SC-900 - Security, Compliance, and Identity Concepts (13% of the exam) - Section 1.1

Describe security and compliance concepts.

Describe the shared responsibility model, defense in depth layers, and the Zero Trust model, and explain how encryption and hashing protect data at rest and in transit. Recognise how governance, risk, and compliance frameworks guide an organisation's security posture.

shared responsibility modeldefense in depthZero Trust modelencryption and hashinggovernance, risk, and compliance

Practice question for this objective

Free sampleSecurity, Compliance, and Identity Conceptseasy

An instructor is contrasting encryption and hashing while explaining how organisations protect data. Which TWO statements about encryption and hashing are correct? Select TWO.

  • AEncryption is a one-way transformation that, like hashing, cannot be reversed even by a party holding the correct key.
  • BHashing converts data into a fixed-length value that is not designed to be reversed back to the input. Correct
  • CEncryption in transit protects data as it moves across a network, for example between a client and a service. Correct
  • DHashing keeps a secret key so that the original value can be recovered whenever it is later needed.
  • EEncryption at rest only applies to data held in memory and never to data stored on a disk.
Encryption is reversible with a key and protects data in transit and at rest, while hashing is a one-way, fixed-length transformation that is not meant to be reversed. Hashing produces a fixed-length, one-way digest with no key and cannot be reversed, so B is correct, while encryption in transit protects data as it crosses a network so intercepted traffic stays unreadable, so C is correct. Encryption is reversible with the correct key, so calling it one-way is wrong, and encryption at rest protects stored data on disk rather than only data in memory.

Why A is wrong: Tempting because both scramble data, but encryption is reversible by design: the correct key decrypts the ciphertext back to the original value, which is exactly what separates it from one-way hashing.

Why B is correct: Hashing is one-way and yields a fixed-length digest, so it cannot be reversed to recover the original input.

Why C is correct: Encryption in transit secures data while it travels over a network so intercepted traffic stays unreadable.

Why D is wrong: Tempting because keys feel central, but hashing uses no decryption key and is not reversible like encryption.

Why E is wrong: This reverses the meaning; encryption at rest protects stored data on persistent media, not data in memory.

See more SC-900 practice questions, answers explained.

Exam traps in Security, Compliance, and Identity Concepts

Answers that look right on this material and are not. Each one is a distractor from a different question in the SC-900 bank for this domain.

  • Trust the internal network, since assets inside the perimeter are safer than those outside.

    Why it is wrong: Trusting the internal perimeter describes the traditional model that Zero Trust replaces, not the Zero Trust idea itself.

  • A public key encrypts the data and a separate private key is used to decrypt it.

    Why it is wrong: Encrypting with a public key and decrypting with a separate private key describes asymmetric encryption and its key pair, not symmetric encryption.

  • Customer data, which the matrix marks as a customer responsibility in every deployment type.

    Why it is wrong: The grounding marks customer data as a customer responsibility across on-premises, IaaS, PaaS, and SaaS, so it is never a shared area.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.