Full exam simulation
45 questions · 45 minutes, 0 unscored and not identified. One question per screen, flag and strike-out, a review screen and a score report per domain — no answers until you finish.
MicrosoftSC-900FoundationalSecurityAvailable
Microsoft Security, Compliance, and Identity Fundamentals
Security, compliance and identity concepts with Microsoft Entra, Defender, Sentinel, Azure security services and Microsoft Purview.
Independent practice — not affiliated with or endorsed by Microsoft. SC-900 is used only to identify the exam. Trademark notices
Domain weights
Share of scored content per domain. Every sitting draws questions by these weights.
- D1Describe the concepts of security, compliance, and identity13 %11 concepts
- D2Describe the capabilities of Microsoft Entra27 %21 concepts
- D3Describe the capabilities of Microsoft security solutions37 %29 concepts
- D4Describe the capabilities of Microsoft compliance solutions23 %19 concepts
Your progress
No attempts yet. Take a full sitting to get a readiness rating; results are kept in this browser. Join your class to keep them on every device.
Choose a mode
ESL +30
The full sitting with 30 extra minutes (75 min) — the accommodation non-native English speakers can request for exams in English.
Quick 20
20 questions · 20 min, same weights, all scored. A daily check.
Weak spots
20 questions aimed at your weakest domains, missed concepts and due reviews.
Practice builder
Pick domains, topics, how many questions and which pool (new, wrong, due, low confidence). Spaced repetition with confidence ratings, flashcards and a mistake book.
Open practiceDomain drill
One domain, up to 20 questions.
What's on the exam
Domain 1: Describe the concepts of security, compliance, and identity
13 %Shared responsibility, defense in depth, Zero Trust, encryption and hashing, GRC; identity as the security perimeter, authentication, authorization, identity providers, directory services, Active Directory and federation. Official range 10–15 %.
Practice domain 1 →Domain 2: Describe the capabilities of Microsoft Entra
27 %Microsoft Entra ID, identity types including workload identities, hybrid identity; authentication methods, MFA, password protection; Conditional Access, Entra roles and RBAC; ID Governance, access reviews, Privileged Identity Management and ID Protection. Official range 25–30 %.
Practice domain 2 →Domain 3: Describe the capabilities of Microsoft security solutions
37 %Azure DDoS Protection, Azure Firewall, WAF, VNets, NSGs, Bastion, Key Vault; Defender for Cloud (CSPM, workload protection); Sentinel SIEM/SOAR; Defender XDR for Office 365, Endpoint, Cloud Apps and Identity, Vulnerability Management, Threat Intelligence, Defender portal. Official range 35–40 %.
Practice domain 3 →Domain 4: Describe the capabilities of Microsoft compliance solutions
23 %Service Trust Portal and Microsoft privacy principles; Purview portal, Compliance Manager and compliance score; data classification, Content and Activity explorer, sensitivity labels, DLP, records management and retention; insider risk, eDiscovery and Audit. Official range 20–25 %.
Practice domain 4 →
Domain names and weights come from the official SC-900 exam objectives (checked 2026-10-27). Always check it for the authoritative scope.
Includes 12 performance-style items (put in order, match, read an exhibit) — practice them with the “Order / match” filter.
The real exam's full hot-area simulations (labs in a live interface) are not reproduced.
Sources · checked 2026-10-27
- Microsoft Learn — SC-900 study guide (skills measured as of October 21, 2026; 10–15 / 25–30 / 35–40 / 20–25 %; pass 700) ↗
- Microsoft Learn — Security, Compliance, and Identity Fundamentals certification (45 minutes; last updated 10/21/2026) ↗
- Microsoft Learn — exam duration and experience (Fundamentals 45 min; most exams 40–60 questions) ↗
Sample questions
Two of this exam's original questions, with the explanation you get after every answer.
Sample 1Select one
A company moves its email from on-premises Exchange servers to a SaaS service. Which responsibility ALWAYS stays with the company?
- AIts information and data, accounts and the devices that access them
- BPhysical security of the data center
- CPatching the operating system of the mail servers
- DReplacing failed network switches
Show answer & explanation
Correct: A. In every cloud model the customer keeps responsibility for its information and data, devices, and accounts and identities. The provider always owns physical hosts, network and data center.
Sample 2Select 2
Which of the following are among the six foundational pillars that Microsoft's Zero Trust model secures? (Select TWO.)
- AMarketing campaigns
- BOffice furniture
- CDevices (endpoints)
- DPrinters only
- EIdentities
Show answer & explanation
Correct: C, E. The pillars are identities, endpoints, applications, data, infrastructure and networks; each is a source of signals and a point of control.