Identity concepts and encryption basics
Almost every attack on a cloud service starts or ends with an identity. SC-900 expects you to know the vocabulary before it asks about Microsoft Entra.
Identity basics
An identity can be a user, a device, a service or an application. Identities are stored in a directory and checked by an identity provider (IdP), which issues proof of sign-in to apps.
Two ideas are always separated:
| Term | Question it answers | Example |
|---|---|---|
| Authentication | Who are you? | Password plus an authenticator prompt |
| Authorization | What may you do? | Reader role on a storage account |
Authentication always comes first. A modern identity system also supports single sign-on (one sign-in for many apps) and role-based access control to grant permissions.
Identity providers and federation
A modern identity solution centralizes users in one provider so that apps do not keep their own passwords. Federation extends this: two organizations trust each other’s IdP, so a user from one can access resources of the other without a second account. Common protocols include SAML, OpenID Connect and OAuth 2.0. Active Directory Domain Services is the on-premises directory; Active Directory Federation Services (AD FS) provides federation from it. Microsoft Entra ID is the cloud equivalent.
Encryption and hashing
| Concept | Key points |
|---|---|
| Symmetric encryption | One shared key encrypts and decrypts. Fast, used for bulk data. |
| Asymmetric encryption | A public key encrypts, a private key decrypts. Also used for digital signatures. |
| Hashing | One-way. Same input gives the same fixed-length output. Used for passwords and integrity checks. |
Data has three states. At rest is stored data, protected with disk or database encryption. In transit moves over a network, protected with TLS. In use is being processed in memory.
Common threats
Know the labels: phishing tricks users into giving credentials, password spray tries a few common passwords across many accounts, ransomware encrypts data for payment, and DDoS floods a service so it becomes unavailable.
Exam traps
- Authentication is not authorization. Signing in successfully does not mean access is allowed.
- Hashing is not encryption. You cannot decrypt a hash.
- Federation is a trust between providers. It is not the same as syncing passwords.
- Asymmetric encryption uses two different keys, not one shared key.
- Encrypting data at rest does not protect it while it travels. Both states need protection.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. A user proves who they are by entering a password and approving a phone prompt. What is this process called?
Show answer
Answer: B.Authentication proves identity. Authorization decides what the proven identity may do.
2. Employees sign in to a partner's app with their own company credentials, and the partner trusts the company's identity provider. What is this called?
Show answer
Answer: B.Federation is a trust relationship between identity providers, so one organization accepts the other's authentication.
3. Which statement about hashing is true?
Show answer
Answer: B.A hash is one-way. It is used to store passwords and to check integrity, not to recover the original data.
4. Data stored on a disk is protected so that stolen drives are unreadable. Which state of data does this protect?
Show answer
Answer: B.Encryption at rest protects stored data, such as disks or databases. TLS protects data in transit.