SC-900 exam tips: how to pass first time
The most useful SC-900 tip is to match every scenario to one keyword and one product: the exam rewards recognising what each Microsoft product is for, not knowing how to configure it. Most lost points come from near-identical product names, outdated names from older study material, and rushing statement questions. This page collects the habits that help most in the 45 minutes.
Read for the verb
Each scenario contains a verb that points to the answer.
| If the scenario says… | Think… |
|---|---|
| detect, correlate, investigate across sources | Microsoft Sentinel |
| posture, recommendations, secure score | Defender for Cloud |
| phishing, malicious attachment | Defender for Office 365 |
| devices, endpoint, ransomware on laptops | Defender for Endpoint |
| unsanctioned SaaS apps, shadow IT | Defender for Cloud Apps |
| on-premises Active Directory attack | Defender for Identity |
| web exploits such as SQL injection | Web Application Firewall |
| flood of traffic | DDoS Protection |
| secrets, keys, certificates | Key Vault |
| elevate a role temporarily | Privileged Identity Management |
| conditions on sign-in | Conditional Access |
| prevent sharing sensitive data | Data loss prevention |
| keep or delete after a period | Retention |
| legal hold and search | eDiscovery |
| risky user activity, departing employee | Insider risk management |
| Microsoft audit reports | Service Trust Portal |
Learn the pairs that get confused
- Authentication versus authorization. Who you are versus what you may do.
- Defender for Cloud versus Defender for Cloud Apps. Azure resources and posture versus SaaS application usage.
- Sensitivity labels versus retention labels versus DLP. Protection of an item, lifetime of an item, and prevention of leakage.
- NSG versus Azure Firewall versus WAF. Basic packet rules, a managed network firewall, and web application protection.
- Encryption versus hashing. Reversible with a key versus one-way.
- eDiscovery versus Audit. Finding content versus recording activity.
Handle statement questions carefully
Some questions give several statements and ask which are true. Read each one separately and watch for absolute words such as always, only and never. Often one wrong word, not the product, makes a statement false. On items where you cannot go back, answer before moving on.
Use current names
Older material may say Azure Active Directory, Azure AD Conditional Access, Microsoft 365 Defender, Azure Sentinel or Microsoft 365 compliance center. Today’s names are Microsoft Entra ID, Microsoft Defender XDR, Microsoft Sentinel and the Microsoft Purview portal. The exam uses current names, so translate as you study. The exam changes page explains how to follow outline updates.
Manage the time
45 minutes is generous for a conceptual exam. Do not spend more than a minute on any one item: if you know the product you know it immediately, and if you do not, flag it and move on. Keep the last few minutes for flagged items. The exam day guide covers check-in and the proctored environment.
Practice the right way
- Take the official practice assessment once early.
- Work through the free practice test and write the product name next to each question you miss.
- Re-take a different set a few days later. Scoring 80% or more twice in a row on different sets is a good signal.
For the facts you need on the day, see the cheat sheet and the exam format.