Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
Which two types of resources can be protected by using Azure Firewall? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
Azure Firewall is a managed, cloud-based network security service designed to secure traffic inside and across Azure Virtual Networks. Microsoft describes Azure Firewall as a stateful firewall that ''protects Azure Virtual Network resources'' by enforcing network and application rules, central logging, and threat intelligence--based filtering. Because it is deployed into a VNet/subnet (often as the hub in a hub-and-spoke), it directly governs East/West and North/South flows to workloads such as Azure virtual machines and platform services reachable through the VNet, using DNAT/SNAT and rule collections. Microsoft guidance highlights capabilities to ''centrally create, enforce, and log application and network connectivity policies across subscriptions and virtual networks,'' and to filter traffic for peered VNets, branch connections (VPN/ExpressRoute), and internet traffic. These capabilities explicitly map to protecting Azure virtual networks and the VMs and subnets inside them. In contrast, Azure AD users, Exchange Online inboxes, and SharePoint Online sites are SaaS/identity resources protected by Microsoft Entra controls, Exchange/SharePoint security, and Purview/Defender for Office 365---not by a VNet firewall. Therefore, the Azure Firewall--protectable resource types among the options are Azure virtual machines and Azure virtual networks.
Which two types of devices can be managed by using Endpoint data loss prevention (Endpoint DLP)? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
Endpoint data loss prevention (Endpoint DLP), a feature in Microsoft Purview, supports Windows 10 and 11 and now also supports macOS for core DLP capabilities. It allows organizations to monitor and restrict actions like copying sensitive files to USBs, printing, or uploading to unapproved cloud services.
SCI Extract: 'Endpoint DLP extends Microsoft Purview Data Loss Prevention to Windows 10, Windows 11, and macOS devices, allowing for monitoring and control of sensitive data usage at the endpoint.'
Other platforms like Linux, iOS, and Android are not currently supported for Endpoint DLP
What are three uses of Microsoft Cloud App Security? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
Microsoft Cloud App Security (now Microsoft Defender for Cloud Apps) is Microsoft's CASB that ''discovers and controls shadow IT,'' integrates with identity and endpoint signals, and enforces data protection in SaaS and custom apps. SCI materials describe three core use cases relevant here: (1) Discovery and control of shadow IT by analyzing network logs and app usage, rating risk, and applying governance---matching A. (2) Protect sensitive information hosted anywhere in the cloud via policies such as DLP, information protection label awareness, and integration with apps through API connectors---matching C. (3) Prevent data leaks to noncompliant apps and limit access to regulated data using Conditional Access App Control and session controls that can block download, apply protections, or monitor in real time---matching E. In contrast, secure connections to Azure virtual machines are provided by Azure Bastion, not the CASB (eliminating B), and pass-through authentication to on-premises apps is delivered by Azure AD features such as Azure AD Application Proxy or PTA (not Cloud App Security), eliminating D.
In the Microsoft Cloud Adoption Framework for Azure, which two phases are addressed before the Ready phase? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
In the Microsoft Cloud Adoption Framework (CAF) for Azure, the methodology is organized into sequential stages that guide an organization from initial intent through operations. Microsoft describes the flow as: ''Strategy Plan Ready Adopt Govern Manage.'' The guidance explains that before building landing zones or preparing environments (Ready), organizations should complete the Strategy and Plan work. Microsoft states that the framework ''helps you create and align your business strategy, define business outcomes, and justify cloud adoption'' in the Strategy stage; then, in Plan, you ''translate that strategy into an actionable adoption plan, rationalize portfolios, and prepare a cloud adoption backlog.'' Only after these two stages does the Ready phase occur, where you ''prepare your cloud environment (landing zone) to host the workloads.''
Additionally, CAF emphasizes that Govern and Manage are ongoing disciplines that operate alongside and after adoption rather than preceding Ready: ''Govern and Manage provide iterative guardrails and operational baselines that evolve as you adopt more workloads.'' Therefore, the two phases addressed before the Ready phase are Define Strategy and Plan, aligning with Microsoft's prescribed order and intent of the Cloud Adoption Framework methodology.
Which compliance feature should you use to identify documents that are employee resumes?
In Microsoft Purview Information Protection, pre-trained (Microsoft-provided) trainable classifiers are designed to automatically recognize specific categories of content by learning from examples rather than relying only on patterns or keywords. Microsoft's guidance explains that trainable classifiers ''look for data by learning from examples,'' and that Microsoft supplies a catalog of ''pre-trained classifiers that you can use immediately in your tenant.'' The documentation explicitly lists content types these classifiers can recognize, including ''Resumes,'' along with other categories such as Source code, Threat and harassment, and more. Because they're already trained by Microsoft, you can use them ''to identify and classify items across SharePoint, OneDrive, and Exchange,'' and then take actions such as auto-labeling or enforcing DLP policies based on the classifier match.
By contrast, Content explorer is a reporting tool that lets you view where sensitive info types/labels were found; it doesn't identify resumes on its own. Activity explorer shows events like DLP policy matches over time. eDiscovery is used for legal hold, search, and review, not for semantic content identification. Therefore, to identify documents that are employee resumes, the correct Microsoft compliance feature is the pre-trained (Microsoft-provided) trainable classifier for Resumes.
Which Microsoft 365 compliance feature can you use to encrypt content automatically based on specific conditions?
In Microsoft 365 compliance, sensitivity labels (Microsoft Purview Information Protection) are the feature designed to classify and automatically protect data. Microsoft states that sensitivity labels ''let you classify and protect your organization's data'' and that a label ''can apply protection settings such as encryption'' to files and emails. Labels can be deployed so that protection is applied without user action: Microsoft explains that labels ''can be applied automatically, recommended, or by users,'' and that administrators can ''auto-apply a sensitivity label to content in SharePoint, OneDrive, and Exchange based on conditions such as sensitive info types, keywords, or trainable classifiers.'' When a label with protection is applied, ''encryption settings travel with the content'' and enforce usage rights like who can open, print, or forward, even outside the organization.
By contrast, Content Search and eDiscovery are discovery/investigative tools and do not enforce protection. Retention policies manage how long content is kept or deleted, but they don't encrypt content. Therefore, the Microsoft 365 compliance capability that encrypts content automatically based on specific conditions is sensitivity labels with auto-labeling policies in Microsoft Purview.
Exam domains verified against: Official Microsoft SC-900 exam guide, last checked October 2026.
This section covers security methodologies, Zero Trust methodology, shared responsibility framework, defense-in-depth principles, general threats, encryption schemes, and Microsoft privacy rules. It establishes the foundational language and concepts you need for the remaining three domains.
This section tests your ability to manage security, compliance, and identity features within Microsoft Entra. The focus is on balancing data safety with business agility through identity management, authentication, access control, and conditional access capabilities.
Sample question from this domain above: Q3
This section covers the breadth and depth of Microsoft security solutions and features, requiring understanding of the latest technologies for mitigating and reducing cybersecurity threats. You learn how Microsoft Defender, Azure security services, Microsoft Sentinel, and related tools work together to protect cloud and hybrid environments.
This section explores the diverse functionalities of Microsoft compliance solutions to demonstrate understanding of data safety and integrity processes. You learn about regulatory frameworks, compliance tools, and how Microsoft Purview and related services help organisations meet compliance requirements.
Common questions about the exam itself
