10 SC-900 Questions Most Candidates Get Wrong
Here are 10 multiple-choice questions designed to mirror the difficulty and style of the SC-900 (Microsoft Security, Compliance, and Identity Fundamentals) exam. They cover identity, security, and compliance domains.
Question 1
Your organization is adopting a Zero Trust security model. Which of the following principles is the primary focus of this model? Want to go further? 8 CISM Questions Most Candidates Get Wrong is a good next step.
A. Implicit trust for users within the corporate network perimeter
B. Assuming breach and verifying explicitly for every request
C. Using a single, strong firewall to protect all internal resources
D. Restricting access based solely on a user's IP address
Answer: B
Explanation: Zero Trust operates on the principle of "never trust, always verify," which assumes a breach has already occurred and requires continuous verification of identity and device health. Options A, C, and D represent traditional perimeter-based security models that rely on implicit trust once inside the network or based on static network location, which Zero Trust explicitly rejects.
Question 2
A company wants to enable employees to use their existing corporate Microsoft Entra ID (Azure AD) credentials to sign in to third-party SaaS applications. Which Microsoft Entra ID feature should they use?
A. Self-service password reset (SSPR)
B. Conditional Access
C. Enterprise Applications (App Gallery)
D. Privileged Identity Management (PIM)
Answer: C
Explanation: Enterprise Applications in Microsoft Entra ID allows administrators to configure single sign-on (SSO) for third-party SaaS apps, using the existing corporate identities as the trust anchor. SSPR is for resetting passwords, Conditional Access is for policy enforcement after sign-in, and PIM is for managing privileged roles, not for federating access to external apps.
Question 3
Which of the following is a shared responsibility of both the customer and Microsoft when using Microsoft 365 services?
A. Physical security of Microsoft's data centers
B. Patching the underlying hypervisor for the cloud service
C. Configuration of tenant-level security settings
D. Maintaining the host operating system for IaaS VMs
Answer: C
Explanation: In the shared responsibility model, the customer is always responsible for configuring their own tenant, including security settings, user access, and compliance policies. Microsoft is responsible for the physical data centers and the underlying infrastructure (hypervisor, host OS). Maintaining the host OS for IaaS VMs is Microsoft's responsibility, while the customer manages the guest OS.
Question 4
A security administrator needs to ensure that users can only access Microsoft 365 apps from compliant devices and trusted locations. Which Microsoft Entra ID capability should they configure?
A. Microsoft Entra Verified ID
B. Conditional Access policies Related reading: 10 CRISC Questions Most Candidates Get Wrong.
C. Identity Governance
D. Microsoft Entra Permissions Management
Answer: B
Explanation: Conditional Access is the core policy engine in Microsoft Entra ID that uses signals like device compliance, location, and risk to grant or block access. Verified ID is for decentralized identity verification, Identity Governance is for access lifecycle management, and Permissions Management is for managing permissions across multicloud environments.
Question 5
Which Microsoft Purview solution provides a unified data governance solution that helps you discover, classify, and protect sensitive data across your entire digital estate?
A. Microsoft Purview Audit
B. Microsoft Purview Information Protection
C. Microsoft Purview Data Loss Prevention (DLP)
D. Microsoft Purview Compliance Manager
Answer: B
Explanation: Microsoft Purview Information Protection focuses on discovering, classifying, and protecting sensitive documents and emails with labels and encryption. Audit is for logging and investigating events, DLP is specifically about preventing unauthorized sharing, and Compliance Manager is for assessing your compliance posture against regulations.
Question 6
You are using Microsoft Purview Compliance Manager to assess your organization's compliance with GDPR. What does a "customer-managed control" represent in Compliance Manager?
A. A control that Microsoft fully manages and operates on your behalf
B. A control that your organization is responsible for implementing and maintaining
C. A control that is shared between Microsoft and your organization
D. A control that has been automatically implemented by the system
Answer: B
Explanation: In Compliance Manager, controls are categorized by management responsibility. "Customer-managed" means your organization is responsible for implementing the technical and organizational measures required for that control. Microsoft-managed controls are handled by Microsoft, and shared controls are a combination of both.
Question 7
Which of the following is the primary purpose of Microsoft Entra ID Governance?
A. To monitor sign-in attempts for malicious activity
B. To automate the identity lifecycle and access reviews
C. To enforce multi-factor authentication for all users
D. To synchronize on-premises identities to the cloud
Answer: B You can explore this further in 8 CompTIA Linux+ Questions Most Candidates Get Wrong.
Explanation: Microsoft Entra ID Governance focuses on the identity lifecycle—managing user access rights, automating access reviews, and ensuring users only have the access they need for their role. Monitoring sign-ins is a security operations function, MFA is a security control, and synchronization is a separate identity management feature.
Question 8
A company wants to use Microsoft Sentinel for security information and event management (SIEM) and security orchestration, automation, and response (SOAR). Which of the following is a prerequisite for using Sentinel?
A. A Microsoft 365 E5 license
B. An Azure subscription and a Log Analytics workspace
C. Microsoft Intune for device management
D. Microsoft Purview Data Loss Prevention policies
Answer: B
Explanation: Microsoft Sentinel is an Azure-native service that runs on top of a Log Analytics workspace. You must have an Azure subscription and create a Log Analytics workspace to ingest and analyze data. Sentinel is available with various licenses, but the Azure subscription is the foundational prerequisite. Intune and DLP are separate services that can send data to Sentinel but are not prerequisites.
Question 9
In Microsoft 365 Defender, which portal provides a unified view of alerts and incidents across identities, endpoints, email, and cloud apps?
A. Microsoft Purview compliance portal
B. Microsoft Entra admin center
C. Microsoft 365 Defender portal
D. Azure Defender for Cloud
Answer: C
Explanation: The Microsoft 365 Defender portal (security.microsoft.com) aggregates signals from Microsoft Defender for Endpoint, Office 365, Identity, and Cloud Apps into a single queue of incidents and alerts. The Purview portal is for compliance, the Entra admin center is for identity management, and Azure Defender for Cloud is for protecting cloud workloads (PaaS/IaaS).
Question 10
Your organization is subject to the Health Insurance Portability and Accountability Act (HIPAA). You want to use a Microsoft compliance offering to assess your current risk posture and track improvement actions. Which tool should you use?
A. Microsoft Service Trust Portal
B. Microsoft Purview Compliance Manager
C. Microsoft Defender for Cloud Apps
D. Microsoft Entra Identity Protection
Answer: B
Explanation: Compliance Manager provides a detailed, actionable dashboard that calculates a compliance score based on your implementation of controls for various regulations, including HIPAA. The Service Trust Portal is for reading audit reports and documentation, Defender for Cloud Apps is for cloud app security, and Identity Protection is for detecting identity-based risks.
These questions cover the core pillars of the exam: describing the concepts of security, compliance, and identity; describing the capabilities of Microsoft Entra ID; describing the capabilities of Microsoft security solutions; and describing the capabilities of Microsoft compliance solutions.
A free SC-900 study plan can give you a week-by-week schedule that fits your timeline, so you can prepare for each area covered by the exam.
Reinforce your weaker topics by repeating Microsoft Security, Compliance, and Identity Fundamentals (SC-900) mock test questions until your score plateaus above passing.
Before you repeat full mocks, a free SC-900 readiness check can point you to the topic that needs the most review.