Best SC-900 practice tests in 2026: free vs paid, compared

The short version: start with Microsoft Learn's free SC-900 training and Microsoft's free SC-900 Practice Assessment, then add one paid bank only if you want more reps and a timed mock. SC-900 is a Beginner-level fundamentals exam: it asks what each Microsoft security, compliance and identity service is for and which one fits a need. Microsoft's free material covers that well; practice questions show you which lookalikes you still mix up.

Try CrushCert free for 7 daysNo card required.

We build SC-900 prep ourselves, so weigh our own entry accordingly. The rest is an honest account of the practice options for Microsoft Exam SC-900, Microsoft Security, Compliance, and Identity Fundamentals, as of November 9, 2026 — including what we don't do. We haven't listed other vendors' prices or question counts, because they change often and we'd rather send you to the vendor's own page than quote a number that's out of date.

What the exam actually is

Two things about this exam matter for buying practice tests. First, there is one current outline: skills measured as of October 21, 2026. Microsoft's change log lists two minor changes, to Microsoft Entra ID identity types and to threat protection with Defender XDR, so a bank written to the previous outline is mostly still on target. Second, a lot of names have changed, and a bank that isn't maintained will key old names as correct: Azure AD is now Microsoft Entra ID; Microsoft 365 Defender is now Defender XDR in the Microsoft Defender portal; Azure Security Center is Microsoft Defender for Cloud; the compliance portal has given way to the Microsoft Purview portal; and Microsoft calls Microsoft Entra Cloud Sync its recommended sync tool.

Quick comparison

1. Microsoft Learn (free)

BEST FREEMicrosoft's own material is the place to start. Microsoft Learn has free self-paced training for SC-900, and the SC-900 study guide lists the skills measured as of October 21, 2026, with a change log of what moved. Microsoft also offers a free SC-900 Practice Assessment, now on AI Skills Navigator. Take it early to see where you stand, and again near the end as a check.

Best for: everyone, first. For a fundamentals exam, Microsoft's free material may be all some people need. Trade-off: it isn't a large bank or a timed full-length mock, so if you want more variety and timed practice you'll want a second source.

2. CrushCert

LABS + MOCKThat's us. CrushCert's SC-900 bank is 200 original questions written to the October 21, 2026 outline and its weights — 25 on concepts, 55 on Microsoft Entra, 75 on Microsoft security solutions and 45 on Microsoft compliance solutions. Questions use current names (Microsoft Entra ID, Microsoft Entra Cloud Sync, Microsoft Defender XDR, the Microsoft Defender portal, Microsoft Sentinel, the Microsoft Purview portal), and every explanation says why the right answer is right and why each wrong answer is wrong.

You also get four drag-and-drop labs, one per domain, that drill the choices the exam likes to test: Match the Security Concept, Pick the Microsoft Entra Feature, Which Microsoft Security Tool? and Pick the Microsoft Purview Tool. Add adaptive quizzes that prioritize unseen and missed questions, flashcards with spaced repetition, and a 50-question mock on a 45-minute timer with a 70% pass line. It is $10/mo for SC-900 alone, or included in the $19/mo Associate plan with all 10 Associate-tier exams, or the $24/mo Professional plan with all 23 exams across Cisco, CompTIA, AWS, ISC2 and Microsoft. 7-day free trial, no card, cancel anytime.

Best for: people who want a large bank, matching labs and a full-length timed mock in one place, and anyone planning to go on to SC-200 or other certs. Trade-off: it is practice, not a video course, so pair it with Microsoft's free training, and it's a subscription rather than a one-time purchase. SC-900 is new to CrushCert, so it doesn't have a track record yet. Here's CrushCert's SC-900 prep.

3. MeasureUp

ESTABLISHED PUBLISHERMeasureUp, a long-standing publisher of Microsoft practice tests, sells an SC-900 practice test. Check its product page for the current price, question count and any sale.

Best for: people who want a practice test from an established Microsoft-focused publisher. Trade-off: Microsoft's own training and Practice Assessment are free, so compare what you'd get beyond them.

4. Udemy practice-test courses

VARIES BY INSTRUCTORSeveral instructors sell SC-900 practice-test courses on Udemy. Quality and freshness vary a lot from course to course, so check the last-updated date, recent reviews and the sample questions before you buy.

Best for: people who already use Udemy and want an inexpensive extra question set. Trade-off: some courses haven't kept up with the renames; use the checklist below.

How to choose

• Check the names in the sample questions. A correct answer that says "Azure AD," "Azure AD Connect," "Azure Security Center," "Azure Sentinel," "Microsoft 365 Defender" or "Microsoft Cloud App Security" means the bank hasn't caught up.
• Check that it covers all four domains at the right weights. Microsoft security solutions is 35–40% of the exam and Microsoft Entra is 25–30%. A bank that's mostly security concepts is lopsided.
• Read the explanations, not just the answers. On SC-900 the wrong choices are usually real services that fit a slightly different need (Conditional Access vs PIM, sensitivity vs retention label, DLP vs insider risk management, Defender for Identity vs Entra ID Protection, secure score vs compliance score). You want explanations that cover why each wrong choice is wrong.
• Watch for the wrong depth. SC-900 doesn't test KQL, PowerShell or click paths. A bank full of configuration steps is studying for a different exam.
• Count Microsoft's free Practice Assessment as your benchmark. Whatever else you use, it's the closest thing to Microsoft's own view of the exam, and it costs nothing.

Our honest recommendation

Work through Microsoft Learn's free SC-900 training and take Microsoft's free SC-900 Practice Assessment early to find your weak domains. If you're comfortable after that, you may not need anything else. If you want more reps, add one paid source: MeasureUp or a well-reviewed, recently updated Udemy course if you only want more questions; CrushCert if you want a 200-question bank, four matching labs, a 45-minute mock and a plan that also covers your next cert. Skip the dumps. Book the exam when you're passing timed mocks with room to spare. If you're still deciding, read is SC-900 worth it; for the time budget, see how long to study for SC-900, or go straight to the SC-900 study plan.

Keep reading

Frequently asked questions