Cheat sheet
Microsoft SC-900 Cheat Sheet
SCI Concepts
- 10-15% of exam
- Shared Responsibility Zero Trust GRC AuthN vs AuthZ Encryption
Microsoft Entra
- 25-30% of exam
- Entra ID Authentication Access Management Identity Governance Identity Picker
Microsoft Security
- 35-40% of exam
- Azure Security Defender for Cloud Sentinel Defender XDR Security Picker
Microsoft Compliance
- 20-25% of exam
- Service Trust Purview Priva DLP Compliance Picker
Quick Facts
- Exam SC-900
- Credential SCI Fundamentals
- Time 45 min
- Pass 700/1000
- Level Beginner
- Provider Pearson VUE
- Blueprint Nov 7 2025
- Skill Match capability
Zero Trust CO
- Verify, least privilege, assume breach
- Verify explicitly Least privilege Assume breach
AuthN vs AuthZ CO
AuthN
- Proves identity
- Before access
- Passwords MFA certs
AuthZ
- Grants actions
- After authentication
- Roles permissions scopes
- Who vs what
Security Concepts CO
- Shared responsibility Provider plus customer
- Defense in depth Layered controls
- Zero Trust Never trust automatically
- Least privilege Minimum required access
- Assume breach Limit blast radius
- GRC Govern risk comply
- CIA Confidentiality integrity availability
- Perimeter Identity now central
Hashing vs Encryption CO
Hashing
- One-way
- Fixed digest
- Integrity proof
Encryption
- Reversible
- Key required
- Confidentiality protection
- Verify vs hide
Crypto + Identity CO
- Encryption Reversible with key
- Hashing One-way digest
- At rest Stored data
- In transit Moving data
- In use Processing data
- Authentication Proves identity
- Authorization Grants actions
- Federation Trusted identity provider
Entra Flow EN
- Identity -> AuthN -> CA -> AuthZ
- Identity: who AuthN: prove CA: decide AuthZ: allow
Entra Roles vs RBAC EN
Entra roles
- Directory actions
- Users groups apps
- Tenant scope
Azure RBAC
- Resource actions
- Subscriptions resources
- Azure scope
- Directory vs resources
Identity Picker EN
- Need cloud identity → Entra ID
- Require extra proof → MFA
- Forget passwords → SSPR
- Context-based access → Conditional Access
- Temporary admin → PIM
- Review access → Access reviews
- Detect identity risk → ID Protection
- Package access → Entitlement management
Entra Basics EN
- Entra ID Cloud identity
- Tenant Dedicated directory
- User Human identity
- Group Identity collection
- Device Managed endpoint
- Service principal App identity
- Managed identity Azure resource identity
- Hybrid identity Cloud plus on-prem
Conditional Access vs PIM EN
Conditional Access
- Access conditions
- Signals decisions
- Grant block require
PIM
- Privileged roles
- Just-in-time
- Approval activation
- Access gate vs admin elevation
Authentication EN
- MFA Extra verification
- Passwordless No password login
- FIDO2 Security key
- Authenticator Phone approval
- SSPR User password reset
- Password Protection Block weak passwords
- Smart lockout Brute-force defense
- SSO One sign-in
Access + Governance EN
- Conditional Access Signal-based policy
- Entra roles Directory permissions
- Azure RBAC Resource permissions
- PIM Just-in-time admin
- Access reviews Periodic access checks
- Entitlement management Access packages
- ID Protection Risk detection
- Lifecycle workflows Joiner mover leaver
Defender Map SE
- Cloud, endpoint, email, apps, identity
- Cloud: posture Endpoint: devices O365: email Apps: SaaS
Defender Cloud vs Sentinel SE
Defender Cloud
- Cloud posture
- Workload protection
- Recommendations
Sentinel
- SIEM SOAR
- Cross-source detection
- Playbooks
- Posture vs operations
Security Picker SE
- Cloud posture → Defender for Cloud
- Security score → Defender for Cloud
- SIEM needed → Sentinel
- Automate response → Sentinel playbooks
- Endpoint threats → Defender Endpoint
- Email attacks → Defender Office 365
- SaaS discovery → Defender Cloud Apps
- Legacy AD attacks → Defender Identity
Azure Security SE
- DDoS Protection Volumetric attack defense
- Azure Firewall Network filtering
- WAF Web app protection
- VNet Network segmentation
- NSG Subnet NIC rules
- Bastion Private VM access
- Key Vault Secrets keys certs
- Private Link Private service access
Firewall vs WAF SE
Azure Firewall
- Network traffic
- Layer 3-7
- Central filtering
WAF
- HTTP apps
- OWASP defense
- Web exploits
- Network vs web
Defender for Cloud SE
- Defender for Cloud Cloud security management
- CSPM Posture management
- CWPP Workload protection
- Secure score Posture metric
- Recommendations Hardening actions
- Security policy Govern standards
- Regulatory compliance Framework mapping
- Workload alerts Threat notifications
Microsoft Sentinel SE
- Sentinel Cloud SIEM SOAR
- SIEM Collect correlate detect
- SOAR Automate response
- Connectors Data ingestion
- Analytics rules Detect threats
- Incidents Grouped alerts
- Workbooks Visual investigation
- Playbooks Automated actions
Defender XDR SE
- Defender XDR Unified detection response
- Defender portal Security operations hub
- Endpoint Device protection
- Office 365 Email collaboration protection
- Cloud Apps SaaS app protection
- Identity AD signal protection
- Vulnerability Mgmt Exposure discovery
- Microsoft Threat Intelligence Threat intelligence
Purview Map CO
- Classify, protect, retain, investigate
- Labels classify DLP protects Retention keeps eDiscovery investigates
DLP vs Retention CO
DLP
- Prevent sharing
- Sensitive data
- Policy tips
Retention
- Keep delete
- Lifecycle rules
- Records support
- Leakage vs lifecycle
Compliance Picker CO
- Need audit reports → Service Trust
- Track compliance tasks → Compliance Manager
- Classify documents → Sensitivity labels
- Stop leakage → DLP
- Keep content → Retention policy
- Declare records → Records management
- Legal investigation → eDiscovery
- Privacy requests → Priva
Trust + Privacy CO
- Service Trust Audit compliance reports
- Compliance offerings Certifications attestations
- Trust documents Independent audit evidence
- Privacy principles Control and transparency
- Priva Privacy risk management
- Subject rights Data request handling
- Data minimization Reduce personal data
- Privacy assessment Risk discovery
Content vs Activity Explorer CO
Content explorer
- Inspect items
- Sensitive content
- Label visibility
Activity explorer
- Inspect actions
- User activity
- Label events
- Data vs behavior
Purview Governance CO
- Purview portal Compliance management hub
- Compliance Manager Assessment workflow
- Compliance score Improvement measure
- Data classification Find sensitive data
- Content explorer Inspect labeled data
- Activity explorer Inspect user activity
- Data map Govern data estate
- Catalog Discover data assets
Purview Protection CO
- Sensitivity labels Classify and protect
- Label policies Publish labels
- DLP Prevent data leakage
- Retention policies Keep or delete
- Retention labels Item-level retention
- Records management Declare records
- Insider risk Risky user detection
- eDiscovery Legal evidence search
- Audit Activity log review
Common Traps
Identity vs permission
- Entra signs in ≠ RBAC grants actions
Hash vs encrypt
- Hash cannot reverse ≠ Encryption can reverse
Role scope trap
- Entra controls directory ≠ RBAC controls resources
Posture vs SIEM
- Defender Cloud hardens ≠ Sentinel detects broadly
WAF vs firewall
- WAF protects HTTP ≠ Firewall filters network
DLP vs labels
- Labels classify content ≠ DLP blocks movement
Retention vs records
- Retention keeps deletes ≠ Records declare items
Trust vs compliance
- Service Trust shows reports ≠ Compliance Manager tracks tasks
Last Minute
- 1. Weights: 10-15 / 25-30 / 35-40 / 20-25
- 2. AuthN proves; AuthZ permits
- 3. Zero Trust: verify least assume
- 4. Hash = one-way digest
- 5. Encryption = reversible with key
- 6. Entra ID = cloud identity
- 7. CA = signal-based access
- 8. PIM = temporary privileged roles
- 9. Defender Cloud = posture
- 10. Sentinel = SIEM plus SOAR
- 11. Purview = compliance governance
- 12. Priva = privacy risk
Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-900)
- Practice Questions 100 questions Study Guide 74 topics Cheat Sheet 97 facts Flashcards 50 cards Shorts 1 short Videos 2 videos Blogs 2 blogs Free CE Podcast