Microsoft · SC-900 · Fundamentals

Microsoft Security, Compliance, and Identity Fundamentals (SC-900) — Practice Questions and Mock Exam

Name: Pass-IT
Author: Pass-IT

Prepare for SC-900 with original practice questions and clear answer explanations. Ask Alex, your AI tutor, when you need more detail, use your results to identify topics to review, and practice your pacing with timed mock exams.

Start practicing SC-900 free Buy SC-900 access for $29.99

Buy SC-900 access for $29.99 Start practicing SC-900 free

50Mock exam questions

45minTime limit

700/ 1000Passing score

Checked against Microsoft · September 2026 · Current exam version

Overview

About the exam

The SC-900 certification demonstrates foundational knowledge of security, compliance, and identity concepts across Microsoft cloud services. It covers core security concepts, Zero Trust principles, Microsoft Entra identity services, Microsoft security solutions including Defender and Sentinel, and Microsoft compliance solutions including Purview and Compliance Manager. The exam validates broad conceptual understanding without requiring deep implementation skills.

This is an ideal starting point for anyone exploring security, compliance, and identity roles in the Microsoft ecosystem. It suits business professionals, IT generalists, students, and stakeholders who want to understand Microsoft's security and compliance capabilities before pursuing role-based certifications like SC-200 or SC-300.

Try the practice preview

Try five SC-900 questions

Try five practice questions from the app’s current Microsoft Security, Compliance, and Identity Fundamentals question bank, with answers and explanations.

Describe the capabilities of Microsoft security solutions1 / 5

Which Microsoft security solution is a cloud-native SIEM and SOAR solution that collects data at cloud scale, detects previously undetected threats, and responds to incidents with built-in orchestration and automation?

AlexFull explanation from Alex

Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution. It collects data at cloud scale from across the entire organization using 350+ built-in data connectors. Sentinel uses AI and machine learning to detect previously undetected threats, minimize false positives, and provide intelligent security analytics. Key capabilities include data collection, threat detection with analytics rules, investigation with incidents and entity mapping, and automated response with playbooks (Logic Apps). Exam tip: Sentinel = SIEM + SOAR. SIEM = collect and analyze security data. SOAR = automate responses with playbooks. Cloud-native means no infrastructure to deploy.

Sourcelearn.microsoft.com

Describe the capabilities of Microsoft compliance solutions3 / 5

Microsoft Purview Activity explorer shows which types of activities related to labeled and sensitive content?

AlexFull explanation from Alex

Microsoft Purview Activity explorer shows activities related to labeled and sensitive content including: labeling activities (labels applied, changed, removed), DLP policy matches (when content triggers a DLP rule), and sensitive content discoveries (when sensitive information types are detected in content). Activity explorer provides a historical view of user and system actions on classified data, helping compliance teams monitor data protection effectiveness and identify potential issues. It works with data from Exchange, SharePoint, OneDrive, and endpoint devices. Exam tip: Activity explorer shows three types: labeling activities, DLP matches, and SIT discoveries. It's different from Content explorer (shows what sensitive content exists) vs Activity explorer (shows what happened to it).

Sourcelearn.microsoft.com

Describe the capabilities of Microsoft Entra4 / 5

Which Microsoft Entra governance capability allows organizations to create bundles of resources (apps, groups, sites) that users can request access to through a self-service portal?

AlexFull explanation from Alex

Entitlement management access packages in Microsoft Entra ID allow organizations to create bundles of resources that users can request access to through a self-service portal. An access package can include multiple resources: applications, groups, SharePoint sites, and Teams. Each package has policies defining who can request, who approves, how long access lasts, and whether access reviews are required. This streamlines access governance by packaging related resources together — a new employee in sales can request the "Sales Team" access package to get all needed apps and groups in one request. Exam tip: Access packages = bundles of resources with request/approval policies. Catalogs organize packages. Policies define who, approval, duration, and review requirements.

Sourcelearn.microsoft.com

Create a free account

Question pool

436 practice questions

The Pass-IT question pool gives you material to practice for SC-900. A Pass-IT mock exam uses 50 questions and a 45-minute time limit; these are practice settings.

Pool details: SC-900

Exam details checked against MicrosoftSeptember 3, 2026

date of the last check against the official Microsoft source

Passing score700 / 1,000

as published by Microsoft

Objectives in the guide72 objectives listed in the official guide

across 4 domains in the official exam guide

Pool size436 questions

= The pool size is equivalent to 8 sets of 50 questions; this does not mean that each mock exam uses a separate set.

Blueprint domains4 domains in the exam blueprint

Describe the concepts of security, compliance, and identity 55 · Describe the capabilities of Microsoft Entra 115 · Describe the capabilities of Microsoft security solutions 158 · Describe the capabilities of Microsoft compliance solutions 108

Recorded as checked against sources436 of 436

questions recorded as having their answer, options, and explanation checked against official Microsoft documentation

How questions are made →

Exam domains

What's on the exam

Microsoft security solutions carry the most weight at 35–40% — core Azure infrastructure security, Sentinel, and Defender XDR make up more than a third of the exam on their own. Microsoft Entra capabilities follow at 25–30%, compliance solutions at 20–25%, and foundational security/compliance/identity concepts trail at just 10–15%.

The weighting means SC-900 rewards breadth across Microsoft's security product line over depth in Zero Trust theory: knowing what Sentinel, Defender for Endpoint, and Defender for Cloud each do outweighs being able to define the six Zero Trust pillars. Candidates who study identity and compliance concepts thoroughly but treat the security-solutions domain as a vocabulary list are underprepared for the largest single domain on the exam.

Exam blueprint: SC-900

Describe the concepts of security, compliance, and identity10–15%

Security and compliance concepts including shared responsibility, defense-in-depth, Zero Trust, encryption, and GRC; identity concepts including authentication, authorization, identity providers, and federation

≈ 2 h

Describe the capabilities of Microsoft Entra25–30%

Microsoft Entra ID function and identity types, authentication capabilities, access management capabilities, and identity protection and governance capabilities

≈ 4 h

Describe the capabilities of Microsoft security solutions35–40%

Core Azure infrastructure security services, security management capabilities, Microsoft Sentinel capabilities, and Microsoft Defender XDR threat protection

≈ 6 h

Describe the capabilities of Microsoft compliance solutions20–25%

Service Trust Portal, Compliance Manager, information protection, data lifecycle management, data governance, insider risk, eDiscovery, and audit capabilities in Microsoft Purview

≈ 3 h

Format

Exam format and question types

The exam draws 40–60 questions from a mix of multiple-choice, multiple-select, drag-and-drop, and hot-area formats inside a 45-minute window. Questions test whether you can match a security, compliance, or identity concept to the Microsoft product that implements it, rather than how to configure that product. Most items are direct and conceptual, so the time pressure sits lower than on the associate-level security exams.

Question types: SC-900

Multiple Choice42%

Select the single answer that best meets the question’s requirements.

Drag & Drop18%

Move items into the slots, groups, or sequence specified by the task.

Multiple Response18%

Select multiple answers. Follow the question’s instructions on how many to choose.

Dropdown12%

Choose options from dropdown menus to complete a statement or configuration.

True / False10%

Decide whether a statement is true or false, paying attention to its conditions and wording.

See Microsoft for official question-format information. The shares shown describe the Pass-IT practice pool; they do not establish the proportions on the official exam.

Planning

Preparing for SC-900

The exam runs through Pearson VUE, either online with a remote proctor or at an authorized testing center, and is offered in English, Japanese, Chinese, Korean, French, German, Spanish, Portuguese, and several other languages. Fundamentals certifications don't expire, so there's no renewal cycle to track.

Preparation and logistics: SC-900

Preparation

Illustrative study time10–25 h

illustrative planning range: 10 h with relevant experience to 25 h when starting out; your needs may fall outside this range

LevelFundamentals

Taking and maintaining the certification

DeliveryPearson VUE online proctored or at authorized testing centers worldwide

Retake policy24-hour wait after the first attempt, 14 days between subsequent attempts, maximum 5 attempts per exam within a 12-month period

Certification validityFundamentals certifications do not expire and do not require renewal. However, Microsoft recommends staying current with evolving security and compliance services.

Official guideView on provider site

Study notes

Common pitfalls

Topics to review: SC-900

01Zero Trust Concepts
Not understanding the six foundational pillars of Zero Trust and how they apply to Microsoft's security product portfolio.
02Identity vs Security
Confusing Microsoft Entra identity features with Microsoft Defender security capabilities and their different purposes.
03Compliance Tools
Struggling to differentiate Compliance Manager, Purview, and Microsoft Priva and their specific compliance functions.
04Shared Responsibility
Overlooking the shared responsibility model across IaaS, PaaS, and SaaS and what Microsoft vs the customer manages.
05Defender Products
Mixing up the various Microsoft Defender products (for Endpoint, for Cloud, for Identity, for Office 365) and their coverage areas.

Practice with questions and explanations in Pass-IT →

Questions

Frequently asked questions

How long is the Microsoft Security, Compliance, and Identity Fundamentals exam?

The SC-900 exam has 50 questions and a 45-minute time limit.

What is the passing score for Microsoft Security, Compliance, and Identity Fundamentals?

The passing score for the SC-900 exam is 700 / 1000.

Which pitfalls should I review when preparing for Microsoft Security, Compliance, and Identity Fundamentals?

Topics to review include Zero Trust Concepts, Identity vs Security, Compliance Tools, Shared Responsibility, Defender Products. Work through examples to check that you understand the distinctions and can explain your answer.

Does SC-900 expire?

No. Microsoft fundamentals certifications carry no expiry date and no renewal requirement, so SC-900 stays on your transcript once you pass it.

What should you take after SC-900?

SC-200 for security operations, SC-300 for identity and access, or SC-401 for information security. SC-900 covers the concepts those three assume, which is why it is commonly taken first even though none of them require it.

How long does it take to prepare for SC-900?

Around 15 hours is realistic. The heaviest area is Microsoft's security solutions at roughly 38%, with Entra capabilities near 28%, so time spent on the product portfolio pays off more than time spent on definitions.

What happens if you fail SC-900?

You can retake it after 24 hours. Each further attempt needs a 14-day wait, and you are capped at five attempts in any 12-month period.

One certification, 12 months

Practice for SC-900

Focus your practice on one certification, or choose Pro to practice across all certifications.

Buy SC-900 access for $29.99

Start a free practice sessionTry the first 20 questions without a card to see whether the practice suits you.

For eligible purchases: money-back guarantee if you fail your exam.

View guarantee terms →