SC-900 sample exam questions

15 exam-style questions for Microsoft SC-900: Security, Compliance, and Identity Fundamentals, with answers and explanations. Take them as a timed practice exam first if you want a score out of 1000.

Take the free practice exam SC-900 exam guide

Question 1Multiple responseOther

In the Microsoft Cloud Adoption Framework for Azure, which two phases are addressed before the Ready phase? Each correct answer presents a complete
solution.
NOTE: Each correct selection is worth one point.
1. A
  Plan
2. B
  Manage
3. C
  Adopt
4. D
  Govern
5. E
  Define Strategy
Show answer

Correct answer: A, E

Why
The Cloud Adoption Framework phases run Define Strategy, Plan, Ready, Adopt, with Govern and Manage running alongside them. So Define Strategy and Plan come before Ready, while Adopt follows it and Govern and Manage are ongoing.
Question 2Multiple responseMicrosoft Entra

Which three authentication methods can be used by Azure Multi-Factor Authentication (MFA)? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
1. A
  text message (SMS)
2. B
  Microsoft Authenticator app
3. C
  email verification
4. D
  phone call
5. E
  security question
Show answer

Correct answer: A, B, D

Why
Microsoft Entra multifactor authentication (formerly Azure MFA) supports the Microsoft Authenticator app, SMS text messages and voice phone calls, as well as OATH tokens and FIDO2 keys. Email verification and security questions are only used for self-service password reset, not MFA.
Question 3Single choiceSecurity, compliance and identity concepts

You plan to implement a security strategy and place multiple layers of defense throughout a network infrastructure.
Which security methodology does this represent?
1. A
  threat modeling
2. B
  identity as the security perimeter
3. C
  defense in depth
4. D
  the shared responsibility model
Show answer

Correct answer: C

Why
Defense in depth uses several layers of protection (physical, identity, perimeter, network, compute, application, data), so if one layer is breached the others still protect the asset. Threat modeling finds threats during design, and the shared responsibility model splits duties between Microsoft and the customer.
Question 4Single choiceMicrosoft security solutions

Which type of alert can you manage from the Microsoft 365 Defender portal?
1. A
  Microsoft Defender for Storage
2. B
  Microsoft Defender for SQL
3. C
  Microsoft Defender for Endpoint
4. D
  Microsoft Defender for IoT
Show answer

Correct answer: C

Why
The Microsoft Defender portal (formerly Microsoft 365 Defender) manages alerts from Defender for Endpoint, Office 365, Identity and Cloud Apps. Defender for Storage, SQL and IoT were traditionally Defender for Cloud and Azure alerts, so Defender for Endpoint is the expected answer.
Question 5Single choiceOther

What are customers responsible for when evaluating security in a software as a service (SaaS) cloud services model?
1. A
  operating systems
2. B
  network controls
3. C
  applications
4. D
  accounts and identities
Show answer

Correct answer: D

Why
In SaaS, the provider manages the application, operating system, network controls and infrastructure. The customer always keeps responsibility for their information and data, devices, and accounts and identities.

Question 6HotspotMicrosoft Entra

HOTSPOT

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

You can create a hybrid identity in an on-premises Active Directory that syncs to Azure AD.	Yes / No
User accounts created in Azure AD sync automatically to an on-premises Active Directory.	Yes / No
When using a hybrid model, authentication can either be done by Azure AD or by another identity provider.	Yes / No

Show answer

You can create a hybrid identity in an on-premises Active Directory that syncs to Azure AD. Yes
User accounts created in Azure AD sync automatically to an on-premises Active Directory. No
When using a hybrid model, authentication can either be done by Azure AD or by another identity provider. Yes

Why

Hybrid identities are created in on-premises AD and synced to Microsoft Entra ID (formerly Azure AD) by Entra Connect. Cloud-only accounts are not synced back to AD by default. Authentication can use password hash sync or pass-through authentication in Entra ID, or federation with another provider such as AD FS.

Question 7Multiple responseSecurity, compliance and identity concepts

What are two reasons to deploy multiple virtual networks instead of using just one virtual network? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.
1. A
  to meet governance policies
2. B
  to connect multiple types of resources
3. C
  to separate the resources for budgeting
4. D
  to isolate the resources
Show answer

Correct answer: A, D

Why
Organizations deploy several virtual networks to isolate resources from each other (segmentation) and to meet governance policies that require separate environments or owners. One VNet can already hold many kinds of resources, and budgeting separation is usually done with subscriptions, resource groups or tags.
Question 8Single choiceMicrosoft compliance solutions

Which score measures an organization’s progress in completing actions that help reduce risks associated to data protection and regulatory standards?
1. A
  Adoption Score
2. B
  Microsoft Secure Score
3. C
  Secure score in Microsoft Defender for Cloud
4. D
  Compliance score
Show answer

Correct answer: D

Why
Compliance score in Microsoft Purview Compliance Manager tracks completion of improvement actions that reduce data protection and regulatory risk. Microsoft Secure Score and Defender for Cloud secure score measure security posture, and Adoption Score measures how people use Microsoft 365.

Question 9HotspotSecurity, compliance and identity concepts

HOTSPOT

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

GitHub is a cloud-based identity provider.	Yes / No
Federation provides single sign-on (SSO) with multiple service providers.	Yes / No
A central identity provider manages all modern authentication services, such as authentication, authorization, and auditing.	Yes / No

Show answer

GitHub is a cloud-based identity provider. Yes
Federation provides single sign-on (SSO) with multiple service providers. Yes
A central identity provider manages all modern authentication services, such as authentication, authorization, and auditing. Yes

Why

Microsoft Learn lists GitHub, alongside Microsoft, Google and Facebook, as a cloud identity provider. Federation creates trust between domains so one sign-in works across several service providers. With modern authentication, a central identity provider handles authentication, authorization and auditing services.

Question 10Single choiceMicrosoft Entra

When you enable Azure AD Multi-Factor Authentication (MFA), how many factors are required for authentication?
1. A
  1
2. B
  2
3. C
  3
4. D
  4
Show answer

Correct answer: B

Why
Multifactor authentication needs at least two different factors, for example something you know (a password) plus something you have (the Authenticator app or a phone) or something you are (biometrics). So Microsoft Entra MFA, formerly Azure AD MFA, requires two factors.
Question 11HotspotMicrosoft security solutions

HOTSPOT

Select the answer that correctly completes the sentence.

Microsoft Defender for Cloud assesses Azure resources ___ for security issues. continuously / daily / every 15 minutes / hourly
Show answer
- Microsoft Defender for Cloud assesses Azure resources ___ for security issues. continuously
Why
Microsoft Defender for Cloud continuously assesses Azure, hybrid and multicloud resources for security issues and updates its recommendations and secure score. It does not run on a fixed daily, hourly or 15-minute schedule.

Microsoft Defender for Cloud assesses Azure resources ___ for security issues.	continuously / daily / every 15 minutes / hourly

Question 12HotspotMicrosoft compliance solutions

HOTSPOT

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

eDiscovery (Standard) search results can be exported.	Yes / No
eDiscovery (Standard) can be integrated with insider risk management.	Yes / No
eDiscovery (Standard) can be used to search Microsoft Exchange Online public folders.	Yes / No

Show answer

eDiscovery (Standard) search results can be exported. Yes
eDiscovery (Standard) can be integrated with insider risk management. No
eDiscovery (Standard) can be used to search Microsoft Exchange Online public folders. Yes

Why

eDiscovery (Standard) lets you create cases, search content locations including Exchange public folders, place holds and export results. Escalating insider risk cases to eDiscovery is a Premium capability. Note: Standard and Premium are now merged into the unified eDiscovery experience in the Purview portal.

Question 13Multiple responseMicrosoft security solutions

Which two actions can you perform by using Azure Key Vault? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.
1. A
  Store secrets.
2. B
  Store Azure Resource Manager (ARM) templates.
3. C
  Implement network security groups (NSGs).
4. D
  Implement Azure DDoS Protection.
5. E
  Store keys.
Show answer

Correct answer: A, E

Why
Azure Key Vault stores secrets (passwords, connection strings), cryptographic keys and certificates. ARM templates belong in a repository or Template Specs, and NSGs and DDoS Protection are network security services configured separately.

Question 14HotspotMicrosoft Entra

HOTSPOT

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Microsoft Entra Access Review evaluates user and group permissions for Azure resources.	Yes / No
A user can be removed from a group automatically after a Microsoft Entra Access Review evaluation.	Yes / No
The Microsoft Entra Access Review feature is available in all Microsoft Entra ID service plans.	Yes / No

Show answer

Microsoft Entra Access Review evaluates user and group permissions for Azure resources. Yes
A user can be removed from a group automatically after a Microsoft Entra Access Review evaluation. Yes
The Microsoft Entra Access Review feature is available in all Microsoft Entra ID service plans. No

Why

Access reviews can cover group membership, application access and Azure resource roles (via PIM), and the auto-apply setting removes denied users automatically. The feature requires Microsoft Entra ID P2 or Microsoft Entra ID Governance licences, not the Free plan.

Question 15Multiple responseMicrosoft compliance solutions

To which three locations can a data loss prevention (DLP) policy be applied? Each correct answer presents a complete solution.

NOTE: Each correct answer is worth one point.
1. A
  Microsoft Exchange Online email
2. B
  Microsoft OneDrive accounts
3. C
  Microsoft Exchange Online public folders
4. D
  Microsoft Teams chat and channel messages
5. E
  Microsoft Viva Engage
Show answer

Correct answer: A, B, D

Why
Microsoft Purview DLP policies can apply to Exchange Online email, SharePoint sites, OneDrive accounts, Teams chat and channel messages, devices and more. Exchange public folders are not a supported DLP location, and Viva Engage is not one of the expected answers.