SC-900

An organization has deployed Microsoft 365 applications to all employees. Considering the shared responsibility model, who is responsible for the accounts and identities relating to these employees?

• The Organization

• Microsoft, the Saas provider

• There's shared responsibility between an organization

Answer explanation

In the shared responsibility model, the customer organization always has responsibility for their data, including information and data relating to employees, devices, and accounts and identities.

Which of the following measures might an organization implement as part of the defense in-depth security methodology?

• Locating all its servers in a single physical location

• Multifactor authentication for all users

• Ensuring there's no segmentation of your corporate network

Answer explanation

Multifactor authentication is an example of defense in-depth at the identity and access layer.

The human resources organization wants to ensure that stored employee data is encrypted. Which security mechanism would they use?

• Hashing

• Encryption in transit

• Encryption at rest

Answer explanation

Encryption at rest could be part of a security strategy to protect stored employee data.

Which of the following best describes the concept of data sovereignty?

• There are regulations that govern the physical locations where data can be stored and how and when it can be transferred, processed, or accessed internationally.

• Data, particularly personal data, is subject to the laws and regulations of the country/region in which it's physically collected, held, or processed.

• Trust no one, verify everything.

Answer explanation

Data sovereignty is the concept that data, particularly personal data, is subject to the laws and regulations of the country/region in which it's physically collected, held, or processed.

What are the six foundational pillars?

• Identities

  and

  Devices

• Applications

  and

  Data

• Infrastructure

  and

  Networks

• Saas

  and

  Paas

What is the zero trust guiding principles?

• Verify explicitly

• Least privileged access

• Assume breach

• Do not verify

What are the two top-level types of encryption?

• Symmetric encryption

  uses the same key to encrypt and decrypt the data.

• Asymmetric encryption

  uses a public key and private key.

  Either key can encrypt data, but a single key can not be used to decrypt encrypted data.

Is stored data such as on a server an example of "Data at rest"?

If an attacker obtained a hard drive with encrypted data and didn't have access to the encryption keys, could the attacker get access to the data?

• YES

  NO

• YES

  YES

• NO

  NO

• ??

  ??

Is HTTPS an example of encryption in transit?

• No

• YES

• Encrypting data in transit protects it from outside observers and provides a mechanism to transmit data while limiting the risk of exposure.

Is Hashing often used to store passwords?

• Yes

• No

• Maybe

Answer explanation

Hashing is the process of converting data — text, numbers, files, or anything, really — into a fixed-length stringof letters and numbers. Data is converted into these fixed-length strings, or hash values, by using a special algorithm called a hash function. For example, a hash function that creates 32-character hash values