SC-900 Tests Matching Each Requirement to the Right Microsoft Service — Not Configuration
SC-900 is a 45-minute fundamentals exam for anyone new to Microsoft security. Most items are short statements; the shift is learning what each Entra, Defender and Purview service does and, just as often, does not do.
Check Your Readiness →Most candidates understand Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-900) concepts — and still fail. This exam tests how you apply knowledge under pressure.
Questions are definitional: a statement or two-line scenario, often in a three-statement yes/no block, so one misread word can cost several points. Spot the asset or requirement, then choose the one service whose purpose fits. 700/1000 to pass; question count not published.
Configure an access review for the admin role
Privileged Identity Management provides just-in-time, time-bound activation with approval and justification. Access reviews only recertify whether existing assignments should continue; entitlement management packages requestable access with expiry.
Deploy a Web Application Firewall on Application Gateway
Azure DDoS Protection handles volumetric and protocol floods aimed at availability. WAF inspects HTTP requests for exploits such as SQL injection or cross-site scripting and does not absorb network-layer traffic volume.
Rely on Defender XDR incidents alone
Microsoft Sentinel is the SIEM and SOAR: data connectors ingest non-Microsoft sources, analytics rules correlate them, and a Logic Apps playbook disables the account. Workbooks visualise data; playbooks respond.
Search Microsoft Purview Audit and export the results
Audit records who did what and when; it does not hold content. eDiscovery places custodians on legal hold, searches and exports the items. Insider risk management would only flag risky behaviour patterns.
Under the shared responsibility model, information and data, devices, accounts and identities stay with the customer in IaaS, PaaS and SaaS alike. Yes/no statements saying Microsoft secures your user accounts in Exchange Online are false.
Defender for Cloud protects Azure, hybrid and multicloud workloads and produces Secure Score. Defender for Cloud Apps is the CASB that discovers shadow IT and controls sessions in SaaS apps. The names differ by one word on purpose.
Microsoft Entra ID Protection calculates user risk and sign-in risk. Conditional Access is the if-then policy engine that consumes that risk to require MFA, a password change or block. Risk-based prompts need both features together.
Sensitivity labels classify and protect with encryption, headers and watermarks. Keeping or deleting content after a period is retention: a retention policy for whole locations, a retention label for individual items, and records management to lock declared records.
Compliance score in Compliance Manager tracks weighted improvement actions; Secure Score in Defender products tracks security recommendations. Neither proves a regulation is met. Microsoft's own SOC and ISO audit reports live in the Service Trust Portal.
Strengthen weak areas with exam-style practice questions and detailed explanations.
Simulate the real exam experience and assess your readiness under timed conditions.
Review key concepts, objectives, and exam topics in one place.
Get personalized explanations, learning recommendations, and instant answers.
Follow a structured learning path designed to help you prepare efficiently.
SC-900 hinges on telling look-alike Microsoft services apart. Find out which ones you still mix up.