Skip to content
Cheat sheets
Foundational · SC-900Prep available

Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-900) practice exam and study path

A free, timed 60-question SC-900 practice exam in 45 minutes, scored by domain, with every option explained after you submit. Also 116 practice questions you can check one at a time, a page for every task in the exam guide, and a study path. No sign-up.

Start the free practice examGet the exam packPractise question by question →
Security, Compliance, and Identity Fundamentals exam pack:

$4.99for 12 months

The entry-level Microsoft security exam: shared responsibility, Zero Trust and identity concepts, what Microsoft Entra does for sign-in, access and governance, the Azure and Defender security services and Microsoft Sentinel, and the Microsoft Purview solutions for compliance and data protection.

The exam

Exam code
SC-900
Questions
Not yet published
Time
45 minutes
Passing score
700 of 1,000 (scaled)
Exam fee
$99 (USD)
Question types
multiple choice, multiple response

Exam SC-900 is a proctored fundamentals exam: 45 minutes, offered in 13 languages through Pearson VUE or Certiport, it may include interactive components, and 700 passes. Microsoft doesn't publish the number of questions (most of its exams have 40 to 60). The fee is set by the country or region (USD 99 in the United States). Fundamentals certifications don't expire, so there is no renewal. Our questions follow the skills measured as of October 21, 2026, and our forms use 60 questions split 8 / 17 / 22 / 13, close to the midpoints of the guide's ranges.

From Microsoft's certification page and exam guide, checked Oct 25, 2026.

Domains and weights

  • Domain 1: Describe the concepts of security, compliance, and identity

    13%

  • Domain 2: Describe the capabilities of Microsoft Entra

    28%

  • Domain 3: Describe the capabilities of Microsoft security solutions

    37%

  • Domain 4: Describe the capabilities of Microsoft compliance solutions

    22%

Practice

116 original practice questions, every option explained with the Microsoft documentation page that proves it. Free, no sign-up; progress stays on this device.

Your results on this device →

More practice exams

The lessons, the sample questions on every task page and the first full practice exam are free and stay free. A pack adds the further timed SC-900 practice exams.

Security, Compliance, and Identity Fundamentals exam pack

$4.99for 12 months

  • Every paid SC-900 practice exam, timed, with every option explained
  • The next version of this exam included when it changes within your 12 months
  • 12 months of access. One payment, nothing renews by itself.
  • 14-day refund, no conditions
  • 14-day refund, no conditions: ask within 14 days of buying and you get the whole payment back.
  • No pass guarantee. These are practice exams written by us from the exam guide and the Microsoft documentation; a score here does not predict your result on the real exam.

Study path

One module per exam domain. Lessons that already exist on BytePatterns are linked; the rest are being written.

  1. Module 1: Describe the concepts of security, compliance, and identity

    1. 1The shared responsibility model for IaaS, PaaS, SaaS and AI workloadsTask 1.1

      Partly covered by: Shared Responsibility & IAM, Guardrails

    2. 2Defense in depth and the confidentiality, integrity and availability triadTask 1.1

      Lesson coming

    3. 3Zero Trust: verify explicitly, least privilege and assume breachTask 1.1

      Lesson coming

    4. 4Encryption at rest, in transit and in use, keys, hashing and saltingTask 1.1

      Partly covered by: KMS, Envelope Encryption & Private CA

    5. 5Governance, risk and compliance; data residency, sovereignty and privacyTask 1.1

      Lesson coming

    6. 6Identity as the primary security perimeter; authentication and authorizationTask 1.2

      Partly covered by: Shared Responsibility & IAM

    7. 7Identity providers, tokens, single sign-on and federationTask 1.2

      Lesson coming

    8. 8Directory services and Active Directory Domain ServicesTask 1.2

      Lesson coming

  2. Module 2: Describe the capabilities of Microsoft Entra

    1. 9Microsoft Entra ID, tenants and directoriesTask 2.1

      Lesson coming

    2. 10User, device, workload and agent identities, and groupsTask 2.1

      Lesson coming

    3. 11Hybrid identity with Microsoft Entra Cloud SyncTask 2.1

      Lesson coming

    4. 12External ID: B2B collaboration, direct connect and customer identityTask 2.1

      Lesson coming

    5. 13Authentication methods, passwordless and phishing-resistant sign-inTask 2.2

      Lesson coming

    6. 14Multifactor authentication and security defaultsTask 2.2

      Lesson coming

    7. 15Self-service password reset and password protectionTask 2.2

      Lesson coming

    8. 16Conditional Access signals, assignments, grant and session controlsTask 2.3

      Lesson coming

    9. 17Microsoft Entra roles, custom roles and Azure RBACTask 2.3

      Partly covered by: Shared Responsibility & IAM

    10. 18Microsoft Entra ID Governance, lifecycle workflows and entitlement managementTask 2.4

      Lesson coming

    11. 19Access reviewsTask 2.4

      Lesson coming

    12. 20Privileged Identity ManagementTask 2.4

      Lesson coming

    13. 21Microsoft Entra ID Protection: sign-in risk and user riskTask 2.4

      Lesson coming

  3. Module 3: Describe the capabilities of Microsoft security solutions

    1. 22Azure DDoS Protection, Azure Firewall and Web Application FirewallTask 3.1

      Lesson coming

    2. 23Virtual network segmentation, network security groups and Azure BastionTask 3.1

      Partly covered by: VPC: Subnets, NAT & Firewalls

    3. 24Azure Key Vault for secrets, keys and certificatesTask 3.1

      Partly covered by: KMS, Envelope Encryption & Private CA

    4. 25Microsoft Defender for Cloud: DevSecOps, CSPM and workload protectionTask 3.2

      Lesson coming

    5. 26Secure score, policies, standards and recommendationsTask 3.2

      Partly covered by: Organizations, SCPs & Control Tower

    6. 27SIEM and SOARTask 3.3

      Lesson coming

    7. 28Microsoft Sentinel: connectors, analytics rules, hunting, automation and playbooksTask 3.3

      Lesson coming

    8. 29The Defender XDR suite and its cross-product capabilitiesTask 3.4

      Lesson coming

    9. 30Defender for Office 365, Endpoint, Cloud Apps and IdentityTask 3.4

      Lesson coming

    10. 31Defender Vulnerability Management, threat intelligence and the Microsoft Defender portalTask 3.4

      Lesson coming

  4. Module 4: Describe the capabilities of Microsoft compliance solutions

    1. 32The Service Trust Portal and Microsoft's privacy principlesTask 4.1

      Lesson coming

    2. 33The Microsoft Purview portal, Compliance Manager and compliance scoreTask 4.2

      Lesson coming

    3. 34Data classification: sensitive information types, trainable classifiers and the explorersTask 4.3

      Partly covered by: Finding and Masking PII

    4. 35Sensitivity labels, label policies and data loss preventionTask 4.3

      Partly covered by: Finding and Masking PII

    5. 36Retention policies, retention labels and records managementTask 4.3

      Lesson coming

    6. 37Insider risk management and adaptive protectionTask 4.4

      Lesson coming

    7. 38eDiscovery and Microsoft Purview AuditTask 4.4

      Lesson coming

Every task in the exam guide

The exam guide splits each domain into task statements. Each one has a page with a short summary, the lessons that teach it and open sample questions.

Domain 1: Describe the concepts of security, compliance, and identity

Domain 2: Describe the capabilities of Microsoft Entra

Domain 3: Describe the capabilities of Microsoft security solutions

Domain 4: Describe the capabilities of Microsoft compliance solutions

How these questions are made

  • Written by us from the exam guide's task statements and the Microsoft documentation — never from real exam content.
  • Every option carries its own explanation and a link to the Microsoft page that proves it.
  • A question enters a timed exam only after an independent check; until then it is a practice question.
  • Results are a plain percentage, per domain too — not an imitation of Microsoft's scaled score.

Questions about the SC-900 practice exam

Is the SC-900 practice exam free?
Yes. The full practice exam (60 questions, 45 minutes) is free with no sign-up, and so are the 116 practice questions, the task pages and the study path. Your attempts are saved in this browser, on this device.
How many questions does it have, and is it timed?
60 questions in 45 minutes: the real SC-900 pace, scaled to this form. When the time runs out, the exam is submitted as it stands.
Are the answers explained?
After you submit, not during: like the real exam, the timed exam gives no feedback until the end. Then you get your score overall and per exam domain, and every question with each option explained and a link to the Microsoft documentation page behind it. In practice mode an answer is explained as soon as you check it.
What does the Security, Compliance, and Identity Fundamentals exam pack add?
3 more timed practice exams (Practice exam 1: 60 questions, 45 minutes; Practice exam 2: 60 questions, 45 minutes; Practice exam 3: 60 questions, 45 minutes), each scored and explained the same way, and the next version of this exam if it changes within your 12 months. 12 months of access. One payment, nothing renews by itself. Everything above stays free. See the pack.
Can I get a refund?
Yes, with no conditions: ask within 14 days of buying and you get the whole payment back. The details are in the terms.
Is this an official Microsoft practice exam?
No. BytePatterns is not affiliated with, endorsed or sponsored by Microsoft. Every question is written by us from the public exam guide and the Microsoft documentation, never from real exam content, and a score here does not predict your result on the real exam. Microsoft lists its own preparation resources on its certification page.