EnglishDeutschFrançaisEspañolPortuguês

Microsoft · SC-900 · Fundamentals

Microsoft Security, Compliance, and Identity Fundamentals (SC-900) — Practice Questions and Mock Exam

The SC-900 certification demonstrates foundational knowledge of security, compliance, and identity concepts across Microsoft cloud services.

Practice for freeTry a practice question first
Try a practice question firstPractice for free
Start practicing SC-900 freeBuy SC-900 access for $29.99
50Questions per Pass-IT mock exam
45minPass-IT mock exam time limit

Official SC-900 exam: 700 out of 1000 points to pass.

Checked against Microsoft · September 2026 · Current exam version

Try Pass-IT

See what learning with Pass-IT is like.

Answer a SC-900 sample question and read the explanation with its source. Right here, with no sign-up.

Describe the capabilities of Microsoft security solutions1 / 5

Which Microsoft security solution is a cloud-native SIEM and SOAR solution that collects data at cloud scale, detects previously undetected threats, and responds to incidents with built-in orchestration and automation?

AlexFull explanation from Alex

Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution. It collects data at cloud scale from across the entire organization using 350+ built-in data connectors. Sentinel uses AI and machine learning to detect previously undetected threats, minimize false positives, and provide intelligent security analytics. Key capabilities include data collection, threat detection with analytics rules, investigation with incidents and entity mapping, and automated response with playbooks (Logic Apps). Exam tip: Sentinel = SIEM + SOAR. SIEM = collect and analyze security data. SOAR = automate responses with playbooks. Cloud-native means no infrastructure to deploy.

Sourcelearn.microsoft.com

Describe the capabilities of Microsoft compliance solutions3 / 5

Microsoft Purview Activity explorer shows which types of activities related to labeled and sensitive content?

AlexFull explanation from Alex

Microsoft Purview Activity explorer shows activities related to labeled and sensitive content including: labeling activities (labels applied, changed, removed), DLP policy matches (when content triggers a DLP rule), and sensitive content discoveries (when sensitive information types are detected in content). Activity explorer provides a historical view of user and system actions on classified data, helping compliance teams monitor data protection effectiveness and identify potential issues. It works with data from Exchange, SharePoint, OneDrive, and endpoint devices. Exam tip: Activity explorer shows three types: labeling activities, DLP matches, and SIT discoveries. It's different from Content explorer (shows what sensitive content exists) vs Activity explorer (shows what happened to it).

Sourcelearn.microsoft.com

Describe the capabilities of Microsoft Entra4 / 5

Which Microsoft Entra governance capability allows organizations to create bundles of resources (apps, groups, sites) that users can request access to through a self-service portal?

AlexFull explanation from Alex

Entitlement management access packages in Microsoft Entra ID allow organizations to create bundles of resources that users can request access to through a self-service portal. An access package can include multiple resources: applications, groups, SharePoint sites, and Teams. Each package has policies defining who can request, who approves, how long access lasts, and whether access reviews are required. This streamlines access governance by packaging related resources together — a new employee in sales can request the "Sales Team" access package to get all needed apps and groups in one request. Exam tip: Access packages = bundles of resources with request/approval policies. Catalogs organize packages. Policies define who, approval, duration, and review requirements.

Sourcelearn.microsoft.com

How to prepare for SC-900 with Pass-IT.

Currently 435 practice questions for SC-900, with new ones added regularly. Focus on what you still need to learn.

Get past difficult questions.

Understand why an answer is correct. Alex explains the concepts and answers your follow-up questions so you can apply what you learn to the next task.

Meet Alex →

Conversation preview · SC-900

Data residency

  1. You

    What does a requirement to store EU data inside the EU describe?

  2. Alex · AI tutor

    Data residency: the geographic location where the data is stored.

    Read the Microsoft documentation ↗
  3. You

    Is the question asking about encryption?

  4. Alex · AI tutor

    No. It specifies where data must reside at rest, rather than how it is encrypted.

    Read the Microsoft documentation ↗

Make your study time count.

Practice at your level.
For new practice sessions, Pass-IT adjusts the difficulty based on your previous answers.

Learn from mistakes.
Incorrect answers automatically become flashcards. When you review them, you rate how confidently you remember; Pass-IT schedules the next review.

See how focused practice works →

Animated feature preview

Turn your mistakes into knowledge you can rely on.

How Pass-IT works

Your review

Answered a question incorrectly?

Pass-IT saves it for your review.

SC-900 · Question excerpt

Data residency

View the full question

An organization has a compliance requirement that personal data for EU users be stored at rest within the European Union. Which concept does this represent?

Understand the correct answer.

Data residency

A geographic storage requirement is a data residency requirement.

Read the Microsoft documentation ↗

How confidently do you remember?

During review, you assess how well you still know the answer.

Correct after hesitating

Pass-IT schedules your next review.

The date depends on your self-assessment and previous reviews.

Simplified demonstration. No learning progress is saved.

Practice for the moment that counts.

Take a full mock exam with a time limit and find out whether you can finish in time.

Your SC-900 mock exam

Questions
50
Minutes
45

Illustration of an exam session

  1. Start
  2. Answer questions
  3. Finish

Length and time limit of the Pass-IT mock exam.

Go into your exam with more confidence.

Your Readiness Score helps you assess whether you are ready for the exam. Results by exam domain show you where you should keep practicing.

Your money back if you fail despite 80% Readiness.
If your Readiness Score is at least 80% when you take the exam and you still fail, we refund the Pass-IT purchase price for this certification.

For active, paid access. Submit proof of failing within 14 days.

Further guarantee conditions

You need at least 80% Readiness and active, paid access to the certification when you take the exam. Take the exam within your access period and submit official proof of failing within 14 days after the exam.

For purchases through Apple or Google, refunds are handled by the respective store. See the full terms for further details.

Read the guarantee terms →

The Readiness Score describes your practice progress, not a probability of passing.

Guarantee requirement

80%

At least 80% Readiness
when you take the exam

Money back if you fail

Question counts and mock exam settings from the current Pass-IT catalog.

Exam domains

What you practice for SC-900.

Exam topics, relevant practice and sources you can check.

Security, compliance and identity basics10–15% of the exam54 QuestionsPass-IT questions

Understand the principles behind protecting access, information and cloud services.

  • Explain shared responsibility, defense in depth and Zero Trust as approaches to organizing security controls.
  • Distinguish encryption from hashing and explain the role of governance, risk and compliance.
  • Explain why identity is a security boundary and distinguish authentication from authorization.
  • Describe identity providers, directory services, Active Directory and federation between identity systems.
Official Microsoft objectives
Identity and access with Microsoft Entra25–30% of the exam115 QuestionsPass-IT questions

This section covers identity types, sign-in protection and control over permissions in Microsoft Entra.

  • Describe Entra ID, its identity types including agent ID, and how hybrid identity connects cloud and on-premises identities.
  • Explain authentication methods, multifactor authentication and password protection and management.
  • Describe Conditional Access, Microsoft Entra roles and role-based access control.
  • Explain how Entra ID Governance, access reviews, Privileged Identity Management and ID Protection manage access and identity risks.
Official Microsoft objectives
Microsoft security services35–40% of the exam158 QuestionsPass-IT questions

Understand how Microsoft services protect infrastructure, detect threats and support a coordinated response.

  • Describe Azure DDoS Protection, Azure Firewall and Web Application Firewall, plus network segmentation through virtual networks and network security groups.
  • Explain how Azure Bastion supports protected remote access and how Key Vault safeguards keys, secrets and certificates.
  • Describe Defender for Cloud, cloud security posture management and workload protection, including the role of security policies, standards and recommendations.
  • Explain security information and event management (SIEM) and security orchestration and automated response (SOAR), and how Microsoft Sentinel detects and mitigates threats.
  • Describe Defender XDR and its portal, with Defender for Office 365, Endpoint, Cloud Apps and Identity, plus Vulnerability Management and Threat Intelligence.
Official Microsoft objectives
Compliance and information protection20–25% of the exam108 QuestionsPass-IT questions

This section covers Microsoft’s compliance resources and the controls used to protect and retain information.

  • Describe the Service Trust Portal’s resources and Microsoft’s privacy principles.
  • Explain the Microsoft Purview portal, Compliance Manager and the uses and benefits of compliance score.
  • Describe data classification, Content explorer and Activity explorer, sensitivity labels and policies, and data loss prevention.
  • Explain records management and the roles of retention policies, retention labels and retention label policies.
  • Describe insider risk management, eDiscovery and audit capabilities in Microsoft Purview.
Official Microsoft objectives
Question formats you can practice
Multiple Choice
Select one answer.
Multiple Response
Select multiple applicable answers.
True / False
Decide whether statements are true or false.
Drag & Drop
Match items to the appropriate targets.
Dropdown
Choose the appropriate entry from a dropdown list.

These are Pass-IT practice formats. Check the Microsoft certification page for the official exam information.

The ranges describe the weighting of exam topics. See Official Microsoft objectives for the current exam objectives.

Frequently asked questions

Your preparation

How much study time should I plan for SC-900?

For planning, Pass-IT estimates roughly 10–25 hours. Relevant experience may put you toward the lower end; starting from scratch may put you toward the higher end. Your needs may fall outside this range. This is not a time requirement from Microsoft or a promise that you will be exam-ready within that time.

Using Pass-IT

What language are Pass-IT questions in?

Questions in the app are currently in English. Translations of the sample questions on this page apply only to this preview. Check with Microsoft for the languages available for the official exam.

How long does my SC-900 access last?

Access covers this certification for 12 months. You pay once, with no automatic renewal.

When does the money-back guarantee apply?

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days. Guarantee terms

About the SC-900 exam

Where can I take the SC-900 exam?

Pearson VUE online proctored or at authorized testing centers worldwide.

How long is the Microsoft Security, Compliance, and Identity Fundamentals exam?

The SC-900 exam has 50 questions and a 45-minute time limit.

Does SC-900 expire?

No. Microsoft fundamentals certifications carry no expiry date and no renewal requirement, so SC-900 stays on your transcript once you pass it.

How long does it take to prepare for SC-900?

Around 15 hours is realistic. The heaviest area is Microsoft's security solutions at roughly 38%, with Entra capabilities near 28%, so time spent on the product portfolio pays off more than time spent on definitions.

What happens if you fail SC-900?

You can retake it after 24 hours. Each further attempt needs a 14-day wait, and you are capped at five attempts in any 12-month period.

Your preparation for SC-900

$29.99one-time

12 months of access for SC-900 · No automatic renewal

Buy SC-900 access

Questions in the app are currently in English.

Try 20 questions for freeFree account required. No credit card.

Already have an account? Log in

Prefer a subscription? View subscriptions →

Money back if you fail with at least 80% Readiness, for eligible purchases under the guarantee terms.

Guarantee terms

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days.

Full guarantee terms →

Related certifications

Administering Information Security in Microsoft 365Administering Microsoft Azure SQL SolutionsAdministering Windows ServerCollaboration Communications Systems EngineerAll Microsoft certifications →