Try Microsoft SC-900
Get a taste before you commit — no account needed. Then a free account unlocks 25 questions with readiness tracking, no card required.
Get full access to Microsoft SC-900
All questions, timed exams, flashcards, PDF study guide download & progress tracking.
This course
$9.99
one-time
Monthly
$12.99
per month · all courses
Takes 30 seconds — create a free account, then straight to checkout. Already have an account? Sign in
Microsoft · Exam reference
About the Microsoft SC-900 exam
Microsoft SC-900 (Security, Compliance, and Identity Fundamentals) is the entry point into the Microsoft security stack, covering Zero Trust, Microsoft Entra, Defender, Sentinel and Purview. This course gives you the practice questions, flashcards and study guide you need to walk into the exam knowing exactly what each service does and when it applies.
10
Sample questions
45 min
Exam time limit
70%
Passing score
$99
Exam voucher
SC-900 is the exam that finally makes the Microsoft security portfolio make sense. Microsoft sells security under a dozen brand names that all sound alike, and the single hardest part of this exam is not difficulty, it is telling Defender for Cloud apart from Defender for Cloud Apps, or knowing where Purview stops and Entra begins. SC-900 is the fundamentals certification that draws those boundaries for you, and it is why business stakeholders, career changers and seasoned IT professionals moving into a Microsoft shop all sit it. The exam covers four areas. You start with the vendor-neutral groundwork: shared responsibility, defence in depth, Zero Trust, encryption and hashing, and governance, risk and compliance. Then Microsoft Entra, which is the largest identity block on the exam and covers identity types including agent ID, hybrid identity, authentication methods and MFA, Conditional Access, RBAC, ID Governance, access reviews, Privileged Identity Management and ID Protection. The biggest slice is Microsoft security solutions: Azure DDoS Protection, Azure Firewall, Web Application Firewall, network segmentation, NSGs, Bastion, Key Vault, Defender for Cloud and CSPM, Microsoft Sentinel as SIEM and SOAR, and the whole Defender XDR family. Finally compliance: the Service Trust Portal, Microsoft privacy principles, Compliance Manager and compliance score, sensitivity labels, DLP, records management, retention, insider risk management, eDiscovery and audit. Nothing here asks you to configure anything in anger. Almost every objective begins with the word describe. What the exam wants is recognition: given a business requirement, name the Microsoft service that meets it. That is a memory and vocabulary problem, and it is exactly the kind of problem practice questions solve.
Exam Domains Covered
Exam Format & Details
45 minutes, roughly 40 to 60 questions, delivered online or at a Pearson VUE test centre. You need a scaled score of 700 out of 1000 to pass, which the app tracks as 70 percent. Most items are multiple choice and multiple response, and Microsoft confirms the exam may include interactive components such as drag and drop (matching), build list (ordering) and active screen (configuration) items. There are no labs on a Fundamentals exam. The voucher is 99 USD in the United States and is priced regionally elsewhere. Book through Pearson VUE from the Microsoft Learn exam page, or through Certiport if you are a student or educator. The exam has no prerequisites and the certification does not expire.
Why Practice Questions Matter
SC-900 is a naming exam. The concepts are approachable, but the service catalogue is enormous and deliberately confusable, and 45 minutes leaves under a minute per question, so recall has to be instant rather than reasoned out. Practice questions are the only efficient way to build that recall, because they force you to choose between Defender for Endpoint and Defender for Identity, or between a retention label and a sensitivity label, under the same time pressure the real exam applies. Working through several hundred scenario-framed questions turns a long list of product names into a set of reflexes, and the explanations tell you why the near-miss answer was wrong.
Sample Practice Questions
The following questions are a preview of the type of syllabus-aligned questions you will practise in CertCrush. They reflect the format and reasoning style of the Microsoft SC-900 exam — not actual exam content.
Q1.A company runs a virtual machine on an IaaS platform. Under the shared responsibility model, who is responsible for patching the guest operating system?
- A.The customer
- B.The cloud provider
- C.Shared equally with no clear owner
- D.Whoever configured the virtual network
Domain: Security, Compliance, and Identity Concepts
Q2.A team builds an application on a PaaS offering. Using the study guide's "fully staffed commercial kitchen" analogy, what does Microsoft continue to manage that the team does not?
- A.The operating system and underlying runtime
- B.The application code and business logic
- C.The organization's data
- D.Who is allowed access to the application
Domain: Security, Compliance, and Identity Concepts
Q3.An organization runs its own servers, operating systems, applications, and data entirely in its own building with no cloud provider involved. Under the shared responsibility model, what best describes this setup?
- A.The organization manages everything itself
- B.Microsoft manages the hardware while the organization manages the rest
- C.The split is identical to SaaS
- D.Responsibility is shared equally with a third-party host
Domain: Security, Compliance, and Identity Concepts
Q4.Which security model is built on the principle of "never trust, always verify," where no user or device is automatically trusted just because it is inside the network?
- A.Zero Trust
- B.Defense-in-depth
- C.Shared responsibility model
- D.Data residency
Domain: Security, Compliance, and Identity Concepts
Q5.Which process runs data through an algorithm to produce a fixed-length string used to verify that the data has not changed, and cannot be reversed back into the original data?
- A.Hashing
- B.Encryption
- C.Data residency
- D.Defense-in-depth
Domain: Security, Compliance, and Identity Concepts
Frequently Asked Questions
What is included in the free Microsoft SC-900 sample?
The free sample includes 10 syllabus-aligned practice questions, sample flashcards, and a preview chapter from the study guide. No account or payment is required to try the sample.
How many questions are in the full Microsoft SC-900 course?
The full course includes a comprehensive question bank covering all exam domains. You can see the total question count on the Microsoft SC-900 course page.
Are these official Microsoft exam questions?
No. CertCrush questions are independently written and syllabus-aligned — they mirror the format, difficulty, and reasoning style of the official exam. We are not affiliated with or endorsed by Microsoft.
Which domains does the Microsoft SC-900 course cover?
The course covers 4 exam domains: Security, Compliance, and Identity Concepts, Microsoft Entra Capabilities, Microsoft Security Solutions, Microsoft Compliance Solutions.
Can I study on mobile?
Yes. CertCrush is fully responsive and works on phones, tablets, and desktops. The timed exam, flashcards, and study guide all work on mobile without installing an app.
What happens when I create an account?
Creating a free account lets you access full courses, track your weak areas by domain, and resume practice sessions across devices. No credit card is required to register.