SC-900 practice test — pick the right Microsoft security tool every time the exam asks
The SC-900 exam, Microsoft Security, Compliance, and Identity Fundamentals, is Microsoft's beginner-level security exam. It asks what a service is for and which one fits a need: Conditional Access or PIM, a sensitivity label or a retention label, Defender for Identity or Entra ID Protection, Azure Firewall or a network security group. CrushCert drills exactly that: 200 original practice questions at the official skill-area weights, each explaining why the right answer is right and why every wrong answer is wrong. Alongside them: four drag-and-drop labs on the choices the exam keeps testing, flashcards with spaced repetition, and a 50-question, 45-minute timed mock exam.
7 days free · No card required · $10/mo for SC-900 alone
Up to date: written to Microsoft's skills outline of October 21, 2026, using current names (Microsoft Entra ID, Microsoft Entra Cloud Sync, Microsoft Defender XDR, the Microsoft Defender portal, Microsoft Sentinel, the Microsoft Purview portal).
How CrushCert gets you exam-ready
Sort out the lookalikes
Most SC-900 misses come from services that sound alike. Four CrushCert labs make you match real requirements to the right concept, Microsoft Entra feature, security tool or Microsoft Purview capability, one per exam domain, so "only when needed, with approval" becomes PIM and "the label stays with the file" becomes a sensitivity label without a second thought.
Adaptive practice
Quizzes prioritize questions you haven't seen and questions you missed, so your weak skill areas get more reps and every session moves your score.
Realistic mock exams
Timed tests of 50 questions on a 45-minute countdown, with a question navigator, mark-for-review, and a 70% pass line that mirrors the real 700 bar.
Every answer explained
All 200 questions are original, tagged to one of the four skill areas, and were reviewed against Microsoft Learn by a separate reviewer. Each explanation covers why the right answer is right and why every wrong choice is wrong.
What studying looks like
Real CrushCert SC-900 screens from the live app, not mockups.
What's on the SC-900 exam
Exam SC-900, Microsoft Security, Compliance, and Identity Fundamentals, earns the Microsoft Certified: Security, Compliance, and Identity Fundamentals credential, a Beginner-level certification. You get 45 minutes and need a scaled score of 700 to pass. Microsoft doesn't publish the number of questions (third-party reports suggest about 40 to 60), and it doesn't publish one global price; third-party sources put it at about $99 in the US. Microsoft says most questions cover generally available features, though the exam may include preview features if they're commonly used. Fundamentals certifications don't expire, so there's nothing to renew. The four skill areas and their weights:
| Skill area | CrushCert questions | Exam weight |
|---|---|---|
| Describe the concepts of security, compliance, and identity | 25 | 10–15% |
| Describe the capabilities of Microsoft Entra | 55 | 25–30% |
| Describe the capabilities of Microsoft security solutions | 75 | 35–40% |
| Describe the capabilities of Microsoft compliance solutions | 45 | 20–25% |
These are the skills measured as of October 21, 2026. Microsoft's change log for that update lists two minor changes, to describing the function and identity types of Microsoft Entra ID and to describing threat protection with Microsoft Defender XDR, with the domains unchanged. CrushCert's 200 questions follow the official weights. The bank covers every outline area at fundamentals depth: what each service is for and when to pick it, not click paths or configuration steps. Topic coverage includes:
Train on every skill area above
Adaptive practice questions and drag-and-drop labs mapped to these exact skill areas. 7 days free, no card required.
Start free trialThe 4 hands-on SC-900 labs
One drag-and-drop lab per exam domain. Each gives you six real-world requirements and asks you to match each one to the concept, feature or tool that meets it, which is exactly the decision most SC-900 questions turn on.
Name the idea, pick the identity feature
Match the Security Concept (Zero Trust, defense in depth, shared responsibility, authentication vs authorization, hashing) · Pick the Microsoft Entra Feature (Conditional Access, Privileged Identity Management, access reviews, ID Protection, self-service password reset, managed identity).
Choose the tool for the job
Which Microsoft Security Tool? (Defender for Office 365, Defender for Identity, Defender for Cloud Apps, Defender for Cloud, Microsoft Sentinel, Azure Bastion) · Pick the Microsoft Purview Tool (sensitivity labels, DLP, retention labels, insider risk management, eDiscovery, Compliance Manager).
"Admins get the Global Administrator role for 4 hours, after approval"
→ Privileged Identity Management
"Require MFA only when users sign in from outside the office"
→ Conditional Access
"Managers confirm every quarter who still needs access to the finance app"
→ Access reviews
// mix up PIM and access reviews and the lab shows you which match was wrong.
SC-900 doesn't test KQL or configuration, so these labs are about choosing, not typing. Ready to go deeper after SC-900? The SC-200 practice test is the associate-level next step, with hands-on KQL labs where you write real hunting queries.
Free SC-900 practice questions: are you ready?
Ten questions across all four exam domains. Answer each one, see the explanation, and find out which topic to work on first. No account needed.
Free readiness check
Verify explicitly means always authenticating and authorizing based on all available signals, such as identity, location and device health. Least privilege access is about limiting how much access a user gets and for how long. Assume breach is about limiting blast radius and detecting attacks quickly. Network segmentation is a technique used to limit blast radius under assume breach, not the principle of checking every request. Every CrushCert question includes an explanation like this.
A user-assigned managed identity is a standalone Azure resource with its own lifecycle, and it can be shared across multiple resources. A system-assigned managed identity belongs to one resource, can't be shared, and is deleted with that resource. An application object is the global template for an app registration, not the identity a VM uses at runtime. Agent identities are meant for AI agents, not virtual machines.
ID Protection needs password hash synchronization to detect leaked credentials for hybrid users, and Microsoft recommends PHS as a backup even when another sign-in method is used. Password writeback only sends cloud password resets to on-premises AD. Federation moves authentication on-premises and doesn't give ID Protection the hashes it compares. Self-service password reset lets users reset passwords themselves.
Lifecycle workflows automate joiner, mover and leaver tasks based on user attributes, such as a set number of days before the hire date. Tasks include emailing the manager and generating temporary credentials. Entitlement management handles access requests. Access reviews check existing access. Conditional Access evaluates sign-ins.
DDoS Network Protection is the tier that includes DDoS Rapid Response (DRR) and cost protection for attack-driven scale-out. DDoS IP Protection uses the same mitigation engine but does not include DRR or cost protection. The default infrastructure-level protection every Azure service gets has no tunable plan or these extras. Azure Firewall Premium adds signature-based IDPS, not DDoS response support.
Defender for Key Vault is a Defender for Cloud workload protection plan that adds threat detection and security alerts for your vaults. HSM-backed keys in the Premium tier change how keys are protected, not how unusual access is detected. An access policy controls who may use the vault but doesn't detect suspicious behavior. DDoS IP Protection mitigates network floods against public IPs.
Real-time detections is the email investigation tool in Defender for Office 365 Plan 1. Threat Explorer replaces it in Plan 2 with deeper hunting and investigation. Threat Trackers and automated investigation and response (AIR) are also Plan 2 features. A quick way to tell the plans apart is that Plan 1 has Real-time detections and Plan 2 has Explorer.
Threat analytics reports explain tracked threats and show whether your environment is exposed and protected against them. Advanced hunting can search your data, but someone would have to write the queries and it doesn't come with expert threat write-ups. Secure Score measures overall posture, not exposure to one named campaign. Attack simulation training sends fake phishing to train users.
Retention labels apply at the item level and travel with the content when it moves within the tenant. A retention policy applies to a location, and its settings don't follow content that moves elsewhere. A sensitivity label controls access, not retention. A DLP policy prevents risky sharing.
Activity explorer shows a history of up to 30 days of activities on labeled and classified content, including label changes and endpoint actions like copying to USB. Content explorer shows what labeled items exist now and where, not who did what. Compliance Manager tracks compliance controls. The Service Trust Portal holds Microsoft's own audit reports.
Why learners pick CrushCert
You practice the way the exam tests you. SC-900 is short scenarios — "your company needs… which service should you use?" — where one clue decides the answer: only when needed, with approval; the label must stay with the document; without exposing RDP to the internet; Microsoft's own SOC 2 report. CrushCert's questions are built the same way, every distractor is a real Microsoft service or feature you could confuse, and every explanation tells you why the other choices are wrong.
Start with Microsoft's free material, then add reps. Microsoft Learn's free self-paced SC-900 training covers the content, and Microsoft's free SC-900 Practice Assessment (now on AI Skills Navigator) is a good first check. CrushCert adds a 200-question bank at the official weights, four labs on the lookalikes and a full-length timed mock, for people who want more practice than that.
It is a practice bank, not a course. CrushCert is practice questions, drag-and-drop labs and mock exams, not a video course. It suits people new to Microsoft security, IT pros and admins adding a security credential, students, and people in sales, project or compliance roles who need to speak Microsoft security fluently. New to security concepts in general? The vendor-neutral Security+ goes deeper; new to Azure itself? See AZ-900.
You always know your readiness. A live readiness score blends your quiz accuracy, mock results, and lab performance, and points you to exactly what to study next.
A guided plan tells you what to study today. Guided Learning builds a short daily plan from your performance — a warm-up review, a lesson on your weakest topic, and flashcards, with spaced repetition so material comes back right before you'd forget it.
SC-900 pricing
$10/month
Microsoft Security, Compliance, and Identity Fundamentals (SC-900) on its own: all 200 questions, the 4 labs, flashcards, mock exams, the readiness score and Guided Learning.
$19/month
All 10 Associate-tier exams, SC-900 included — worth it if you're pairing SC-900 with another entry-level cert.
$24/month
All 23 exams across Cisco, CompTIA, AWS, ISC2 and Microsoft, including SC-200 for when you're ready for the next step.
7-day free trial · No card required · Cancel anytime · SC-900 is an Associate-tier exam
Keep learning: SC-900 reading
Best SC-900 practice tests in 2026
Microsoft's free training and Practice Assessment first, then the paid options side by side — what you get, and who each one suits.
WORTH IT?Is the SC-900 worth it in 2026?
What the Security, Compliance, and Identity Fundamentals cert honestly does for you, who it pays off for, and who can skip it.
TIMELINEHow long to study for the SC-900?
Typical timelines by background, from admins who already use Microsoft 365 security to people brand new to IT.
STUDY PLANSC-900 study plan
A 2-week and a 4-week schedule across the four skill areas, pairing Microsoft Learn with practice questions, labs and a timed mock.
NEXT STEPSC-200 Security Operations Analyst practice test
The associate-level follow-on: Defender XDR and Microsoft Sentinel in depth, with hands-on KQL labs.
AZURE FUNDAMENTALSAZ-900 Azure Fundamentals practice test
New to Azure itself? The companion fundamentals exam on cloud concepts and core Azure services.
Not sure which cert comes next? Take the two-minute Which certification should I take? quiz.
Ready to crush the SC-900?
200 original questions, four drag-and-drop labs, explanations on every answer, and a timed mock exam — $10/month for SC-900, and the first 7 days are free with no card required.
Start studying freeSC-900 FAQ
Is the SC-900 hard?
It is a Beginner-level fundamentals exam, so it asks what services are for rather than how to configure them. What trips people up is the number of products and the lookalikes: Conditional Access versus PIM, access reviews versus entitlement management, password hash sync versus pass-through authentication, Defender for Identity versus Entra ID Protection, secure score versus compliance score, and sensitivity versus retention labels. You have 45 minutes and need a scaled score of 700 to pass.
How many questions are on the SC-900 exam?
Microsoft doesn't publish a question count for SC-900; third-party reports suggest about 40 to 60 questions. You get 45 minutes and need a scaled score of 700 to pass. CrushCert's mock exam is 50 questions on a 45-minute timer with a 70% pass line that mirrors the 700 bar.
How long does it take to study for the SC-900?
Our estimate, at roughly 5 hours a week: about 1 to 2 weeks if you already administer Microsoft 365 or Azure security features, about 2 to 3 weeks if you work in IT but are new to Microsoft's security tools, and about 4 to 5 weeks if you are new to IT. These are estimates, not guarantees; let your practice scores decide when you book.
Is there a free SC-900 practice test?
Yes. Microsoft offers a free SC-900 Practice Assessment, now on AI Skills Navigator, and Microsoft Learn's self-paced SC-900 training is free too. Start there. The ten sample questions on this page are also free and need no account.
Does SC-900 include KQL or hands-on labs?
The SC-900 exam doesn't test KQL, PowerShell or configuration steps; it tests what each service is for. CrushCert's four SC-900 labs are drag-and-drop matching labs, one per exam domain. If you want to write KQL, that's SC-200, the associate-level Security Operations Analyst exam, and CrushCert's SC-200 prep includes hands-on KQL labs.
Which version of the SC-900 should I study, and is the bank updated when Microsoft changes the outline?
Study the skills measured as of October 21, 2026. Microsoft's change log for that update lists two minor changes, to Microsoft Entra ID identity types and to threat protection with Microsoft Defender XDR; the domains stayed the same. Every CrushCert question is written to that version using current names: Microsoft Entra ID, Microsoft Entra Cloud Sync, Microsoft Defender XDR, the Microsoft Defender portal, Microsoft Sentinel and the Microsoft Purview portal. We will update the bank when Microsoft updates the outline.
Does the SC-900 certification expire?
No. Microsoft fundamentals certifications, including Microsoft Certified: Security, Compliance, and Identity Fundamentals, don't expire, so there is nothing to renew. Microsoft doesn't publish one global exam price; third-party sources put it at about $99 in the US.
Is CrushCert enough on its own to pass the SC-900?
Use it alongside Microsoft Learn, not instead of it. CrushCert is practice questions, four labs and mock exams, not a video course. Work through Microsoft Learn's free self-paced SC-900 training, take Microsoft's free Practice Assessment to find your gaps, then use CrushCert to drill the skill areas you still miss.