SC-900: Security, Compliance, and Identity Fundamentals

400 practice questions · Free 15-question demo available

The SC-900 (Microsoft Security, Compliance, and Identity Fundamentals) tests foundational knowledge of security concepts, identity management, and the Microsoft tools built around them. It covers Zero Trust principles, Microsoft Entra ID, the Defender product family, and the compliance solutions in Microsoft Purview. No hands-on security experience required: this is a conceptual exam focused on understanding what each tool does and when to use it.

Who is SC-900 for?

SC-900 suits a broad audience. Security analysts and IT administrators take it as a foundation before moving to associate-level security exams like SC-200 or SC-300. Compliance officers, risk managers, and legal professionals use it to build enough technical literacy to work alongside security teams. Developers and cloud engineers who want to understand the security layer of their Microsoft environment find it useful too.

If you have already passed AZ-900, the identity and security sections of SC-900 will feel familiar; Microsoft Entra ID and Defender for Cloud appear in both. SC-900 goes deeper into each product and adds the compliance and governance layer that AZ-900 only touches on.

Exam at a glance

What does the SC-900 cover?

The exam has four domains. Microsoft security solutions is the largest, making up more than a third of the exam. The weightings below come from the official Microsoft study guide; verify the current version on Microsoft Learn before your sitting.

How difficult is the SC-900?

SC-900 is a foundational exam with no hands-on experience required, but it is terminology-heavy. The Microsoft security product portfolio is large, and many products have similar names or overlapping functions. Knowing the difference between Microsoft Sentinel (SIEM/SOAR) and Defender for Cloud (CNAPP/CSPM) matters. So does knowing that Defender for Endpoint protects devices, while Defender for Identity protects on-premises Active Directory accounts.

The Microsoft Entra domain (25–30%) is the second-largest and catches candidates who treat identity as a minor topic. Conditional Access policies, Privileged Identity Management, and the difference between authentication and authorization come up repeatedly. Give this domain proper attention.

How to prepare for SC-900

Most candidates pass with 2–4 weeks of study at around one hour per day. Here is a study path that works:

1. 1

   Start with Microsoft Learn

   Microsoft publishes a free official SC-900 learning path at learn.microsoft.com. It takes roughly 8–10 hours and covers all four domains. Start here to build vocabulary before moving to practice questions.

2. 2

   Master Zero Trust early

   Zero Trust is not just a buzzword on this exam; it is the lens through which Microsoft frames every security decision. Understanding the three principles (verify explicitly, use least privilege, assume breach) makes the rest of the exam easier to reason through.

3. 3

   Build a product map

   The hardest part of SC-900 is keeping the Microsoft security product portfolio straight. Make a simple reference: product name, what it protects (identity, endpoint, email, cloud workloads, data), and its category (SIEM, CSPM, EDR, DLP). Review this regularly.

4. 4

   Know Entra ID deeply

   Identity is the largest single domain and appears in security questions too. Understand authentication vs authorisation, Conditional Access logic (what triggers it, what it can enforce), and the difference between PIM (just-in-time role assignment) and standard RBAC.

5. 5

   Do a full timed mock exam

   Before your sitting, complete a full mock under timed conditions. Sky Cloud Prep includes 50 SC-900 mock questions. Review every wrong answer; the explanation tells you the exact distinction the exam is testing.

Common pitfalls on the SC-900

These are the distinctions candidates most often get wrong:

• arrow_right
  Defender for Cloud vs Microsoft Sentinel: Defender for Cloud manages your cloud security posture — it assesses your Azure resources against security benchmarks and protects workloads (VMs, databases, containers). Microsoft Sentinel is a SIEM: it collects security events from across your environment and detects threats through analytics rules and AI. Different tools, different jobs.
• arrow_right
  Conditional Access vs MFA: MFA is an authentication factor. Conditional Access is a policy engine that decides what conditions trigger MFA (or block access entirely). You can require MFA through a Conditional Access policy — but Conditional Access can also enforce compliant devices, restrict access by location, or block risky sign-ins. They are not the same thing.
• arrow_right
  PIM vs RBAC: RBAC (Role-Based Access Control) assigns standing permissions — a user always has the role. Privileged Identity Management (PIM) makes role assignments just-in-time: the user activates the role when needed and it expires after a set time. PIM reduces the attack surface of standing privileged access.
• arrow_right
  Microsoft Purview vs Microsoft Defender: Purview handles data governance and compliance: classifying data, applying sensitivity labels, managing retention, and running eDiscovery. Defender products handle threat protection: detecting attacks, investigating incidents, and responding to breaches. The exam distinguishes these clearly.
• arrow_right
  DDoS Protection Basic vs Standard: Basic DDoS Protection is always on and free for all Azure resources — it handles volumetric attacks automatically. Standard (now called Network Protection in Defender for Cloud) adds ML-based traffic profiling, attack analytics, SLA guarantees, and cost protection for scaled-out resources during an attack. Know when Standard is needed.

Frequently asked questions

For the full skill outline and current domain percentages, visit the official SC-900 page on Microsoft Learn. Microsoft updates the exam objectives periodically; always verify before your sitting.