Describe the concepts of security, compliance, and identity
Domain 1 of SC-900 accounts for 10-15% of the exam. EarnYourCert has 52 original questions for this domain, all with explanations: 36 multiple choice, 7 yes/no and 9 completion or ordering items, like the real exam.
Domain 1 sample questions
8 questions from our 52-question bank for this domain. Try to answer before revealing the solution.
1. Which security approach uses multiple layers of protection so that if one layer fails, others still protect the data?
- Role inheritance
- Defense in depth
- Data sovereignty
- Single sign-on
Show answer
Correct answer: B. Defense in depth layers physical, identity, perimeter, network, compute, application and data protections.
2. A malicious actor changes the amount in a financial record. Which CIA property is violated?
- Integrity
- Confidentiality
- Availability
- Authentication
Show answer
Correct answer: A. Integrity means data is accurate and has not been altered without authorization.
3. A DDoS attack takes a website offline for customers. Which CIA property is primarily affected?
- Confidentiality
- Non-repudiation
- Availability
- Integrity
Show answer
Correct answer: C. Availability ensures authorized users can access systems and data when needed.
4. In asymmetric encryption, which key is used to decrypt data that was encrypted with the recipient's public key?
- The same public key
- A hash of the message
- The recipient's private key
- The sender's private key
Show answer
Correct answer: C. Only the holder of the private key can decrypt what was encrypted with the matching public key.
5. Which layer of defense in depth includes controls such as badges, cameras and locked server rooms?
- Physical security
- Identity and access
- Application
- Data
Show answer
Correct answer: A. The physical layer is the first line of defense for facilities and hardware.
6. Which open standard is an authorization framework that lets an app access resources on behalf of a user without sharing the user's password?
- SMTP
- RADIUS
- OAuth 2.0
- DHCP
Show answer
Correct answer: C. OAuth 2.0 provides delegated authorization using access tokens.
7. Which XML-based standard is widely used for exchanging authentication and authorization data between an identity provider and a service provider?
- ICMP
- HTML
- SAML
- SSH
Show answer
Correct answer: C. SAML assertions enable federated single sign-on.
8. In a modern authentication flow, what does a security token represent?
- A DNS record that maps a name to an IP
- A VPN key used for tunnel encryption
- A physical badge for building access
- Proof of authentication or authorization containing claims about the user or app
Show answer
Correct answer: D. Tokens carry claims such as user identity and permissions and are signed by the identity provider.