Search...
Master key concepts with interactive flashcards
What are the three Zero Trust guiding principles?
Click to reveal answer
1. Verify explicitly — always authenticate and authorize using all available signals (identity, location, device, service, data, anomalies). 2. Use least privilege access — limit user access with Just-In-Time/Just-Enough-Access and risk-based adaptive policies. 3. Assume breach — minimize blast radius, segment access, verify end-to-end encryption, and use analytics to drive threat detection.
Click to show question
Security, Compliance, and Identity Fundamentals (SC-900) is a Microsoft certification. These facts come from the current exam guide and are the numbers to plan around.
| Domain | Weight | What to focus on |
|---|---|---|
| Describe the capabilities of Microsoft security solutions | 37% | Azure DDoS Protection and Azure Firewall, Web Application Firewall (WAF), Microsoft Defender for Cloud: CSPM and CWPP |
| Describe the capabilities of Microsoft Entra | 28% | Microsoft Entra ID (Azure AD) basics, Authentication methods: MFA, SSPR, FIDO2, Conditional Access policies |
| Describe the capabilities of Microsoft compliance solutions | 22% | Microsoft Purview compliance portal, Sensitivity labels and label policies, Data Loss Prevention (DLP) |
| Describe the concepts of security, compliance, and identity |
| 13% |
| Zero Trust model and principles, Shared responsibility model, Defense in depth |
Yes. You can start SC-900 practice and flashcards free without creating an account. A free account keeps your progress, and the full bank (300+ questions) unlocks with a subscription.
They cover all 4 domains of the SC-900 exam: Describe the capabilities of Microsoft security solutions (37%), Describe the capabilities of Microsoft Entra (28%), Describe the capabilities of Microsoft compliance solutions (22%), Describe the concepts of security, compliance, and identity (13%). Each section is weighted in the same proportion as the real exam, so nothing high-value is buried.
The SC-900 exam has approximately 50 questions in 60 minutes, with a passing score of 700. Use the practice questions to confirm you are consistently above that line before booking the real exam.
Study in short, spaced sessions: a card you have not seen for two days is worth more than a card you reread immediately. Filter by Describe the capabilities of Microsoft security solutions first, then mix domains so you practise identifying the topic before recalling the definition.
They are the recall half of preparation. Pair the cards with practice questions and at least one timed practice exam — candidates who only review cards usually recognise terms but miss scenario questions.