Microsoft SC-900: Security, Compliance & Identity Fundamentals Practice Exam
Cover all four SC-900 skill areas — SCI concepts, Microsoft Entra, Microsoft security solutions, and Microsoft compliance solutions — with objective-mapped practice questions, immediate feedback in Learn mode, and full timed simulation in Exam mode.
Start 24-hour free trial →SC-900 exam at a glance
- Vendor
- Microsoft (Security)
- Exam code
- SC-900
- Certification
- Microsoft Certified: Security, Compliance, and Identity Fundamentals
- Level
- Fundamentals (foundational, no coding)
- Blueprint
- Skills measured as of July 28, 2026 (current edition)
- Format
- Typically 40–60 questions; multiple choice, multiple response, drag-and-drop, and scenario-based items
- Duration
- 45 minutes seat time (about 60 minutes total appointment)
- Passing score
- 700 of 1000 (scaled, not a raw percentage)
- Delivery
- Pearson VUE test center or online proctored
- Prerequisites
- None. Familiarity with Azure and Microsoft 365 is helpful but not required
- Cost (USD)
- $99 USD list price (varies by region)
- Validity
- Does not expire — Microsoft Fundamentals certifications are lifetime
Source: Microsoft Learn — SC-900 study guide (skills measured) and the Security, Compliance, and Identity Fundamentals certification page. Verify current details with Microsoft before scheduling.
About the Microsoft Certified: Security, Compliance, and Identity Fundamentals certification
SC-900 is Microsoft’s foundational credential for security, compliance, and identity (SCI) across Microsoft’s cloud services. It validates a broad, conceptual understanding of core security principles — the shared responsibility model, defense-in-depth, and Zero Trust — and of how Microsoft’s identity (Microsoft Entra), security (Azure infrastructure, Defender, Sentinel), and compliance (Microsoft Purview) solutions fit together. It is deliberately non-technical: no coding or hands-on configuration is required, which makes it popular with business stakeholders, IT professionals moving toward security, and career changers entering the field.
SC-900 is an active exam and remains one of the most popular security fundamentals credentials. Its blueprint was refreshed on July 28, 2026, with only minor changes — the four areas and their weightings are unchanged, and Microsoft added coverage of newer identity types (including agent identities) to the Entra area, reflecting the move toward securing AI agents. For deeper study on the concepts SC-900 introduces, the security fundamentals pair naturally with the role-based SC certifications listed below.
Every PowerKram practice question maps to one of the four SC-900 skill areas and links to the specific Microsoft Learn page it was derived from, so your weak spots become a focused reading list rather than a guess.
SC-900 skill areas and weights (July 2026 blueprint)
Four skill areas, with Microsoft security solutions the single heaviest at 35–40%. Microsoft published each area as a weighting range rather than an exact percentage; the ranges below are reproduced as Microsoft stated them in the current edition.
Core Azure infrastructure security (DDoS Protection, Azure Firewall, Web Application Firewall, network segmentation and NSGs, Azure Bastion, Key Vault); Microsoft Defender for Cloud and Cloud Security Posture Management; Microsoft Sentinel (SIEM and SOAR); and threat protection across the Microsoft Defender XDR family.
Microsoft Entra ID and identity types (including hybrid identity and newer agent identities); authentication methods and multifactor authentication; access management with Conditional Access and role-based access control (RBAC); and identity protection and governance including Privileged Identity Management, access reviews, and ID Protection.
The Service Trust Portal and Microsoft’s privacy principles; compliance management with Microsoft Purview (Compliance Manager and compliance score); information protection and data lifecycle (data classification, sensitivity labels, data loss prevention, records and retention); and insider risk, eDiscovery, and audit in Purview.
Security and compliance concepts — the shared responsibility model, defense-in-depth, the Zero Trust model, encryption and hashing, and Governance, Risk, and Compliance (GRC); and identity concepts including identity as the primary security perimeter, authentication versus authorization, identity providers, directory services, and federation.
Source: Microsoft Learn — SC-900 study guide (skills measured, as of July 28, 2026). Microsoft published weightings as ranges; Microsoft security solutions is the heaviest area.
Who SC-900 is for
Security, Compliance & Identity Fundamentals suits anyone needing foundational literacy in Microsoft’s security stack, technical or not:
- Business stakeholders involved in security, compliance, or procurement decisions who need the vocabulary of the field.
- IT professionals moving toward security, identity, or compliance roles and building a baseline.
- Career changers and students entering cybersecurity who want a credential that maps the Microsoft security landscape.
- Sales, pre-sales, and consulting staff who position Microsoft security, Entra, and Purview solutions.
There are no formal prerequisites, though familiarity with Azure and Microsoft 365 helps. SC-900 is the on-ramp to the role-based security certifications: from here, SC-300 Identity and Access Administrator goes deeper on Entra, SC-200 Security Operations Analyst covers Defender and Sentinel, and SC-400 Information Protection Administrator covers Purview compliance. For the roles this credential supports — with skills, tools, and salary ranges — see the Cybersecurity Specialist career path.
What this SC-900 practice exam delivers
Learn mode
Get the correct answer, the explanation, and a direct link to the exact Microsoft Learn page each question was derived from — immediately after each question. Best for the “which solution addresses this need” matching SC-900 tests across identity, security, and compliance.
Exam mode
A timed run in the SC-900 shape — roughly 40 to 60 questions in 45 minutes — including multiple-response, drag-and-drop, and scenario items, so you build the pacing the real exam requires.
Source-linked explanations
Every answer cites the exact Microsoft Learn documentation page it was built from — so you can verify capabilities and dig deeper, not just memorize.
Score by skill area
Results break down by the four SC-900 areas — SCI concepts, Microsoft Entra, security solutions, and compliance solutions — so practice tells you exactly which area to revisit.
Sample SC-900 practice questions
Ten free questions across the four SC-900 skill areas, with full explanations and source links to the Microsoft Learn pages each is derived from. The complete bank is available with the 24-hour trial.
A security team adopts a strategy that never assumes trust based on network location, verifies every request explicitly, and grants least-privilege access.
Which security model does this describe?
- The perimeter (castle-and-moat) model
- The Zero Trust model
- The waterfall model
- The shared responsibility model
Show answer & explanation
Correct: B — the Zero Trust model. Zero Trust never assumes trust from network location, verifies explicitly, and enforces least-privilege access — exactly the strategy described. It is a core SC-900 security concept.
Why not the others: the perimeter model (A) is the older “trust the internal network” approach Zero Trust replaces; waterfall (C) is a project methodology; the shared responsibility model (D) divides security duties between cloud provider and customer, a different concept.
Source: Microsoft Learn — Zero Trust model →An organization wants users to prove their identity with something beyond a password — such as an approval in an authenticator app — when signing in.
Which Microsoft Entra capability provides this?
- Data loss prevention (DLP)
- Multifactor authentication (MFA)
- Sensitivity labels
- Azure Firewall
Show answer & explanation
Correct: B — multifactor authentication (MFA). MFA requires a second verification factor beyond the password, such as an authenticator-app approval — a core Microsoft Entra authentication capability, exactly as described.
Why not the others: DLP (A) and sensitivity labels (C) are Microsoft Purview compliance features; Azure Firewall (D) is a network security service. None is a sign-in verification factor.
Source: Microsoft Learn — What is Microsoft Entra ID? → Further reading: PowerKram — SC-300 Identity & Access Administrator →A company wants to allow sign-in only when conditions are met — for example, requiring MFA when a user signs in from an unfamiliar location or an unmanaged device.
Which Microsoft Entra capability enforces these signal-based rules?
- Azure Bastion
- Microsoft Sentinel
- Records management
- Conditional Access
Show answer & explanation
Correct: D — Conditional Access. Conditional Access evaluates signals such as user, location, device, and risk, and enforces controls like requiring MFA or blocking access — exactly the signal-based sign-in rules described.
Why not the others: Azure Bastion (A) provides secure VM access; Sentinel (B) is SIEM/SOAR; records management (C) is a Purview compliance feature. None enforces sign-in conditions.
Source: Microsoft Learn — Microsoft Entra Conditional Access → Further reading: PowerKram — SC-300 Identity & Access Administrator →An organization wants to grant just-in-time, time-limited elevated access to administrators, with approval and auditing, rather than standing permanent admin rights.
Which Microsoft Entra capability provides this?
- Azure DDoS Protection
- Compliance Manager
- Privileged Identity Management (PIM)
- Content explorer
Show answer & explanation
Correct: C — Privileged Identity Management (PIM). PIM provides just-in-time, time-limited, approval-based elevated access with auditing, reducing standing admin privilege — exactly as described. It is part of Entra identity governance.
Why not the others: DDoS Protection (A) defends against network floods; Compliance Manager (B) and Content explorer (D) are Purview compliance tools. None manages privileged access.
Source: Microsoft Learn — Privileged Identity Management →A security operations team wants a single service that collects logs from across the enterprise, detects threats, and can automate responses — combining SIEM and SOAR.
Which Microsoft solution is this?
- Microsoft Sentinel
- Azure Key Vault
- Microsoft Purview
- Azure Bastion
Show answer & explanation
Correct: A — Microsoft Sentinel. Sentinel is Microsoft’s cloud-native SIEM and SOAR solution: it collects and correlates signals across the enterprise, detects threats, and automates response — exactly the SIEM+SOAR need described.
Why not the others: Key Vault (B) stores secrets and keys; Purview (C) is compliance; Azure Bastion (D) provides secure VM access. None is a SIEM/SOAR platform.
Source: Microsoft Learn — Microsoft Sentinel overview → Further reading: PowerKram — SC-200 Security Operations Analyst →A cloud team wants to continuously assess the security posture of its Azure resources, get a secure score, and receive hardening recommendations.
Which Microsoft service provides this cloud security posture management?
- Azure Web Application Firewall
- Microsoft Entra ID Protection
- eDiscovery
- Microsoft Defender for Cloud
Show answer & explanation
Correct: D — Microsoft Defender for Cloud. Defender for Cloud provides Cloud Security Posture Management — continuous assessment, a secure score, and hardening recommendations for cloud resources — exactly as described.
Why not the others: Web Application Firewall (A) protects web apps from exploits; Entra ID Protection (B) detects identity risk; eDiscovery (C) is a compliance tool. None is cloud posture management.
Source: Microsoft Learn — Microsoft Defender for Cloud →An administrator needs a managed, cloud-based network firewall to centrally control and filter inbound and outbound traffic for an Azure virtual network.
Which Azure service provides this?
- Azure Key Vault
- Azure Firewall
- Microsoft Purview
- Access reviews
Show answer & explanation
Correct: B — Azure Firewall. Azure Firewall is a managed, cloud-based network security service that centrally controls and filters inbound and outbound traffic for virtual networks — exactly the described need, part of core Azure infrastructure security.
Why not the others: Key Vault (A) stores secrets; Purview (C) is compliance; access reviews (D) are an Entra governance feature. None is a network firewall.
Source: Microsoft Learn — Azure Firewall → Further reading: PowerKram — SC-200 Security Operations Analyst →A team wants integrated protection that detects and responds to threats across endpoints, email, identities, and cloud apps from a single portal.
Which Microsoft solution provides this extended detection and response (XDR)?
- Microsoft Purview
- Azure Bastion
- Microsoft Defender XDR
- Azure Key Vault
Show answer & explanation
Correct: C — Microsoft Defender XDR. Defender XDR delivers extended detection and response across endpoints, email, identities, and cloud apps from a unified portal — exactly the cross-domain protection described. It includes Defender for Endpoint, Office 365, Identity, and Cloud Apps.
Why not the others: Purview (A) is compliance; Azure Bastion (B) provides secure VM access; Key Vault (D) stores secrets. None is an XDR platform.
Source: Microsoft Learn — Microsoft Defender XDR →A compliance team wants to automatically classify sensitive documents and prevent confidential data from being shared outside the organization.
Which Microsoft Purview capabilities address this?
- Sensitivity labels and data loss prevention (DLP)
- Conditional Access and MFA
- Azure Firewall and NSGs
- Sentinel and SOAR playbooks
Show answer & explanation
Correct: A — sensitivity labels and data loss prevention (DLP). Microsoft Purview uses sensitivity labels to classify and protect data and DLP to prevent confidential information from being shared inappropriately — exactly the classification-and-prevention need described.
Why not the others: Conditional Access and MFA (B) are Entra identity controls; Azure Firewall and NSGs (C) are network security; Sentinel and SOAR (D) are SIEM/SOAR. None is data classification and DLP.
Source: Microsoft Learn — Microsoft Purview → Further reading: PowerKram — SC-400 Information Protection Administrator →A legal team needs to identify, hold, and export electronic content across Microsoft 365 in response to a litigation request.
Which Microsoft Purview capability supports this?
- Secure Score
- Network security groups
- eDiscovery
- Azure Key Vault
Show answer & explanation
Correct: C — eDiscovery. eDiscovery in Microsoft Purview identifies, holds, collects, and exports electronic content across Microsoft 365 for legal and investigative matters — exactly the litigation-response need described.
Why not the others: Secure Score (A) measures security posture; network security groups (B) filter network traffic; Key Vault (D) stores secrets. None is an eDiscovery tool.
Source: Microsoft Learn — Microsoft Purview (eDiscovery) →Keep going: study & career resources
SC-900 is the on-ramp to the Microsoft security track. From here, the role-based SC exams go deeper, and the cybersecurity career path shows where security skills lead.
Deep dive: SC-900 format, scoring, the July 2026 blueprint, and study path
Exam format and scoring
SC-900 delivers roughly 40 to 60 questions in 45 minutes of seat time (about a 60-minute total appointment), with a passing score of 700 out of 1000 (scaled). Question formats include multiple choice, multiple response, drag-and-drop, and short scenario-based items. There is no penalty for wrong answers, and the exam focuses on concepts and “which solution addresses this need” matching rather than hands-on configuration. See the SC-300 Identity Administrator path →
The July 2026 blueprint
The current edition (skills measured as of July 28, 2026) kept the four areas and their weightings unchanged, with only minor sub-area updates. The most notable content addition is newer identity types — including agent identities — in the Microsoft Entra area, reflecting Microsoft’s move toward securing AI agents alongside human and workload identities. Security solutions remains by far the heaviest area at 35–40%. See the SC-200 Security Operations path →
Identity, security, and compliance — the three pillars
Beyond the concepts area, SC-900 is organized around three product pillars. Microsoft Entra covers identity: authentication, MFA, Conditional Access, RBAC, and governance features like PIM. Security solutions — the largest area — covers Azure infrastructure security, Defender for Cloud, Sentinel (SIEM/SOAR), and the Defender XDR family. Compliance solutions cover Microsoft Purview: information protection, DLP, retention, insider risk, eDiscovery, and audit. Knowing which pillar owns a given capability is the single most reliable SC-900 skill. See the SC-400 Information Protection path →
Realistic study path
SC-900 is a fundamentals exam; most candidates pass with one to three weeks of focused preparation. A practical plan: complete the official Microsoft Learn SC-900 learning path, then move to scenario-based practice with PowerKram’s Learn mode to drill the solution-matching decisions, and finish with at least one full timed Exam-mode simulation. Spend the most time on security solutions, since it is the heaviest area. See the AZ-900 Azure Fundamentals path →
Cost, scheduling, and retake policy
List price is $99 USD (regional pricing varies). Microsoft often offers free exam vouchers through Virtual Training Day events — worth checking before you schedule. The exam is delivered through Pearson VUE at a test center or online with a proctor (the online option requires a quiet, private room and a webcam check). Retake rules follow Microsoft’s standard fundamentals policy: wait 24 hours after a first failure and 14 days after subsequent failures, with a cap of five attempts per 12 months. SC-900 certification page →
Career outlook and next steps
SC-900 is a fundamentals credential, so it opens doors rather than unlocking senior roles on its own. It pairs well with a specific direction: SC-300 (Identity and Access Administrator), SC-200 (Security Operations Analyst), or SC-400 (Information Protection Administrator), and eventually the SC-100 Cybersecurity Architect expert exam. For career changers entering cybersecurity, it is a strong, current entry point. Career Hub — Cybersecurity Specialist →
Microsoft SC-900 (Security, Compliance & Identity Fundamentals) exam FAQ
What are the SC-900 skill areas and weights?
Is SC-900 still active, or has it retired?
What is the SC-900 passing score and format?
Does SC-900 have prerequisites?
What should I study after SC-900?
Start your free 24-hour SC-900 practice trial
Full access to the question bank, both study modes, source-linked explanations, and score-by-skill-area. No credit card required.
Start free trial →