DEV Community: CyberTTopic

SC-900 Part 1: Security, Compliance and Identity Concepts (with labs and 12 practice questions)

CyberTTopic — Thu, 03 Sep 2026 14:53:15 +0000

Domain 1 is only 10–15% of the exam, but it is the vocabulary that the other 85% is written in. If you're fuzzy on "authentication vs authorization" or "who owns the OS in PaaS," you will lose points in domains 2 and 3 without realizing why.

This post covers it in four blocks, then gives you a lab and 12 questions.

This series follows the SC-900 objectives updated on July 28, 2026. Check the official study guide before your exam.

1. The shared responsibility model

The single most tested concept in this domain. Move to the cloud and Microsoft takes over some of the work — but not all of it, and how much depends on the service model.

Read the diagram top-down and one rule jumps out:

Data, devices, and accounts & identities are always yours. In every model. On-premises, IaaS, PaaS or SaaS.

That is the answer to a whole family of exam questions phrased like "Your company moves to SaaS. Who is responsible for protecting user identities?"

The rest shifts:

On-premises: you own everything, down to the building.
IaaS (virtual machines): Microsoft owns the physical layer; you still own the OS, patching, apps and network controls.
PaaS (App Service, Azure SQL): Microsoft owns the OS and runtime; you own your app, your data and your identities.
SaaS (Microsoft 365): Microsoft owns nearly the whole stack; you own data, devices, identities and how you configure it.

2. Zero Trust

Zero Trust replaced the old "castle and moat" idea, where anything inside the corporate network was trusted. That model broke the moment people started working from home on their own devices.

Three guiding principles:

Verify explicitly — authenticate and authorize using every available signal: identity, location, device health, service, data classification, anomalies.
Use least privilege access — just-enough-access (JEA), just-in-time (JIT), risk-based adaptive policies.
Assume breach — segment access, encrypt end to end, use analytics to detect and improve defenses.

Six pillars to protect: identities, endpoints, applications, data, infrastructure, networks.

A phrase worth memorizing: "Zero Trust doesn't mean trusting no one; it means never trusting implicitly, and verifying every time."

3. Defense in depth and the CIA triad

Defense in depth = layers, so that a failure in one control doesn't reach the data. Classic layer stack from outside in: physical → identity and access → perimeter → network → compute → application → data.

The CIA triad is what every control ultimately serves:

Property	Question it answers	Example control
Confidentiality	Can only authorized people read it?	Encryption, access control
Integrity	Is the data unaltered and trustworthy?	Hashing, digital signatures
Availability	Can authorized people reach it when needed?	Redundancy, backups, DDoS protection

Also know the common threat vocabulary the exam uses: phishing, ransomware, data breach, dictionary/brute-force attack, password spray (one password against many accounts, which is why lockout policies alone don't catch it), and supply chain attack.

4. Cryptography basics: encryption, hashing, signing

The exam does not ask you to implement anything, but it does ask you to pick the right one.

Technique	Reversible?	Keys	Used for
Symmetric encryption	Yes	One shared key for encrypt and decrypt	Bulk data, fast
Asymmetric encryption	Yes	Key pair: public + private	Key exchange, certificates, signatures
Hashing	No	None	Storing passwords, verifying integrity
Digital signature	n/a	Signed with private key, verified with public	Proving origin and integrity (non-repudiation)

Two traps:

Hashing is not encryption. There is no "unhash." Same input always gives the same hash; that's why passwords are stored hashed (and salted).
You encrypt with the recipient's public key; you sign with your own private key. Reversing those two is the most common mistake.

Also know data states: data at rest (in storage), data in transit (moving over a network), data in use (loaded in memory). Different states need different protections.

5. Authentication vs authorization

Authentication (AuthN) proves who you are.
Authorization (AuthZ) decides what you're allowed to do.

AuthN always happens first. Single sign-on (SSO) means you authenticate once and access many applications — it is an authentication benefit, not an authorization one.

Identity vocabulary to have ready:

Identity provider (IdP): the service that verifies identity and issues tokens (Microsoft Entra ID is one).
Federation: a trust relationship that lets an IdP in one organization vouch for a user accessing another organization's resources.
Identity as the security perimeter: the modern replacement for the network perimeter — the "four pillars" being administration, authentication, authorization and auditing.

⚠️ Exam traps in this domain

"Who is responsible for the operating system in IaaS?" → The customer. Microsoft only owns the physical layer and hypervisor.
Hashing vs encryption → if the question says "must be verified but never recovered," it's hashing.
SSO is an authentication convenience; it does not grant permissions.
Zero Trust is not a product. You cannot buy it. It's a strategy implemented with many products.
Federation vs SSO → federation is the trust between organizations; SSO is the user experience.

🎯 Now practise it: 12 questions + both labs

Reading about Zero Trust and answering an exam question about Zero Trust are two different skills, and only one of them is graded on exam day.

So the practice for this domain lives in an interactive page instead of a list you can scroll past:

👉 Take the Part 1 quiz and labs

What you get:

12 exam-style questions. Pick an answer and you immediately see why it's right — and why each of the other three is wrong. That reasoning is the actual skill: the exam is won by elimination, not by recognition.
Options shuffled on every attempt, so retaking it tests the concept instead of the position you memorized.
Lab 1 — shared responsibility. Fill the table from memory. It grades every cell and gives you the corrections.
Lab 2 — map your own laptop to Zero Trust. Six pillars, and it tells you which ones you left blank. Those blanks are your real gap list.

Free, no sign-up, works on your phone. It's a single static page — nothing is collected.

Then come back and comment your score out of 12, and which question caught you. I use those comments to improve the series.

What's next

Part 2 covers Microsoft Entra — 25–30% of the exam, and the domain where a single licensing detail (P1 vs P2) decides several questions. We'll build users, groups and a Conditional Access policy in the free lab.

If you found an error or something changed in a newer exam update, drop a comment — I keep these posts edited.

SC-900 in 2026: The Complete Study Series (4 Domains, Free Labs, 60+ Practice Questions)

CyberTTopic — Tue, 01 Sep 2026 01:49:38 +0000

I passed the SC-900: Microsoft Security, Compliance, and Identity Fundamentals exam, and while studying I noticed something: almost every free guide out there is the same list of definitions copied from the learning path. Very few of them let you do anything.

So I wrote the series I wish I had found — five posts that cover the four exam domains, each one with:

Diagrams instead of walls of text
Hands-on labs you can complete in 10–20 minutes in a free tenant
10–12 practice questions per domain with the reasoning behind each answer, not just the letter
An "exam trap" section with the confusions that actually cost people points

⚠️ Read this before you start. Microsoft updated the SC-900 skills measured on July 28, 2026. Always open the official study guide and check the "Skills measured as of" date before your exam. This series follows the current four-domain structure, but Microsoft renames products often (Azure AD → Microsoft Entra ID, Azure AD B2C → Microsoft Entra External ID, and so on).

What SC-900 actually is

It's a fundamentals certification. There is no lab in the exam, no PowerShell, no configuration. What it measures is whether you can look at a business problem and say "that's a job for Conditional Access" or "that's a Purview retention policy."

Typical exam facts:

Item	Detail
Level	Fundamentals (entry level)
Questions	Around 40–60, multiple choice and multi-select
Passing score	700 out of 1000
Prerequisites	None
Good for	Support, helpdesk, sales, compliance, and anyone entering cloud security

Always confirm duration and pricing on the official exam page, since those change by region.

The four domains and their weight

#	Domain	Weight	Post
1	Security, compliance and identity concepts	10–15%	Part 1
2	Capabilities of Microsoft Entra	25–30%	Part 2
3	Capabilities of Microsoft security solutions	35–40%	Part 3
4	Capabilities of Microsoft compliance solutions	15–20%	Part 4

Two thirds of the exam is domains 2 and 3. If you are short on time, that is where you spend it. Domain 1 is short but it is the vocabulary everything else is built on — skipping it makes the other three harder, not faster.

Build your free lab (what still works in 2026)

Here is the part most guides get wrong. A lot of them still tell you to join the Microsoft 365 Developer Program and get an instant sandbox. That program no longer accepts personal accounts: it now requires a qualifying subscription such as Visual Studio Enterprise/Professional, or partner/support program membership. If you don't qualify, you need another path.

The path that works

Create an Azure free account with a personal email. Creating a directory costs nothing; you only pay for resources you deploy, and you get starting credit.
Create a new Microsoft Entra tenant. Azure portal → Microsoft Entra ID → Manage tenants → Create. This gives you the Entra ID Free tier: users, groups, security defaults, basic reports.
Start the Entra ID P2 trial (30 days) only when you're ready to touch Conditional Access, Identity Protection and PIM. Starting it on day one wastes half of it.
Start a Microsoft 365 E5 trial (30 days) when you reach domains 3 and 4 — that's what unlocks the Defender and Purview portals.
Set a calendar reminder for day 25 of each trial so nothing surprises you.

💡 Use a naming convention from the start: svc-, usr-, grp- prefixes. It costs nothing and it makes the labs (and the screenshots you'll take) much easier to read.

If you can't build a tenant

Every post in this series includes a paper version of the lab: a table to complete or a diagram to fill in. You will still get most of the learning value, and you can do it on a phone during a commute.

How to use this series

I recommend two passes:

Pass 1 — understand (4 days). Read one post per day. Do the lab. Don't worry about memorizing product names yet.

Pass 2 — drill (2 days). Redo only the practice questions and the "exam traps" boxes. Anything you get wrong twice goes on an index card.

Then take the official practice assessment linked from the study guide. If you're scoring above 80% consistently, book the exam.

The three mistakes I see most

Memorizing without a mental model. There are dozens of Microsoft product names in this exam. If you learn them as a flat list, you will mix them up. If you learn them as "this one protects devices, this one protects mailboxes, this one protects on-prem AD," you won't.
Ignoring licensing. A surprising number of questions hinge on which tier gives you a feature. Conditional Access is P1. Identity Protection and PIM are P2. That single fact is worth points.
Skipping domain 4. Compliance feels boring next to threat detection, but it's 15–20% of the exam and the content is very memorizable — labels, DLP, retention, eDiscovery. It's the cheapest score in the whole exam.

Series index

Part 0 — this post: how the exam works and how to build the lab
Part 1: Security, compliance and identity concepts (Zero Trust, shared responsibility, CIA, encryption, AuthN vs AuthZ)
Part 2: Microsoft Entra capabilities (tenant objects, authentication methods, Conditional Access, governance)
Part 3: Microsoft security solutions (Defender XDR family, Defender for Cloud, Sentinel, Azure network security)
Part 4: Microsoft compliance solutions (Purview, labels, DLP, retention, insider risk, eDiscovery)
Part 5: Final mock exam — 30 questions with full explanations + glossary

If this series helps you pass, leave a comment with your score. And if you spot something that changed in a newer exam update, tell me and I'll edit the post — that's the whole point of publishing it here instead of a PDF.

I work in IT support and identity administration, and I hold SC-900 and ISC2 CC. Everything here is my own study material; always validate against Microsoft Learn before your exam.

Part 1 — Security, Compliance and Identity Concepts drops in 48 hours: Zero Trust, shared responsibility, encryption vs hashing, and 12 practice questions + A 15-minute self-assessment exercise with full explanations.

Follow me so it shows up in your feed, and bookmark this post — it's the index for all six parts.

Quick one for the comments: in a SaaS model, who owns the responsibility for user identities? 👇

How Cloud Security in Microsoft Azure: Protect your Data and Applications

CyberTTopic — Wed, 27 May 2026 19:28:51 +0000

Introduction

As organizations continue migrating workloads to the cloud, security has become one of the most critical pillars of digital transformation. Cloud computing offers scalability, flexibility, and operational efficiency, but it also introduces new cybersecurity challenges that traditional on-premises environments were not designed to handle.

Microsoft Azure has emerged as one of the leading cloud platforms worldwide, trusted by enterprises, governments, healthcare institutions, and financial organizations. Azure provides a comprehensive ecosystem of security services that help organizations protect sensitive data, secure applications, maintain compliance, and defend against modern cyber threats.

Cloud security in Azure is not simply about enabling a firewall or configuring permissions. It is a shared responsibility model where both Microsoft and the customer play important roles in securing infrastructure, applications, identities, and data.

Understanding the Shared Responsibility Model

One of the most important concepts in cloud security is the Shared Responsibility Model. In traditional data centers, organizations were responsible for every layer of security, including physical infrastructure. In Azure, Microsoft secures the physical cloud infrastructure while customers remain responsible for protecting their data, identities, applications, and configurations.

This model reduces operational burden while allowing organizations to focus more on governance, identity protection, and application security. However, misconfigurations in cloud environments remain one of the leading causes of security incidents. Improper access permissions, exposed storage accounts, weak authentication methods, and insecure APIs can create significant vulnerabilities.

According to Microsoft security reports, identity-related attacks such as password spraying, phishing, and credential theft continue to rise globally. This highlights the importance of implementing Zero Trust principles within cloud environments.

Identity and Access Management in Azure

Identity is considered the new security perimeter in modern cloud computing. Azure relies heavily on Microsoft Entra ID, formerly known as Azure Active Directory, to manage authentication and authorization.

Organizations can enforce security controls such as:

Multi-Factor Authentication (MFA)
Conditional Access Policies
Role-Based Access Control (RBAC)
Privileged Identity Management (PIM)
Passwordless Authentication

These technologies help reduce unauthorized access and insider threats while improving visibility into user activity.

A major advantage of Azure is the integration between identity security and cloud resources. Administrators can enforce policies based on geographic location, device compliance, user risk levels, or application sensitivity.

For example, an employee attempting to access a sensitive financial application from an unmanaged device in another country may automatically be blocked or required to complete additional verification steps.

Zero Trust Security Architecture

Modern cybersecurity strategies increasingly follow the Zero Trust model, which operates under the principle of “Never Trust, Always Verify.”

In Azure environments, Zero Trust focuses on continuously validating users, devices, applications, and network activity before granting access. This significantly reduces the attack surface.

The Zero Trust approach includes several core principles:

Verify identity continuously
Enforce least privilege access
Assume breach scenarios
Monitor user behavior
Segment networks and workloads
Protect data at all stages

This model has become especially important with the growth of remote work, hybrid infrastructures, and cloud-native applications.

Data Protection and Encryption

Protecting sensitive information is one of the most important aspects of cloud security. Azure offers multiple layers of encryption and data protection services to secure information both at rest and in transit.

Azure Key Vault enables organizations to securely store:

Encryption keys
Secrets
Certificates
API credentials

Azure also supports encryption standards such as AES-256 and TLS protocols for secure communications.

Data Loss Prevention (DLP) policies can help organizations prevent unauthorized sharing of confidential information such as customer records, financial data, or intellectual property.

Many industries, including healthcare and banking, must comply with regulations such as:

GDPR
HIPAA
ISO 27001
PCI-DSS

Azure provides built-in compliance capabilities that help organizations align with these frameworks more efficiently.

Network Security in Azure

Network security remains fundamental in protecting cloud resources against external and internal threats.

Azure provides several network protection technologies, including:

Network Security Groups (NSGs)
Azure Firewall
Web Application Firewall (WAF)
Distributed Denial-of-Service (DDoS) Protection
Virtual Networks (VNets)

Web applications are among the most targeted assets in modern environments. Attackers frequently exploit vulnerabilities such as:

SQL Injection
Cross-Site Scripting (XSS)
Remote Code Execution
Credential stuffing

Azure Web Application Firewall helps mitigate these threats by filtering malicious traffic before it reaches applications.

DDoS attacks are also increasing globally. Azure DDoS Protection helps organizations maintain availability and resilience during high-volume attack attempts.

Security Monitoring and Threat Detection

Cloud security requires continuous monitoring and rapid threat detection capabilities. Azure integrates advanced security analytics and artificial intelligence to identify suspicious activity in real time.

Microsoft Defender for Cloud provides:

Security posture management
Vulnerability assessments
Threat detection
Secure score recommendations
Compliance monitoring

Microsoft Sentinel extends visibility further by offering a cloud-native SIEM and SOAR solution capable of analyzing logs across hybrid and multi-cloud environments.

These tools allow security teams to:

Detect anomalies faster
Automate incident response
Investigate threats efficiently
Reduce response time
Improve security operations maturity

Common Cloud Security Threats

Cloud environments face a variety of evolving cyber threats. Some of the most common risks include:

Threat	Description
Misconfigured Storage	Publicly exposed storage accounts or containers
Identity Attacks	Phishing, MFA fatigue, credential theft
Insider Threats	Unauthorized access by internal users
API Vulnerabilities	Insecure integrations and exposed APIs
Ransomware	Encryption or exfiltration of organizational data
Shadow IT	Unapproved cloud applications or services

Organizations that fail to implement proper governance and monitoring strategies often become vulnerable to these attacks.

Azure Security by the Numbers

The growth of cloud adoption has significantly increased investments in cloud security technologies and defensive architectures. Organizations today prioritize identity protection, threat detection, and encryption as fundamental pillars of their cybersecurity strategies.

The chart below highlights some of the most common cloud security priorities among organizations securing Microsoft Azure and hybrid cloud environments.

The data demonstrates that Identity Protection remains the highest priority, largely due to the increasing number of credential-based attacks and phishing campaigns targeting cloud environments. Threat Detection and Data Encryption also rank among the top concerns as organizations attempt to improve visibility, compliance, and resilience against cyber threats.

Cloud security is evolving beyond traditional perimeter defenses. Modern enterprises now focus heavily on Zero Trust security architectures, continuous monitoring, behavioral analytics, and proactive threat intelligence to secure data and applications across distributed environments.

Best Practices for Securing Azure Environments

Implementing strong cloud security requires a proactive and layered approach. Organizations should adopt security best practices that combine technology, governance, monitoring, and employee awareness.

Key best practices include:

Enabling Multi-Factor Authentication across all accounts
Applying the principle of least privilege
Regularly reviewing access permissions
Encrypting sensitive data
Monitoring logs continuously
Automating security updates and patch management
Conducting vulnerability assessments
Implementing backup and disaster recovery strategies
Using security baselines and compliance policies

Security should not be treated as a one-time deployment activity. Instead, it must evolve continuously alongside organizational growth and emerging threats.

The Future of Cloud Security

Cloud security is rapidly evolving due to advancements in artificial intelligence, automation, and increasingly sophisticated cyberattacks.

Future Azure security trends include:

AI-driven threat detection
Automated incident response
Behavioral analytics
Confidential computing
Secure DevSecOps pipelines
Passwordless authentication
Multi-cloud security integration

Organizations adopting these technologies will likely improve resilience and reduce the impact of future cyber threats.

Conclusion

Cloud security in Azure represents far more than protecting servers or applications. It involves securing identities, data, networks, workloads, and operational processes within a constantly evolving threat landscape.

Microsoft Azure provides powerful security capabilities that help organizations implement modern cybersecurity frameworks such as Zero Trust, identity-centric security, and intelligent threat detection. However, technology alone is not enough. Effective cloud security also depends on governance, user awareness, proper configurations, and continuous monitoring.

As cloud adoption continues to accelerate globally, organizations that invest in robust Azure security practices will be better positioned to protect sensitive information, maintain compliance, and build resilient digital infrastructures against future cyber threats.