Free SC-900 sample questions with answers
Here are five free SC-900 sample questions, covering all four skill areas, with the answer and the reasoning behind it. Try each one before opening the answer. These are original scenario questions written against the official skills outline, not questions from the real exam.
Question 1. A company decides that no user, device or network location is trusted by default, and that every request is verified explicitly using all available signals. Which security model does this describe?
- A. The shared responsibility model
- B. A traditional network perimeter model
- C. Zero Trust
- D. Defense in depth
Show answer
Answer: C
Zero Trust assumes breach, verifies explicitly and grants least privilege, regardless of network location. The shared responsibility model divides duties between provider and customer. Defense in depth means layering controls, which can exist without that trust stance. A perimeter model trusts everything inside the corporate network, which is the opposite.
Want more questions like this? Full SC-900 practice tests →
Question 2. Users must be asked for multifactor authentication only when they sign in from outside the corporate network to the finance application. Which Microsoft Entra capability should you use?
- A. Conditional Access
- B. Privileged Identity Management
- C. Access reviews
- D. Password protection
Show answer
Answer: A
Conditional Access evaluates signals such as location and application and then enforces controls such as requiring MFA. Privileged Identity Management gives time-limited elevation to roles. Access reviews recertify who has access. Password protection blocks weak passwords and has no sign-in conditions.
Want more questions like this? Full SC-900 practice tests →
Question 3. You want a single score and a list of recommendations that show how well your Azure subscriptions follow security best practice. Which service provides this?
- A. Azure Firewall
- B. Azure Key Vault
- C. Azure Bastion
- D. Microsoft Defender for Cloud
Show answer
Answer: D
Microsoft Defender for Cloud provides cloud security posture management with a secure score and recommendations. Azure Firewall filters network traffic and gives no posture score. Azure Key Vault stores secrets and keys. Azure Bastion gives browser-based remote access to VMs.
Want more questions like this? Full SC-900 practice tests →
Question 4. A security team wants to collect logs from many sources, detect threats with analytics rules and automatically run a playbook that disables a compromised account. Which product fits?
- A. Microsoft Purview Compliance Manager
- B. Microsoft Sentinel
- C. Azure DDoS Protection
- D. Microsoft Purview Audit
Show answer
Answer: B
Microsoft Sentinel is a cloud-native SIEM with SOAR capabilities: it collects and correlates data, detects threats and runs automated playbooks. Microsoft Purview protects and governs data. Azure DDoS Protection mitigates volumetric network attacks. Compliance Manager assesses compliance against regulations and does not detect threats.
Want more questions like this? Full SC-900 practice tests →
Question 5. Documents that contain customer credit card numbers must be prevented from being shared outside the organization by email. Which Microsoft Purview capability should you configure?
- A. A data loss prevention policy
- B. eDiscovery
- C. Audit
- D. Insider risk management
Show answer
Answer: A
Data loss prevention policies detect sensitive information such as card numbers and block or warn on sharing. eDiscovery finds and holds content for legal cases but does not block sending. Audit records activity afterwards. Insider risk management looks for risky user behavior patterns, not for blocking a specific share.
Want more questions like this? Full SC-900 practice tests →
What to do next
If you scored 4 or 5, try the 20-question practice test. If you missed the Defender or Purview items, read the security solutions and compliance guides, and see the study plan for a week-by-week order.