Treating corporate IP address membership as the sole security perimeter for cloud resources. That caution concerns identity as security perimeter; the specific misconception here is: Treating provider-hosted SaaS as permission to ignore tenant access and data governance.

Assuming every authenticated employee has permission to read every organizational file. That caution concerns authorization; the specific misconception here is: Treating provider-hosted SaaS as permission to ignore tenant access and data governance.

Assuming single sign-on automatically gives a user authorization to every connected application. That caution concerns single sign-on concept; the specific misconception here is: Treating provider-hosted SaaS as permission to ignore tenant access and data governance.

Question 5

Configure trusted single sign-on across applications that accept the identity provider's session or tokens.
Have the customer maintain guest OS configuration, patching, and applications while the provider secures the physical infrastructure.
Evaluate the employee's permissions and resource policy before granting access to the folder.
Base access protection on user and workload identities with contextual policy rather than only network location.

Explanation

Correct Answer

Have the customer maintain guest OS configuration, patching, and applications while the provider secures the physical infrastructure. IaaS reduces customer hardware responsibilities but leaves customer control of guest operating systems and software. To verify, check guest patch compliance and the provider's published infrastructure responsibility scope separately.

Incorrect Answers

Configure trusted single sign-on across applications that accept the identity provider's session or tokens. That addresses a different task: a staff member needs to open several approved cloud apps without repeated independent sign-ins. The present requirement concerns shared responsibility in IaaS.

Evaluate the employee's permissions and resource policy before granting access to the folder. That addresses a different task: a correctly signed-in employee requests access to a confidential payroll folder. The present requirement concerns shared responsibility in IaaS.

Base access protection on user and workload identities with contextual policy rather than only network location. That addresses a different task: remote workers use cloud services from networks not managed by the enterprise. The present requirement concerns shared responsibility in IaaS.

Question 6

During an access-management redesign at a construction engineering group, the risk manager records this concrete requirement: A business deploys virtual machines and asks whether the cloud host will patch the guest operating system. The solution must address this requirement directly, without replacing unrelated controls. The team implements the following response: Have the customer maintain guest OS configuration, patching, and applications while the provider secures the physical infrastructure. Which evidence BEST verifies that the action met its stated purpose?

Trace a sign-in through the provider and validate the relying application's accepted identity assertion.
Verify that access decisions still enforce identity-centric requirements from home, office, and mobile networks.
Check guest patch compliance and the provider's published infrastructure responsibility scope separately.
Test access as authorized and unauthorized identities and verify permission evaluations differ correctly.

Explanation

Correct Answer

Check guest patch compliance and the provider's published infrastructure responsibility scope separately. IaaS reduces customer hardware responsibilities but leaves customer control of guest operating systems and software.

Incorrect Answers

Trace a sign-in through the provider and validate the relying application's accepted identity assertion. This would test identity provider, whereas the required evidence is: Check guest patch compliance and the provider's published infrastructure responsibility scope separately.

Verify that access decisions still enforce identity-centric requirements from home, office, and mobile networks. This would test identity as security perimeter, whereas the required evidence is: Check guest patch compliance and the provider's published infrastructure responsibility scope separately.

Test access as authorized and unauthorized identities and verify permission evaluations differ correctly. This would test authorization, whereas the required evidence is: Check guest patch compliance and the provider's published infrastructure responsibility scope separately.

Question 7

Following a privileged access audit at a multinational publisher, the technology auditor has to defend a design against oversimplified assumptions. The requirement is: A business deploys virtual machines and asks whether the cloud host will patch the guest operating system. The review is limited to the control and concept described by this requirement. Which security, identity, or compliance principle MOST directly explains the appropriate approach?

Directory services provide a structured identity store and lookup capabilities; they do not alone define every resource permission.
An identity provider authenticates identities and supplies the identity information applications rely on.
Authentication establishes who or what is making an identity claim; it precedes authorization decisions.
IaaS reduces customer hardware responsibilities but leaves customer control of guest operating systems and software.

Explanation

Correct Answer

IaaS reduces customer hardware responsibilities but leaves customer control of guest operating systems and software. It explains why the selected measure—Have the customer maintain guest OS configuration, patching, and applications while the provider secures the physical infrastructure—fits the specific requirement. It should be verified by checking: Check guest patch compliance and the provider's published infrastructure responsibility scope separately.

Incorrect Answers

Directory services provide a structured identity store and lookup capabilities; they do not alone define every resource permission. This describes directory services; the governing concept here is: IaaS reduces customer hardware responsibilities but leaves customer control of guest operating systems and software.

An identity provider authenticates identities and supplies the identity information applications rely on. This describes identity provider; the governing concept here is: IaaS reduces customer hardware responsibilities but leaves customer control of guest operating systems and software.

Authentication establishes who or what is making an identity claim; it precedes authorization decisions. This describes authentication; the governing concept here is: IaaS reduces customer hardware responsibilities but leaves customer control of guest operating systems and software.

Question 8

Following a privileged access audit at a multinational publisher, the technology auditor has to defend a design against oversimplified assumptions. The requirement is: A business deploys virtual machines and asks whether the cloud host will patch the guest operating system. The review is limited to the control and concept described by this requirement. Which unsupported assumption would MOST directly undermine this requirement?

Assuming an IaaS provider automatically patches every customer-controlled guest OS and application.
Assuming federation requires copying all partner passwords into the receiving organization.
Treating corporate IP address membership as the sole security perimeter for cloud resources.
Assuming a directory group entry automatically grants access to every resource without permission configuration.

Explanation

Correct Answer

Assuming an IaaS provider automatically patches every customer-controlled guest OS and application. This belief conflicts with this control principle: IaaS reduces customer hardware responsibilities but leaves customer control of guest operating systems and software. The appropriate response instead is: Have the customer maintain guest OS configuration, patching, and applications while the provider secures the physical infrastructure.

Incorrect Answers

Assuming federation requires copying all partner passwords into the receiving organization. That caution concerns federation; the specific misconception here is: Assuming an IaaS provider automatically patches every customer-controlled guest OS and application.

Treating corporate IP address membership as the sole security perimeter for cloud resources. That caution concerns identity as security perimeter; the specific misconception here is: Assuming an IaaS provider automatically patches every customer-controlled guest OS and application.

Assuming a directory group entry automatically grants access to every resource without permission configuration. That caution concerns directory services; the specific misconception here is: Assuming an IaaS provider automatically patches every customer-controlled guest OS and application.

Question 9

Use an identity provider to authenticate identities and provide trusted identity claims to relying applications.
Configure trusted single sign-on across applications that accept the identity provider's session or tokens.
Keep responsibility for application code, user access, and data configuration while the platform provider maintains the underlying runtime and infrastructure.
Use directory services to organize identity objects and make them discoverable to authorized systems.

Explanation

Correct Answer

Keep responsibility for application code, user access, and data configuration while the platform provider maintains the underlying runtime and infrastructure. PaaS abstracts infrastructure management without removing the customer's application and data security decisions. To verify, review application settings, identity permissions, and provider platform maintenance coverage separately.

Incorrect Answers

Use directory services to organize identity objects and make them discoverable to authorized systems. That addresses a different task: an enterprise needs a managed directory of users, groups, and related identity attributes. The present requirement concerns shared responsibility in PaaS.

Question 10

During a cloud governance workshop at a school district, the application administrator records this concrete requirement: A development group moves an application to a managed platform and must assign duties for application code and identities. The solution must address this requirement directly, without replacing unrelated controls. The team implements the following response: Keep responsibility for application code, user access, and data configuration while the platform provider maintains the underlying runtime and infrastructure. Which evidence BEST verifies that the action met its stated purpose?

Inspect successful authentication events and the factor or method that established the identity claim.
Verify that access decisions still enforce identity-centric requirements from home, office, and mobile networks.
Test access as authorized and unauthorized identities and verify permission evaluations differ correctly.
Review application settings, identity permissions, and provider platform maintenance coverage separately.

Explanation

Correct Answer

Review application settings, identity permissions, and provider platform maintenance coverage separately. PaaS abstracts infrastructure management without removing the customer's application and data security decisions.

Incorrect Answers

Inspect successful authentication events and the factor or method that established the identity claim. This would test authentication, whereas the required evidence is: Review application settings, identity permissions, and provider platform maintenance coverage separately.

Verify that access decisions still enforce identity-centric requirements from home, office, and mobile networks. This would test identity as security perimeter, whereas the required evidence is: Review application settings, identity permissions, and provider platform maintenance coverage separately.

Test access as authorized and unauthorized identities and verify permission evaluations differ correctly. This would test authorization, whereas the required evidence is: Review application settings, identity permissions, and provider platform maintenance coverage separately.