SC-900 quick review

Memory hook: Protect the right property with the right kind of control.

Must remember

Confidentiality prevents unauthorized disclosure; integrity protects against unauthorized alteration; availability keeps a service usable. Authenticity establishes that something is genuine. Non-repudiation supplies evidence of origin or action, subject to trustworthy keys, identities and records.

Authentication establishes an identity, authorization decides permitted actions and accounting records activity. Identify which stage failed: a valid login with excessive database privileges is an authorization problem.

One control can have several classifications. A camera detects; a visible camera may also deter. A compensating control addresses the original control's intent when the normal implementation is not feasible; it does not simply mean a cheaper control.

Zero trust evaluates access using identity, device state, resource sensitivity and context rather than trusting network location. A policy engine decides, a policy administrator arranges the session and an enforcement point permits or blocks it. Least privilege and segmentation reduce blast radius; continuous evaluation handles changing conditions.

Honeypots, honeynets, honeyfiles and honeytokens are deception tools. Access to a decoy can be a high-value detection signal, but a decoy needs containment and monitoring.

Choose under exam pressure

Traps

• Encryption alone does not make a service available.
• Zero trust is an architecture and decision process, not one appliance.

Practise this topic

Memory hook: Prove who, decide what, review why access continues.

Must remember

Entra ID provides cloud identity and access management. AD DS provides traditional domain services; hybrid identity connects supported on-premises and cloud identity processes. Federation trusts another identity provider for authentication. People, devices, applications and workloads can all have identities with different lifecycles.

Authentication proves identity; authorization decides actions. MFA combines independent proof factors; passwordless methods can use keys or device-bound credentials. Password Protection and self-service reset address different parts of credential management. No method removes the need to secure enrollment and recovery.

Conditional Access evaluates configured signals and applies access/session controls. Entra roles manage directory tasks; Azure RBAC manages Azure resource access. Identity Protection identifies user/sign-in risk; it does not mean every detection is confirmed compromise.

Identity Governance manages access lifecycle. Access reviews check continuing need; entitlement management organizes requestable access; PIM supports temporary controlled privileged activation. Least privilege and timely offboarding reduce standing exposure.

Choose under exam pressure

Traps

• Authentication is not authorization.
• Entra ID is not simply a cloud VM running AD DS.

Practise this topic

Memory hook: Filter traffic, protect secrets, find exposure.

Must remember

Virtual networks/subnets segment network placement; NSGs filter permitted traffic at supported subnet/interface boundaries. Azure Firewall provides managed centralized network filtering; WAF addresses supported web-layer attacks; DDoS Protection addresses supported denial-of-service exposure. They work at different layers and are not interchangeable.

Azure Bastion provides managed remote access to supported VMs without exposing their RDP/SSH ports directly to the internet. Key Vault stores/manages supported secrets, keys and certificates with access control. A vault does not automatically rotate every application secret or eliminate the need to grant the application permission.

Defender for Cloud combines cloud security posture management and supported workload-protection plans. CSPM assesses configurations and recommendations; workload protection detects/protects specific workloads under enabled plans. Security standards and policies help assess alignment, but a score or recommendation list is not proof that every risk is resolved.

Shared responsibility changes with IaaS/PaaS/SaaS. The provider handles more infrastructure in managed services, while customer data, access and configuration responsibilities remain. Select controls from the threat and resource type, then validate effective behavior.

Choose under exam pressure

Traps

• WAF does not replace every network firewall function.
• A high posture score does not guarantee no compromise.

Practise this topic

Memory hook: XDR connects product signals; SIEM connects the wider evidence.

Must remember

Defender XDR correlates supported security signals into incidents. Defender for Endpoint addresses endpoint protection/detection; Defender for Office 365 covers supported email/collaboration threats; Defender for Identity analyzes supported identity infrastructure; Defender for Cloud Apps addresses SaaS/cloud-app visibility and controls. Vulnerability Management prioritizes weaknesses; threat intelligence supplies adversary/indicator context.

Microsoft Sentinel is a SIEM/SOAR platform: collect and correlate telemetry, detect suspicious patterns, investigate incidents and orchestrate response. Data connectors ingest evidence; analytics rules detect conditions; automation/playbooks support response. A connector alone does not mean every required detection is enabled or tuned.

The Defender portal brings supported investigation experiences together. An alert is a signal; an incident groups related evidence and response work. Analysts validate, scope, contain and investigate rather than treating every alert as proven malicious activity. Automated response needs suitable permissions and safeguards.

SIEM emphasizes centralized event analysis; SOAR emphasizes orchestration/automation; XDR emphasizes correlated detection/response across integrated security products. The categories overlap in modern platforms, but the exam still asks which capability solves a stated need.

Choose under exam pressure

Traps

• Defender for Cloud and Defender for Cloud Apps are different products.
• An alert count does not directly measure confirmed incidents.

Practise this topic

Memory hook: Classify, protect, retain, investigate and prove.

Must remember

Microsoft Purview brings supported data governance, protection and compliance capabilities together. Classification identifies sensitive information; sensitivity labels mark and apply supported protection; DLP detects/restricts inappropriate data movement. A label policy publishes label availability/default behavior, while an item’s label expresses its classification/handling.

Retention policies and labels manage how long content is retained or deleted. Records management applies stronger lifecycle controls for designated records. Retention and sensitivity labels have different jobs: keeping content is not the same as encrypting or restricting access to it. Legal preservation needs can override ordinary disposal workflows.

Content explorer helps inspect classified content within permissions; Activity explorer shows supported protection-related activity. Insider Risk Management correlates supported indicators under privacy/access controls. eDiscovery supports finding, preserving and reviewing information for investigations/legal processes; audit records supported activity. These functions require appropriate configuration, roles and data scope.

Compliance Manager organizes assessments and improvement actions; compliance score is a progress/risk-management signal, not a legal certification. Service Trust Portal provides Microsoft assurance/compliance resources. Privacy principles and shared responsibility guide evaluation, but an organization must still determine its own obligations and actual control operation.

Choose under exam pressure

Traps

• Sensitivity and retention labels are not interchangeable.
• Compliance score is not proof of legal compliance.

Practise this topic