Free SC-900 practice test 2026: 20 questions without signup

Time allowed

45 minutes format →

Passing score

700 of 1000 — vendor, checked October 5, 2026 detail →

1080 practice test questions for Microsoft Security Compliance and Identity SC-900, grouped by exam domain. Every question below shows all four options, which one is correct, and why each of the other three is not — the wrong answers are where most candidates lose marks.

Not sure where you stand? Take the free 5-min SC-900 readiness check →

SC-900 certification: requirements, cost and exam format → ·  SC-900 exam format →  ·  SC-900 passing score →

Questions by domain

• Describe the capabilities of Microsoft security solutions — 405 questions →
• Describe the capabilities of Microsoft Entra — 297 questions →
• Describe the capabilities of Microsoft compliance solutions — 243 questions →
• Describe the concepts of security, compliance, and identity — 135 questions →

Sample questions

Defender XDR: Which capability best satisfies this cross-domain requirement?

1. Defender for Endpoint

   Defender for Endpoint focuses on endpoint prevention, detection, investigation, and response capabilities.
2. Defender XDR ✓

   Defender XDR correlates signals across email, endpoints, identities, and cloud apps into incidents.
3. Microsoft Threat Intelligence

   Microsoft Threat Intelligence supplies actor, indicator, and campaign context rather than correlating organizational security signals.
4. Defender for Cloud Apps

   Defender for Cloud Apps provides CASB capabilities for cloud-app discovery, activity, and session controls.

All 405 Describe the capabilities of Microsoft security solutions questions →

Password plus a security key: Which option meets the requirement?

1. Compliant device plus a password

   Device compliance is a contextual signal, not necessarily a human authentication factor category by itself.
2. PIN plus a security question

   A PIN and security question are both knowledge factors, despite using different secret values.
3. Password plus another password

   Two passwords are both knowledge factors, so they do not provide two distinct authentication factor categories.
4. Password plus a security key ✓

   A password supplies knowledge and a security key supplies possession, creating distinct factor categories.

All 297 Describe the capabilities of Microsoft Entra questions →

Microsoft Service Trust Portal: Which capability should it use?

1. Defender for Cloud secure score

   Secure score prioritizes cloud security posture improvements and does not provide Microsoft provider audit documentation.
2. Compliance Manager

   Compliance Manager tracks customer assessments, controls, improvement actions, and progress rather than publishing provider assurance reports.
3. Microsoft Service Trust Portal ✓

   The Service Trust Portal provides Microsoft cloud compliance and audit assurance documentation for customer due diligence, subject to access conditions.
4. Microsoft Purview compliance portal

   The Purview portal provides compliance experiences, but the stated provider assurance reports are supplied elsewhere.

All 243 Describe the capabilities of Microsoft compliance solutions questions →

Patch the guest operating system: Which task remains the college’s responsibility?

1. Patch the guest operating system ✓

   In IaaS, the customer generally manages guest operating-system maintenance while the provider manages physical infrastructure.
2. Replace failed physical storage devices

   Replacing physical infrastructure components is normally the provider’s responsibility in IaaS.
3. Secure the provider’s data-center buildings

   Physical facilities are managed by the cloud provider under the shared-responsibility model.
4. Maintain the provider’s network facilities

   The provider operates and protects the underlying physical and network infrastructure.

All 135 Describe the concepts of security, compliance, and identity questions →

CSPM assesses posture and provides recommendations: Which response is accurate?

1. Secure score certifies regulatory compliance after review.

   Secure score indicates progress and prioritization; it is not legal certification or proof of regulatory compliance.
2. CSPM assesses posture and provides recommendations. ✓

   Defender for Cloud CSPM assesses configuration posture and provides recommendations, secure score, and compliance views.
3. Recommendations automatically remediate every identified misconfiguration.

   Recommendations identify improvement actions but are not automatically remediated simply because administrators view them.
4. CSPM replaces workload threat protection for supported resources.

   CSPM evaluates posture, while workload protection addresses threats to supported workloads through configured plans.

All 405 Describe the capabilities of Microsoft security solutions questions →

Access reviews: Which Microsoft Entra capability provides this periodic attestation?

1. Conditional Access

   Conditional Access evaluates access conditions and applies controls, but it does not ask reviewers to attest membership.
2. Access reviews ✓

   Access reviews periodically ask designated reviewers to confirm whether existing memberships or access remain necessary.
3. Privileged Identity Management

   PIM manages eligible and time-bound privileged role activation, not periodic attestation of ordinary group membership.
4. Identity Protection

   Identity Protection detects risky users and sign-ins; it does not conduct membership attestation.

All 297 Describe the capabilities of Microsoft Entra questions →

A sensitive information type: Which Purview capability provides the underlying sensitive-information detection

1. A sensitivity label

   A sensitivity label classifies content and can apply configured protection, but it is not the underlying detection pattern.
2. A data loss prevention policy

   A DLP policy uses detection signals to audit, notify, or restrict inappropriate sharing and use.
3. A sensitive information type ✓

   A sensitive information type defines detectable patterns or identifiers for recognizing sensitive data such as payment-card numbers.
4. Content Explorer

   Content Explorer displays classified content and distribution for permitted users, rather than defining the detection pattern.

All 243 Describe the capabilities of Microsoft compliance solutions questions →

Authentication proves identity: Which concept provides the clearest explanation?

1. A successful sign-in should provide access whenever the identity provider has authenticated the user, regardless of repository permissions.

   The relying service must still validate applicable identity information and enforce its own authorization rules.
2. Single sign-on reduces repeated prompts but does not grant repository permissions.

   Single sign-on simplifies sign-in for configured applications; it does not remove authorization checks or grant universal access.
3. Federation lets a relying service trust identity assertions from another provider.

   Federation establishes trust for identity assertions, but it does not automatically grant repository permissions or copy every password.
4. Authentication proves identity; authorization determines permitted repository actions. ✓

   Authentication establishes who the user is, while authorization determines which actions that identity may perform on the repository.

All 135 Describe the concepts of security, compliance, and identity questions →

SC-900 exam: the facts

How long is the SC-900 exam?

45 minutes.

What topics does the SC-900 exam cover?

4 domains: Describe the capabilities of Microsoft security solutions, Describe the capabilities of Microsoft Entra, Describe the capabilities of Microsoft compliance solutions, Describe the concepts of security, compliance, and identity. Weights: Describe the capabilities of Microsoft security solutions 37.5%, Describe the capabilities of Microsoft Entra 27.5%, Describe the capabilities of Microsoft compliance solutions 22.5%, Describe the concepts of security, compliance, and identity 12.5%.

How many SC-900 practice test questions does Certsqill have?

1080, spread across 4 exam domains. Every one shows all options, which is correct, and why each of the others is not.

SC-900 dumps vs practice questions

An SC-900 dump claims to be the live exam — questions copied from real sittings. Practice questions are written against Microsoft’s published SC-900 study guide to test the same skills, without reproducing the exam.

Microsoft’s policy is explicit. It treats all exam content as confidential intellectual property and prohibits obtaining, using or distributing it by any method, including memorisation. It defines a brain dump as a source containing fraudulently obtained exam content, and states that using such material to prepare for an exam constitutes cheating.

The consequences listed by Microsoft: a candidate may be permanently prohibited from taking future exams, banned from the Microsoft Credentials Program, and have credentials and scores revoked. The candidate agreement also names using braindump material as misconduct. For a Fundamentals certification that does not expire, that is a lot to risk.

How to use SC-900 practice questions well

Work by skill area, in proportion to the weighting. Microsoft security solutions carry 35–40%, so a weak score there costs the most; the concepts of security, compliance and identity carry only 10–15%, but they underpin every other area.

Read the explanation for every option, including the ones you ruled out. In SC-900, wrong options are often real Microsoft products that solve a different problem — a Defender product where Purview is right, or the reverse — and knowing why they do not fit is what transfers to new questions.

Then check against the update. Microsoft changes the English exam on 21 October 2026, with two objectives marked as minor changes: the function and identity types of Microsoft Entra ID, and threat protection with Microsoft Defender XDR. Give those two extra attention if your earlier notes predate the change.

SC-900 practice: questions people ask

Are SC-900 dumps allowed?

No. Microsoft treats exam content as confidential and defines using brain dump material as cheating; penalties can include a permanent ban and revoked credentials. Source: Microsoft Learn, checked 9 October 2026.

Are Certsqill’s SC-900 questions taken from the real exam?

No. They are expert-developed against Microsoft’s published SC-900 study guide, with an explanation for every answer option and a readiness score per skill area.

Does the candidate agreement mention braindumps?

Yes. The Microsoft Certification Exam Candidate Agreement lists using braindump material as misconduct. Checked 9 October 2026.