Last-minute reference for SC-900. Security solutions is the largest area; concepts is the smallest, but its vocabulary supports the rest.
Exam facts
| |
|---|
| Duration | 45 minutes |
| Passing score | 700 / 1000 |
| Questions | Not published |
| Renewal | None |
| Weights | Concepts 10–15%, Entra 25–30%, Security 35–40%, Compliance 20–25% |
Concepts
- Zero Trust: verify explicitly, least-privilege access, assume breach.
- Defense in depth: layered controls; one failure does not expose everything.
- Shared responsibility: the provider secures the facility; the customer always owns data and identities.
- Encryption reversible with a key; hashing one-way.
- Authentication proves who; authorization decides what; federation links identity providers.
Microsoft Entra
| Need | Answer |
|---|
| Conditions on sign-in | Conditional Access |
| Time-limited role elevation | Privileged Identity Management |
| Detect risky sign-ins | ID Protection |
| Recertify access periodically | Access reviews |
| Manage joiners, movers, leavers | ID Governance |
| One identity on-premises and cloud | Hybrid identity |
| Identity for apps and services | Workload identity |
| Users reset own password | Self-service password reset |
MFA = two of: know, have, are. Passwordless: Authenticator, FIDO2 key, Windows Hello for Business.
Security solutions
| Product | One-line purpose |
|---|
| DDoS Protection | Absorb floods of traffic |
| Azure Firewall | Managed network firewall |
| WAF | Stop web exploits |
| NSG | Allow or deny by address, port, protocol |
| Bastion | Remote access without public IPs |
| Key Vault | Secrets, keys, certificates |
| Defender for Cloud | Posture (CSPM), secure score, workload protection |
| Sentinel | SIEM plus SOAR |
| Defender for Office 365 | Email and collaboration |
| Defender for Endpoint | Devices |
| Defender for Cloud Apps | SaaS, shadow IT (CASB) |
| Defender for Identity | On-premises Active Directory |
| Vulnerability Management | Find and prioritize weaknesses |
| Defender portal | One place for XDR incidents |
Compliance solutions
| Need | Answer |
|---|
| Microsoft audit reports | Service Trust Portal |
| Regulatory assessments and score | Compliance Manager |
| Find sensitive data | Data classification |
| Classify and encrypt a file | Sensitivity label |
| Stop sharing of sensitive data | DLP |
| Keep or delete after time | Retention policy or label |
| Lock items as records | Records management |
| Risky user behavior | Insider risk management |
| Legal search and hold | eDiscovery |
| Activity log of user and admin actions | Audit |
Common traps
- Old names: Azure AD is now Microsoft Entra ID.
- Defender for Cloud is not Defender for Cloud Apps.
- A compliance score is not proof of legal compliance.
- Conditional Access enforces conditions after the first sign-in step; it does not replace authentication.
See the study plan and the exam tips for how to use this.