SC-900 Security, Compliance & Identity Concepts 2

Question 1

Which security principle states that users should be granted only the minimum level of access necessary to perform their job functions?

Accepted Answer

Least privilege

Answer

Least privilege limits user access rights to only what is strictly required for their role, reducing the attack surface.

Question 2

What type of attack involves an attacker intercepting and potentially altering communication between two parties without their knowledge?

Accepted Answer

Man-in-the-middle attack

Answer

A man-in-the-middle (MitM) attack occurs when an attacker secretly relays and possibly alters communications between two parties.

Question 3

In the context of identity, what does the term 'federation' refer to?

Accepted Answer

A trust relationship between identity providers across organizations

Answer

Federation establishes a trust relationship between identity providers, allowing users from one organization to access resources in another without separate credentials.

Question 4

Which of the following best describes 'data sovereignty'?

Accepted Answer

The legal concept that data is subject to the laws of the country where it is stored

Answer

Data sovereignty refers to the principle that digital data is subject to the laws and governance structures of the nation where it is physically stored.

Question 5

What is the primary purpose of a Security Information and Event Management (SIEM) system?

Accepted Answer

To collect, analyze, and correlate security events across an organization

Answer

A SIEM system aggregates and analyzes log data from multiple sources to detect threats, generate alerts, and support incident response.

(SC-900) Microsoft Security, Compliance, and Identity Fundamentals Exam Practice Test

(SC-900) Microsoft Security, Compliance, and Identity Fundamentals Exam Practice Test

SC-900 Security, Compliance & Identity Concepts 2