Try Microsoft SC-900
Try 10 questions now. No account, no card.
A free account unlocks 25 questions per course plus readiness tracking.
Get full access to Microsoft SC-900
All questions, timed exams, flashcards, PDF study guide download & progress tracking.
Lifetime · all courses
$29.99
One payment · future courses included
30 seconds, then straight to checkout.
Pass, or your money back
Reach 85% readiness on this course, sit the real exam, and if you don't pass we refund it in full. Applies to this single-course purchase. Terms.
Microsoft · Exam reference
About the Microsoft SC-900 exam
Microsoft SC-900 (Security, Compliance, and Identity Fundamentals) is the entry point into the Microsoft security stack, covering Zero Trust, Microsoft Entra, Defender, Sentinel and Purview. This course gives you the practice questions, flashcards and study guide you need to walk into the exam knowing exactly what each service does and when it applies.
10
Sample questions
45 min
Exam time limit
70%
Practice pass mark
$99
Exam voucher
SC-900 is the exam that finally makes the Microsoft security portfolio make sense. Microsoft sells security under a dozen brand names that all sound alike, and the single hardest part of this exam is not difficulty, it is telling Defender for Cloud apart from Defender for Cloud Apps, or knowing where Purview stops and Entra begins. SC-900 is the fundamentals certification that draws those boundaries for you, and it is why business stakeholders, career changers and seasoned IT professionals moving into a Microsoft shop all sit it. The exam covers four areas. You start with the vendor-neutral groundwork: shared responsibility, defence in depth, Zero Trust, encryption and hashing, and governance, risk and compliance. Then Microsoft Entra, which is the largest identity block on the exam and covers identity types including agent ID, hybrid identity, authentication methods and MFA, Conditional Access, RBAC, ID Governance, access reviews, Privileged Identity Management and ID Protection. The biggest slice is Microsoft security solutions: Azure DDoS Protection, Azure Firewall, Web Application Firewall, network segmentation, NSGs, Bastion, Key Vault, Defender for Cloud and CSPM, Microsoft Sentinel as SIEM and SOAR, and the whole Defender XDR family. Finally compliance: the Service Trust Portal, Microsoft privacy principles, Compliance Manager and compliance score, sensitivity labels, DLP, records management, retention, insider risk management, eDiscovery and audit. Nothing here asks you to configure anything in anger. Almost every objective begins with the word describe. What the exam wants is recognition: given a business requirement, name the Microsoft service that meets it. That is a memory and vocabulary problem, and it is exactly the kind of problem practice questions solve.
Exam Domains Covered
Exam Format & Details
45 minutes, roughly 40 to 60 questions, delivered online or at a Pearson VUE test centre. You need a scaled score of 700 out of 1000 to pass, which the app tracks as 70 percent. Most items are multiple choice and multiple response, and Microsoft confirms the exam may include interactive components such as drag and drop (matching), build list (ordering) and active screen (configuration) items. There are no labs on a Fundamentals exam. The voucher is 99 USD in the United States and is priced regionally elsewhere. Book through Pearson VUE from the Microsoft Learn exam page, or through Certiport if you are a student or educator. The exam has no prerequisites and the certification does not expire.
Why Practice Questions Matter
SC-900 is a naming exam. The concepts are approachable, but the service catalogue is enormous and deliberately confusable, and 45 minutes leaves under a minute per question, so recall has to be instant rather than reasoned out. Practice questions are the only efficient way to build that recall, because they force you to choose between Defender for Endpoint and Defender for Identity, or between a retention label and a sensitivity label, under the same time pressure the real exam applies. Working through several hundred scenario-framed questions turns a long list of product names into a set of reflexes, and the explanations tell you why the near-miss answer was wrong.
Sample Practice Questions
The following questions are a preview of the type of syllabus-aligned questions you will practise in CertCrush. They reflect the format and reasoning style of the Microsoft SC-900 exam — not actual exam content.
Q1.A marketing employee is denied access to payroll records because that access is not needed to do their job, even though granting it would be more convenient for IT. Which Zero Trust principle is being applied?
- A.Least privilege
- B.Verify explicitly
- C.Assume breach
- D.Defense-in-depth
Domain: Security, Compliance, and Identity Concepts
Q2.Which product watches the software-as-a-service applications employees use day to day, rather than infrastructure or cross-product correlation?
- A.Microsoft Defender for Cloud Apps
- B.Microsoft Defender for Cloud
- C.Microsoft Defender XDR
- D.Microsoft Defender for Endpoint
Domain: Microsoft Security Solutions
Q3.A help desk technician manually changes a locked-out employee's password using an administrative tool, without the employee proving their identity through any pre-registered method. What is this workflow called?
- A.An administrator-initiated password reset
- B.Self-service password reset (SSPR)
- C.Password writeback
- D.Smart lockout recovery
Domain: Microsoft Entra Capabilities
Q4.A security architect distinguishes between the layer that defends the edge of the network against large-scale DDoS floods and the layer that segments internal traffic so a breach doesn't spread. Which two defense-in-depth layers are being contrasted?
- A.Perimeter security and network security
- B.Identity and access controls and compute security
- C.Physical security and application security
- D.Data security and identity and access controls
Domain: Security, Compliance, and Identity Concepts
Q5.A company runs a virtual machine on an IaaS platform. Under the shared responsibility model, who is responsible for patching the guest operating system?
- A.The customer
- B.The cloud provider
- C.Shared equally with no clear owner
- D.Whoever configured the virtual network
Domain: Security, Compliance, and Identity Concepts
Frequently Asked Questions
What is included in the free Microsoft SC-900 sample?
The free sample includes 10 syllabus-aligned practice questions, sample flashcards, and a preview chapter from the study guide. No account or payment is required to try the sample.
How many questions are in the full Microsoft SC-900 course?
The full course includes a comprehensive question bank covering all exam domains. You can see the total question count on the Microsoft SC-900 course page.
Are these official Microsoft exam questions?
No. CertCrush questions are independently written and syllabus-aligned — they mirror the format, difficulty, and reasoning style of the official exam. We are not affiliated with or endorsed by Microsoft.
Which domains does the Microsoft SC-900 course cover?
The course covers 4 exam domains: Security, Compliance, and Identity Concepts, Microsoft Entra Capabilities, Microsoft Security Solutions, Microsoft Compliance Solutions.
Can I study on mobile?
Yes. CertCrush is fully responsive and works on phones, tablets, and desktops. The timed exam, flashcards, and study guide all work on mobile without installing an app.
What happens when I create an account?
Creating a free account lets you access full courses, track your weak areas by domain, and resume practice sessions across devices. No credit card is required to register.