In the full course
What you get
- 400 exam-style questions, each with a full explanation
- 20 performance-based tasks, marked with partial credit
- 200 flashcards, filtered by domain
- The full study guide, 25 chapters
- Timed mock exams matched to the real exam length
- A readiness score weighted by the official exam blueprint
Get full access to Microsoft SC-900
All questions, timed exams, flashcards, PDF study guide download & progress tracking.
Lifetime · all courses
$29.99
One payment · future courses included
30 seconds, then straight to checkout.
Pass, or your money back
Reach 85% readiness on this course, sit the real exam, and if you don't pass we refund it in full. Applies to this single-course purchase. Terms.
More free samples
Marked, and passed
Real feedback from people who passed
“I failed my CISSP on the first attempt with another platform. Switched to CertCrush, focused on my weak domains using the tracking feature, and passed three months later. The explanations for wrong answers are genuinely useful, not just 'A is correct because A is correct'.”
“Honestly wasn't expecting much but this is probably the best ten bucks I've spent on exam prep. Did 20–30 questions every morning before work for 6 weeks. Passed with a comfortable margin. The timed exam mode is what really got me comfortable with the pressure.”
“The flashcards are underrated. I used them during my commute and it made a huge difference for the theory-heavy ITIL questions. Passed first try. Already using it again for CISM.”
Microsoft SC-900 (Security, Compliance, and Identity Fundamentals) is the entry point into the Microsoft security stack, covering Zero Trust, Microsoft Entra, Defender, Sentinel and Purview. This course gives you the practice questions, flashcards and study guide you need to walk into the exam knowing exactly what each service does and when it applies.
Practice content last updated · Independently written and aligned to Microsoft’s published exam objectives.
About the Microsoft SC-900 Exam
SC-900 is the exam that finally makes the Microsoft security portfolio make sense. Microsoft sells security under a dozen brand names that all sound alike, and the single hardest part of this exam is not difficulty, it is telling Defender for Cloud apart from Defender for Cloud Apps, or knowing where Purview stops and Entra begins. SC-900 is the fundamentals certification that draws those boundaries for you, and it is why business stakeholders, career changers and seasoned IT professionals moving into a Microsoft shop all sit it. The exam covers four areas. You start with the vendor-neutral groundwork: shared responsibility, defence in depth, Zero Trust, encryption and hashing, and governance, risk and compliance. Then Microsoft Entra, which is the largest identity block on the exam and covers identity types including agent ID, hybrid identity, authentication methods and MFA, Conditional Access, RBAC, ID Governance, access reviews, Privileged Identity Management and ID Protection. The biggest slice is Microsoft security solutions: Azure DDoS Protection, Azure Firewall, Web Application Firewall, network segmentation, NSGs, Bastion, Key Vault, Defender for Cloud and CSPM, Microsoft Sentinel as SIEM and SOAR, and the whole Defender XDR family. Finally compliance: the Service Trust Portal, Microsoft privacy principles, Compliance Manager and compliance score, sensitivity labels, DLP, records management, retention, insider risk management, eDiscovery and audit. Nothing here asks you to configure anything in anger. Almost every objective begins with the word describe. What the exam wants is recognition: given a business requirement, name the Microsoft service that meets it. That is a memory and vocabulary problem, and it is exactly the kind of problem practice questions solve.
Exam Domains Covered
- Security, Compliance, and Identity Concepts12%
- Microsoft Entra Capabilities28%
- Microsoft Security Solutions38%
- Microsoft Compliance Solutions22%
Exam Format & Details
45 minutes, roughly 40 to 60 questions, delivered online or at a Pearson VUE test centre. You need a scaled score of 700 out of 1000 to pass, which the app tracks as 70 percent. Most items are multiple choice and multiple response, and Microsoft confirms the exam may include interactive components such as drag and drop (matching), build list (ordering) and active screen (configuration) items. There are no labs on a Fundamentals exam. The voucher is 99 USD in the United States and is priced regionally elsewhere. Book through Pearson VUE from the Microsoft Learn exam page, or through Certiport if you are a student or educator. The exam has no prerequisites and the certification does not expire.
Why Practice Questions Matter
SC-900 is a naming exam. The concepts are approachable, but the service catalogue is enormous and deliberately confusable, and 45 minutes leaves under a minute per question, so recall has to be instant rather than reasoned out. Practice questions are the only efficient way to build that recall, because they force you to choose between Defender for Endpoint and Defender for Identity, or between a retention label and a sensitivity label, under the same time pressure the real exam applies. Working through several hundred scenario-framed questions turns a long list of product names into a set of reflexes, and the explanations tell you why the near-miss answer was wrong.
Try 2 performance tasks free
Drag-and-drop, sequencing and configuration tasks that mirror the interactive questions on the real Microsoft SC-900 exam, marked with partial credit.
Sample Practice Questions
The following questions are a preview of the type of syllabus-aligned questions you will practise in CertCrush. They reflect the format and reasoning style of the Microsoft SC-900 exam, not actual exam content.
Q1.A marketing employee is denied access to payroll records because that access is not needed to do their job, even though granting it would be more convenient for IT. Which Zero Trust principle is being applied?
- A.Least privilege
- B.Verify explicitly
- C.Assume breach
- D.Defense-in-depth
Domain: Security, Compliance, and Identity Concepts
Q2.Which product watches the software-as-a-service applications employees use day to day, rather than infrastructure or cross-product correlation?
- A.Microsoft Defender for Cloud Apps
- B.Microsoft Defender for Cloud
- C.Microsoft Defender XDR
- D.Microsoft Defender for Endpoint
Domain: Microsoft Security Solutions
Q3.A help desk technician manually changes a locked-out employee's password using an administrative tool, without the employee proving their identity through any pre-registered method. What is this workflow called?
- A.An administrator-initiated password reset
- B.Self-service password reset (SSPR)
- C.Password writeback
- D.Smart lockout recovery
Domain: Microsoft Entra Capabilities
Q4.A security architect distinguishes between the layer that defends the edge of the network against large-scale DDoS floods and the layer that segments internal traffic so a breach doesn't spread. Which two defense-in-depth layers are being contrasted?
- A.Perimeter security and network security
- B.Identity and access controls and compute security
- C.Physical security and application security
- D.Data security and identity and access controls
Domain: Security, Compliance, and Identity Concepts
Q5.A company runs a virtual machine on an IaaS platform. Under the shared responsibility model, who is responsible for patching the guest operating system?
- A.The customer
- B.The cloud provider
- C.Shared equally with no clear owner
- D.Whoever configured the virtual network
Domain: Security, Compliance, and Identity Concepts
Q6.In Privileged Identity Management, what does an eligible assignment mean?
- A.The user could hold the role but does not have it turned on until they activate it
- B.The user holds the role permanently, all day, every day
- C.The user has been denied the role by an access review
- D.The user has requested the role through an access package but is awaiting approval
Domain: Microsoft Entra Capabilities
Q7.An organization must demonstrate that its cloud environment aligns with frameworks such as ISO 27001, PCI DSS, or NIST. What does Defender for Cloud provide for this?
- A.Regulatory compliance standards you can assess the environment against
- B.Only the Microsoft Cloud Security Benchmark, which covers all frameworks
- C.CWPP plans purchased per named framework
- D.Multicloud connectors for each regulator
Domain: Microsoft Security Solutions
Q8.Beyond exam trivia, why does using Azure RBAC for Key Vault permissions matter?
- A.It uses the same roles, scopes, and inheritance model as other Azure resources, simplifying administration and environment-wide auditing
- B.It removes the need to grant applications any permission to read secrets
- C.It automatically upgrades software-protected keys to HSM-backed keys
- D.It replaces the need for soft delete and purge protection on the vault
Domain: Microsoft Security Solutions
Q9.Which two statements correctly describe the boundaries of Conditional Access? (Choose two.)
- A.It is not a firewall or network security tool and does not inspect network traffic
- B.It works alongside authentication and authorization rather than replacing either of them
- C.It replaces authorization by determining what a signed-in user is permitted to do
- D.It replaces authentication by proving the identity of the person signing in
Domain: Microsoft Entra Capabilities
Q10.An HR investigator wants to determine what a particular employee accessed during a specific two-week window, without asking each system administrator to check their own logs. Which approach does the chapter describe?
- A.Run a single audit log search filtered by date range, activity, and user
- B.Open an eDiscovery case and export the employee's mailbox
- C.Create an insider risk policy and wait for it to generate an alert
- D.Apply a retention label to the employee's files so nothing is deleted
Domain: Microsoft Compliance Solutions
Microsoft SC-900 guides & exam news
How to Pass the Microsoft SC-900 Exam in 2026: A 4-Week Study Plan for the New 28 July Objectives
Microsoft updated the SC-900 objectives on 28 July 2026, and most study material online still teaches the old list. Here is a realistic 4-week SC-900 study plan built on the current skills measured, including the new agent ID content.
Microsoft SC-900 Cost in 2026: Exam Price, Domains and Is It Worth It?
A complete breakdown of the Microsoft SC-900 exam in 2026: the four domains and their weights, exam cost, format, the new Security Copilot content, and an honest verdict on whether the Security, Compliance and Identity Fundamentals cert is worth your time.
SC-500 vs SC-200 in 2026: Which Microsoft Security Exam Should You Take?
SC-500 is for engineers who build and harden Azure, hybrid and AI workloads. SC-200 is for analysts who detect, investigate and respond. How the two 2026 exams differ, where their objectives overlap, and which to take first.
Microsoft AB-650 Exam Topics and Domain Weightings in 2026: The MS-102 Replacement, Now in Beta
AB-650 replaces MS-102 as Microsoft's tenant administration exam, and the weightings tell a different story. Security and governance take 40 to 45 percent, AI services take 35 to 40 percent, and classic tenant admin is down to a fifth of the exam.
Frequently Asked Questions
Does the Microsoft SC-900 course include performance-based questions?
Yes. The Microsoft SC-900 course includes 20 performance-based questions (PBQs): hands-on tasks that mirror the interactive questions on the real exam, including drag-and-drop matching, sequencing and configuration screens. Each one is marked with partial credit, so you can see exactly which placements were wrong, and every task includes a full explanation. The first two are free to try.
What is included in the free Microsoft SC-900 sample?
The free sample includes 10 syllabus-aligned practice questions, sample flashcards, and a preview chapter from the study guide. No account or payment is required to try the sample.
How many questions are in the full Microsoft SC-900 course?
The full Microsoft SC-900 course includes 400 practice questions and 20 performance-based tasks, covering all 4 exam domains. Every question carries a full explanation for the right answer and the wrong ones.
Are these official Microsoft exam questions?
No. CertCrush questions are independently written and syllabus-aligned. They mirror the format, difficulty, and reasoning style of the official exam. We are not affiliated with or endorsed by Microsoft.
Which domains does the Microsoft SC-900 course cover?
The course covers 4 exam domains: Security, Compliance, and Identity Concepts, Microsoft Entra Capabilities, Microsoft Security Solutions, Microsoft Compliance Solutions.
Can I study on mobile?
Yes. CertCrush is fully responsive and works on phones, tablets, and desktops. The timed exam, flashcards, and study guide all work on mobile without installing an app.
What happens when I create an account?
Creating a free account lets you access full courses, track your weak areas by domain, and resume practice sessions across devices. No credit card is required to register.
Start with 10 free questions
No account, no card. The full Microsoft SC-900 course is $9.99, once.