Microsoft · SC-900 · Fundamentals
Microsoft Security, Compliance, and Identity Fundamentals (SC-900) — Practice Questions and Mock Exam
Practice real SC-900 questions, never dumps. Alex explains every answer, and your readiness score tells you when you're ready to pass.
Checked against Microsoft · July 2026Current exam version
Overview
About the exam
The SC-900 certification demonstrates foundational knowledge of security, compliance, and identity concepts across Microsoft cloud services. It covers core security concepts, Zero Trust principles, Microsoft Entra identity services, Microsoft security solutions including Defender and Sentinel, and Microsoft compliance solutions including Purview and Compliance Manager. The exam validates broad conceptual understanding without requiring deep implementation skills.
This is an ideal starting point for anyone exploring security, compliance, and identity roles in the Microsoft ecosystem. It suits business professionals, IT generalists, students, and stakeholders who want to understand Microsoft's security and compliance capabilities before pursuing role-based certifications like SC-200 or SC-300.
Exam Domains
What's on the exam
The exam consists of 40–60 questions to be completed in approximately 45 minutes. Question types include multiple-choice, multiple-select, drag-and-drop, and hot area formats. Questions test conceptual understanding of security principles, identity services, and compliance tools rather than hands-on implementation. Pace yourself at roughly one minute per question as most questions are direct and concept-based.
Security and compliance concepts including shared responsibility, defense-in-depth, Zero Trust, encryption, and GRC; identity concepts including authentication, authorization, identity providers, and federation
Microsoft Entra ID function and identity types, authentication capabilities, access management capabilities, and identity protection and governance capabilities
Core Azure infrastructure security services, security management capabilities, Microsoft Sentinel capabilities, and Microsoft Defender XDR threat protection
Service Trust Portal, Compliance Manager, information protection, data lifecycle management, data governance, insider risk, eDiscovery, and audit capabilities in Microsoft Purview
SourceMicrosoft study guide
Format
What to expect
Watch out
Where candidates struggle
Despite being a fundamentals exam, SC-900 covers security, compliance, and identity — three broad domains. Candidates who focus on only one area while neglecting the others often miss questions on unfamiliar topics.
- 01Zero Trust Concepts — Not understanding the six foundational pillars of Zero Trust and how they apply to Microsoft's security product portfolio.
- 02Identity vs Security — Confusing Microsoft Entra identity features with Microsoft Defender security capabilities and their different purposes.
- 03Compliance Tools — Struggling to differentiate Compliance Manager, Purview, and Microsoft Priva and their specific compliance functions.
- 04Shared Responsibility — Overlooking the shared responsibility model across IaaS, PaaS, and SaaS and what Microsoft vs the customer manages.
- 05Defender Products — Mixing up the various Microsoft Defender products (for Endpoint, for Cloud, for Identity, for Office 365) and their coverage areas.
Details
Exam logistics
Delivered via Pearson VUE online or at testing centers. Available in English, Japanese, Chinese, Korean, French, German, Spanish, Portuguese, and more. This fundamentals certification does not expire and requires no renewal.
SourceMicrosoft exam page
Before you book the exam
Would you pass SC-900 today?
Take the free readiness check. Answer real SC-900 questions and get your readiness score across every domain.
Take the free readiness check20 questions · freeReach 80% readiness by exam day. Pass, or your money back.