Microsoft Security, Compliance, and Identity Fundamentals (SC-900) practice exam & study guide

Microsoft positions SC-900 as validating a foundational understanding of security, compliance, and identity concepts and the related Microsoft and Azure solutions. It is aimed at people who want to understand how Microsoft SCI solutions span across cloud-based and Microsoft 365 services.

It covers the concepts of security, compliance, and identity; the capabilities of Microsoft Entra; Microsoft security solutions such as Defender and Sentinel; and Microsoft compliance solutions built on Microsoft Purview.

SC-900 is a fundamentals exam and one of the more approachable certifications: it tests conceptual understanding and which Microsoft capability addresses a need rather than hands-on configuration. Most candidates pass with a few weeks of focused study.

The main challenge is the breadth of Microsoft product names and knowing which one fits a scenario — distinguishing Defender for Cloud from Defender XDR, or Conditional Access from Privileged Identity Management. Practising scenario questions until those distinctions are automatic is the key.

Microsoft does not fix a single public question count for SC-900; it typically presents roughly 40–60 questions in a mix of formats — multiple choice, multiple response, and drag-and-drop — within about 60 minutes of working time.

Our full-length practice mock uses a 65-question, 90-minute session so you can rehearse pacing under realistic time pressure before test day.

Microsoft scores SC-900 on a scale of 1 to 1,000, and the passing score is 700. That is a scaled score rather than a raw 70%, because Microsoft adjusts for question difficulty, and there is no penalty for wrong answers, so you should never leave a question blank. Our practice mock uses a 70% threshold to give you a comparable target.

The SC-900 exam fee is set by Microsoft and varies by region — check the Microsoft certification page for current pricing, and note that fundamentals certifications like this one do not expire. Everything on this hub is free.

SCI Fundamentals is aimed at business stakeholders, new or existing IT professionals, and students who want to understand Microsoft security, compliance, and identity solutions across cloud-based and Microsoft 365 services.

Microsoft recommends general familiarity with Microsoft Azure and Microsoft 365. No security-engineering experience is required — the exam is about understanding capabilities, not implementing them.

SC-900 is relevant for aspiring security, compliance, and identity professionals, and for business and IT roles that need a shared vocabulary for Microsoft SCI solutions. It is a foundation for role-based security certifications such as Azure Security Engineer (AZ-500) and the Microsoft security operations and identity paths.

How much any certification affects pay depends heavily on geography, seniority, and hands-on experience, so treat any single salary figure with caution. SC-900 is best viewed as a way to demonstrate foundational security literacy rather than a guaranteed raise on its own.

Most candidates need two to four weeks at roughly an hour a day. The most efficient path is to learn the four skill areas in order, giving extra time to the heavily weighted security-solutions area, and drilling the topic quiz for each before moving on.

Review every explanation, including for questions you answered correctly, because SC-900 distractors are built from plausible but incorrect Microsoft products or concepts. Use the per-domain results here to find and shore up your weakest area, then finish with full-length timed mocks.

Study the four skill areas above, giving the most time to Microsoft security solutions, then drill practice questions area by area. Every MockAPI question reveals a full explanation and tells you why each wrong answer is wrong — the fastest way to absorb the product terminology this exam rewards.

When you can answer topic drills comfortably, move to a full-length timed mock to rehearse pacing. Use the glossary to keep the Microsoft product names straight, and aim to score consistently above the pass mark on mocks before you book.

Yes. Microsoft delivers SC-900 through Pearson VUE, so you can test at a physical Pearson VUE centre or online with remote proctoring (OnVUE). The online exam requires a private, quiet room, a clear workspace, a webcam and microphone, a stable connection, and government-issued photo ID, with a proctor monitoring you and a room scan before you start.

If you do not pass, Microsoft requires a 24-hour wait before a second attempt; after that, a 14-day wait applies between further attempts, with a limit of five attempts in a 12-month period, and each attempt needs its own registration.

After SC-900, common next steps include role-based security certifications such as the Azure Security Engineer Associate (AZ-500), the Security Operations Analyst (SC-200), or the Identity and Access Administrator (SC-300), which build on these concepts with hands-on skills.

If your interest is broader Azure, the AZ-900 Azure Fundamentals exam pairs well. Pairing any of these with hands-on practice is what turns a certificate into a career.