These SC 900 sample questions are written in the scenario style Microsoft favors on this exam: a short business situation followed by four options, one correct answer, and a distractor that looks right at first glance. Each question below shows the correct answer after the options, along with an explanation of why it is right and why the strongest distractor is wrong.
These SC 900 sample questions use the scenario style Microsoft favors: a short situation, four close options, and a distractor built to look right if you skim. Work each one before checking the answer, then read the explanation, since the reasoning behind the strongest wrong option often matters more than the correct label alone.
Question 1
Domain: Describe the capabilities of Microsoft Entra
Northgate Clinics must comply with a state regulation: every employee's access to patient records must be re-verified and approved by a manager every 90 days, with an audit trail. The identity team is told not to change the existing self-service access request process. What should they use to meet the compliance requirement?
- A. Set up a recurring access review on the patient-records app with managers as reviewers.
- B. Move patient-record access into an access package with its own approval and review requirements.
- C. Create a conditional access policy that requires reauthentication for users of the patient-records app.
- D. Use Privileged Identity Management for the patient-records group with time-limited activation.
Answer: A
Explanation: The recurring access review option is correct because the compliance rule requires a manager to re-verify and approve every employee's access every 90 days and retain an audit trail; Microsoft Entra access reviews are designed for exactly this recertification cycle. The access-package option is the strongest distractor: entitlement management can also enforce approvals and reviews, but the stem says not to change the existing self-service request process, and moving access into an access package changes that process. The general rule is to use access reviews when the need is periodic recertification of existing access, and entitlement management when the goal is to provide a catalog of requestable resources.
Question 2
Domain: Describe the capabilities of Microsoft Entra
A public sector agency needs to let its support engineers reset user passwords and manage Microsoft Entra ID user accounts. The agency's compliance policy forbids permanent administrator assignments and requires a request-and-approval workflow with an audit record before any privileged action is taken. What should you configure?
- A. Assign the support engineers directly to the built-in User Administrator role in Microsoft Entra ID on a permanent basis.
- B. In Privileged Identity Management, make engineers eligible for User Administrator and require approval for activation.
- C. Create a custom Microsoft Entra user-management role, then assign that role directly to the support engineers.
- D. Scope a custom user-management role to an administrative unit, then assign that role to the relevant support engineers.
Answer: B
Explanation: Privileged Identity Management is the correct mechanism because the policy forbids standing administrator assignments and requires an approval step. In PIM, the User Administrator role can be assigned as eligible, so the engineer has no active admin rights until approval is given for activation; the activation is written to the PIM audit log. The strongest distractor is the direct permanent User Administrator assignment: it uses the right built-in role but gives standing access and has no request-and-approval step. Custom or admin-unit-scoped role assignments improve least privilege but still create permanent access, so they also fail the stated compliance rule. The general rule is to use Microsoft Entra Privileged Identity Management whenever a scenario requires just-in-time, approved, or auditable activation of a Microsoft Entra administrative role.
Question 3
Domain: Describe the capabilities of Microsoft security solutions
A regulated financial services firm stores its payment processor API key in Azure Key Vault. Because a former contractor knew the key, it must be changed now. The compiled application retrieves this API key by using the secret's unversioned URI, and it cannot be redeployed this quarter. Which action rotates the key without code changes or downtime?
- A. Create a new version with the new API key value and update the application to use the versioned URI.
- B. Create a new secret under a different name with the new API key value and update the application to reference that name.
- C. Create a new version with the new API key value and keep the application's unversioned URI unchanged.
- D. Create a new Key Vault, store a fresh API key value, and update the application to use the new vault URI.
Answer: C
Explanation: The answer that creates a new version with the new API key value and keeps the unversioned URI unchanged is correct because the application already uses the unversioned secret URI. In Azure Key Vault, when no version is included in a secret URI, a retrieval returns the latest version of that secret, so creating a new version changes the value the application receives on its next retrieval with no redeploy or code change. The strongest distractor is the option that also creates a new version but updates the application to use the versioned URI; that would rotate the secret, but any version-specific reference requires changing and redeploying the application, which the scenario forbids. General rule: use versionless secret URIs for Azure Key Vault secrets when you want rotation to take effect without a code deployment.
Question 4
Domain: Describe the capabilities of Microsoft security solutions
A university research group investigates credential-phishing campaigns. A confirmed malicious domain triggered a Microsoft Defender XDR alert. The team must enrich that alert with the domain's DNS history, IP addresses, and registrant information directly inside the Microsoft Defender portal so analysts can pivot to related infrastructure. Their Microsoft 365 E5 licenses are already funded, but the grant does not cover additional Microsoft security products. Which action meets this requirement at the lowest additional cost?
- A. Use the Defender Threat Intelligence capability that is already included in their Microsoft 365 E5 licenses.
- B. Export the alert to CSV and look up DNS, IP, and WHOIS records in a public database outside the Defender portal.
- C. Enable Microsoft Sentinel and use Microsoft Defender Threat Intelligence Premium for the same enrichment.
- D. Subscribe to Microsoft Defender Threat Intelligence Premium, the paid service for advanced threat actor research.
Answer: A
Explanation: This is correct because the requirement is to enrich a Defender XDR alert inside the Microsoft Defender portal with DNS, IP, and registrant data, and the standard Defender Threat Intelligence capability that comes with the existing Microsoft 365 E5 licenses does exactly that with no additional cost. The strongest distractor is the paid Defender Threat Intelligence Premium service: it would support the research, but it is an additional Microsoft security product the grant cannot cover, so it is not the lowest-cost option that meets the target. The manual public database option fails because it moves the analyst outside the portal and does not enrich the Defender XDR alert. The general rule is to check whether a built-in capability in the customer's current Microsoft 365 E5 or Defender XDR licensing tier satisfies the requirement before selecting a premium or paid add-on.
Question 5
Domain: Describe the capabilities of Microsoft Entra
A fast-growing SaaS startup enforces Microsoft Entra ID MFA and uses combined registration. A long-time employee has work and mobile phones, Microsoft Authenticator on three devices, several app passwords, and a FIDO2 security key registered. When she tries to register a new FIDO2 security key, the My Sign-Ins portal says: You have reached the maximum number of authentication methods. What is blocking the request?
- A. The per-user maximum of 5 hardware OATH tokens has been reached.
- B. The per-user maximum of 20 authentication methods has been reached.
- C. The per-user maximum of 5 Authenticator device registrations has been reached.
- D. The per-user maximum of 40 generated app passwords has been reached.
Answer: B
Explanation: This is correct because Microsoft Entra combined registration enforces a per-user maximum of 20 authentication methods. The message 'maximum number of authentication methods' signals that total registration cap, not a method-specific limit. The app-password option is a real separate limit for legacy applications, but this user is not trying to create another app password; she is trying to add a FIDO2 key while the overall method count is already at the cap. Authenticator-device and OATH-token limits are also per-method quotas and do not explain a general block on registering any new method. In general, distinguish the total registration limit from per-method quotas: a user can be under one limit while hitting the other.
Question 6
Domain: Describe the capabilities of Microsoft security solutions
A gaming studio has monitored its on-premises Active Directory with Microsoft Defender for Identity for the past year and has forwarded every identity alert into a Microsoft Sentinel workspace configured for two-year retention. The security team is investigating a credential attack that started eight months ago and wants to review the original identity alerts. Which solution should they search first?
- A. Microsoft Sentinel workspace query
- B. Microsoft Entra ID Protection reports
- C. Microsoft Defender for Identity portal
- D. Microsoft Defender for Cloud dashboard
Answer: A
Explanation: Microsoft Sentinel is correct because Microsoft Defender for Identity retains identity alert and activity data for 180 days, so an attack from eight months ago is beyond its retention window. Because the alerts were streamed into Microsoft Sentinel from the start, the original evidence is still available there. The Microsoft Defender for Identity portal option is the strongest distractor: it is the natural place to look for an on-premises identity attack, but it fails because of the 180-day retention boundary. The general rule is to use Defender for Identity for current identity-threat detection and short-term investigation, and forward its alerts to Microsoft Sentinel or another SIEM for longer-term evidence.
Question 7
Domain: Describe the capabilities of Microsoft Entra
Northwind Health uses Microsoft Entra ID and a third-party EHR app. Compliance policy states that no single EHR session may stay authenticated longer than 60 minutes, regardless of whether the clinician has already authenticated to Microsoft 365 today. The limit must be applied as a per-connection ceiling for the EHR app only, not as an aggregate limit across all apps. You need to enforce this using Microsoft Entra Conditional Access. What should you configure?
- A. Sign-in frequency session control assigned to the EHR app with a 60-minute period.
- B. MFA registration policy that requires all EHR users to register for Microsoft Entra MFA.
- C. Sign-in risk policy that requires Microsoft Entra MFA during risky sign-ins.
- D. Persistent browser session control for the EHR app set to 'Never persistent'.
Answer: A
Explanation: The sign-in frequency session control is correct because it enforces a per-connection time ceiling: after 60 minutes, the clinician must reauthenticate to the EHR app, and the policy can be scoped to that app so other Microsoft 365 apps are unaffected. This is a per-session ceiling, not an aggregate sign-in limit. The persistent browser session control is the strongest distractor because it also manages session lifetime, but it controls whether a browser cookie survives after the browser closes, not how long an active EHR session can run. The general rule is that Conditional Access session controls act after authentication; sign-in frequency sets an elapsed-time ceiling for the selected cloud apps, while persistent browser session controls address cookie reuse.
Question 8
Domain: Describe the capabilities of Microsoft security solutions
Contoso operates an industrial IoT platform. Its management VMs run in an Azure virtual network, and its edge server is on-premises. A Site-to-Site VPN connects the virtual network to the factory. No server has a public IP. Security requires all administrator RDP/SSH sessions to go through a single Azure Bastion deployment using the Azure portal. What should you do?
- A. Use Azure Bastion for the Azure VMs and a VPN client for the edge server.
- B. Use Azure Bastion for the Azure VMs and Azure Arc-enabled servers for the edge server.
- C. Use Azure Bastion with the Basic SKU and connect to the edge server by private IP over the VPN.
- D. Use Azure Bastion with the Standard SKU and connect to the edge server by private IP over the VPN.
Answer: D
Explanation: The option that deploys Bastion with the Standard SKU and connects to the edge server by private IP is correct because Bastion's IP-based connection feature supports targets without an Azure VM resource ID, such as an on-premises server reachable through a Site-to-Site VPN. The strongest distractor is the Azure Arc-enabled servers option: it is a valid hybrid-management approach, but it violates the requirement that every RDP/SSH session go through one Azure Bastion deployment. The Basic SKU option fails because IP-based connections require the Standard SKU. The general rule is that Azure Bastion is not limited to Azure VMs: any resource reachable from the Bastion virtual network can be addressed by private IP when the Standard SKU is used.
Question 9
Domain: Describe the capabilities of Microsoft security solutions
A university research group has two Azure virtual networks, Research-VNet and Lab-VNet, in the same resource group. The VNets use overlapping address space (10.1.0.0/16), so they cannot be peered. You need to grant a researcher permission to change the address space of Research-VNet only. The researcher must not be able to modify Lab-VNet or any other network resource. Which assignment should you use?
- A. Network Contributor on the subscription
- B. Global Administrator in Microsoft Entra ID
- C. Network Contributor on Research-VNet only
- D. Network Contributor on the resource group
Answer: C
Explanation: Assigning Network Contributor directly to Research-VNet is correct because Azure virtual network configuration is governed by Azure RBAC, not by Microsoft Entra roles. The overlapping address space is what forces the address-space change, and the VNet-resource scope grants exactly that change without covering any other resource. The strongest distractor is assigning Network Contributor at the resource-group scope; it is tempting because RBAC assignments are often made at resource-group level, but that role assignment would apply to every resource in the group, including Lab-VNet, which violates the 'only Research-VNet' constraint. The general rule is to use the smallest Azure RBAC scope that contains the resource the user must manage; Microsoft Entra roles control identity and tenant admin tasks, while Azure RBAC controls access to Azure resources.
Using these SC-900 practice questions well
Reading nine SC-900 sample questions helps, but it is not the same as sitting a timed exam. These items give you the scenario style and reasoning pattern Microsoft favors, but a full mock tells you whether you can apply that reasoning under a clock across every domain. Check the exam objectives page to confirm you have covered the domains these questions came from, and use the study plan to close any gaps this set revealed.
For what our mock reproduces and what it does not, see the practice test page, and check exam format and scoring for how these SC-900 questions and answers translate into a pass or fail.
Exam facts on this page come from Microsoft’s own pages (official exam page). Prices, versions and policies change — confirm there before you book.