SC-900: Security, Compliance, and Identity Fundamentals Practice Exam

What the SC-900 exam covers

• Describe Concepts of Security, Compliance, and Identity122 questions
• Describe Capabilities of Microsoft Entra259 questions
• Describe Capabilities of Microsoft Security Solutions334 questions
• Describe Capabilities of Microsoft Compliance Solutions236 questions

Free SC-900 practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 951.

1. Question 1Describe Concepts of Security, Compliance, and Identity

   Which security model assumes that all users, devices, and network traffic are untrusted by default, even if they are inside the corporate network?

   • AShared responsibility model
   • BPerimeter-based security model
   • CZero Trust modelCorrect
   • DDefense-in-depth model
   ✓ Correct answer: C

   Zero Trust treats network location as irrelevant to trust, so being inside the corporate firewall grants no implicit privileges. Every access request must be authenticated, authorized, and continuously validated against signals such as user identity, device health, and the resource being requested. This 'never trust, always verify' posture directly answers the scenario of treating all users, devices, and traffic as untrusted by default. It exists precisely because attackers who breach the perimeter would otherwise move freely across an implicitly trusted internal network.

   Why the other options are wrong

   • AShared responsibility model divides security duties between the cloud provider and the customer; it does not describe how much to trust users or network traffic.
   • BPerimeter-based security treats anything inside the network boundary as trusted, which is the exact opposite of assuming all internal entities are untrusted.
   • DDefense in depth layers multiple independent controls so a failure of one is caught by another, but it does not by itself declare every user and device untrusted by default.
2. Question 2Describe Concepts of Security, Compliance, and Identity

   A company allows partner organizations to access a shared project management application using their own corporate credentials. Users do not need separate accounts in the company's directory. Which identity concept enables this scenario?

   • APrivileged identity management
   • BConditional access
   • CFederationCorrect
   • DMulti-factor authentication
   ✓ Correct answer: C

   Federation is the identity concept that enables partner organizations to access shared applications using their own corporate credentials without requiring accounts in the company's directory. Federation establishes trust relationships between identity providers, allowing users from one organization to be authenticated by their home organization and gain access to partner resources.

   Why the other options are wrong

   • APrivileged identity management is incorrect because it manages administrative access, not external partner access.
   • BConditional access is incorrect because it applies access policies to already-authenticated users.
   • DMulti-factor authentication is incorrect because it is an authentication method, not a cross-organizational identity mechanism.
3. Question 3Describe Capabilities of Microsoft Entra

   Microsoft Entra Connect is used to synchronize on-premises Active Directory identities to Microsoft Entra ID.

   • ATrueCorrect
   • BFalse
   ✓ Correct answer: A

   Microsoft Entra Connect synchronizes on-premises Active Directory objects, including users, groups, and contacts, to Microsoft Entra ID. This enables hybrid identity scenarios where users maintain a single identity across on-premises and cloud environments with various synchronization and authentication options.

   Why the other options are wrong

   • BFalse is incorrect. The statement is true: Microsoft Entra Connect synchronizes on-premises Active Directory objects, including users, groups, and contacts, to Microsoft Entra ID.
4. Question 4Describe Capabilities of Microsoft Security Solutions

   What does Azure Key Vault provide?

   • AScheduled backup and point-in-time recovery of virtual machines
   • BDistribution of incoming traffic across multiple web servers
   • CAutomated build and release deployment of application code
   • DSecure storage and management of secrets, keys, and certificatesCorrect
   ✓ Correct answer: D

   Azure Key Vault provides a centralized, secure storage service for managing sensitive information including database connection strings, API keys, and encryption certificates. It supports automated key rotation, audit logging, and access policies to ensure secrets are protected throughout their lifecycle.

   Why the other options are wrong

   • AVM backup and recovery is provided by Azure Backup; Key Vault centrally stores and manages secrets, cryptographic keys, and certificates.
   • BTraffic distribution is a load balancer function, unrelated to Key Vault, which safeguards sensitive material like keys and secrets.
   • CAutomated code deployment is handled by Azure DevOps or GitHub Actions pipelines, whereas Key Vault protects the secrets those pipelines consume.
5. Question 5Describe Capabilities of Microsoft Compliance Solutions

   Which score in Microsoft Purview Compliance Manager measures an organization's progress in completing the improvement actions that reduce risks around data protection and regulatory standards?

   • AProductivity score
   • BSecure score
   • CIdentity score
   • DCompliance scoreCorrect
   ✓ Correct answer: D

   In Microsoft Purview Compliance Manager, the compliance score measures progress on completing improvement actions that reduce data protection and regulatory risk. Each improvement action carries points, and completing them raises the score, reflecting how well the organization meets the controls in its assessments. The question describes tracking improvement-action completion against compliance standards, which is the compliance score. It gives organizations a quantifiable view of their compliance posture.

   Why the other options are wrong

   • AProductivity score measures how an organization adopts and uses Microsoft 365 tools, not its compliance posture.
   • BSecure score measures security configuration recommendations, whereas this question is about compliance improvement actions.
   • CIdentity score, framed as identity secure score, measures identity security best practices rather than regulatory compliance progress.
6. Question 6Describe Capabilities of Microsoft Security Solutions

   In Microsoft Sentinel, what does an analytics rule do?

   • AIt detects threats in ingested data and generates alerts or incidentsCorrect
   • BIt stores raw log data in the workspace for long-term archival and retention
   • CIt grants users role-based permission to view and manage a workspace
   • DIt connects an external data source to Sentinel for ingestion
   ✓ Correct answer: A

   Analytics rules in Microsoft Sentinel run queries across ingested data to find suspicious activity. When a rule's conditions are met, it produces an alert, and related alerts can be grouped into an incident for investigation. Sentinel provides built-in rule templates as well as the option to create custom rules.

   Why the other options are wrong

   • BLong-term retention is a workspace configuration setting, not the function of an analytics rule.
   • CGranting permission to view a workspace is an Azure RBAC task, not something analytics rules do.
   • DConnecting an external source is the role of a data connector, not an analytics rule.
7. Question 7Describe Capabilities of Microsoft Entra

   When configuring identity types at Litware Inc, administrators must also consider built-in roles as part of the overall architecture.

   • TrueTrueCorrect
   • FalseFalse
   ✓ Correct answer: True

   Identity types define different types of identities that can exist in Entra (users, service principals, managed identities). Built-in roles define role configurations. When implementing identity types, administrators should consider how built-in roles apply to different identity types. This statement is accurate.

   Why the other options are wrong

   • FalseFalse is incorrect. The statement is true: Identity types define different types of identities that can exist in Entra (users, service principals, managed identities). Built-in roles define role configurations.
8. Question 8Describe Capabilities of Microsoft Compliance Solutions

   What additional capability does Microsoft Purview Audit (Premium) provide that Audit (Standard) does not?

   • ALonger audit log retention and access to high-value crucial eventsCorrect
   • BThe ability to apply encryption and rights protection to outbound email messages
   • CAutomatic purging of all audit records once they reach thirty days of age
   • DThe ability to block sensitive files from being shared with external recipients
   ✓ Correct answer: A

   Audit (Premium) extends the default 180-day retention of Audit (Standard) to one year (and optionally longer with an add-on), and surfaces high-value 'crucial events' such as when a mail item was accessed, which are valuable during forensic and breach investigations. It also provides higher bandwidth access to the audit log via the API.

   Why the other options are wrong

   • BEncrypting and rights-protecting email is a sensitivity label and message encryption feature, not an Audit (Premium) capability, which extends log retention and crucial events.
   • CAudit (Premium) lengthens retention to a year or more; automatically purging logs at 30 days is the opposite of what it provides.
   • DBlocking external sharing of sensitive files is a DLP function, not an audit capability, whereas Premium adds longer retention and high-value events.
9. Question 9Describe Capabilities of Microsoft Entra

   An organization migrating fully to the cloud is decommissioning its on-premises Active Directory. They want to confirm what Microsoft Entra ID is so they set expectations correctly. Which description is most accurate?

   • AA cloud-based identity and access management service that authenticates users and secures access to apps and resourcesCorrect
   • BA direct cloud-hosted clone of on-premises Active Directory Domain Services with identical LDAP and Group Policy features
   • CA virtual network service that connects on-premises datacenters to Azure
   • DA storage service for archiving identity logs
   ✓ Correct answer: A

   Microsoft Entra ID is a cloud identity provider: it stores user, group, device and application objects in a flat multi-tenant directory and issues tokens over internet protocols such as OpenID Connect, OAuth 2.0 and SAML. That is a different design from Active Directory Domain Services, which answers LDAP queries, authenticates with Kerberos and NTLM, arranges objects into organisational units inside a forest, and applies configuration through Group Policy - none of which Entra ID reproduces. Its purpose is authenticating identities and authorising access to applications and resources, not networking or storage.

   Why the other options are wrong

   • BEntra ID is not an identical clone of AD DS; it does not provide LDAP or Group Policy in the same way.
   • CConnecting datacenters to Azure is the role of networking services like VPN Gateway, not Entra ID.
   • DEntra ID is an identity service, not a log archiving storage service.
10. Question 10Describe Capabilities of Microsoft Security Solutions

    A growing company is deciding between relying on Defender XDR's automatic incident correlation versus building custom detections in Sentinel for their bespoke line-of-business application logs. Which factor most clearly points toward Sentinel for the application logs?

    • AThe logs come from a custom, non-Microsoft application that Defender XDR does not natively protectCorrect
    • BThe logs consist solely of Microsoft 365 mailbox activity that Defender XDR already correlates natively
    • CThe company has decided it never wants to author any custom detection logic of its own at all
    • DThe data relates only to Windows device antivirus events already handled by Defender for Endpoint
    ✓ Correct answer: A

    Defender XDR focuses on Microsoft workloads it natively protects. For a bespoke line-of-business application, Sentinel can ingest the custom logs through connectors and let teams author custom analytics rules, hunting queries, and automation, making it the appropriate platform for that data.

    Why the other options are wrong

    • BMicrosoft 365 mailbox activity is already natively covered by Defender XDR, so it argues against needing Sentinel, not for it.
    • CSentinel's value here is authoring custom detections; a stated refusal to write any detection logic points away from Sentinel, not toward it.
    • DWindows antivirus events are natively handled by Defender for Endpoint within XDR, so they do not justify moving detection into Sentinel.

Who this SC-900 practice exam is for

This practice set is for anyone preparing for the SC-900: Security, Compliance, and Identity Fundamentals exam at the foundational level - from first-time candidates building a foundation to experienced Microsoft practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this SC-900 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real SC-900 exam.

Related Microsoft resources

• SC-900 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Best AZ-900 Practice Exams (2026)Comparison
• SC-900 vs SC-100Comparison
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• AB-100 practice examRelated
• AB-620 practice examRelated
• AB-730 practice examRelated

SC-900 practice exam FAQ