Lesson 1: Exam Orientation and Core Security Concepts

Before You Start: How This Course and the Exam Work

This course prepares you for Exam SC-900: Microsoft Security, Compliance, and Identity Fundamentals. Read these ground rules first.

• The official syllabus is Microsoft's. The Study guide for Exam SC-900 is free on Microsoft Learn. We follow its skills list, but we do not reproduce it here. Read the original.
• Passing score: Microsoft's study guide says "A score of 700 or greater is required to pass."
• Length, price and languages: check these on Microsoft's SC-900 exam page before you book. Price depends on the country or region where the exam is proctored, and Microsoft can change these details.
• Independence: this course is independent of Microsoft and not endorsed by it. No course can promise a pass.

Task 1: Set up your official resources

1. Search Microsoft Learn for "Study guide for Exam SC-900" and bookmark it. Use the section titled "Skills measured as of October 21, 2026".
2. From the study guide, open "Take a free Practice Assessment". Take it once now to get a baseline score, then again near exam day.
3. Open the Exam sandbox to see what the exam screen and question types look like.
4. On the exam details page, check the duration, the languages offered and the price for your region. If your language isn't offered, the guide says you can request an extra 30 minutes.
5. Write down the four skill areas and their weights:
   • Concepts of security, compliance, and identity: 10–15% (this level and the next)
   • Capabilities of Microsoft Entra: 25–30%
   • Capabilities of Microsoft security solutions: 35–40%
   • Capabilities of Microsoft compliance solutions: 20–25%

Task 2: Learn the Shared Responsibility Model

The shared responsibility model sets out which security tasks belong to the cloud provider (Microsoft) and which belong to you, the customer. The split depends on the type of service.

Examples:

• IaaS (e.g., Azure Virtual Machines): you patch the operating system.
• PaaS (e.g., Azure SQL Database, Azure App Service): Microsoft manages the operating system. You manage your app's configuration and access.
• SaaS (e.g., Microsoft 365): Microsoft runs almost everything.

Rule to memorise: in every model, you always keep responsibility for your data, your endpoints (devices), your accounts and identities, and access management.

Task 3: Learn Defense-in-Depth

Defense-in-depth uses several overlapping layers of security instead of a single perimeter. If an attacker breaks through one layer, the next one stops them. Learn the layers from the outside in:

1. Physical security: locked facilities, guards, badge readers.
2. Identity and access: MFA, role-based access control, Conditional Access.
3. Perimeter: DDoS protection, perimeter firewalls.
4. Network: network segmentation, network security groups (NSGs).
5. Compute: patching, closing unused ports, securing VMs.
6. Application: secure development, input validation.
7. Data: the innermost layer. Access controls, encryption, classification.

These layers protect the CIA triad:

• Confidentiality: only authorised people can see the data.
• Integrity: data stays accurate and unchanged unless changed through an authorised process.
• Availability: authorised users can reach the data and systems when they need them.

Task 4: Learn the Zero Trust Model

Zero Trust is a strategy, not a product. Its core idea is "never trust, always verify": no request is trusted just because it comes from inside the corporate network. It has three guiding principles:

1. Verify explicitly: authenticate and authorise every request using all available signals (identity, location, device health, data classification, anomalies).
2. Use least privileged access: give only the access needed, for only as long as it's needed. Two ways to do this are just-in-time (JIT) and just-enough-access (JEA).
3. Assume breach: plan as if attackers are already inside. Segment access, encrypt end to end, and monitor so you detect attacks quickly.

Microsoft also describes seven pillars: Identities, Devices, Applications, Data, Infrastructure, Networks, and Visibility, automation, and orchestration.

Task 5: Tell Encryption and Hashing Apart

Encryption makes data unreadable without a key. It can be reversed.

• Symmetric: the same key encrypts and decrypts. It is fast. The hard part is sharing the key safely.
• Asymmetric: uses a public/private key pair. Data encrypted with the public key can only be decrypted with the private key. HTTPS uses it.

Encryption applies to three states of data:

• At rest: stored data, such as disks and databases.
• In transit: data moving across a network, such as HTTPS/TLS traffic or a VPN.
• In use: data being processed in memory, protected by confidential computing.

Hashing turns any input into a fixed-length value. It is one-way and uses no key, and the same input always gives the same hash. Systems use it to store passwords. Salting adds a unique random value to each password before hashing, which defeats rainbow-table attacks.

Task 6: Break Down GRC

• Governance: the rules, practices and processes an organisation uses to direct and control its activities. Example: who approves admin access.
• Risk management: identify, assess, respond to (accept, mitigate, transfer or avoid) and monitor threats.
• Compliance: following the laws, regulations and standards that apply (e.g., HIPAA, ISO 27001, SOC 2). Compliance is not the same as security.

Related terms:

• Data residency: rules about where data can physically be stored and how it can be moved.
• Data sovereignty: data is subject to the laws of the country or region where it is collected, held or processed.
• Data privacy: handling personal data properly, including transparency, consent and individuals' rights.

What the Exam Asks About This

• Scenario questions about who is responsible for a task in IaaS, PaaS or SaaS, often worded as "which responsibility is always retained by the customer?"
• Matching a control to its defense-in-depth layer or to a Zero Trust principle.
• Telling symmetric encryption, asymmetric encryption and hashing apart.
• Choosing between governance, risk and compliance, and between data residency, sovereignty and privacy.

Key Takeaways

• The free study guide on Microsoft Learn is the syllabus, and you need 700 or more to pass. Check length, price and languages on Microsoft's exam page.
• Customers always own their data, devices, accounts/identities and access management. Microsoft takes on more of the stack as you move from IaaS to PaaS to SaaS.
• Defense-in-depth means layers, with data at the centre. Zero Trust means verify explicitly, use least privileged access and assume breach.
• Encryption can be reversed with a key. Hashing is one-way and keyless. Salting strengthens password hashes.
• Governance sets the rules, risk management handles threats, and compliance meets external obligations.