Microsoft Security, Compliance, and Identity Fundamentals Exam Prep

Practice progress

Practise SC-900 product and concept decisions

Unofficial, independently authored practice for Microsoft Security, Compliance, and Identity Fundamentals. No affiliation or endorsement is implied.

Target: English SC-900, skills measured 2026-07-28; sources verified 22 September 2026. 72 original single-choice scenarios cover all 58 listed objective bullets at least once. This curated bank is not exhaustive preparation.

The retained July authoring map was based on a September 22 capture of Microsoft's Portuguese guide. Both live study guides now show the October outline and do not establish July bullet-level coverage. English product documentation supports each original rationale. The July identity-types bullet includes Agent ID; it is not silently replaced with the October workload-only wording. Defender TI terminology is bound to the July map with current product references.

Practice uses 13%, 27%, 37%, 23%: authored integer weights within Microsoft's 10–15%, 25–30%, 35–40%, 20–25% ranges. These are not exact Microsoft question-distribution claims. Whole-question counts use largest remainder with ties in displayed domain order.

These untimed rounds do not reproduce official exam difficulty or the full exam experience. Microsoft's proctored assessment may include interactive components; this bank uses one correct answer per question. No practice score predicts passing.

Official SC-900 details · Current official study guide (Portuguese).

Skills-measured date:

Only 2026-07-28 is available. An unavailable or stale edition blocks the round and saved-attempt restoration.

Planned exam date (optional):

Use YYYY-MM-DD, or leave blank for today. The English update on 2026-10-21 requires a new bank. Practice admission uses UTC calendar days.

Practice mode:

Questions follow the disclosed practice weights within the official ranges, rounded by largest remainder. Short rounds may omit a domain. The selected practice level limits the available counts.

Domain:

Practice difficulty:

Foundational concepts practise recognition and recall; applied reasoning uses scenarios. These authored levels are not calibrated to official exam difficulty.

Feedback:

Question count:

Replay seed:

Keep the seed to replay the same questions and option order.

Answers and the replay seed are saved in the page URL. Sharing that URL shares the attempt. No account, exam credentials or certification details are needed.

{{ progressPercent }}%

{{ answeredCount }} of {{ questionCount }} answered

Question {{ examCursor + 1 }} of {{ questionCount }}

Study: {{ studySource(currentQuestion.id).title }}

Answer recorded. Corrections appear after the round.

Review this practice round

Readiness review

Unofficial original SC-900 practice, skills measured 2026-07-28. This score describes only the authored questions in this round; it is not an official scaled score or a passing prediction.

This untimed single-choice practice does not reproduce the full official exam experience. Microsoft's proctored assessment may include interactive components.

Use the documentation-linked corrections to choose your next study topics. Unsampled objectives remain untested. Repeat the missed items, then use hands-on exercises and Microsoft's official preparation resources.

Missed answer review

{{ item.prompt }}

Your answer: {{ item.selected_answer_label }}

Correct answer: {{ item.correct_answer_label }}

{{ item.explanation }}

Study: {{ studySource(item.question_id).title }}

Domain performance

Unanswered or unsampled domains are not evidence of weakness.

{{ row.label }} · {{ row.weight_percent }}% practice weight: {{ row.question_count }} sampled; accuracy {{ row.accuracy_percent === null ? 'not sampled' : row.accuracy_percent.toFixed(1) + '%' }}; weighted contribution {{ row.contribution_points === null ? 'unavailable' : row.contribution_points.toFixed(1) + ' percentage points' }}.

Not tested this round: {{ untestedDomains.join("; ") }}.

Loading domain-performance chart…

Answer ledger

{{ ledgerContextSummary }}
Question and domain	Answers	Explanation and study source	Copy
{{ row.question_id }} · {{ row.category_label }} · {{ itemDetails(row.question_id).objective }} · {{ difficultyLabel(row.question_id) }}{{ row.prompt }}	Your answer: {{ row.selected_answer_label }} Correct answer: {{ row.correct_answer_label }} {{ row.outcome_label }}	{{ row.explanation }} {{ studySource(row.question_id).title }}

A successful sign-in does not mean an employee should be allowed to edit every report or share its contents outside the organization. Authentication establishes the claimed identity. Authorization determines what that identity may do. Protecting the report also requires decisions about sensitive information, permitted sharing, and how long the information must be kept.

Microsoft Security, Compliance, and Identity Fundamentals, assessed by SC-900, brings these distinctions together across Microsoft Azure, Microsoft 365, and related services. It covers security and identity concepts, Microsoft Entra, Microsoft security solutions, and Microsoft compliance solutions. The subject is useful to business stakeholders, students, and IT professionals who need to recognize which capability addresses a requirement and where another control is still needed.

Moving an application to the cloud changes the division of security work rather than transferring every responsibility to the provider. Infrastructure, platform, and software services leave different tasks with the customer. Decisions about the organization's data, identities, and access remain important even when the provider operates the underlying infrastructure.

Zero Trust applies explicit verification, least privilege, and an assumption that a breach is possible. An internal network address alone is not enough reason to trust a request. Identity, device condition, the requested resource, and other relevant signals can affect access. Defense in depth complements this approach by combining controls, so a stolen credential does not have to leave the organization dependent on a single remaining safeguard.

Microsoft Entra addresses identities and access, while Microsoft Defender services address threats affecting supported devices, identities, collaboration services, cloud applications, and workloads. Microsoft Sentinel brings security events from multiple sources into detection, investigation, and response work. Microsoft Purview addresses data governance, data security, and compliance. These responsibilities can overlap within one business process without making the products interchangeable.

A confidential report illustrates why data protection also needs more than one decision.

Sensitivity and protection: A sensitivity label classifies content and can apply configured protection, such as encryption or markings. A label's name alone does not establish which protections are enabled.
Data loss prevention: Data loss prevention, or DLP, evaluates supported content and activities against policies that can warn about or restrict inappropriate sharing.
Retention: Retention determines whether content must be preserved, deleted, or preserved before deletion. Keeping a document for a required period does not by itself prevent inappropriate disclosure.

For example, a report may need restricted access, a rule against external sharing, and a retention period at the same time. A visible watermark cannot establish that all three requirements are enforced. Product selection must be followed by suitable policy scope, permissions, configuration, and verification.

Compliance adds evidence and organizational obligations to these technical decisions. Microsoft Purview Compliance Manager can help prioritize improvement actions and monitor progress, but its compliance score is not a legal compliance guarantee. Likewise, recognizing the correct product in a question is not proof that someone can safely configure a production environment. Fundamentals study supports understanding; operational competence also requires hands-on work and review of the actual requirements.

How to Use This Tool:

The practice contains 72 independently authored questions with one correct answer among four choices. This is unofficial practice, with no claim of Microsoft affiliation or endorsement. The initial setup is a 10-question mixed round across All skill areas, with feedback after each answer.

Confirm the Skills-measured date is 2026-07-28. Enter a real Planned exam date in YYYY-MM-DD format, or leave it blank to use the current day in Coordinated Universal Time (UTC).
The July bank does not support planned dates on or after October 21, 2026, and it stops admitting practice when the current UTC day reaches that date. For an invalid target or an unrestorable saved attempt, Use verified July target and reset attempt clears the attempt and restores the default setup. It cannot override the expiry date.
Choose the scope under Practice mode. Focused practice draws from one selected domain or from All skill areas without domain quotas. Practice-weighted across skill areas allocates questions using the disclosed practice weights.
Select Mixed practice, Foundational concepts, or Applied scenarios, then choose a Question count from the available menu. Foundational questions emphasize recognition and recall; applied questions emphasize scenario reasoning. The available counts depend on the eligible questions. A full 72-question round requires mixed, unweighted All skill areas; weighted rounds offer at most 60 mixed questions or 30 at either individual level.
Choose After each answer for immediate corrections or After the round to defer them until completion. Under Advanced, keep the Replay seed unchanged to reproduce question and option order with the same settings and question bank. Use a nonblank seed of at most 128 characters.
Select Start exam practice, then choose one answer for each question. Selecting an option submits and locks it immediately in both feedback modes. Use Next question to continue and View results after the final answer. Corrections remain hidden during deferred-feedback rounds, but answers are still recorded.
Review the explanations in Missed answer review and the full Answer ledger. Follow the associated study sources before choosing Retry missed. Replay same round clears answers for another attempt at the same questions, while New shuffled round uses another seed and may still include familiar questions.

Interpreting Results:

During a round, Practice progress reports how many questions have been answered, not how many are correct. The completed summary reports correct answers out of the total. Perfect round means every question in that particular round was answered correctly; there is no pass threshold or validated readiness band.

In Domain performance, focused rounds compare correct and missed answer counts. Weighted rounds instead show each domain's contribution in percentage points, alongside its sampled count and accuracy. A larger contribution can reflect a larger assigned weight, not simply better performance. Practice-weighted accuracy and the percentage correct by question count can therefore differ.

Answered-domain coverage describes the practice weights represented by domains with answers. It does not count mastered objectives. Even 100% coverage can come from only a few questions in each domain. Unsampled domains are untested, not demonstrated weaknesses.

Use the ledger's objective labels and explanations to identify the distinction behind each mistake. Compare rounds with the same scope, difficulty, count, and feedback conditions. Improvement on repeated questions can include memory of the answers, so combine retries with documentation and hands-on exercises rather than treating them as a prediction of an official result.

Technical Details:

Identity protection separates evidence about a request from the permissions and policies that govern it. Multifactor authentication (MFA) combines different categories of authentication evidence, such as a password and possession-based approval. It does not by itself establish which application an identity may access or whether an administrative role should remain assigned indefinitely.

Choosing an access control

The required decision identifies the relevant capability. Detecting risk, applying sign-in conditions, granting permissions, and reviewing continued access are related but different tasks.

Identity requirements and the Microsoft capabilities that address them
Requirement	Relevant capability	Important distinction
Identify suspicious sign-ins or potentially compromised identities	Microsoft Entra ID Protection	Produces identity-risk signals for investigation and policy use.
Require verification or another access control under specified conditions	Microsoft Entra Conditional Access	Evaluates applicable signals and applies configured controls; a risk signal alone is not the policy.
Delegate directory administration	Microsoft Entra roles	Directory permissions are distinct from Azure role-based access control (RBAC) permissions for Azure resources.
Activate privileged access only when needed	Privileged Identity Management (PIM)	Eligible, time-bound access and configured activation controls reduce reliance on permanent privilege.
Decide whether an identity still needs assigned access	Access reviews	Reviews continued entitlement rather than replacing sign-in risk detection.

Software also needs an identity. Workload identities identify applications and services without treating them as human employees. An agent identity distinguishes an artificial intelligence agent's authentication and activity from its creator's identity. Having that identity neither grants unrestricted permissions nor proves that the agent's outputs are correct.

Posture, attacks, and information policies

Cloud Security Posture Management (CSPM) examines cloud configurations and security weaknesses. Microsoft Defender for Cloud includes posture assessment and protection for supported cloud workloads. A recommendation about a misconfiguration is not the same as evidence of an active attack.

Extended detection and response (XDR) correlates threat signals across supported security domains. Microsoft Defender XDR can connect endpoint, identity, email, and cloud-application evidence into an investigation. Security information and event management (SIEM) collects and analyzes security events, while security orchestration, automation, and response (SOAR) coordinates response workflows. Microsoft Sentinel supports these security-operations tasks. Available protection depends on supported resources, deployment, configuration, and applicable service plans.

Information policies have their own scope. A retention policy applies lifecycle settings to content in selected locations, whereas a retention label applies settings to an individual item. Publishing a retention label makes it available for application; an auto-apply policy applies it when matching conditions are met. These retention decisions remain separate from sensitivity protection and DLP rules about disclosure.

Scores and completion progress

Each correct response earns one point and each incorrect response earns zero. The point total is the correct-answer count, with a possible total equal to the number of questions in the round. Accuracy and completion progress use different numerators.

\begin{array}{l} R = 100 \times \frac{C}{N} \\ P = 100 \times \frac{A}{N} \end{array}

N is the round's question count, C is the correct count, and A is the answered count. R is raw accuracy in percent and P is progress in percent. Unanswered questions remain in N but are not counted as incorrect. A completed result requires every question to have an answer. There is no partial credit or deduction for a wrong answer. N is positive, all counts are whole numbers, and zero ≤ C ≤ A ≤ N. Raw accuracy and visible progress retain the unrounded ratios from 0% to 100%.

Domain weights and question allocation

The practice weights are authored choices within Microsoft's published domain ranges, not a claim about the exact distribution of questions in an official exam. The question pool is also finite. Each domain contains equal numbers of foundational and applied questions.

Domain ranges, authored practice weights, and available question counts in displayed domain order
Domain	Official range	Practice weight	Mixed pool	Each individual level
Security and identity concepts	10% to 15%	13%	12	6
Microsoft Entra	25% to 30%	27%	20	10
Microsoft security solutions	35% to 40%	37%	24	12
Microsoft compliance solutions	20% to 25%	23%	16	8

Weighted selection first calculates a fractional quota for each domain and takes its whole-number part. Remaining questions go to the domains with the largest fractional remainders. Equal remainders are resolved in the domain order shown above.

\begin{array}{l} q_{i} = \frac{N \times w_{i}}{100} \\ b_{i} = ⌊ q_{i} ⌋ \end{array}

For domain i, w is its percentage weight expressed as 13, 27, 37, or 23. The fractional question quota is q, and b is its initial whole-question allocation. Questions are then drawn without replacement from each eligible domain pool. A question does not repeat within the round.

For 50 questions, the fractional quotas are 6.5, 13.5, 18.5, and 11.5. Taking whole numbers allocates 48 questions. All four remainders tie, so the two remaining questions go to concepts and Entra, producing 7, 14, 18, and 11 questions. Short rounds can omit a domain, and counts that exceed a domain's available questions are not offered.

Focused selection instead gives each eligible question an equal selection chance without replacement. It does not enforce domain quotas, even when all skill areas are included. A missed-question retry uses exactly that missed subset, rather than filling it out to match the practice weights.

Weighted accuracy and coverage

Weighted review first measures accuracy among the answered questions in each domain. Multiplying that ratio by the domain's practice weight gives its contribution in percentage points.

\begin{array}{l} D_{i} = 100 \times \frac{C_{i}}{A_{i}} \\ T_{i} = w_{i} \times \frac{C_{i}}{A_{i}} \\ W = \sum_{i = 1}^{4} T_{i} \\ H = \sum_{i : A_{i} > 0} w_{i} \end{array}

C and A with a domain subscript mean correct and answered questions in that domain. D is domain accuracy in percent, T is its weighted contribution, W is the overall weighted accuracy in percent, and H is answered-domain coverage in percent of the declared practice weights. Domain accuracy, weighted contributions, and overall weighted accuracy are displayed to one decimal place. Coverage sums the whole-number domain weights.

Conditions for meaningful weighted scores and domain coverage
Condition	Result
A domain has no answered questions	Its accuracy and contribution are unavailable, not zero ability.
An ordinary weighted round is complete and all four domains have answers	The overall weighted accuracy is the sum of the four contributions.
A weighted round is incomplete or omits a domain	No overall weighted accuracy is reported. Represented weights are not rescaled to 100%.
A focused round or missed-question retry is being reviewed	No overall weighted accuracy applies.

A one-question weighted round samples only Microsoft security solutions. Answering it correctly gives 1/1 and 37% answered-domain coverage, but no overall weighted accuracy because the other three domains have no answers. This is not equivalent to demonstrating competence across 37% of the syllabus.

Edition dates and valid rounds

The supported target is the English SC-900 edition with skills measured from July 28, 2026. Microsoft announces an English update for October 21, 2026. Starting, restoring, or continuing practice checks the dated target; selecting an earlier planned date cannot bypass the current-day cutoff.

Inclusive start and exclusive end dates for the supported July practice edition
Date requirement	Accepted condition
Skills-measured date	Exactly 2026-07-28. No other edition is substituted.
Current UTC calendar day	July 28, 2026, through October 20, 2026, inclusive.
Planned exam date, or current UTC day when blank	July 28, 2026, through October 20, 2026, inclusive.

No October question bank is included. Invalid dates and incompatible or conflicting saved attempts are rejected rather than silently converted. The cutoff follows the English exam update, not a retirement of SC-900 or a verified update schedule for every localized exam.

Edition and Coverage Limits:

The 72 questions are organized against 58 objective labels in a retained July authoring map. That map was based on a September 22, 2026, capture of Microsoft's Portuguese guide, with English product documentation supporting the explanations. The live English and Portuguese guides now show the October outline. Their current contents must not be treated as proof of July bullet-level coverage. Mapping a question to an objective does not establish exhaustive treatment or mastery of that objective.

Edition-specific terminology also matters. The July identity material retains Agent ID. The October identity-types bullet explicitly names workload identities instead; that wording has not replaced the July material here. The July security material names Microsoft Defender Threat Intelligence. Separately, the standalone product reached its announced August 1, 2026, retirement boundary, while threat intelligence capabilities continue within Microsoft Defender. Current Microsoft documentation describes threat intelligence in the Defender portal and enrichment of entity information. Preview workspace prerequisites are specific to the Integrated Security Operations Center (ISOC) experience, so availability and requirements must be checked for the intended experience. This product transition is separate from the October exam update.

Rounds are untimed, use only single-choice questions, and have authored difficulty levels that are not calibrated to Microsoft's exam. The official assessment is proctored and may include interactive components. This curated practice neither reproduces the complete exam experience nor supplies an official scaled score, passing prediction, certification, or assurance of professional security competence.

Privacy Notes:

If saving an attempt fails, the previous saved URL remains unchanged. Newer in-page answers may be lost on reload, so keep the page open until you have reviewed or recorded them.

Answers are scored in the browser, but the attempt, responses, setup, and replay seed are also encoded in the page URL without encryption. Sharing that URL shares the attempt. URLs can remain in browser history and reach the site when the page is reloaded, so browser scoring does not mean the answers can never leave the device.

No account, exam credentials, or certification details are needed for the practice. Page resources, chart and document features, and opened study references can use the network; fully offline operation is not promised. Exported answer ledgers also contain responses. Resetting an attempt does not remove copies of its URL or exported records held elsewhere.

Worked Examples:

Eight correct answers with a different weighted percentage

A 10-question Practice-weighted across skill areas round allocates 1 concepts question, 3 Entra questions, 4 security-solutions questions, and 2 compliance-solutions questions. Suppose the correct counts are 1, 2, 3, and 2 respectively. The completed summary is 8/10, equivalent to 80% correct by question count. The weighted contributions are 13, 18, 27.75, and 23 percentage points, totaling 81.75%, displayed as Practice-weighted accuracy of 81.8%. The difference comes from the domain weights, not bonus credit. Review the two missed explanations before using Retry missed; that two-question retry is a focused review and has no overall weighted accuracy.

A sensitivity label exists but users cannot select it

Choose Focused practice, Microsoft compliance solutions, Foundational concepts, and 8 questions to include that domain's complete foundational set. In the label-publication question, an administrator has created a sensitivity label with encryption and markings but has not published it. The correct choice is to publish the label through a sensitivity-label policy scoped to the intended users or groups. That answer earns one point, and the explanation distinguishes creating protection settings from making the label available. The practice answer neither creates a label nor verifies access in a real tenant. Review the linked publication guidance and allow for propagation; creating another protection setting or publishing a retention label does not resolve the stated problem.

References:

Microsoft Certified: Security, Compliance, and Identity Fundamentals, Microsoft Learn.
SC-900 study guide for the October 21, 2026, skills outline, Microsoft Learn.
SC-900 study guide in Portuguese for the October 21, 2026, skills outline, Microsoft Learn.
Shared responsibility in the cloud, Microsoft Learn.
Zero Trust as a security foundation, Microsoft Learn.
What is Microsoft Entra?, Microsoft Learn.
Microsoft Entra authentication overview, Microsoft Learn.
Microsoft Entra Conditional Access overview, Microsoft Learn.
Microsoft Entra role-based access control overview, Microsoft Learn.
What is Privileged Identity Management?, Microsoft Learn.
What are agent identities?, Microsoft Learn.
Microsoft Defender for Cloud overview, Microsoft Learn.
What is Microsoft Defender XDR?, Microsoft Learn.
What is Microsoft Sentinel SIEM?, Microsoft Learn.
Learn about sensitivity labels, Microsoft Learn.
Learn about data loss prevention, Microsoft Learn.
Learn about retention policies and retention labels, Microsoft Learn.
Compliance Manager scoring, Microsoft Learn.
Threat intelligence in Microsoft Defender, Microsoft Learn.
MDTI reaches end of life August 1, 2026, Microsoft Learn, July 23, 2026.