PracticeVideosBlogFlashcards
All Practice Exams

Free Practice Questions for Microsoft SC-900

Exam-style questions and explanations by OpenExamPrep.

✓ No registration✓ No credit card
100+ Questions
100% Free

Loading practice questions...

Same family resources

Explore More Microsoft Certifications

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

Microsoft Power BI Data Analyst

Practice Questions316 questionsStudy Guide40 topicsCheat Sheet74 factsFlashcards50 cardsGames40 termsFeedCourse Playlist63 videosVideos4 videosBlogs4 blogs

Microsoft 365 Administrator Expert (MS-102)

Practice Questions300 questionsStudy Guide57 topicsCheat Sheet96 factsFlashcards50 cardsGames20 termsFeedVideos3 videosBlogs3 blogs

Microsoft 365 Endpoint Administrator (MD-102)

Practice Questions312 questionsStudy Guide24 topicsCheat Sheet120 factsFlashcards50 cardsGames43 termsFeedVideos2 videosBlogs2 blogs

Microsoft Certified: Information Security Administrator Associate (SC-401)

Practice Questions215 questionsStudy Guide68 topicsFeedVideos2 videosBlogs2 blogs

Microsoft Power Platform Functional Consultant

Practice Questions212 questionsStudy Guide57 topicsFeedVideos2 videosBlogs2 blogs

Microsoft Power Platform Developer (PL-400)

Practice Questions350 questionsStudy Guide50 topicsCheat Sheet122 factsFlashcards50 cardsFeedVideos1 videoBlogs1 blog

More From This Family

Videos and articles for deeper review.

VideoSC-900 Exam Guide 2026: Pass Microsoft Security Cert FREEThis examVideoFREE DP-600 Exam Guide 2026: Pass Microsoft Fabric Analytics Engineer (Direct Lake, DAX, Semantic Models)VideoFREE MD-102 Exam Guide 2026: Pass Microsoft Endpoint Administrator (Intune, Autopilot, Windows 11)VideoFREE MS-102 Exam Guide 2026: Pass Microsoft 365 Administrator (Entra, Defender XDR, Purview)ArticleSC-900 Exam Guide 2026: Pass Microsoft Security Cert FREE28 min readArticleMS-900 Retired 2026: FREE Guide + AB-900 Pivot17 min readArticlePL-900 Exam Guide 2026: Current Outline and Free Prep19 min readArticlePL-200 Exam Guide 2026: Skills, Retirement, and Renewal12 min read
Exam Review

Key Facts: Microsoft SC-900 Exam

700/1000

Passing Score

Microsoft

40-60

Questions

Microsoft

45 min

Time Limit

Microsoft

$99

Exam Fee

USD

20-30 hrs

Study Time

Recommended

4

Exam Domains

Microsoft study guide

Sample Microsoft SC-900 Practice Questions

Try these sample questions to review concepts for the Microsoft SC-900 exam. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1Which statement best describes the cloud shared responsibility model?
A.The cloud provider is responsible for all security regardless of service model
B.Security responsibilities are divided between the cloud provider and the customer based on the service model
C.The customer is always responsible for the physical datacenter
D.Responsibility shifts entirely to the customer once data is uploaded
Explanation: The shared responsibility model splits responsibilities between the cloud provider and customer. The provider always handles physical hosts, network, and datacenter. The customer always owns information and data, devices, and accounts/identities. Other responsibilities (OS, network controls, applications) shift between the parties depending on whether the service is IaaS, PaaS, or SaaS.
2Under the shared responsibility model, who is ALWAYS responsible for information and data, devices, and accounts/identities?
A.The cloud provider
B.The customer
C.It depends on the service model
D.A neutral third party
Explanation: Across IaaS, PaaS, and SaaS, the customer always retains responsibility for information and data, devices (mobile and PCs), and accounts and identities. The cloud provider is always responsible for the physical hosts, network, and datacenter.
3What is the core idea behind a defense in depth strategy?
A.Rely on a single strong perimeter firewall
B.Use multiple layers of security controls so no single failure exposes the asset
C.Encrypt data only when it leaves the network
D.Replace all on-premises controls with cloud-native ones
Explanation: Defense in depth uses a layered approach (physical, identity and access, perimeter, network, compute, application, data) so that if one control fails another still protects the asset. It avoids single points of failure in a security architecture.
4Which three principles form the foundation of the Zero Trust model?
A.Trust but verify, encrypt everything, audit annually
B.Verify explicitly, use least privilege access, assume breach
C.Build perimeter, monitor logs, patch systems
D.Block by default, allow by exception, log everything
Explanation: The three Microsoft Zero Trust guiding principles are Verify Explicitly (always authenticate and authorize using all available signals), Use Least Privilege Access (just-in-time and just-enough access), and Assume Breach (segment, encrypt, and use analytics to detect threats).
5Which Zero Trust principle is best illustrated by network microsegmentation and end-to-end encryption?
A.Verify explicitly
B.Use least privilege access
C.Assume breach
D.Trust internal traffic
Explanation: Assume Breach drives the use of microsegmentation, end-to-end encryption, and continuous analytics. The premise is that an attacker may already be inside, so you limit blast radius and continuously inspect activity.
6What does the C in the CIA triad stand for?
A.Compliance
B.Confidentiality
C.Continuity
D.Cryptography
Explanation: The CIA triad consists of Confidentiality (protecting data from unauthorized disclosure), Integrity (preventing unauthorized modification), and Availability (ensuring authorized users can access data when needed).
7Which CIA triad property is violated when an attacker tampers with a database record?
A.Confidentiality
B.Integrity
C.Availability
D.Authenticity
Explanation: Integrity ensures data is not changed in unauthorized ways. Tampering with records is an integrity violation. Confidentiality is about disclosure, and availability is about access.
8Which encryption state protects data while it is stored on disk in a database or storage account?
A.Encryption in transit
B.Encryption at rest
C.Encryption in use
D.Encryption in motion
Explanation: Encryption at rest protects stored data on disks, databases, or storage accounts. Encryption in transit protects data moving between systems (for example TLS). Encryption in use protects data while it is being processed in memory (for example confidential computing).
9Which technology is most associated with encryption in use?
A.TLS 1.3
B.BitLocker
C.Confidential computing using trusted execution environments
D.Storage Service Encryption
Explanation: Encryption in use protects data while it is being processed. Azure confidential computing uses hardware-based trusted execution environments (TEEs) such as Intel SGX or AMD SEV-SNP to keep data encrypted in memory during processing. TLS protects in transit, BitLocker and SSE protect at rest.
10Which statement correctly distinguishes hashing from encryption?
A.Hashing is reversible with the right key; encryption is one-way
B.Hashing is one-way and produces a fixed-length value; encryption is reversible with a key
C.Hashing requires a public and private key; encryption only requires a password
D.Hashing and encryption are interchangeable terms
Explanation: Hashing is a one-way function that produces a fixed-length digest from arbitrary input and cannot be reversed. It is used for integrity verification and password storage. Encryption is reversible by anyone with the correct key and is used to keep data confidential.

About the Microsoft SC-900 Exam

Foundational certification that validates understanding of security, compliance, and identity (SCI) concepts and the related Microsoft Entra, Microsoft Defender, Microsoft Sentinel, and Microsoft Purview capabilities across Azure and Microsoft 365.

Exam sponsor: Microsoft. The requirements and fees below concern the certification or admission exam, separate from our free practice resources.

Assessment

Question count not published by the exam provider

Time Limit

45 minutes

Passing Score

700/1000

Exam / Certification Fees

$99 USD

Exam sponsor website

Fees, eligibility, and exam policies can change. Confirm them with the exam sponsor before applying or paying.

Our practice resources: topics covered

We aim to reflect publicly available exam outlines and topic information in our study resources. Coverage, format, and difficulty may differ from the actual exam, and we cannot guarantee that every detail is accurate or current. Confirm exam requirements, fees, and policies with the official exam sponsor.

10-15%

Security, Compliance, and Identity Concepts

Shared responsibility, defense-in-depth, Zero Trust, encryption and hashing, GRC concepts, identity as the primary security perimeter, authentication, authorization, identity providers, directory services, federation

25-30%

Microsoft Entra Capabilities

Entra ID, identity types, hybrid identity, authentication methods, MFA, password protection, Conditional Access, roles and RBAC, ID Governance, access reviews, Privileged Identity Management, ID Protection

35-40%

Microsoft Security Solutions

Azure DDoS Protection, Azure Firewall, Azure WAF, network segmentation, NSGs, Azure Bastion, Azure Key Vault, Defender for Cloud, CSPM, Microsoft Sentinel, Microsoft Defender XDR services

20-25%

Microsoft Compliance Solutions

Service Trust Portal, Microsoft privacy principles, Purview portal, Compliance Manager, data classification, sensitivity labels, DLP, records management, retention, insider risk, eDiscovery, Audit

Preparing for the Microsoft SC-900 Exam

What You Need to Know

  • Passing score: 700/1000
  • Assessment: Question count not published by the exam provider
  • Time limit: 45 minutes
  • Exam / certification fees: $99 USD Official sources

Using Our Practice Resources

  • Work through all 100 available questions
  • Review every answer and explanation
  • Track weak areas and revisit them
  • Use our AI tutor for tough concepts

Microsoft SC-900: Suggested Study Strategy

1Memorize the three Zero Trust principles: Verify Explicitly, Use Least Privilege Access, and Assume Breach
2Know the difference between Defender for Cloud (Azure CSPM/CWPP) and Defender for Cloud Apps (Microsoft 365 CASB)
3Distinguish Microsoft Sentinel (cloud-native SIEM/SOAR) from Microsoft Defender XDR (cross-domain XDR)
4Be able to pick between sensitivity labels (classification + protection) and retention labels (lifecycle) for a given scenario
5Study the compliance skill area: Compliance Manager, sensitivity labels, DLP, records management, retention, insider risk, eDiscovery, and audit
6Use Microsoft branding correctly: Microsoft Entra ID (not Azure AD) and Microsoft Sentinel (not Azure Sentinel)

Frequently Asked Questions

What is the Microsoft SC-900 exam?

The SC-900 (Microsoft Security, Compliance, and Identity Fundamentals) is an entry-level certification that validates understanding of security, compliance, and identity concepts and how Microsoft Entra, Microsoft Defender, Microsoft Sentinel, and Microsoft Purview deliver them across Azure and Microsoft 365.

How many questions are on the SC-900 exam?

Microsoft does not publish an exact question count for SC-900; it says most certification exams typically contain 40-60 questions. You have 45 minutes to complete the exam. The passing score is 700 out of 1000.

How long should I study for SC-900?

Most candidates need 20-30 hours of study over 2-4 weeks. Focus on Microsoft security solutions (35-40%) and Microsoft Entra capabilities (25-30%), the two largest skill areas on the exam.

What topics are covered on the SC-900 exam?

The SC-900 exam covers four skill areas: SCI concepts (10-15%), Microsoft Entra capabilities (25-30%), Microsoft security solutions (35-40%), and Microsoft compliance solutions (20-25%).

Is Microsoft SC-900 worth it?

Yes. SC-900 is the recommended starting point for anyone moving into Microsoft security, compliance, or identity roles. It establishes vocabulary needed for SC-200 (Security Operations), SC-300 (Identity and Access), SC-401 (Information Security Administrator, which replaced SC-400), and SC-500 (Cloud and AI Security Engineer, which replaced AZ-500 on August 31, 2026).

What is the difference between SC-900 and SC-500?

SC-900 is a fundamentals exam testing conceptual knowledge of Microsoft SCI solutions across Azure and Microsoft 365. SC-500, which replaced AZ-500 on August 31, 2026, is an associate-level Cloud and AI Security Engineer exam that expects hands-on experience securing cloud and AI workloads. SC-900 is a useful foundation before SC-500.