Azure Mastery Exam SC-900 Download
Azure Mastery

Microsoft Certification SC-900

SC-900: Predict your score. Know what to study next.

See your predicted score, follow a study plan based on your answers, and revisit topics you're starting to forget. It all runs on your device.

397 practice questions AI score prediction 100% offline
Download free iPhone & iPad · Free to start QR code — scan with your iPhone to open Azure Mastery on the App Store On your Mac?
Scan to install

SC-900 Practice Questions & Exam Prep — Microsoft Security, Compliance, and Identity Fundamentals

Get exam-ready for SC-900 (Microsoft Security, Compliance, and Identity Fundamentals) on iPhone or iPad. Azure Mastery uses on-device AI to predict your readiness score, build a personalised study plan, and surface topics you're forgetting. Core study stays on-device and works offline; optional sync uses your private iCloud account.

The exam

What is the SC-900 exam?

SC-900 is the Microsoft Certified: Security, Compliance, and Identity Fundamentals credential — the entry-level exam for anyone working with (or making decisions about) Microsoft's security stack across both Azure and Microsoft 365. It's pitched at business stakeholders, new and existing IT professionals, and students who want a credible foundation in Microsoft SCI solutions.

Common audiences include security analysts about to step into SC-200, identity administrators heading toward SC-300, and architects on the path to SC-100 (Cybersecurity Architect Expert).

The exam doesn't ask you to configure a Conditional Access policy or write a KQL query. It expects you to recognise scenarios across the SCI surface:

Microsoft updated the SC-900 skills outline on 28 July 2026. Every question in Azure Mastery's SC-900 bank is mapped to the current outline — no leftover questions on retired services. Read the official outline at learn.microsoft.com.

Skills measured · 28 July 2026

SC-900 exam objectives

Four domains, with weights set by Microsoft's 28 July 2026 update. Every domain below lists Microsoft's own skill groups verbatim from the official skills outline, so you always know which domain you're being tested on and where your weak spots cluster.

Aura presents a visual map of identity, protection, detection, and governance skills.
Security skill map

Describe the concepts of security, compliance, and identityPublished weight 10–15%

51 exam-scoped practice questions in the app

Explore Concepts topics
  • Describe security and compliance concepts
  • Define identity concepts
  • This domain sets the vocabulary every later domain assumes: shared responsibility, defence-in-depth, Zero Trust, and identity as the perimeter.
  • Authentication and authorization get confused here, and that confusion carries into every Entra question that follows.
  • Lock down authentication versus authorization before moving on; the exam keeps testing that one distinction.

Describe the capabilities of Microsoft EntraPublished weight 25–30%

112 exam-scoped practice questions in the app

Explore Entra topics
  • Describe function and identity types of Microsoft Entra ID
  • Describe authentication capabilities of Microsoft Entra ID
  • Describe access management capabilities of Microsoft Entra ID
  • Describe identity protection and governance capabilities of Microsoft Entra
  • This domain tests sorting a described capability into one of four sub-areas: identity types, authentication, access management, or governance.
  • Candidates know Conditional Access and Privileged Identity Management by name but mix up which sub-area each belongs to.
  • Name the sub-area first, then the specific Entra feature; the exam rewards that ordering.

Describe the capabilities of Microsoft security solutionsPublished weight 35–40%

150 exam-scoped practice questions in the app

Explore Security topics
  • Describe core infrastructure security services in Azure
  • Describe security management capabilities of Azure
  • Describe capabilities of Microsoft Sentinel
  • Describe threat protection with Microsoft Defender XDR
  • This domain tests mapping a described attack surface to the right named product across a long Defender and Sentinel lineup.
  • Candidates who can't match which Defender product covers a surface lose the most marks in the whole exam.
  • Build a one-line table of every Defender and Sentinel product before starting practice questions here.

Describe the capabilities of Microsoft compliance solutionsPublished weight 20–25%

84 exam-scoped practice questions in the app

Explore Compliance topics
  • Describe Microsoft Service Trust Portal and privacy principles
  • Describe compliance management capabilities of Microsoft Purview
  • Describe information protection, data lifecycle management, and data governance capabilities of Microsoft Purview
  • Describe insider risk, eDiscovery, and audit capabilities in Microsoft Purview
  • This domain is almost entirely Microsoft Purview: compliance management, information protection, data lifecycle, insider risk, and eDiscovery.
  • Compliance score often gets treated as a separate tool rather than the numeric output Compliance Manager actually produces.
  • Learn compliance score as Compliance Manager's output, not a standalone product, before the exam tests that pairing.

Common traps

Where SC-900 candidates slip

Five recurring misconceptions that trip up otherwise well-prepared SC-900 candidates, grounded in the current skills outline.

Authentication and authorization answer two different questions

Candidates use the two terms almost interchangeably in conversation, then mix them up the moment the exam tests them.

  • MFA and passwordless methods authenticate identity; RBAC authorises actions. Conditional Access is the policy engine that evaluates signals and can require stronger authentication or block access.
  • Ask whether the scenario is proving identity, assigning permissions, or evaluating access conditions before choosing a feature.

Defender is a family of products, not one product

SC-900 expects you to match a described surface to the specific Defender product that covers it, and the brand name alone will not get you there.

  • Email, devices, SaaS apps, and on-premises AD signals each map to a different named Defender product.
  • Name the exact surface in the scenario, such as email or endpoint, before choosing which Defender product answers it.

Microsoft Sentinel and Defender XDR cover different scopes

Both correlate security signal, so candidates treat Sentinel as just another Defender product rather than a separate platform.

  • Sentinel is a broad SIEM and automation platform for Microsoft and non-Microsoft data. Defender XDR correlates incidents across Defender products and integrates with Sentinel.
  • Pick Sentinel when the scenario centres on cross-environment log ingestion, analytics rules, or playbooks; pick Defender XDR for unified investigation across Defender workloads.

Sensitivity labels and retention labels solve different problems in Purview

Both live inside Microsoft Purview, so candidates assume one label type covers both classification and retention.

  • Sensitivity labels protect content based on what it is; retention labels govern how long that content is kept.
  • Pick retention over sensitivity whenever the scenario is about a legally required keep-or-delete period.

Compliance score is an output, not a separate tool

Candidates describe compliance score as its own product rather than a number that Compliance Manager calculates.

  • Compliance score is the weighted output Compliance Manager produces from whichever assessments you've chosen to run.
  • Remember compliance score reports on Compliance Manager's controls; it isn't a tool you configure on its own.

Designed for SC-900

How Azure Mastery helps you pass SC-900

Exam-specific practice

  • 397 SC-900 practice questions, each tagged to one of the four official domains.
  • Coverage weights security solutions heaviest at 35–40%, the largest domain by a clear margin.
  • Practise matching a described surface to the right Defender or Entra capability, the exam's real test.

Predicted score

  • Exam IQ forecasts your SC-900 score on-device after about 30 questions, with a confidence range.
  • It names the specific Entra or Defender topic actually pulling your score down.
  • Track your weakest of the four domains in the days before you book a sitting.

Adaptive study plan

  • Your plan weights security solutions heaviest, matching Microsoft's 35–40% share of the exam.
  • Miss a Defender-product question and the next session surfaces that same family first.
  • Get a Sentinel-versus-Defender distinction right three sessions running and the plan moves on.

Knowledge decay

  • Forget authentication versus authorization early on and every later Entra question gets harder.
  • The Today screen flags topics approaching decay so you revisit before they fade.
  • Weak Spots sessions bring fading Purview or Defender topics back into rotation.

Exam rehearsal

  • Rehearse a full 45-minute session with a one-way path: once you answer, you move on.
  • The domain mix follows the published weighting, built from Azure Mastery's own question bank.
  • Microsoft alone decides the live SC-900 interface and its exact question order.

Answer Coach

  • Untangles SC-900's near-identical pairs: authentication vs authorization, Sentinel vs Defender XDR, sensitivity vs retention labels.
  • Get one wrong and Answer Coach names the precise confusion as well as the correct pick.
  • Eligible devices can additionally reword a note on-device once grounding checks confirm it's safe.

Aura guidance

  • Aura tracks how your first week of SC-900 sessions actually goes and adjusts what it suggests.
  • Each session closes with a short summary: what changed, what needs another look, what's next.

Private by design

  • Your SC-900 answer history, readiness gauge, and coaching notes stay on your device by default.
  • There's no Azure Mastery account and no external server processing your study data.
  • Sync, if you switch it on, runs through your own private iCloud account only.

2-week revision plan

Suggested SC-900 study plan

Build a map of security, identity and compliance services in the first week. Use the second week for focused revision and timed practice.

  1. Security concepts

    • Review Zero Trust.
    • Explore defence in depth.
    • Understand identity as a security perimeter.

  2. Microsoft Entra

    • Review Entra ID, MFA and Conditional Access.
    • Compare RBAC and Identity Protection.
    • Explore Privileged Identity Management.

  3. Microsoft security services

    • Distinguish Defender for Cloud and Defender for Endpoint.
    • Compare Defender for Office 365 and Defender for Identity.
    • Review how Defender XDR connects investigation signals.

  4. Compliance services

    • Explore Purview Compliance Manager.
    • Review labels, DLP and retention.
    • Compare Insider Risk and Priva scenarios.

  5. Target weaker topics

    • Run Focus Weak Spots sessions.
    • Review explanations for missed questions.
    • Revisit topics you have not practised recently.

  6. Timed rehearsal

    • Complete two 45-minute Exam Simulator sessions.
    • Review each run carefully.
    • Record topics that need more attention.

  7. Check your progress

    • Complete another simulator session.
    • Look for recurring mistakes.
    • Use the results to plan any further study.

  8. Light review

    • Revisit your key notes.
    • Allow time to rest.
    • Decide whether you are ready to move ahead.

Inside the app

Nine interactive practice formats, on iPhone

Azure Mastery has nine interactive formats for exam practice. The examples below show original SC-900 practice questions in Azure Mastery on iPhone and iPad. The exam simulator uses timed sessions with the published domain weights. Microsoft's live interface and question mix may differ.

Which type of encryption uses a single key for both encryption and decryption?

  • Asymmetric encryption
  • Symmetric encryption
  • Hashing
  • Digital signing

Multiple choice

An original SC-900 practice question with one correct answer. The app explains every option after you answer.

Exam-specific sample

Which TWO protocols are used by Microsoft Entra ID for modern authentication? (Choose TWO.)

  • LDAP
  • OAuth 2.0
  • Kerberos
  • OpenID Connect
  • NTLM

Multi-select

An original SC-900 multi-select question. Select all the correct options to earn the mark.

All-or-nothing

Drag-and-drop

An original SC-900 ordering question you can answer by touch on iPhone and iPad.

Interactive item

Hotspot

An original SC-900 question with a visual prompt, designed for touch on iPhone and iPad.

Tap target

Case studies

An original SC-900 case study with several questions about the same requirements and environment.

Multi-question

Answer Coach

Answer Coach explains why the answer is correct and, where available, why each option is right or wrong. It helps you understand a mistake and remember the distinction. Read explanations after each question or at the end of a practice test. On supported devices, optional AI can reword a note on your device after checking it against the written guidance.

App exclusive

Frequently asked

SC-900 FAQs

Which Defender product owns which surface — does SC-900 test that?

Yes, repeatedly. SC-900 expects you to place Defender for Endpoint, Cloud Apps, Identity, Office 365, and Cloud against the surface each one actually protects rather than by product name alone. Answer Coach names the specific surface a wrong pick would have left uncovered.

SC-900 vs AZ-900 — which should I take first?

Pick based on which vocabulary you need first. SC-900 teaches Microsoft's security, identity, and compliance stack; AZ-900 teaches general Azure fundamentals like regions, compute, and pricing. Security-adjacent roles start with SC-900; newcomers to Azure generally start with AZ-900. Many candidates sit both.

What question formats come up on SC-900?

SC-900's assessed time is 45 minutes. Microsoft does not promise an exact format in advance, but says most Fundamentals exams contain 35–50 questions. Azure Master's original security-fundamentals bank uses single-select, scenario, multi-select, drag-to-match, hot-area, dropdown, case-study, and drag-and-drop practice.

What's the SC-900 exam fee, and does it vary by region?

The SC-900 voucher costs USD $99 in the United States, and pricing varies by region, around £77 in the UK. Microsoft occasionally runs free-voucher promotions around events like Build or Ignite, so check your Learn profile before booking.

Once passed, does an SC-900 certification lapse?

No. Microsoft Fundamentals certifications, including AZ-900, DP-900, AI-901, SC-900, and PL-900, never expire once you pass. Associate and Expert certifications such as SC-200 or SC-300 differ: those need an annual free renewal assessment on Microsoft Learn.

Purview compliance solutions — what's the recurring SC-900 trap?

Candidates reach for the Purview tool they've heard of, not the one built for the stated requirement, confusing a DLP policy with a sensitivity label, or a retention policy with an eDiscovery case. Answer Coach spells out that distinction whenever you miss one.

I need to resit SC-900 — how long is the wait?

The wait before your first retake is 24 hours.

  • First retake: 24-hour wait.
  • Second and third retakes: 14-day wait each.
  • Five attempts maximum per rolling 12 months, each needing a new voucher.
Is SC-900 worth taking if I'm not technical?

Yes. SC-900 targets a broad audience on purpose: business stakeholders weighing security procurement, IT generalists working near security, and students entering the field all sit it. You won't configure Conditional Access or write KQL, just pick which Defender product covers a described surface.

Can I try Azure Mastery's SC-900 bank before paying?

Yes. The app is free to download with a free allowance of SC-900 questions so you can try every feature. The full 397-question bank unlocks with a one-time exam-pack purchase, or a subscription unlocks every exam in the catalogue.

Does SC-900 revision work with no signal?

Yes. Practice, scoring, and the readiness prediction all run on-device rather than through a server, so a train tunnel or aeroplane mode works fine. No account is needed, and iCloud sync stays optional and private.

Free study guides

Free guides that pair with SC-900

Where SC-900 fits

Certification paths that start with SC-900

SC-900 is the foundational entry point for Microsoft's Security, Compliance, and Identity role-based tracks. It's optional but strongly recommended — Microsoft markets it as preparation for the SC-200, SC-300, and downstream SC-100 paths, even though it's not a formal prerequisite. If your interest is general Azure infrastructure, look at AZ-900 (Azure Fundamentals) instead.

Security Operations Analyst path

Associate tier
  1. SC-900 Fundamentals
  2. SC-200 Security Operations Analyst Associate

Identity & Access Administrator path

Associate tier
  1. SC-900 Fundamentals
  2. SC-300 Identity & Access Admin Associate

Cybersecurity Architect Expert path

Expert tier
  1. SC-900 Fundamentals
  2. SC-200 prereq option
  3. or SC-300 prereq option
  4. SC-100 Cybersecurity Architect exam
  5. Cybersecurity Architect Expert credential

Ready to pass SC-900?

Download Azure Mastery free. 397 SC-900 practice questions, AI score prediction, and a personalised study plan that adapts to your weak spots. iPhone & iPad.

Download Azure Mastery — free iPhone & iPad · Free to start · No account required
SC-900 practice — free on the App Store Download