SC-900: SCI Fundamentals Ninjas Guide
Did you start to prepare for the new Microsoft Security exams? Don’t know where to start? This blog post will guide you on starting and succeeding with the new SC-900 exam with many tips and useful links. This post will focus on SC-900 Microsoft SCI Fundamentals Ninjas Guide.
Microsoft launched a new portfolio of security certifications! The four exams that were released focus across Microsoft Azure and Microsoft 365 around security, identity, and compliance. Each exam is aimed at different roles within the organization, from the fundamentals aspect to folks who implement technical solutions.
Introduction
Exam SC-900: Microsoft Security, Compliance, and Identity Fundamentals certification are targeted to those looking to familiarize themselves with the fundamentals of security, compliance, and identity (SCI) across cloud-based and related Microsoft services.
This broad audience may include business stakeholders, new or existing IT professionals, or students interested in Microsoft security, compliance, and identity solutions.
Candidates should be familiar with Microsoft Azure and Microsoft 365 and understand how Microsoft security, compliance, and identity solutions can span these solution areas to provide a holistic and end-to-end solution.
This exam measures your ability to describe the following: concepts of security, compliance, and identity; capabilities of Microsoft identity and access management solutions; capabilities of Microsoft security solutions; and Microsoft compliance solutions.
Like other essential cloud exams, such as the AZ-900 or MS-900, the SC 900 is a crucial exam that focuses on various topics. The exam is not particularly difficult and touches on many identities, compliance, information protection, and more.
What is the SC-900 Exam? Microsoft SC-900 certification exam designed for individuals to understand the concepts of security, compliance, and identity (SCI) across cloud-based and other related Microsoft services.
What is the preferred knowledge required for the SC-900 Exam? First, individuals must have familiarity with Microsoft Azure and Microsoft 365. Second, they must have the ability to understand how Microsoft security, compliance, and identity solutions can range across these solution areas for providing end-to-end solutions.
How many questions are there on SC-900 Exam? The SC-900 exam includes between 40 to 60 questions.
How to prepare for the Microsoft exam? the best way is to practice the skills for the exam. Get hands-on experience with the concepts to successfully pass Microsoft SC-900 Certification exams. To start preparing, review the Skills measured section of the Exam Details page and evaluate your skills against what is assessed on the exam.
Domains and Skills Measured
NOTE: The bullets that appear below each skill measured illustrate how we assess that skill. This list is not definitive or exhaustive.
NOTE: Most questions cover features that are General Availability (GA). The exam may contain questions on Preview features if those features are commonly used.
Describe the concepts of security, compliance, and identity (5-10%)
Describe the capabilities of Microsoft identity and access management solutions (25-30%)
Describe the capabilities of Microsoft security solutions (30-35%)
Describe the capabilities of Microsoft compliance solutions (25-30%)
Describe the Concepts of Security, Compliance, and Identity (5-10%)
Describe security methodologies
- Describe the Zero-Trust methodology
- Describe the shared responsibility model
- Define defense in depth
Describe security concepts
Describe Microsoft Security and compliance principles
Describe the capabilities of Microsoft Identity and Access Management Solutions (25-30%)
Define identity principles/concepts
- Define identity as the primary security perimeter
- Define authentication
- Define authorization
- Describe what identity providers are
- Describe what Active Directory is
- Describe the concept of Federated services
- Define common Identity Attacks
Describe the essential identity services and identity types of Azure AD
- Describe what Azure Active Directory is
- Describe Azure AD identities (users, devices, groups, service principals/applications)
- Describe what hybrid identity is
- Describe the different external identity types (Guest Users)
Describe the authentication capabilities of Azure AD
- Describe the various authentication methods
- Describe self-service password reset
- Describe password protection and management capabilities
- Describe Multi-factor Authentication
- Describe Windows Hello for Business
Describe access management capabilities of Azure AD
- Describe what conditional access is
- Describe uses and benefits of conditional access
- Describe the services of Azure AD roles
Describe the identity protection & governance capabilities of Azure AD
- Describe what identity governance is
- Describe what entitlement management and access reviews is
- Describe the capabilities of PIM
- Describe Azure AD Identity Protection
Describe the capabilities of Microsoft Security Solutions (30-35%)
Describe basic security capabilities in Azure
- Describe Azure Network Security groups
- Describe Azure DDoS protection
- Describe what Azure Firewall is
- Describe what Azure Bastion is
- Describe what Web Application Firewall is
- Describe ways Azure encrypts data
Describe security management capabilities of Azure
- Describe the Azure Security center
- Describe Azure Secure score
- Describe the benefit and use cases of Azure Defender – previously, the CWPP
- Describe cloud security posture management (CSPM)
- Describe security baselines for Azure
Describe security capabilities of Azure Sentinel
- Define the concepts of SIEM, SOAR, XDR
- Describe the role and value of Azure Sentinel to provide integrated threat protection
Describe threat protection with Microsoft 365 Defender (formerly Microsoft Threat
Protection)
- Describe Microsoft 365 Defender services
- Describe Microsoft Defender for Identity (formerly Azure ATP)
- Describe Microsoft Defender for Office 365 (formerly Office 365 ATP)
- Describe Microsoft Defender for Endpoint (formerly Microsoft Defender ATP)
- Describe Microsoft Cloud App Security
Describe security management capabilities of Microsoft 365
- Describe the Microsoft 365 Security Center
- Describe how to use Microsoft Secure Score
- Describe security reports and dashboards
- Describe incidents and incident management capabilities
Describe endpoint security with Microsoft Intune
- Describe what Intune is
- Describe endpoint security with Intune
- Describe the endpoint security with the Microsoft Endpoint Manager admin center
Describe the Capabilities of Microsoft Compliance Solutions (25-30%)
Describe the compliance management capabilities in Microsoft
- Describe the compliance center
- Describe compliance manager
- Describe use and benefits of compliance score
Describe information protection and governance capabilities of Microsoft 365
- Describe data classification capabilities
- Describe the value of content and activity explorer
- Describe sensitivity labels
- Describe Retention Policies and Retention Labels
- Describe Records Management
- Describe Data Loss Prevention
Describe insider risk capabilities in Microsoft 365
- Describe an Insider risk management solution
- Describe communication compliance
- Describe information barriers
- Describe privileged access management
- Describe customer lockbox
Describe the eDiscovery capabilities of Microsoft 365
- Describe the purpose of eDiscovery
- Describe the capabilities of the content search tool
- Describe the core eDiscovery workflow
- Describe the advanced eDisovery workflow
Describe the audit capabilities in Microsoft 365
Describe resource governance capabilities in Azure
- Describe the use of Azure Resource locks
- Describe what Azure Blueprints is
- Define Azure Policy and describe its use cases
- Describe cloud adoption framework
Audience
This certification is targeted to those looking to familiarize themselves with the fundamentals of security, compliance, and identity (SCI) across cloud-based and related Microsoft services. This broad audience may include business stakeholders, new or existing IT professionals, or students interested in Microsoft security, compliance, and identity solutions.
Candidates should be familiar with Microsoft Azure and Microsoft 365 and understand how Microsoft security, compliance, and identity solutions can span these solution areas to provide a holistic and end-to-end solution.
Materials
Because the SC-900: Microsoft Security, Compliance, and Identity Fundamentals are still new exams, there is still not a piece of high information compared to other AZ or MS exams. But, the existing ones can provide the relevant information to success.
Microsoft Learn Modules
The Microsoft Learn modules provide a rich platform to learn and study many topics and an excellent way to become certified. The Learning paths to gain the skills needed to become SC-900 certified.
SC-900 Part 1: Describe the concepts of security, compliance, and identity
Learn about core concepts, principles, and methodologies foundational to security, compliance, and identity solutions, including Zero-Trust, shared responsibility, privacy principles, and more. Also, learn about threats and how to protect against them.
The Module: SC-900 part 1: Describe the concepts of security, compliance, and identity – Learn | Microsoft Docs
SC-900 Part 2: Describe the capabilities of Microsoft Identity and access management solutions
Azure Active Directory is the tool for identity and access management in the Microsoft Cloud. Learn about Azure AD services and identity principles, secure authentication, access management capabilities, as well as identity protection and governance.
SC-900 Part 3: Describe the capabilities of Microsoft security solutions
Learn about security capabilities in Microsoft. Topics covered will include network and platform capabilities of Azure, Azure security management, and Sentinel. You’ll learn about threat protection with Microsoft 365 Defender and Microsoft 365 security management.
The Module SC-900 part 3: Describe the capabilities of Microsoft security solutions – Learn | Microsoft Docs
SC-900 Part 4: Describe the capabilities of Microsoft compliance solutions
Learn about compliance solutions in Microsoft. Topics covered will include Compliance center, Information protection and governance in Microsoft 365, Insider Risk, audit, and eDiscovery solutions. Also covered are Azure resources governance capabilities.
The Module SC-900 part 4: Describe the capabilities of Microsoft compliance solutions – Learn | Microsoft Docs
Practice Tests and Courses
Below are some of the courses and practices:
Udemy – 3 practice tests for the SC-900 exam | From an instructor who has CLEARED the exam SC-900 Practice Tests [MS Security, Compliance, & Identity] | Udemy
Udemy – Learn SCI for Microsoft 365 Defender, Intune, and Microsoft 365. SC-900: Microsoft Security, Compliance, Identity Fundamentals | Udemy
Pluralsight – Intended for intermediate learners, and prior knowledge of virtual machines, cloud computing fundamentals, and solution architecture is required.
Planning Microsoft Azure Identity and Security Path | Pluralsight
LinkedIn Learning The Microsoft 365 Mobility and Security exam tests a candidate’s ability to evaluate, plan, migrate, deploy, and manage Microsoft 365 services. Plan for Cloud App Security (linkedin.com).
Whizlabs – Practical tests with more than 100 questions. Whizlabs Online Certification Training Courses for Professionals (AWS, Java, PMP)
John Savill with study cram SC-900 Microsoft Security, Compliance, and Identity Fundamentals Study Cram – YouTube
