Microsoft
Free Microsoft SC-900 Practice Questions
The Microsoft SC-900 exam is up to 50 questions in 45 minutes, and the voucher costs $99. CertCrush provides 400 syllabus-aligned practice questions and 20 performance-based questions across all 4 exam domains, each with a full explanation. Free to try, no account required.
Microsoft SC-900 (Security, Compliance, and Identity Fundamentals) is the entry point into the Microsoft security stack, covering Zero Trust, Microsoft Entra, Defender, Sentinel and Purview. This course gives you the practice questions, flashcards and study guide you need to walk into the exam knowing exactly what each service does and when it applies.
Practice content last updated · Independently written and aligned to Microsoft’s published exam objectives.
10
Sample questions
45 min
Exam time limit
70%
Practice pass mark
$99
Exam voucher
About the Microsoft SC-900 Exam
SC-900 is the exam that finally makes the Microsoft security portfolio make sense. Microsoft sells security under a dozen brand names that all sound alike, and the single hardest part of this exam is not difficulty, it is telling Defender for Cloud apart from Defender for Cloud Apps, or knowing where Purview stops and Entra begins. SC-900 is the fundamentals certification that draws those boundaries for you, and it is why business stakeholders, career changers and seasoned IT professionals moving into a Microsoft shop all sit it. The exam covers four areas. You start with the vendor-neutral groundwork: shared responsibility, defence in depth, Zero Trust, encryption and hashing, and governance, risk and compliance. Then Microsoft Entra, which is the largest identity block on the exam and covers identity types including agent ID, hybrid identity, authentication methods and MFA, Conditional Access, RBAC, ID Governance, access reviews, Privileged Identity Management and ID Protection. The biggest slice is Microsoft security solutions: Azure DDoS Protection, Azure Firewall, Web Application Firewall, network segmentation, NSGs, Bastion, Key Vault, Defender for Cloud and CSPM, Microsoft Sentinel as SIEM and SOAR, and the whole Defender XDR family. Finally compliance: the Service Trust Portal, Microsoft privacy principles, Compliance Manager and compliance score, sensitivity labels, DLP, records management, retention, insider risk management, eDiscovery and audit. Nothing here asks you to configure anything in anger. Almost every objective begins with the word describe. What the exam wants is recognition: given a business requirement, name the Microsoft service that meets it. That is a memory and vocabulary problem, and it is exactly the kind of problem practice questions solve.
Exam Domains Covered
Exam Format & Details
45 minutes, roughly 40 to 60 questions, delivered online or at a Pearson VUE test centre. You need a scaled score of 700 out of 1000 to pass, which the app tracks as 70 percent. Most items are multiple choice and multiple response, and Microsoft confirms the exam may include interactive components such as drag and drop (matching), build list (ordering) and active screen (configuration) items. There are no labs on a Fundamentals exam. The voucher is 99 USD in the United States and is priced regionally elsewhere. Book through Pearson VUE from the Microsoft Learn exam page, or through Certiport if you are a student or educator. The exam has no prerequisites and the certification does not expire.
Why Practice Questions Matter
SC-900 is a naming exam. The concepts are approachable, but the service catalogue is enormous and deliberately confusable, and 45 minutes leaves under a minute per question, so recall has to be instant rather than reasoned out. Practice questions are the only efficient way to build that recall, because they force you to choose between Defender for Endpoint and Defender for Identity, or between a retention label and a sensitivity label, under the same time pressure the real exam applies. Working through several hundred scenario-framed questions turns a long list of product names into a set of reflexes, and the explanations tell you why the near-miss answer was wrong.
Try Microsoft SC-900
Get a taste before you commit — no account needed. Then a free account unlocks 25 questions with readiness tracking, no card required.
Get full access to Microsoft SC-900
All questions, timed exams, flashcards, PDF study guide download & progress tracking.
This course
$9.99
one-time
Monthly
$12.99
per month · all courses
Takes 30 seconds — create a free account, then straight to checkout. Already have an account? Sign in
Try 2 performance tasks free
Drag-and-drop, sequencing and configuration tasks that mirror the interactive questions on the real Microsoft SC-900 exam — marked with partial credit.
Sample Practice Questions
The following questions are a preview of the type of syllabus-aligned questions you will practise in CertCrush. They reflect the format and reasoning style of the Microsoft SC-900 exam — not actual exam content.
Q1.A company runs a virtual machine on an IaaS platform. Under the shared responsibility model, who is responsible for patching the guest operating system?
- A.The customer
- B.The cloud provider
- C.Shared equally with no clear owner
- D.Whoever configured the virtual network
Domain: Security, Compliance, and Identity Concepts
Q2.A team builds an application on a PaaS offering. Using the study guide's "fully staffed commercial kitchen" analogy, what does Microsoft continue to manage that the team does not?
- A.The operating system and underlying runtime
- B.The application code and business logic
- C.The organization's data
- D.Who is allowed access to the application
Domain: Security, Compliance, and Identity Concepts
Q3.An organization runs its own servers, operating systems, applications, and data entirely in its own building with no cloud provider involved. Under the shared responsibility model, what best describes this setup?
- A.The organization manages everything itself
- B.Microsoft manages the hardware while the organization manages the rest
- C.The split is identical to SaaS
- D.Responsibility is shared equally with a third-party host
Domain: Security, Compliance, and Identity Concepts
Q4.Which security model is built on the principle of "never trust, always verify," where no user or device is automatically trusted just because it is inside the network?
- A.Zero Trust
- B.Defense-in-depth
- C.Shared responsibility model
- D.Data residency
Domain: Security, Compliance, and Identity Concepts
Q5.Which process runs data through an algorithm to produce a fixed-length string used to verify that the data has not changed, and cannot be reversed back into the original data?
- A.Hashing
- B.Encryption
- C.Data residency
- D.Defense-in-depth
Domain: Security, Compliance, and Identity Concepts
Microsoft SC-900 guides & exam news
How to Pass the Microsoft SC-900 Exam in 2026: A 4-Week Study Plan for the New 28 July Objectives
Microsoft updated the SC-900 objectives on 28 July 2026, and most study material online still teaches the old list. Here is a realistic 4-week SC-900 study plan built on the current skills measured, including the new agent ID content.
Microsoft SC-900 Explained: Domains, Cost and Is It Worth It in 2026?
A complete breakdown of the Microsoft SC-900 exam in 2026: the four domains and their weights, exam cost, format, the new Security Copilot content, and an honest verdict on whether the Security, Compliance and Identity Fundamentals cert is worth your time.
MS-900 Is Retired: What Replaces Microsoft 365 Fundamentals in 2026 (AB-900 vs AB-730)
MS-900 retired on 31 March 2026 and you can no longer book it. Here is the official Microsoft statement, what AB-900 replaced it with, how AB-730 differs, and exactly which exam to sit instead depending on your role.
How to Pass the Microsoft DP-900 Exam in 2026: A 4-Week Azure Data Fundamentals Study Plan for the New 21 July Objectives
The DP-900 skills measured were refreshed on 21 July 2026. Here is a realistic 4-week Azure Data Fundamentals study plan built around the current four domains, the 45-minute time limit and the 700 pass mark.
Frequently Asked Questions
Does the Microsoft SC-900 course include performance-based questions?
Yes. The Microsoft SC-900 course includes 20 performance-based questions (PBQs) — hands-on tasks that mirror the interactive questions on the real exam, including drag-and-drop matching, sequencing and configuration screens. Each one is marked with partial credit, so you can see exactly which placements were wrong, and every task includes a full explanation. The first two are free to try.
What is included in the free Microsoft SC-900 sample?
The free sample includes 10 syllabus-aligned practice questions, sample flashcards, and a preview chapter from the study guide. No account or payment is required to try the sample.
How many questions are in the full Microsoft SC-900 course?
The full course includes a comprehensive question bank covering all exam domains. You can see the total question count on the Microsoft SC-900 course page.
Are these official Microsoft exam questions?
No. CertCrush questions are independently written and syllabus-aligned — they mirror the format, difficulty, and reasoning style of the official exam. We are not affiliated with or endorsed by Microsoft.
Which domains does the Microsoft SC-900 course cover?
The course covers 4 exam domains: Security, Compliance, and Identity Concepts, Microsoft Entra Capabilities, Microsoft Security Solutions, Microsoft Compliance Solutions.
Can I study on mobile?
Yes. CertCrush is fully responsive and works on phones, tablets, and desktops. The timed exam, flashcards, and study guide all work on mobile without installing an app.
What happens when I create an account?
Creating a free account lets you access full courses, track your weak areas by domain, and resume practice sessions across devices. No credit card is required to register.