DEV Community: CyberTTopic

My knowledge base missed a contradiction. My content graph found it in one query

CyberTTopic — Mon, 21 Sep 2026 19:10:04 +0000

This is a submission for the Sanity Challenge, Path One: Ship an Agent That Queries Real Content

What I Built

Detection Debt answers a question a security operations team cannot look up: if this telemetry source goes away, which detections die and which MITRE ATT&CK techniques stop being watched?

No document holds that answer. It exists only by walking

connector → logTable → detectionRule → technique

and subtracting sets. A keyword search over detection rules returns the rules that exist; it can never return the gap.

But the thing I actually learned was something else, and it happened early.

I fed two CIS benchmark PDFs and a set of Microsoft Learn pages into a Sanity Context Knowledge Base. Separately, I modelled the same claims as documents in a Sanity dataset, with references between them. Then I asked both the same question: how long should a break-glass account password be?

The knowledge base gave a careful, well-sourced answer about emergency access accounts. It told me something I had missed after two manual readings of the source. It did not mention that its own corpus contains two incompatible answers.

The graph returned both, in one query:

Authority	Location	Claim
CIS Microsoft 365 Foundations v7.0.0	§ 1.1.2, pp. 24–26	at least 16 characters
Microsoft Cloud Security Benchmark	Privileged Access, PA-5	at least 32 characters

Same documents. Same question. One mechanism surfaced the disagreement; the other smoothed over it. The rest of this post is why — and it is not a story about either of them being worse.

Demo

detection-debt.vercel.app

Three questions, against the live dataset: 8 connectors, 18 log tables, 40 detection rules imported from the public Microsoft Sentinel repository, 186 ATT&CK techniques from the official STIX bundle, 8 baseline controls cited to the page.

1. What goes dark

If we do not renew Defender for Endpoint, which ATT&CK techniques stop being
watched?

4 tables stop. 120 GB/day of ingestion ends. 4 rules stop firing. Two techniques lose their last remaining rule:


`T1003`	OS Credential Dumping	was held up by DET-0020
`T1566`	Phishing	was held up by DET-0034

T1078 and T1136 survive on other rules — and T1136 now rests on DET-0006
alone, which nobody asked about and which is the next thing to break.

2. What nothing is watching

Which Credential Access techniques have nothing validated covering them?

63 of 67. Two more from the same shape of query:

16 of 31 coverage rules read exactly one table. Over half the detection estate is a single point of failure.
23 GB/day of telemetry that no rule reads. Defender for Identity and Defender for Cloud Apps feed four tables on the Analytics plan, and no rule — validated, tuned, draft or retired — queries any of them. I did not design that into the dataset; the agent found it.

3. Where the sources disagree

How long should the break-glass account password be?

Both claims, with citations, and the disagreement stated rather than resolved. This is the question that uses both Context endpoints in one turn.

Ask it something else

The five questions on the page are starting points, not a menu. Eleven tools sit behind it, one of which writes GROQ against the dataset, so it answers things I did not anticipate. Some that work:

How fragile is our detection coverage? — the 16 single-table rules
What's uncovered in Lateral Movement? — any of the 14 ATT&CK tactics
Can we move SigninLogs to Basic? — any of the 18 log tables
Which rule should we deploy for T1078? — ranked, and it flags that the false-positive rate it ranked by is synthetic
Should we block legacy authentication, and how? — the other contested setting: CIS names one Conditional Access policy, Microsoft documents four mechanisms
Which rules have no owner? / What's our most expensive table? / How many rules use join? — arbitrary queries through the escape hatch

And where it stops: ask about something that is not modelled — response times, incidents, analyst names — and it says it does not have that rather than filling the gap from general knowledge about Microsoft security products. That refusal is deliberate. The entire value of the tool is that it reports this estate instead of a plausible one.

Every call is visible

The interface shows each tool call and which of the two endpoints served it. An answer about what is missing from a security estate is worth exactly as much as the reader's ability to check it, so the checking is part of the interface rather than a debug flag.

The demo runs on a free model quota of fifteen requests a minute, and one question costs a model call per agent step — so it is throttled to two questions a minute per caller. If it asks you to wait, that is the quota rather than a bug. It also runs locally with your own key from Anthropic, OpenAI or Google, and needs one environment variable to do it.

Code

github.com/CyberTTopic/detection-debt

122 unit assertions that need no credentials, 25 GROQ assertions against a local fixture, and 27 live checks against the real dataset that run without a model at all (npm run smoke). The README documents three problems that each cost a day.

How I Used Sanity

The schema is the argument

Six document types. One design rule: if a fact is an entity, it is a
reference.

connector ──▶ logTable ──▶ detectionRule ──▶ technique
                                │                │
                                │                └── parentTechnique (self-ref)
                                │
baselineControl ────────────────┘
      └── conflictsWith (self-ref)

Three of those fields do the real work:

detectionRule.dataSources[] → logTable is why connector loss is computable. A rule reading one table is a single point of failure, and count(dataSources) == 1 is one line of GROQ instead of a judgement call.

technique.parentTechnique, a self-reference, is what keeps coverage honest. A rule covering T1078.004 does not cover T1078. Flattening that hierarchy overstates coverage, and the only way to not flatten it is to model it.

baselineControl.conflictsWith, also a self-reference, is the one this post is about:

defineField({
  name: 'conflictsWith',
  type: 'array',
  of: [{type: 'reference', to: [{type: 'baselineControl'}]}],
  description:
    'Controls that govern the same setting with a different recommended value. ' +
    'When a question touches a contested setting, return every claim with its ' +
    'sourceAuthority and sourceLocation. Never pick one silently.',
})

Every other field stores what a source says. That one stores that two sources differ, and it is the only reason the hardest question in this dataset has an answer.

Field descriptions are written for the agent, not for a content editor — Sanity Context's schema_explorer surfaces them, so they are the agent's documentation. kqlFeatures explains which query constructs a cheaper Azure table plan forbids; supportsBasicPlan says a downgrade may not be offered at all.

Two Context endpoints, because a Context MCP serves one mode

An endpoint is either GROQ mode or Knowledge Base mode, and the mode decides which tools it exposes. I needed both, so there are two endpoints and a router.

Endpoint A — GROQ mode, over the live dataset. Tools used: initial_context, schema_explorer, groq_query. This answers structure: what depends on what, how many, and above all what is absent.

Endpoint B — Knowledge Base mode. Tools used: initial_context,
knowledge_base_read. I pointed the Knowledge Base at three source types:

Files — the CIS Microsoft 365 Foundations v7.0.0 and CIS Microsoft Azure Foundations v6.0.0 benchmark PDFs.
Websites — specific Microsoft Learn pages on emergency access accounts, Conditional Access, session lifetime and legacy authentication.
Dataset — the tuningDecision documents from the project itself, so internal decisions are indexed beside the guidance they depart from.

It produced 26 entries. The purpose field steers the outline, and getting it wrong is expensive: my first attempt used documentation directory URLs as website sources, and one of them indexed 157 pages and blew through the plan limit. Leaf pages only.

The router lives in the system prompt and the agent has to name the endpoint it used:

The question is about	Endpoint
what breaks, what is uncovered, how many, what depends on what	the graph
what a source recommends, why a decision was taken	the docs
a hardening value that might be disputed	both

Why the knowledge base missed the contradiction

Not because it is bad at finding contradictions. It found two others in the same build and raised them as issues I had to resolve before the index would finish.

Watching three cases together is what taught me something, because the knowledge base behaved differently in each and the difference was not about how important the conflict was:

Raised. An entry claimed there were ten CIS Azure activity log alert controls. Its own table, and both cited sources, listed eleven. The entry contradicted the documents it was built from, in one place, and the build caught it.

Preserved but not flagged. CIS § 1.1.2 contradicts itself. Its remediation steps have you exclude a break-glass account from Conditional Access and rely on a 16-character password. A Warning at the foot of the same page states that MFA has been required for all users including break-glass accounts since 15 October 2024, and recommends passkeys instead. Both claims landed in the same entry, verbatim, side by side, and nothing marked them incompatible.

Not raised at all. The 16-versus-32 disagreement. The MCSB source is in the corpus; PA-8.1 is cited elsewhere. The privileged_access entry explicitly routes PA-5 to the emergency_access entry. But emergency_access cites no MCSB source. The fact fell between two entries — and a conflict spanning two entries is not a conflict either of them can see.

That is the whole lesson. A prose index can only notice a disagreement that lands inside one of its chunks. Which chunk a fact lands in is decided by an outlining pass, and nobody — including the person who wrote the purpose field that steered it — can predict that reliably.

The graph has the opposite property. Once "these two disagree" is a reference rather than a sentence, it survives chunking because there is no chunking:

{
  "contestedSettings": array::unique(
    *[_type == "baselineControl" && count(conflictsWith) > 0].setting
  )
}

One line, and it cannot miss — not because GROQ is clever, but because the fact was made structural instead of textual.

And the other direction, honestly

The knowledge base also told me this, which I had read past twice:

If the Conditional Access exclusion is managed by a security group, that group
must be role-assignable or enrolled in PIM for Groups. A regular security group
allows Group Administrators to bypass Conditional Access entirely.

That is a conditional, three documents deep, and I had no field for it. I would have had to already know it mattered in order to model it.

Prose keeps the facts you did not anticipate. A schema keeps the facts you did. That is why the agent reads both, and why I would not replace either with the other.

The model does not do the arithmetic

coverage_delta fetches the graph, does the set algebra in TypeScript, and returns only what changed — the 186 techniques never enter the context window.

It takes a list of connectors, and that matters more than it looks:

A technique held up by one rule from Defender for Identity and one rule from
Defender for Cloud Apps survives losing either one. It goes dark when both go.

Run the single-connector query twice and union the answers, and that technique reports as safe. The unit test for this is the one I care about most:

check('the union of the single answers would have missed it',
  [...mde.techniquesGoingDark, ...mdi.techniquesGoingDark]
    .some((t) => t.attackId === 'T2000'),
  false)

And when asked about a single connector, the tool runs both implementations — the TypeScript, and an equivalent GROQ query inside Sanity — and compares them. Two independent expressions of the same set difference, checked against each other at answer time. When they disagree it says so rather than picking one.

That cross-check earned its keep on the first run against production data.

The bug that every test passed

techniques[]->attackId evaluates under groq-js to ["T1110","T1556"]. The same
projection through Context's groq_query returns
[{"attackId":"T1110"},{"attackId":"T1556"}]. Context rewrites projections —
results carry an _id nobody asked for — and dereferenced scalar fields arrive
wrapped. Nested paths are left alone, so connector->slug.current comes back as a
plain string from the same query. That inconsistency is why it took a while to
see.

Those wrapped values were being used as Map keys. Object keys compare by reference, so every lookup missed, every technique fell through the
"not in the snapshot" branch, and the tool reported that losing a connector killed nine rules and left no technique uncovered.

Silent. Plausible. Wrong in the direction that reads as good news.

Every unit test passed the whole time, because they run against a local fixture through groq-js — they were exercising a shape production never emits. What found it was the cross-check: GROQ said four techniques go dark, the TypeScript said none, and the tool refused to choose.

A fixture is not a substitute for running against the real thing. I knew that and still had to learn it.

Then my own agent made the same mistake as the knowledge base

The router was a paragraph in the prompt. That works on a capable model. Late in the build I moved to a smaller one, and asked the break-glass question again.

It called docs_outline, then knowledge_base_read on the emergency access entry, and answered: at least 16 characters, according to the CIS benchmark. It never touched the graph. Two tool calls, both to one endpoint, and an answer that was cited, confident, and missing the contradiction entirely.

Which is exactly the failure this project exists to expose, reproduced by the thing I built to expose it.

The fix was not a bigger model. It was to stop asking the model to remember. Every knowledge base response now carries the disagreement with it:

return {
  source: 'docs endpoint (Knowledge Base mode)',
  contested: await contestedWarning(graph),   // <- attached to the content
  entries: cap(text, 30_000),
}

Where contestedWarning is one cached GROQ query turned into a sentence the model receives alongside the prose it asked for:

IMPORTANT — the graph records 3 settings whose guidance is CONTESTED between
authorities: breakglass-password-length, block-legacy authentication,
admin-signin-frequency. A knowledge base entry states one claim and generally
does not say that another authority disagrees, because a conflict spanning two
entries is invisible to either of them. If your answer touches any of the
settings above, call claims_for_setting before answering.

Same question, same small model, after the change:

The guidance for break-glass account password length is contested between
authorities. CIS Microsoft 365 Foundations v7.0.0, § 1.1.2: at least 16
characters, randomly generated. Note that this benchmark entry contains
conflicting information: while the remediation steps rely on this password, a
warning at the end of the same section states that MFA is now required for all
users, including break-glass accounts. Microsoft Cloud Security Benchmark, v2
PA-5: at least 32 characters, never expiring, split under dual control. These
sources disagree on both the required length and the overall authentication
strategy.

It also got cheaper. The model read the contested list in the outline response and went straight to the graph, skipping the entry read altogether — two calls instead of three, because it no longer needed to read something it already knew was incomplete.

That is the same move twice, at two different layers. conflictsWith made a disagreement between sources structural instead of textual, so a query could find what a prose index could not. This made the warning structural instead of instructional, so a weak model could not skip what a paragraph had merely asked it to do.

Both times the lesson was the same: if a fact matters, do not ask the reader to remember it — put it where they cannot miss it. Which is, more or less, the whole argument for modelling content.

What is invented, and why I say so

The connectors, tables, rule logic, ATT&CK techniques and every cited benchmark control are real, imported from public sources and cited to the page.

Four fields on each detection rule are not. status, fpRate, lastValidated and ownerTeam are generated from a hash of the rule ID — deterministic, so the demo does not reshuffle, but invented. They describe operational history with a rule, and no public repository can know that.

So the agent is instructed to say so whenever one of them drives an answer, and it does:

Synthetic Data Note: the ownerTeam and status fields used to identify
these rules are synthetic demonstration data.

Ranking rules by a fabricated false-positive rate without mentioning that it is fabricated is the most dishonest thing this application could do, and it would look exactly like competence.

Sanity Project Details


Project ID	`6qz0b6rp`
Dataset	`production`
Studio (public)	detection-debt.sanity.studio
Document types	`connector`, `logTable`, `detectionRule`, `technique`, `baselineControl`, `tuningDecision`
Content	8 connectors, 18 log tables, 40 rules, 186 techniques, 8 controls
Knowledge Base	26 entries from 2 PDFs, Microsoft Learn pages, and the dataset

The Studio is public and navigable. Open a detection rule and its tables and techniques are links you can follow — which is a better look at the content model than a project ID is.

What I would tell myself at the start

Model the disagreement, not just the claim. conflictsWith is one array of references and it is the reason the hardest question in this dataset has an answer.

Keep the arithmetic out of the model. Not because models are bad at it, but because when they get it wrong the answer is fluent and nobody can see the error.

Put warnings in the tool output, not the system prompt. A prompt is read once, far from the moment it matters. A tool result arrives in the model's hands exactly where the decision gets made, and the smaller the model, the larger that difference gets.

And run two implementations of the thing you care about most. It found a bug that 36 unit tests did not.

SC-900 Part 5: A Timed 30-Question Mock Exam, Full Glossary and Exam-Day Strategy

CyberTTopic — Thu, 17 Sep 2026 13:31:06 +0000

You've done the four domains. This is the dress rehearsal — and then two things to take into the exam room with you: a glossary you can screenshot, and the strategy I actually used on the day.

New to the series? Start with Part 0 — how the exam works and how to build a free lab. Objectives updated July 28, 2026 — always confirm on the official study guide.

🎓 The mock exam: 30 questions, timed

The mock exam is on the interactive page, and it runs in real exam mode — which matters more than it sounds.

👉 Take the timed mock exam

30 questions, weighted like the real exam: 5 on concepts, 9 on Entra, 10 on security solutions, 6 on compliance. Domain 3 is the biggest for a reason.
A 35-minute clock, which you start when you're ready.
No feedback until you submit. You can change answers, but nothing turns green or red while you work. This is the part that makes it useful: per-question feedback teaches, and that's what the domain quizzes are for — a mock exam has to measure, and it can't measure you if it's helping you.
On submit: your score, a breakdown by section so you can see exactly which domain is dragging you down, and a full review with the reasoning for every question.

Scoring guide: 27–30, book the exam. 24–26, review your weakest section and retake in two days. Below 24, go back to that domain and redo its labs — at that level the gap is conceptual, not memorization.

One rule, and it's on you: do it once, properly, before you look at anything else. A mock exam you take with the write-up open in another tab tells you nothing.

And when you're done with mine, take Microsoft's own free practice assessment. Mine tests the same concepts; theirs is written by the people who write the exam, so the phrasing is closer. Do both.

⚠️ On exam dumps. These 30 questions are original, written from the published objectives. They are not real exam questions and are not meant to resemble them. If you find a site promising "real SC-900 questions", close it: the Microsoft Certification Exam Candidate Agreement prohibits obtaining or distributing exam content by any means — including memorization — and the penalty is having your credentials revoked and being banned from the programme. You'd be risking the certification to learn less.

📖 One-page glossary

Screenshot this. If you can say one sentence about each name, you're ready.

Identity

Term	One-liner
Microsoft Entra ID	Cloud identity and access management service
Entra External ID	Identities for customers and partners (formerly B2C)
Entra ID Protection	Detects risky users and sign-ins in the cloud (P2)
Conditional Access	If-this-then-that access policies (P1)
PIM	Just-in-time, approval-based privileged roles (P2)
Access reviews	Periodic attestation of who still needs access
Entitlement management	Access packages with approval and expiry
SSPR	Self-service password reset
Managed identity	An identity for a workload that Azure manages
Administrative unit	Scopes admin rights to part of the directory
Verified ID	Decentralized verifiable credentials
Permissions Management	CIEM across Azure, AWS and GCP

Security

Term	One-liner
Defender XDR	Correlates alerts across Defender products into incidents
Defender for Endpoint	Device protection and EDR
Defender for Office 365	Email and collaboration protection
Defender for Identity	On-premises Active Directory protection
Defender for Cloud Apps	CASB for SaaS, shadow IT discovery
Defender for Cloud	Cloud posture (CSPM) and workload protection (CWPP)
Microsoft Sentinel	Cloud-native SIEM and SOAR
Secure Score	Prioritized posture measurement
NSG	Basic allow/deny network rules
Azure Firewall	Managed stateful firewall
WAF	Protects web apps from OWASP-style attacks
Azure Bastion	RDP/SSH without public IPs
DDoS Protection	Mitigates volumetric attacks
Key Vault	Stores keys, secrets and certificates

Compliance

Term	One-liner
Microsoft Purview	The compliance platform and portal
Sensitivity label	Protects content; travels with the file
Retention label/policy	Controls how long content is kept
DLP	Prevents risky sharing of sensitive information
Records management	Makes items immutable for their retention period
Insider Risk Management	Detects risky internal activity
Communication Compliance	Detects inappropriate messages
eDiscovery	Finds and preserves content for legal cases
Audit	Records what happened, and for how long it's kept
Compliance Manager	Assessments and compliance score
Service Trust Portal	Microsoft's own audit reports and certifications
Microsoft Priva	Privacy risk management

🎯 Exam-day strategy

Before

Take the official practice assessment linked from the study guide. It's free and its wording is the closest to the real thing.
Re-read only your index cards on the last day. No new material.
Check the "Skills measured as of" date one final time.

During

Read the last line of the question first. It tells you what's actually being asked; the paragraph above is often scenario padding.
Watch for the number of answers required. If it says "select two," an otherwise perfect single answer is wrong.
Eliminate by surface. Most Defender questions resolve instantly once you ask "what is being protected here — a device, a mailbox, on-prem AD, or a SaaS app?"
Licence keywords are decisive. If the scenario mentions risk-based policies or just-in-time roles, you're in P2 territory.
Mark and move on. Nothing costs more points than spending four minutes on one question. Flag it, finish the exam, come back.
Don't overthink the "best" answer. Fundamentals exams reward the textbook answer, not the clever one.

After

You get your result on screen immediately.
Add the badge to LinkedIn the same day, and write a short post about what you learned. That post gets more reach than the badge alone — and, if you did the labs in this series, you have screenshots to prove you practiced.

That's the series

Part 0 — How the exam works + how to build a free lab in 2026
Part 1 — Security, compliance and identity concepts
Part 2 — Microsoft Entra capabilities
Part 3 — Microsoft security solutions
Part 4 — Microsoft Purview and compliance
Part 5 — this one

And the thing that ties it together: the interactive quiz and labs — 48 questions with every option explained, 8 self-grading labs and this mock exam. Free, no sign-up, and the whole thing is open on GitHub if you want to fork it or fix something.

Why I wrote this

I passed the SC-900 and then went looking for what I'd have wanted while studying. What I found was mostly definitions copied out of the learning path, plus dump sites. So I wrote the series I was looking for, and I held it to three rules: explain why the wrong answers are wrong, link every claim to Microsoft Learn with the date it was verified, and build a lab for anything that can be clicked.

Come back and comment your score — I'd genuinely like to know which domain gave you the most trouble, because that's what tells me which post to improve. And if a future exam update makes something here wrong, tell me and I'll edit it. These posts are maintained, not abandoned.

Next for me: SC-300. Same treatment.

Good luck. 🚀

SC-900 Part 4: Microsoft Purview and Compliance (the easiest points in the exam)

CyberTTopic — Tue, 15 Sep 2026 14:55:51 +0000

Domain 4 is 15–20% of SC-900 and most candidates under-study it because it sounds like paperwork. That's a mistake: the content is concrete, highly memorizable, and the questions are usually the least ambiguous in the whole exam.

Everything here lives in Microsoft Purview, the compliance portal.

New to the series? Start with Part 0 — how the exam works and how to build a free lab. Parts 1 to 3 cover the concepts, Microsoft Entra and the security solutions.

Objectives updated July 28, 2026. Purview has absorbed several older brands (Microsoft 365 compliance center, Azure Purview). Verify names on Microsoft Learn before your exam.

1. The data lifecycle in one picture

Everything in this domain fits into five stages:

Know your data — data classification, sensitive information types, trainable classifiers, content explorer, activity explorer.
Label — sensitivity labels, applied manually, automatically or recommended.
Protect — encryption, content marking, and DLP policies that block risky sharing.
Retain — retention labels and policies that keep or delete on a schedule.
Govern and audit — insider risk management, eDiscovery, audit logs, Compliance Manager.

2. The two labels people confuse

This distinction is worth a guaranteed point:

	Sensitivity label	Retention label
Question it answers	How sensitive is this and how do I protect it?	How long do I keep it and what happens then?
Typical actions	Encrypt, watermark, header/footer, restrict access	Keep, delete, keep-then-delete, trigger review
Travels with the file?	Yes — protection persists outside your tenant	No — it's a policy applied where the item lives
Example	"Confidential — Finance"	"Contracts — keep 7 years"

Key properties of sensitivity labels: only one sensitivity label per item, they can be published to specific users/groups, and they can be applied automatically based on content (auto-labeling).

3. Data Loss Prevention (DLP)

DLP watches content against sensitive information types (credit card numbers, national IDs, health records, and custom ones) and enforces actions:

Block the action entirely
Block but allow the user to override with justification
Just notify the user with a policy tip
Generate an alert for the compliance team

DLP policies can apply to Exchange, SharePoint, OneDrive, Teams, and endpoints (Endpoint DLP), plus non-Microsoft cloud apps through Defender for Cloud Apps.

4. Retention and records management

Retention policy — applies broadly to a location (all of SharePoint, all mailboxes).
Retention label — applies to individual items, and can be applied by users or automatically.
Records management — declaring an item a record makes it immutable: it can't be edited or deleted until the retention period ends. There's also regulatory record, which is even stricter.
Disposition review — a human confirms deletion at the end of the period.

Principle to remember: when multiple retention settings conflict, retention wins over deletion, and the longest retention period applies.

5. Insider risk, eDiscovery and audit

Insider Risk Management — detects risky internal activity: mass downloads before resignation, data leaks, policy violations. Works on signals and templates, with pseudonymization by default.
Communication Compliance — detects inappropriate or non-compliant messages.
eDiscovery — finds content relevant to a legal case. Standard does search, hold and export; Premium adds custodian management, review sets and analytics.
Audit — records what happened. Standard audit for basic activity retention; Premium adds longer retention and critical events.
Compliance Manager — assessments against standards (ISO 27001, GDPR, NIST) with improvement actions and a compliance score.
Service Trust Portal — where Microsoft publishes its own audit reports, certifications and compliance documents. If a question asks "where do I download Microsoft's SOC 2 report?", that's the answer.

6. Privacy and trust

Microsoft's stated privacy principles are worth recognizing: control, transparency, security, strong legal protections, no content-based targeting, and benefits to you. Microsoft Priva is the privacy risk management product; the Trust Center is the public documentation hub.

🧪 Lab 1: build a DLP rule that blocks a credit card number

Time: 20 minutes. Needs: Microsoft 365 E5 trial.

Go to purview.microsoft.com → Data loss prevention → Policies → Create policy.
Choose the template Financial → Credit card number (or start from a custom policy).
Scope it to Exchange email only, for your test users.
In the rule, set the action to Block with override and enable the policy tip.
Turn on Test mode with policy tips first.
Send yourself an email containing a test credit card number (use a documented test value such as 4111 1111 1111 1111 — never real data).
Watch the policy tip appear. Then check Activity explorer for the event.

Expected result: a screenshot of the policy tip firing. This is the most convincing artifact you can put in a portfolio for a compliance-adjacent role.

🧪 Lab 2: sensitivity label vs retention label

Time: 20 minutes.

Information protection → Labels → Create a label named Confidential – Finance. Enable encryption and add a footer "Confidential".
Publish it to your test user.
In Word online, apply the label to a document, then download the file and try to open it from an account without permission. It stays protected — that's the label travelling with the file.
Now go to Data lifecycle management → Retention labels and create Contracts – keep 7 years.
Apply it to a document in SharePoint and try to delete it.

Expected result: you experienced the difference between "protect the content" and "control the lifespan." You won't forget it in the exam.

Then check yourself

The "which control solves this?" exercise is on the interactive practice page, along with a second one that fixes the tool confusion in this domain — Service Trust Portal vs Compliance Manager vs Content Explorer vs Audit. Both grade themselves.

⚠️ Exam traps in this domain

Sensitivity vs retention label — protection vs lifespan. Read the verb in the question: protect/encrypt → sensitivity; keep/delete → retention.
Only one sensitivity label per item, but multiple retention settings can interact (longest retention wins).
Service Trust Portal = Microsoft's own audit reports. Compliance Manager = your organization's posture and improvement actions.
Insider Risk Management is about internal users; Defender products are about external threats.
eDiscovery Standard vs Premium — Premium adds custodians, review sets, and analytics.
Compliance score is not a guarantee of compliance, it's a measure of implemented improvement actions.

🎯 Now practise it: 12 questions + both labs

This domain rewards precision with words. "Protect it" and "keep it" sound similar in a meeting and mean two completely different products on the exam.

So the practice lives in an interactive page instead of a list you can scroll past:

👉 Take the Part 4 quiz and labs

What you get:

12 exam-style questions. Pick an answer and you immediately see why it's right — and why each of the other three is wrong. The distractors are the ones that actually catch people: sensitivity vs retention label, Service Trust Portal vs Compliance Manager, Content Explorer vs Activity Explorer, block vs block with override.
Options shuffled on every attempt, so retaking it tests the concept instead of the position you memorized.
Lab 7 — which control solves this? Six business requirements in plain English; you pick the Purview capability. This is how the exam phrases every question in the domain.
Lab 8 — where do I go for this? The tool confusion, fixed in five minutes.

With this, the page now covers all four domains: 48 questions and 8 labs. Free, no sign-up.

Comment your score out of 12. If this domain gives you the least trouble of the four, that's normal — and it's exactly why skipping it is such an expensive mistake.

What's next

Part 5 is the finish line: a 30-question mock exam covering all four domains with full explanations, a one-page glossary of every product name in SC-900, and my exam-day strategy — including how to handle the multi-select questions that trip most people up.

SC-900 Part 3: Microsoft Security Solutions (the biggest domain, decoded)

CyberTTopic — Sun, 13 Sep 2026 21:02:13 +0000

This is the domain that decides your exam: 35–40% of the questions. It is also the one where people lose points for a silly reason — there are nine products whose names start with "Microsoft Defender," and under pressure they blur together.

The fix is not more memorization. It's one mental model: every Defender product protects a different surface.

New to the series? Start with Part 0 — how the exam works and how to build a free lab. Parts 1 and 2 cover the concepts and Microsoft Entra.

Objectives updated July 28, 2026. Product names in this area change often; verify on Microsoft Learn before your exam.

1. The Defender XDR family: who protects what

XDR stands for extended detection and response. Microsoft Defender XDR is the umbrella that correlates signals from all of these into a single incident, so an analyst sees one story instead of five alerts:

Product	Protects	Typical signal
Defender for Endpoint	Devices (Windows, macOS, Linux, mobile)	Malicious process, ransomware behaviour, EDR detection
Defender for Office 365	Email and collaboration (Exchange, Teams, SharePoint, OneDrive)	Phishing message, malicious link, unsafe attachment
Defender for Identity	On-premises Active Directory	Lateral movement, pass-the-hash, reconnaissance
Defender for Cloud Apps	SaaS applications (CASB)	Shadow IT discovery, risky OAuth app, session control
Defender Vulnerability Management	Weaknesses across devices and software	Missing patch, risky configuration
Defender Threat Intelligence	External threat context	Attacker infrastructure, indicators

Memory hook, in the order of a real attack: email arrives (Office 365) → user clicks (Endpoint) → attacker moves to AD (Identity) → exfiltrates to a SaaS app (Cloud Apps).

⚠️ The classic trap: Defender for Identity protects on-premises Active Directory. It is not the product that protects cloud identities — that's Microsoft Entra ID Protection. Different product, different domain of the exam.

2. Microsoft Defender for Cloud vs Microsoft Sentinel

These two get confused constantly. The clean split:

Microsoft Defender for Cloud answers "how secure is my cloud infrastructure right now?"

CSPM (cloud security posture management): continuously assesses Azure, AWS and GCP resources
Secure Score: a percentage plus a prioritized list of recommendations
CWPP (cloud workload protection): plans that protect servers, containers, databases, storage, App Service
Regulatory compliance dashboard: maps your posture to standards

Microsoft Sentinel answers "what happened across my whole estate, and what do we do about it?"

SIEM: collects and correlates logs from anything — cloud, on-prem, third-party
Detects with analytics rules, visualizes with workbooks
Hunting queries for proactive searching, UEBA for behavioural anomalies
SOAR: automated response with playbooks (built on Azure Logic Apps)
Priced mainly by data ingested and retained — a common exam detail

Rule of thumb: Defender for Cloud hardens. Sentinel investigates. And yes, Defender for Cloud's alerts can be fed into Sentinel.

3. Azure network security building blocks

You need to recognize these by purpose, not configure them:

Service	What it does
Network security group (NSG)	Basic allow/deny rules on traffic to subnets and NICs (layer 3/4)
Azure Firewall	Managed, stateful firewall with threat intelligence, FQDN filtering, and a static public IP
Web Application Firewall (WAF)	Protects web apps from OWASP-style attacks (SQL injection, XSS); runs on Application Gateway or Front Door
Azure DDoS Protection	Absorbs and mitigates volumetric attacks
Azure Bastion	Secure RDP/SSH through the portal without exposing public IPs
Network segmentation	Virtual networks and subnets to limit lateral movement

Encryption in Azure: data at rest is encrypted by default in storage; Azure Key Vault stores keys, secrets and certificates.

4. Microsoft Defender for Cloud's Secure Score

Worth understanding as a concept because it appears in scenarios: a percentage that reflects how many recommended controls you've implemented, with each recommendation weighted by impact. Improving it is a prioritization tool, not a compliance certificate.

Don't confuse it with Microsoft Secure Score (in the Defender portal), which measures the security posture of your Microsoft 365 identities, apps and devices. Two different scores, similar names.

🧪 Lab 1: read the Defender portal like an analyst

Time: 20 minutes. Needs: Microsoft 365 E5 trial (or your work tenant if you have read access — do not change anything there).

Go to security.microsoft.com.
Open Incidents & alerts → Incidents. Pick any incident.
For each alert inside it, write down which product generated it: Endpoint, Office 365, Identity or Cloud Apps.
Open the attack story tab and follow the sequence of events.
Open Secure Score and pick one recommendation. Read what it improves and what it might break.

Expected result: you can say out loud "this incident started as a phishing email caught by Defender for Office 365, and the device signal came from Defender for Endpoint." That sentence is domain 3 in a nutshell.

🧪 Lab 2: Defender for Cloud Secure Score

Time: 15 minutes. Needs: Azure free account.

Deploy something trivial — a storage account is enough.
Open Microsoft Defender for Cloud → Recommendations.
Note your Secure Score and pick one recommendation, for example "Secure transfer to storage accounts should be enabled."
Apply the fix.
Come back later and see the score move.

This is also a perfect example of the method from any performance work: measure, change one thing, measure again.

Then check yourself

The "which Defender catches this?" exercise and the Azure network security one are both on the interactive practice page — they grade every row and explain the misses. If you only do one thing from this post, do that first lab.

⚠️ Exam traps in this domain

Defender for Identity = on-premises AD. Entra ID Protection = cloud identities.
Defender for Cloud ≠ Defender for Cloud Apps. The first protects infrastructure posture; the second is a CASB for SaaS.
Sentinel is SIEM + SOAR, and it's billed by ingestion. If a question mentions "collect logs from third-party sources," it's Sentinel.
Secure Score (Defender for Cloud) measures Azure posture; Microsoft Secure Score measures Microsoft 365 posture.
NSG vs Azure Firewall: NSG is basic allow/deny rules; Azure Firewall is a managed service with threat intelligence and FQDN rules.
WAF protects web applications, not the network perimeter in general.

🎯 Now practise it: 12 questions + both labs

This is the domain where you don't discover the gap by reading. You discover it when a scenario says "an attacker performs reconnaissance against a domain controller" and, for a second, you're not sure whether that's Defender for Identity or Entra ID Protection.

So the practice lives in an interactive page instead of a list you can scroll past:

👉 Take the Part 3 quiz and labs

What you get:

12 exam-style questions. Pick an answer and you immediately see why it's right — and why each of the other three is wrong. The distractors are the pairs that actually cost people points: Defender for Cloud vs Defender for Cloud Apps, Sentinel vs Defender for Cloud, Secure Score vs Microsoft Secure Score, Bastion vs just-in-time VM access.
Options shuffled on every attempt, so retaking it tests the concept instead of the position you memorized.
Lab 5 — which Defender catches this? Six incidents, six products. This is the single most useful five minutes you can spend on the domain.
Lab 6 — Azure network security. Six requirements; pick NSG, Azure Firewall, WAF, DDoS Protection, Bastion or Key Vault. It explains the layer each one works at.

Domains 1 and 2 are on the same page, so you can review as you go.

Free, no sign-up, works on your phone.

Comment your score out of 12 — and tell me which pair of product names caught you. In this domain it's almost never the concept; it's the naming.

What's next

Part 4 covers Microsoft compliance solutions with Purview — 15–20% of the exam and, honestly, the easiest points available. Labels, DLP, retention, insider risk and eDiscovery, in one diagram plus a lab where you build a DLP rule that blocks a credit card number.

SC-900 Part 2: Microsoft Entra Capabilities (diagrams, labs and an interactive quiz)

CyberTTopic — Wed, 09 Sep 2026 19:28:15 +0000

Domain 2 is worth 25–30% of SC-900 and it is the domain that pays off the most in a real job, because identity is where most support tickets and most attacks live.

Three things carry this domain: knowing the objects in a tenant, knowing the authentication methods, and knowing which licence tier unlocks what.

Objectives updated July 28, 2026. Verify names and tiers on Microsoft Learn — Microsoft renames things in this area constantly (Azure AD → Microsoft Entra ID; Azure AD B2C → Microsoft Entra External ID).

1. What Microsoft Entra ID is (and isn't)

Microsoft Entra ID is a cloud-based identity and access management service. It is not Active Directory in the cloud.

	Active Directory Domain Services	Microsoft Entra ID
Where	On-premises servers	Cloud service
Protocols	Kerberos, LDAP, NTLM	SAML, OAuth 2.0, OpenID Connect, SCIM
Structure	Forests, domains, OUs, GPOs	Flat tenant + groups + administrative units
Manages	Domain-joined Windows devices	Any device, any platform, SaaS apps

They complement each other. Hybrid identity connects the two with Microsoft Entra Connect (or Connect cloud sync), using one of:

Password hash synchronization (PHS) — a hash of the password hash syncs to the cloud. Simplest, and it keeps working if your on-prem servers are down.
Pass-through authentication (PTA) — the cloud passes the validation to an on-prem agent. Passwords never sync.
Federation (AD FS) — a separate on-prem infrastructure handles authentication.

2. The objects inside a tenant

Users: member accounts (your employees) and guest accounts (B2B collaboration, invited from another organization).
Groups: security groups (permissions) and Microsoft 365 groups (collaboration: mailbox, SharePoint site, Teams). Membership can be assigned (manual) or dynamic (rule-based, requires P1).
Devices: registered (usually personal, BYOD), Entra joined (cloud-only corporate device), hybrid joined (joined to on-prem AD and to Entra).
Roles (RBAC): Global Administrator, User Administrator, Security Reader, and dozens more. Least privilege applies — don't hand out Global Admin.
Administrative units: scope a role to a subset of the directory (for example "help desk admin, but only for the Madrid office").
Applications: enterprise applications (SaaS you connect) and app registrations (apps you build).
Workload identities: service principals and managed identities — identities for apps and services, not people.

Also in the Entra family, worth recognizing by name:

Microsoft Entra External ID — identities for customers and partners (formerly Azure AD B2C).
Microsoft Entra ID Governance — entitlement management, access reviews, lifecycle workflows.
Microsoft Entra Permissions Management — CIEM: permission visibility across Azure, AWS and GCP.
Microsoft Entra Verified ID — decentralized, verifiable credentials.
Microsoft Entra Global Secure Access (Internet Access / Private Access) — identity-centric network access.

3. Authentication methods

Ordered roughly from weakest to strongest:

Password only — weakest.
SMS or voice call — better than nothing, vulnerable to SIM swapping. Microsoft discourages it.
Microsoft Authenticator with number matching — strong and cheap.
OATH hardware/software tokens.
Windows Hello for Business — biometric/PIN tied to the device, phishing-resistant.
FIDO2 security keys / passkeys — phishing-resistant, the current gold standard.
Certificate-based authentication — common in regulated environments.

Related features:

Self-service password reset (SSPR) — users reset their own password after verifying with registered methods; reduces help desk load.
Password protection — bans weak and custom-banned passwords, including on-prem when the agent is deployed.
Multifactor authentication (MFA) — something you know, something you have, something you are.
Passwordless — Authenticator app, FIDO2 keys, Windows Hello.

4. Conditional Access

Conditional Access is the if-this-then-that engine of Zero Trust. It evaluates signals, makes a decision, and enforces controls.

Common signals: user or group membership, IP location, device platform and compliance state, target application, real-time sign-in risk and user risk (those last two require Identity Protection).

Common decisions: grant access, grant with conditions (require MFA, require compliant device, require approved client app, require terms of use), or block access. There are also session controls, such as limiting the session lifetime or enforcing app-enforced restrictions.

A classic policy: "If any user accesses the Azure management portal from an untrusted location, require MFA."

5. The licensing table (memorize this one)

Feature	Free	P1	P2
Security defaults	✅	✅	✅
SSO, basic MFA, self-service password change for cloud users	✅	✅	✅
Self-service password reset with on-premises write-back	❌	✅	✅
Conditional Access	❌	✅	✅
Dynamic groups, group-based licensing	❌	✅	✅
Identity Protection (risk-based policies)	❌	❌	✅
Privileged Identity Management (PIM)	❌	❌	✅
Access reviews	❌	❌	✅

(Governance features may also ship in the Entra ID Governance SKU. Confirm current packaging on Microsoft Learn before the exam.)

Security defaults deserve a note: they're a free, all-or-nothing baseline (MFA for admins, MFA registration for everyone, blocking legacy authentication). You cannot customize them — the moment you need exceptions, you turn them off and move to Conditional Access, which means P1.

6. Identity governance quick reference

PIM — makes privileged roles eligible instead of permanently assigned. The admin activates the role for a limited time, with justification and approval. This is the exam's favourite example of just-in-time access.
Access reviews — periodic attestation: "does this person still need this access?"
Entitlement management — access packages that bundle groups, apps and sites, with an approval workflow and an expiration date.
Lifecycle workflows — automate joiner/mover/leaver tasks.

🧪 Lab 1: users, groups and dynamic membership

Time: 15 minutes. Needs: Entra tenant (Free tier is enough for the first part; dynamic groups need P1 trial).

Entra admin center → Users → New user. Create usr.ana with department Sales, and usr.luis with department IT.
Groups → New group → Security → Assigned. Name it grp-all-staff, add both users.
Now create grp-sales-dynamic as a Dynamic User group with the rule: user.department -eq "Sales"
Wait a few minutes and check the membership: only Ana is there.
Edit Luis and change his department to Sales. Wait, refresh, and watch him appear automatically.

Expected result: you can explain, out loud, why dynamic groups reduce administrative work and why they need P1. That's an exam answer.

🧪 Lab 2: your first Conditional Access policy

Time: 15 minutes. Needs: Entra ID P1 or P2 trial. Warning: always exclude a break-glass account so you don't lock yourself out.

Entra admin center → Protection → Conditional Access → Create new policy.
Users: include All users, exclude your admin account.
Target resources: All cloud apps.
Conditions → Locations: include Any location, exclude a named location you created with your own country.
Grant: Require multifactor authentication.
Set the policy to Report-only first. Look at the "Insights and reporting" workbook to see who would have been affected.
Only then switch it to On and test with a VPN set to another country.

Expected result: a screenshot of the sign-in log showing the policy applied. That screenshot is worth more in an interview than the certificate itself.

Then check yourself

The licensing table and these Conditional Access scenarios are both on the interactive practice page — the licence tiers grade themselves, and the policy builder tells you why each condition and control is the right one.

⚠️ Exam traps in this domain

Conditional Access = P1. Identity Protection and PIM = P2. Expect at least one question on this.
Security defaults and Conditional Access are mutually exclusive — you can't run both.
Dynamic groups need P1, and the membership rule is evaluated by attribute, not by manual add.
Guest (B2B) users live in your tenant as guest accounts; they authenticate against their home tenant.
Managed identity vs service principal: a managed identity is a service principal that Azure manages for you (no secrets to rotate).
Entra ID is not a domain controller. No GPOs, no LDAP, no Kerberos to on-prem servers by default.

🎯 Now practise it: 12 questions + both labs

This domain is where licence tiers decide the answer, and you don't find out whether you really know the split until something asks you.

So the practice lives in an interactive page instead of a list you can scroll past:

👉 Take the Part 2 quiz and labs

What you get:

12 exam-style questions. Pick an answer and you immediately see why it's right — and why each of the other three is wrong. The distractors are the real ones: PTA vs federation, Entra ID vs External ID, PIM vs access reviews.
Options shuffled on every attempt, so retaking it tests the concept instead of the position you memorized.
Lab 3 — the licensing table. Nine features, and you pick the minimum tier for each. It grades every row and explains the misses.
Lab 4 — build a Conditional Access policy. Three requirements in plain English; you choose the condition and the control that implement them.

Domain 1 is on the same page, so you can go back and forth.

Free, no sign-up, works on your phone.

Come back and comment your score out of 12 — and if the licensing table caught you, say so. You won't be the only one.

What's next

Part 3 is the biggest domain of the exam: Microsoft security solutions — 35–40%. That's where the Defender family lives, and where most people mix up nine similarly named products. I'll give you the one diagram that fixes it.

SC-900 Part 1: Security, Compliance and Identity Concepts (with labs and 12 practice questions)

CyberTTopic — Thu, 03 Sep 2026 14:53:15 +0000

Domain 1 is only 10–15% of the exam, but it is the vocabulary that the other 85% is written in. If you're fuzzy on "authentication vs authorization" or "who owns the OS in PaaS," you will lose points in domains 2 and 3 without realizing why.

This post covers it in four blocks, then gives you a lab and 12 questions.

This series follows the SC-900 objectives updated on July 28, 2026. Check the official study guide before your exam.

1. The shared responsibility model

The single most tested concept in this domain. Move to the cloud and Microsoft takes over some of the work — but not all of it, and how much depends on the service model.

Read the diagram top-down and one rule jumps out:

Data, devices, and accounts & identities are always yours. In every model. On-premises, IaaS, PaaS or SaaS.

That is the answer to a whole family of exam questions phrased like "Your company moves to SaaS. Who is responsible for protecting user identities?"

The rest shifts:

On-premises: you own everything, down to the building.
IaaS (virtual machines): Microsoft owns the physical layer; you still own the OS, patching, apps and network controls.
PaaS (App Service, Azure SQL): Microsoft owns the OS and runtime; you own your app, your data and your identities.
SaaS (Microsoft 365): Microsoft owns nearly the whole stack; you own data, devices, identities and how you configure it.

2. Zero Trust

Zero Trust replaced the old "castle and moat" idea, where anything inside the corporate network was trusted. That model broke the moment people started working from home on their own devices.

Three guiding principles:

Verify explicitly — authenticate and authorize using every available signal: identity, location, device health, service, data classification, anomalies.
Use least privilege access — just-enough-access (JEA), just-in-time (JIT), risk-based adaptive policies.
Assume breach — segment access, encrypt end to end, use analytics to detect and improve defenses.

Six pillars to protect: identities, endpoints, applications, data, infrastructure, networks.

A phrase worth memorizing: "Zero Trust doesn't mean trusting no one; it means never trusting implicitly, and verifying every time."

3. Defense in depth and the CIA triad

Defense in depth = layers, so that a failure in one control doesn't reach the data. Classic layer stack from outside in: physical → identity and access → perimeter → network → compute → application → data.

The CIA triad is what every control ultimately serves:

Property	Question it answers	Example control
Confidentiality	Can only authorized people read it?	Encryption, access control
Integrity	Is the data unaltered and trustworthy?	Hashing, digital signatures
Availability	Can authorized people reach it when needed?	Redundancy, backups, DDoS protection

Also know the common threat vocabulary the exam uses: phishing, ransomware, data breach, dictionary/brute-force attack, password spray (one password against many accounts, which is why lockout policies alone don't catch it), and supply chain attack.

4. Cryptography basics: encryption, hashing, signing

The exam does not ask you to implement anything, but it does ask you to pick the right one.

Technique	Reversible?	Keys	Used for
Symmetric encryption	Yes	One shared key for encrypt and decrypt	Bulk data, fast
Asymmetric encryption	Yes	Key pair: public + private	Key exchange, certificates, signatures
Hashing	No	None	Storing passwords, verifying integrity
Digital signature	n/a	Signed with private key, verified with public	Proving origin and integrity (non-repudiation)

Two traps:

Hashing is not encryption. There is no "unhash." Same input always gives the same hash; that's why passwords are stored hashed (and salted).
You encrypt with the recipient's public key; you sign with your own private key. Reversing those two is the most common mistake.

Also know data states: data at rest (in storage), data in transit (moving over a network), data in use (loaded in memory). Different states need different protections.

5. Authentication vs authorization

Authentication (AuthN) proves who you are.
Authorization (AuthZ) decides what you're allowed to do.

AuthN always happens first. Single sign-on (SSO) means you authenticate once and access many applications — it is an authentication benefit, not an authorization one.

Identity vocabulary to have ready:

Identity provider (IdP): the service that verifies identity and issues tokens (Microsoft Entra ID is one).
Federation: a trust relationship that lets an IdP in one organization vouch for a user accessing another organization's resources.
Identity as the security perimeter: the modern replacement for the network perimeter — the "four pillars" being administration, authentication, authorization and auditing.

⚠️ Exam traps in this domain

"Who is responsible for the operating system in IaaS?" → The customer. Microsoft only owns the physical layer and hypervisor.
Hashing vs encryption → if the question says "must be verified but never recovered," it's hashing.
SSO is an authentication convenience; it does not grant permissions.
Zero Trust is not a product. You cannot buy it. It's a strategy implemented with many products.
Federation vs SSO → federation is the trust between organizations; SSO is the user experience.

🎯 Now practise it: 12 questions + both labs

Reading about Zero Trust and answering an exam question about Zero Trust are two different skills, and only one of them is graded on exam day.

So the practice for this domain lives in an interactive page instead of a list you can scroll past:

👉 Take the Part 1 quiz and labs

What you get:

12 exam-style questions. Pick an answer and you immediately see why it's right — and why each of the other three is wrong. That reasoning is the actual skill: the exam is won by elimination, not by recognition.
Options shuffled on every attempt, so retaking it tests the concept instead of the position you memorized.
Lab 1 — shared responsibility. Fill the table from memory. It grades every cell and gives you the corrections.
Lab 2 — map your own laptop to Zero Trust. Six pillars, and it tells you which ones you left blank. Those blanks are your real gap list.

Free, no sign-up, works on your phone. It's a single static page — nothing is collected.

Then come back and comment your score out of 12, and which question caught you. I use those comments to improve the series.

What's next

Part 2 covers Microsoft Entra — 25–30% of the exam, and the domain where a single licensing detail (P1 vs P2) decides several questions. We'll build users, groups and a Conditional Access policy in the free lab.

If you found an error or something changed in a newer exam update, drop a comment — I keep these posts edited.

SC-900 in 2026: The Complete Study Series (4 Domains, Free Labs, 60+ Practice Questions)

CyberTTopic — Tue, 01 Sep 2026 01:49:38 +0000

I passed the SC-900: Microsoft Security, Compliance, and Identity Fundamentals exam, and while studying I noticed something: almost every free guide out there is the same list of definitions copied from the learning path. Very few of them let you do anything.

So I wrote the series I wish I had found — five posts that cover the four exam domains, each one with:

Diagrams instead of walls of text
Hands-on labs you can complete in 10–20 minutes in a free tenant
10–12 practice questions per domain with the reasoning behind each answer, not just the letter
An "exam trap" section with the confusions that actually cost people points

⚠️ Read this before you start. Microsoft updated the SC-900 skills measured on July 28, 2026. Always open the official study guide and check the "Skills measured as of" date before your exam. This series follows the current four-domain structure, but Microsoft renames products often (Azure AD → Microsoft Entra ID, Azure AD B2C → Microsoft Entra External ID, and so on).

What SC-900 actually is

It's a fundamentals certification. There is no lab in the exam, no PowerShell, no configuration. What it measures is whether you can look at a business problem and say "that's a job for Conditional Access" or "that's a Purview retention policy."

Typical exam facts:

Item	Detail
Level	Fundamentals (entry level)
Questions	Around 40–60, multiple choice and multi-select
Passing score	700 out of 1000
Prerequisites	None
Good for	Support, helpdesk, sales, compliance, and anyone entering cloud security

Always confirm duration and pricing on the official exam page, since those change by region.

The four domains and their weight

#	Domain	Weight	Post
1	Security, compliance and identity concepts	10–15%	Part 1
2	Capabilities of Microsoft Entra	25–30%	Part 2
3	Capabilities of Microsoft security solutions	35–40%	Part 3
4	Capabilities of Microsoft compliance solutions	15–20%	Part 4

Two thirds of the exam is domains 2 and 3. If you are short on time, that is where you spend it. Domain 1 is short but it is the vocabulary everything else is built on — skipping it makes the other three harder, not faster.

Build your free lab (what still works in 2026)

Here is the part most guides get wrong. A lot of them still tell you to join the Microsoft 365 Developer Program and get an instant sandbox. That program no longer accepts personal accounts: it now requires a qualifying subscription such as Visual Studio Enterprise/Professional, or partner/support program membership. If you don't qualify, you need another path.

The path that works

Create an Azure free account with a personal email. Creating a directory costs nothing; you only pay for resources you deploy, and you get starting credit.
Create a new Microsoft Entra tenant. Azure portal → Microsoft Entra ID → Manage tenants → Create. This gives you the Entra ID Free tier: users, groups, security defaults, basic reports.
Start the Entra ID P2 trial (30 days) only when you're ready to touch Conditional Access, Identity Protection and PIM. Starting it on day one wastes half of it.
Start a Microsoft 365 E5 trial (30 days) when you reach domains 3 and 4 — that's what unlocks the Defender and Purview portals.
Set a calendar reminder for day 25 of each trial so nothing surprises you.

💡 Use a naming convention from the start: svc-, usr-, grp- prefixes. It costs nothing and it makes the labs (and the screenshots you'll take) much easier to read.

If you can't build a tenant

Every post in this series includes a paper version of the lab: a table to complete or a diagram to fill in. You will still get most of the learning value, and you can do it on a phone during a commute.

How to use this series

I recommend two passes:

Pass 1 — understand (4 days). Read one post per day. Do the lab. Don't worry about memorizing product names yet.

Pass 2 — drill (2 days). Redo only the practice questions and the "exam traps" boxes. Anything you get wrong twice goes on an index card.

Then take the official practice assessment linked from the study guide. If you're scoring above 80% consistently, book the exam.

The three mistakes I see most

Memorizing without a mental model. There are dozens of Microsoft product names in this exam. If you learn them as a flat list, you will mix them up. If you learn them as "this one protects devices, this one protects mailboxes, this one protects on-prem AD," you won't.
Ignoring licensing. A surprising number of questions hinge on which tier gives you a feature. Conditional Access is P1. Identity Protection and PIM are P2. That single fact is worth points.
Skipping domain 4. Compliance feels boring next to threat detection, but it's 15–20% of the exam and the content is very memorizable — labels, DLP, retention, eDiscovery. It's the cheapest score in the whole exam.

Series index

Part 0 — this post: how the exam works and how to build the lab
Part 1: Security, compliance and identity concepts (Zero Trust, shared responsibility, CIA, encryption, AuthN vs AuthZ)
Part 2: Microsoft Entra capabilities (tenant objects, authentication methods, Conditional Access, governance)
Part 3: Microsoft security solutions (Defender XDR family, Defender for Cloud, Sentinel, Azure network security)
Part 4: Microsoft compliance solutions (Purview, labels, DLP, retention, insider risk, eDiscovery)
Part 5: Final mock exam — 30 questions with full explanations + glossary

If this series helps you pass, leave a comment with your score. And if you spot something that changed in a newer exam update, tell me and I'll edit the post — that's the whole point of publishing it here instead of a PDF.

I work in IT support and identity administration, and I hold SC-900 and ISC2 CC. Everything here is my own study material; always validate against Microsoft Learn before your exam.

Part 1 — Security, Compliance and Identity Concepts drops in 48 hours: Zero Trust, shared responsibility, encryption vs hashing, and 12 practice questions + A 15-minute self-assessment exercise with full explanations.

Follow me so it shows up in your feed, and bookmark this post — it's the index for all six parts.

Quick one for the comments: in a SaaS model, who owns the responsibility for user identities? 👇

How Cloud Security in Microsoft Azure: Protect your Data and Applications

CyberTTopic — Wed, 27 May 2026 19:28:51 +0000

Introduction

As organizations continue migrating workloads to the cloud, security has become one of the most critical pillars of digital transformation. Cloud computing offers scalability, flexibility, and operational efficiency, but it also introduces new cybersecurity challenges that traditional on-premises environments were not designed to handle.

Microsoft Azure has emerged as one of the leading cloud platforms worldwide, trusted by enterprises, governments, healthcare institutions, and financial organizations. Azure provides a comprehensive ecosystem of security services that help organizations protect sensitive data, secure applications, maintain compliance, and defend against modern cyber threats.

Cloud security in Azure is not simply about enabling a firewall or configuring permissions. It is a shared responsibility model where both Microsoft and the customer play important roles in securing infrastructure, applications, identities, and data.

Understanding the Shared Responsibility Model

One of the most important concepts in cloud security is the Shared Responsibility Model. In traditional data centers, organizations were responsible for every layer of security, including physical infrastructure. In Azure, Microsoft secures the physical cloud infrastructure while customers remain responsible for protecting their data, identities, applications, and configurations.

This model reduces operational burden while allowing organizations to focus more on governance, identity protection, and application security. However, misconfigurations in cloud environments remain one of the leading causes of security incidents. Improper access permissions, exposed storage accounts, weak authentication methods, and insecure APIs can create significant vulnerabilities.

According to Microsoft security reports, identity-related attacks such as password spraying, phishing, and credential theft continue to rise globally. This highlights the importance of implementing Zero Trust principles within cloud environments.

Identity and Access Management in Azure

Identity is considered the new security perimeter in modern cloud computing. Azure relies heavily on Microsoft Entra ID, formerly known as Azure Active Directory, to manage authentication and authorization.

Organizations can enforce security controls such as:

Multi-Factor Authentication (MFA)
Conditional Access Policies
Role-Based Access Control (RBAC)
Privileged Identity Management (PIM)
Passwordless Authentication

These technologies help reduce unauthorized access and insider threats while improving visibility into user activity.

A major advantage of Azure is the integration between identity security and cloud resources. Administrators can enforce policies based on geographic location, device compliance, user risk levels, or application sensitivity.

For example, an employee attempting to access a sensitive financial application from an unmanaged device in another country may automatically be blocked or required to complete additional verification steps.

Zero Trust Security Architecture

Modern cybersecurity strategies increasingly follow the Zero Trust model, which operates under the principle of “Never Trust, Always Verify.”

In Azure environments, Zero Trust focuses on continuously validating users, devices, applications, and network activity before granting access. This significantly reduces the attack surface.

The Zero Trust approach includes several core principles:

Verify identity continuously
Enforce least privilege access
Assume breach scenarios
Monitor user behavior
Segment networks and workloads
Protect data at all stages

This model has become especially important with the growth of remote work, hybrid infrastructures, and cloud-native applications.

Data Protection and Encryption

Protecting sensitive information is one of the most important aspects of cloud security. Azure offers multiple layers of encryption and data protection services to secure information both at rest and in transit.

Azure Key Vault enables organizations to securely store:

Encryption keys
Secrets
Certificates
API credentials

Azure also supports encryption standards such as AES-256 and TLS protocols for secure communications.

Data Loss Prevention (DLP) policies can help organizations prevent unauthorized sharing of confidential information such as customer records, financial data, or intellectual property.

Many industries, including healthcare and banking, must comply with regulations such as:

GDPR
HIPAA
ISO 27001
PCI-DSS

Azure provides built-in compliance capabilities that help organizations align with these frameworks more efficiently.

Network Security in Azure

Network security remains fundamental in protecting cloud resources against external and internal threats.

Azure provides several network protection technologies, including:

Network Security Groups (NSGs)
Azure Firewall
Web Application Firewall (WAF)
Distributed Denial-of-Service (DDoS) Protection
Virtual Networks (VNets)

Web applications are among the most targeted assets in modern environments. Attackers frequently exploit vulnerabilities such as:

SQL Injection
Cross-Site Scripting (XSS)
Remote Code Execution
Credential stuffing

Azure Web Application Firewall helps mitigate these threats by filtering malicious traffic before it reaches applications.

DDoS attacks are also increasing globally. Azure DDoS Protection helps organizations maintain availability and resilience during high-volume attack attempts.

Security Monitoring and Threat Detection

Cloud security requires continuous monitoring and rapid threat detection capabilities. Azure integrates advanced security analytics and artificial intelligence to identify suspicious activity in real time.

Microsoft Defender for Cloud provides:

Security posture management
Vulnerability assessments
Threat detection
Secure score recommendations
Compliance monitoring

Microsoft Sentinel extends visibility further by offering a cloud-native SIEM and SOAR solution capable of analyzing logs across hybrid and multi-cloud environments.

These tools allow security teams to:

Detect anomalies faster
Automate incident response
Investigate threats efficiently
Reduce response time
Improve security operations maturity

Common Cloud Security Threats

Cloud environments face a variety of evolving cyber threats. Some of the most common risks include:

Threat	Description
Misconfigured Storage	Publicly exposed storage accounts or containers
Identity Attacks	Phishing, MFA fatigue, credential theft
Insider Threats	Unauthorized access by internal users
API Vulnerabilities	Insecure integrations and exposed APIs
Ransomware	Encryption or exfiltration of organizational data
Shadow IT	Unapproved cloud applications or services

Organizations that fail to implement proper governance and monitoring strategies often become vulnerable to these attacks.

Azure Security by the Numbers

The growth of cloud adoption has significantly increased investments in cloud security technologies and defensive architectures. Organizations today prioritize identity protection, threat detection, and encryption as fundamental pillars of their cybersecurity strategies.

The chart below highlights some of the most common cloud security priorities among organizations securing Microsoft Azure and hybrid cloud environments.

The data demonstrates that Identity Protection remains the highest priority, largely due to the increasing number of credential-based attacks and phishing campaigns targeting cloud environments. Threat Detection and Data Encryption also rank among the top concerns as organizations attempt to improve visibility, compliance, and resilience against cyber threats.

Cloud security is evolving beyond traditional perimeter defenses. Modern enterprises now focus heavily on Zero Trust security architectures, continuous monitoring, behavioral analytics, and proactive threat intelligence to secure data and applications across distributed environments.

Best Practices for Securing Azure Environments

Implementing strong cloud security requires a proactive and layered approach. Organizations should adopt security best practices that combine technology, governance, monitoring, and employee awareness.

Key best practices include:

Enabling Multi-Factor Authentication across all accounts
Applying the principle of least privilege
Regularly reviewing access permissions
Encrypting sensitive data
Monitoring logs continuously
Automating security updates and patch management
Conducting vulnerability assessments
Implementing backup and disaster recovery strategies
Using security baselines and compliance policies

Security should not be treated as a one-time deployment activity. Instead, it must evolve continuously alongside organizational growth and emerging threats.

The Future of Cloud Security

Cloud security is rapidly evolving due to advancements in artificial intelligence, automation, and increasingly sophisticated cyberattacks.

Future Azure security trends include:

AI-driven threat detection
Automated incident response
Behavioral analytics
Confidential computing
Secure DevSecOps pipelines
Passwordless authentication
Multi-cloud security integration

Organizations adopting these technologies will likely improve resilience and reduce the impact of future cyber threats.

Conclusion

Cloud security in Azure represents far more than protecting servers or applications. It involves securing identities, data, networks, workloads, and operational processes within a constantly evolving threat landscape.

Microsoft Azure provides powerful security capabilities that help organizations implement modern cybersecurity frameworks such as Zero Trust, identity-centric security, and intelligent threat detection. However, technology alone is not enough. Effective cloud security also depends on governance, user awareness, proper configurations, and continuous monitoring.

As cloud adoption continues to accelerate globally, organizations that invest in robust Azure security practices will be better positioned to protect sensitive information, maintain compliance, and build resilient digital infrastructures against future cyber threats.