Microsoft SC-900 Dumps - Pass Microsoft Security, Compliance, and Identity Fundamentals Exam in First Attempt 2026

Microsoft 365 Information Barriers are compliance policies used ''to prevent certain segments of users from communicating or collaborating with each other.'' In Microsoft's guidance, IB policies are designed for scenarios like insider trading restrictions, M&A deal rooms, or research--sales separation, where it's necessary to block chats, calls, and collaboration between defined user segments. The documentation explains that when IB policies are in place, ''users in the blocked segments cannot search, discover, or communicate with each other in Microsoft Teams,'' and IB v2 extends these controls to additional collaboration workloads such as SharePoint and OneDrive. By contrast, email restrictions in Exchange Online are addressed through mail flow rules or other Exchange features, not information barriers, and restricting unauthenticated access or external sharing is handled by identity access controls and sharing settings, not IB. Therefore, the specific use case is restricting Microsoft Teams chats (and related collaboration) between certain groups within an organization.

You can use an Azure network security group to filter network traffic to and from Azure resources in an Azure virtual network. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources.

Microsoft places Attack simulation training under the email and collaboration protection workloads of Microsoft Defender for Office 365 (MDO). The official product guidance describes it as a built-in capability that ''lets you run realistic attack scenarios in your organization to identify vulnerable users and train users to recognize and report phishing and other social-engineering techniques.'' Microsoft further notes that Attack simulation training ''provides editable phishing payloads, credential-harvesting and attachment scenarios, landing pages, user training, and detailed reporting,'' enabling security teams to measure compromise rates and improve user resilience over time. The service scope is explicit: ''Attack simulation training is a feature of Microsoft Defender for Office 365 Plan 2,'' and it is included in suites that contain MDO P2 such as Microsoft 365 E5 and Office 365 E5. In the Microsoft 365 Defender portal, you access it under Email & collaboration Attack simulation training, where admins can create simulations, target groups, assign training, and review metrics like repeat offenders, resilience score, and simulation results. By design, this feature is not part of Microsoft Defender for Cloud Apps (cloud app security and CASB functions), not part of Microsoft Defender for Identity (on-prem AD identity threat detection), and not part of Defender for SQL. Therefore, the Microsoft SCI documentation aligns that the correct service hosting Attack simulation training is Microsoft Defender for Office 365 (Plan 2).

In Microsoft's Security, Compliance, and Identity (SCI) learning content, Multi-Factor Authentication (MFA) is defined as requiring more than one verification method during sign-in. Microsoft states: ''Multi-factor authentication (MFA) requires two or more verification methods'' and Azure AD (Microsoft Entra ID) MFA ''works by requiring two or more of the following: something you know (password), something you have (trusted device or token), something you are (biometrics).'' The SCI fundamentals also explain that MFA strengthens authentication beyond a single password by combining distinct factor types, noting that ''strong authentication uses at least two different factors to verify identity.''

When you enable Azure AD MFA, a user must successfully present two factors from those categories to complete the authentication---commonly a password (something you know) plus a second factor such as Microsoft Authenticator approval, a FIDO2 security key, SMS/voice code, or Windows Hello (something you have/are). This is the core of Azure AD's risk-based and conditional access controls, which can require MFA based on conditions or risk signals. Therefore, the number of factors required after enabling Azure AD MFA is two, aligning with Microsoft's definition and implementation of multi-factor authentication in Entra ID.

In Microsoft Purview, Sensitivity labels are the feature designed to let users identify and classify content that should be protected. Microsoft's guidance explains that sensitivity labels ''enable you to classify and protect your organization's data while ensuring that user productivity and collaboration aren't hindered.'' Users can manually choose a label in Office apps and services to indicate the data's sensitivity; as Microsoft notes, labels ''can be applied by users or automatically,'' and the label ''persists with the content in its metadata.'' Once identified with a label, protection settings can be enforced, including ''encryption, content marking (headers, footers, watermarks), and access restrictions based on the label.''

By comparison, Data Loss Prevention (DLP) focuses on ''monitoring and blocking the unintentional sharing of sensitive information'' based on policy---DLP enforces handling rules after data is identified, rather than providing the user-centric classification mechanism. Insider Risk addresses ''risky user activities and insider data security scenarios,'' and eDiscovery is used to ''find, preserve, collect, and review content for investigations or litigation.'' Therefore, the feature that explicitly allows users to identify content that should be protected---by selecting and applying a classification that then drives protection---is Sensitivity labels.