Free SC-900 practice test: 20 questions
Twenty questions across the four SC-900 skill areas, weighted roughly as the real exam is: three on concepts, five on Microsoft Entra, eight on security solutions and four on compliance solutions. These are original scenario questions. Find the requirement in each scenario before you look at the options.
Security, compliance and identity concepts
Question 1. Which Zero Trust principle says that you should limit user access with just-in-time and just-enough access?
- A. Verify explicitly
- B. Use least-privilege access
- C. Assume breach
- D. Trust the internal network
Show answer
Answer: B
Use least-privilege access means granting only the access needed, when needed. Verify explicitly is about evaluating all signals on each request. Assume breach is about limiting blast radius and detecting attacks. Trust the network is not a Zero Trust principle at all.
Want more questions like this? Full SC-900 practice tests →
Question 2. A company uses a SaaS email service. According to the shared responsibility model, which item stays the customer's responsibility?
- A. Physical servers
- B. Application code
- C. Operating system patches
- D. User accounts and data
Show answer
Answer: D
In SaaS the provider runs the application, operating system and infrastructure. The customer still owns the data, the users and the accounts. The physical servers and the application code are the provider’s.
Want more questions like this? Full SC-900 practice tests →
Question 3. After a user proves who they are, the system decides which files that user may open. What is the second step called?
- A. Authorization
- B. Authentication
- C. Federation
- D. Hashing
Show answer
Answer: A
Authorization determines what an authenticated identity may do. Authentication is the first step, proving identity. Federation is a trust between identity providers. Hashing is a one-way transformation and not an access decision.
Want more questions like this? Full SC-900 practice tests →
Microsoft Entra
Question 4. Which authentication method is considered passwordless?
- A. A password plus an SMS code
- B. A security question
- C. A FIDO2 security key
- D. A password and an email link
Show answer
Answer: C
FIDO2 security keys and Windows Hello for Business replace the password with a possession or biometric factor. A password plus SMS is still password-based. A security question is a weak knowledge factor. An email link used with a password does not remove the password.
Want more questions like this? Full SC-900 practice tests →
Question 5. A managed identity in Azure is an example of which type of identity?
- A. A user identity
- B. A workload identity
- C. A guest identity
- D. A device identity
Show answer
Answer: B
Managed identities, like service principals, represent applications and services, so they are workload identities. A user identity represents a person. A guest identity is an external person. A device identity represents a registered device.
Want more questions like this? Full SC-900 practice tests →
Question 6. Users have forgotten their passwords and call the help desk daily. Which Entra capability lets them recover access themselves?
- A. Self-service password reset
- B. Conditional Access
- C. Access reviews
- D. Privileged Identity Management
Show answer
Answer: A
Self-service password reset lets users reset their own password after verifying their identity. Conditional Access sets conditions on sign-in. Access reviews recertify access. Privileged Identity Management manages role elevation.
Want more questions like this? Full SC-900 practice tests →
Question 7. Every quarter, group owners must confirm that members of a project team still need access. Which feature automates this?
- A. Microsoft Entra ID Protection
- B. Password protection
- C. Conditional Access
- D. Access reviews
Show answer
Answer: D
Access reviews ask reviewers to approve or remove access on a schedule. ID Protection detects risky sign-ins. Password protection blocks weak passwords. Conditional Access enforces conditions at sign-in, not periodic recertification.
Want more questions like this? Full SC-900 practice tests →
Question 8. Access to a payroll app should be blocked from devices that are not marked compliant. What do you configure?
- A. A sensitivity label
- B. A retention policy
- C. A Conditional Access policy
- D. A network security group
Show answer
Answer: C
A Conditional Access policy can require a compliant device as a grant control. Sensitivity labels classify data. A retention policy governs content lifetime. An NSG filters network packets and does not know device compliance.
Want more questions like this? Full SC-900 practice tests →
Microsoft security solutions
Question 9. An internet-facing service is hit by a flood of traffic meant to exhaust its capacity. Which service mitigates this?
- A. Azure Web Application Firewall
- B. Azure DDoS Protection
- C. Azure Key Vault
- D. Azure Bastion
Show answer
Answer: B
Azure DDoS Protection detects and mitigates volumetric attacks on public IP resources. A WAF blocks application-layer exploits. Key Vault holds secrets. Bastion provides remote administration access.
Want more questions like this? Full SC-900 practice tests →
Question 10. Where should an application store database connection secrets and certificates so that code does not contain them?
- A. Azure Key Vault
- B. Azure Firewall
- C. A network security group
- D. Microsoft Defender for Cloud
Show answer
Answer: A
Azure Key Vault stores and controls access to secrets, keys and certificates. Azure Firewall filters traffic. A network security group filters packets. Defender for Cloud assesses posture and does not store secrets.
Want more questions like this? Full SC-900 practice tests →
Question 11. Which statement about network security groups is correct?
- A. They block SQL injection in HTTP requests
- B. They store certificates
- C. They authenticate users
- D. They allow or deny traffic by address, port and protocol
Show answer
Answer: D
NSGs contain allow and deny rules based on source, destination, port and protocol, and attach to subnets or network interfaces. They do not inspect web request content (that is a WAF), do not store secrets, and are not an identity feature.
Want more questions like this? Full SC-900 practice tests →
Question 12. What does the secure score in Microsoft Defender for Cloud represent?
- A. The number of attacks blocked this month
- B. The estimated monthly security cost
- C. Your security posture based on completed recommendations
- D. Your percentage of GDPR compliance
Show answer
Answer: C
Secure score measures how well your resources follow security recommendations, as part of cloud security posture management. It is not a compliance percentage for a regulation, a count of attacks or a billing estimate.
Want more questions like this? Full SC-900 practice tests →
Question 13. Which pair of terms correctly describes Microsoft Sentinel?
- A. EDR and CASB
- B. SIEM and SOAR
- C. WAF and DDoS
- D. KMS and PKI
Show answer
Answer: B
Sentinel is a cloud-native SIEM with SOAR capabilities. It is not an endpoint protection platform or a CASB, and it is not a firewall or a key management service.
Want more questions like this? Full SC-900 practice tests →
Question 14. Which product detects compromised on-premises Active Directory accounts and lateral movement signals?
- A. Microsoft Defender for Identity
- B. Microsoft Defender for Office 365
- C. Microsoft Defender for Cloud Apps
- D. Microsoft Defender Vulnerability Management
Show answer
Answer: A
Defender for Identity monitors on-premises Active Directory signals for compromised identities and lateral movement. Defender for Office 365 protects email. Defender for Cloud Apps controls SaaS usage. Defender Vulnerability Management finds weaknesses and not active attacks on identities.
Want more questions like this? Full SC-900 practice tests →
Question 15. Employees receive emails with links that lead to credential-harvesting sites. Which Defender product helps protect against this?
- A. Microsoft Defender for Endpoint
- B. Azure Firewall
- C. Microsoft Defender for Office 365
- D. Microsoft Sentinel
Show answer
Answer: C
Defender for Office 365 protects email and collaboration tools against phishing and malicious links and attachments. Defender for Endpoint protects devices. Azure Firewall filters network traffic and does not inspect mailbox content. Sentinel detects and responds but is not the preventive mail control.
Want more questions like this? Full SC-900 practice tests →
Question 16. Where can an analyst see incidents and alerts from several Defender products in one place?
- A. The Service Trust Portal
- B. Compliance Manager
- C. Azure Key Vault
- D. The Microsoft Defender portal
Show answer
Answer: D
The Microsoft Defender portal unifies alerts and incidents from the Defender XDR products. Service Trust Portal offers audit reports. Compliance Manager tracks regulatory assessments. Key Vault is a secrets store.
Want more questions like this? Full SC-900 practice tests →
Microsoft compliance solutions
Question 17. A customer auditor asks for Microsoft's independent audit reports and compliance certifications. Where do you get them?
- A. Compliance Manager
- B. The Service Trust Portal
- C. Microsoft Purview Audit
- D. The Microsoft Defender portal
Show answer
Answer: B
The Service Trust Portal publishes audit reports and compliance documentation. Compliance Manager assesses your own posture. Audit logs record your tenant’s activity. The Defender portal handles threats.
Want more questions like this? Full SC-900 practice tests →
Question 18. A document must be encrypted and marked Confidential, and the protection must follow the file when it is emailed. What should you apply?
- A. A sensitivity label
- B. A retention label
- C. A DLP policy
- D. An eDiscovery case
Show answer
Answer: A
A sensitivity label can apply encryption and markings that persist with the file. Retention labels control how long content is kept. A DLP policy detects and blocks sharing but does not mark or encrypt the file itself. eDiscovery searches content.
Want more questions like this? Full SC-900 practice tests →
Question 19. Which Purview tool shows what actions were performed on labeled items, such as labels changed or files downloaded?
- A. Content explorer
- B. Compliance Manager
- C. Activity explorer
- D. The Service Trust Portal
Show answer
Answer: C
Activity explorer shows activities on labeled content. Content explorer shows the items themselves and their classification. Compliance Manager assesses controls. The Service Trust Portal publishes Microsoft audit documents.
Want more questions like this? Full SC-900 practice tests →
Question 20. Which statement about the Compliance Manager compliance score is correct?
- A. It guarantees you will pass an audit
- B. It counts security incidents in the tenant
- C. It scans email for sensitive content
- D. It measures progress completing improvement actions
Show answer
Answer: D
The score reflects progress through improvement actions, including Microsoft-managed ones, and it does not by itself prove legal compliance. It is not a count of incidents, it does not scan emails and it is not a guarantee of passing an audit.
Want more questions like this? Full SC-900 practice tests →
Missed several in one area? Go to its guide: concepts, Entra, security solutions or compliance.