How many free SC-900 practice questions can I try?

You can answer 10 SC-900 practice questions free without creating an account. Each one is graded instantly with a written explanation. A free account keeps your progress, and the full bank (300+ questions) unlocks with a subscription.

What topics does the SC-900 exam cover?

The SC-900 exam is organised into 4 domains: Describe the capabilities of Microsoft security solutions (37%), Describe the capabilities of Microsoft Entra (28%), Describe the capabilities of Microsoft compliance solutions (22%), Describe the concepts of security, compliance, and identity (13%). The weighting above shows how much of the exam each domain represents, so budget study time in the same proportion.

How long is the SC-900 exam and how is it scored?

The SC-900 exam has approximately 50 questions in 60 minutes, with a passing score of 700. Practice sets here are scored the same way as the real exam so you can see whether you are above or below the line before test day.

How should I start studying for Security, Compliance, and Identity Fundamentals (SC-900)?

Start with Describe the capabilities of Microsoft security solutions, the highest-weighted domain, then work down the list. Answer a mixed set after each domain pass — mixing domains forces you to identify what a question is asking before recalling the content, which is what the real exam does.

Are these the same questions that appear on the real SC-900 exam?

No. These are original practice questions written against the published SC-900 exam objectives. They mirror the style, difficulty, and domain weighting of the real exam, but the actual exam content is confidential and is not reproduced here.

SC-900 Practice Questions — Security, Compliance

Domain	Exam weight	What it covers
Describe the capabilities of Microsoft security solutions	37%	Understand Microsoft security products for endpoint, cloud, and network protection
Describe the capabilities of Microsoft Entra	28%	Understand Microsoft Entra ID authentication, identity governance, and access management
Describe the capabilities of Microsoft compliance solutions	22%	Understand Microsoft Purview compliance tools and governance solutions
Describe the concepts of security, compliance, and identity	13%	Understand core security, compliance, and identity concepts and principles

Sample question 1 — Describe the capabilities of Microsoft security solutions

A three-tier application runs in a single Azure virtual network, and the database tier must accept connections only from the application tier subnet on a specific port. The team wants the simplest stateful filtering at the subnet level. Which control should the team apply?

A. A network security group with rules for the subnet and port.
B. An Azure Firewall policy with application and network rules.
C. A web application firewall attached to the application gateway.
D. Azure DDoS Protection tuned to the virtual network.

Answer: A. Option A is correct because a network security group applies stateful allow and deny rules to a subnet or network interface and can restrict the database port to a source subnet. Option B is incorrect because Azure Firewall is a separate managed appliance that adds cost and complexity here. Option D is incorrect because DDoS Protection defends against volumetric floods. Option C is incorrect because a web application firewall protects HTTP traffic rather than database ports.

Sample question 2 — Describe the capabilities of Microsoft compliance solutions

A pharmaceutical sponsor must guarantee that any document holding a trial participant identifier stays encrypted and permission-restricted wherever it ends up, including a copy that a contractor saves to a personal laptop outside the tenant. Which Microsoft Purview capability meets that requirement?

A. Insider risk management, which scores user activity to surface potentially risky data-handling behaviour.
B. Audit search, which lets an investigator establish who opened the document and when that access happened.
C. Retention policies, which keep the document for the mandated period and remove it once that period ends.
D. Sensitivity labels with encryption, which bind protection and usage rights to the file wherever it

Answer: D. Option D is correct. A sensitivity label that applies encryption embeds the protection and the usage rights in the file itself, so the restriction travels with the copy and an unauthorized reader is refused even on a machine the organization does not manage. Option C is wrong because retention decides how long an item must survive and when it may be purged, without controlling who can read it. Option A is wrong because insider risk management produces signals about behaviour after the fact. Option B is wrong because an audit trail records access that already occurred and cannot prevent the next one.

Sample question 3 — Describe the concepts of security, compliance, and identity

A retailer's security lead is briefing the board on Zero Trust. Today the corporate network is treated as safe: once a laptop reaches the internal VPN, it can open any line-of-business application with no further evaluation. The lead needs to describe the guiding principle that has to replace that arrangement. Which statement reflects a core Zero Trust principle?

A. Every access request is verified explicitly using identity, device health, and other available
B. One strong authentication performed at VPN connection time is sufficient for the whole session.
C. Traffic that originates inside the corporate network may be treated as trustworthy by default.
D. Encrypting internal traffic removes any need to evaluate who is making a particular request.

Answer: A. Option A is correct. Verify explicitly is one of the three Zero Trust principles, alongside least privilege access and assume breach: every request is authenticated and authorized against all the signals available, including the identity, the health of the device, and the sensitivity of the resource. Option D is wrong because confidentiality in transit says nothing about whether the caller should be allowed in at all. Option B is wrong because a one-time check at connection cannot react to a session that is later hijacked or to a device that falls out of compliance. Option C is wrong because implicit network trust is precisely the assumption Zero Trust discards.

Security, Compliance, and Identity Fundamentals (SC-900) Practice Questions

Security, Compliance, and Identity Fundamentals (SC-900) Practice Questions

How the SC-900 exam is structured

Worked sample SC-900 questions