Foundational certification covering security, compliance, and identity concepts and the capabilities of Microsoft Entra, Microsoft security solutions, and Microsoft Purview.
Free sample questions
No account needed. Every question has a worked explanation, just like the full bank.
lock_openFree sampleMicrosoft Entra Capabilitieseasy
A new administrator asks what role Microsoft Entra ID plays within the Microsoft Entra product family. Which statement best describes Microsoft Entra ID?
- AIt is the foundational cloud-based identity and access management service for users, devices, and apps.check_circle Correct
- BIt is a managed domain service that provides group policy, LDAP, and Kerberos for legacy applications.
- CIt is a credential verification service for issuing decentralised verifiable credentials to users.
- DIt is the service that secures remote access to private apps, corporate networks, and multicloud resources.
Microsoft Entra ID is the foundational cloud-based identity and access management service for users, devices, apps, and resources. The grounding states Microsoft Entra ID is the foundational product of Microsoft Entra: a cloud-based identity and access management service that provides authentication, policy enforcement, and protection for users, devices, apps, and resources.
Why A is correct: Correct. The grounding states Microsoft Entra ID is the foundational product of Microsoft Entra: a cloud-based identity and access management service that provides authentication, policy enforcement, and protection for users, devices, apps, and resources.
Why B is wrong: Group policy, LDAP, and Kerberos for legacy apps describe Microsoft Entra Domain Services, a separate product in the family, not Microsoft Entra ID itself.
Why C is wrong: Issuing decentralised verifiable credentials describes Microsoft Entra Verified ID, a different product, not the foundational identity and access management service.
Why D is wrong: Securing remote access to private apps and corporate networks describes Microsoft Entra Private Access, not the core identity and access management service.
lock_openFree sampleSecurity, Compliance, and Identity Conceptseasy
An instructor is explaining the cloud shared responsibility model. Which responsibility area stays with the customer across on-premises, IaaS, PaaS, and SaaS deployments alike?
- AData and identities, which the customer is responsible for protecting in every deployment type.check_circle Correct
- BThe physical hosts, which the customer is responsible for maintaining in every deployment type.
- CThe physical datacenter, which the customer is responsible for securing in every deployment type.
- DThe hypervisor layer, which the customer is responsible for managing in every deployment type.
The customer always retains responsibility for their data and identities, no matter the cloud deployment type. The grounding states that for all cloud deployment types you own your data and identities, and that data and accounts and access management are responsibilities you always retain regardless of the deployment type.
Why A is correct: Correct. The grounding states that for all cloud deployment types you own your data and identities, and that data and accounts and access management are responsibilities you always retain regardless of the deployment type.
Why B is wrong: Physical hosts are a Microsoft responsibility in IaaS, PaaS, and SaaS; only on-premises leaves them with the customer, so they are not always retained.
Why C is wrong: Securing the physical datacenter shifts to Microsoft once you move to any cloud model, so it is not a responsibility the customer always retains.
Why D is wrong: The grounding lists the hypervisor as a Microsoft responsibility for the virtualization layer, so the customer does not retain it.
lock_openFree sampleMicrosoft Security Solutionsmedium
An organisation wants posture management in Defender for Cloud without paying for an extra plan. Which CSPM plan is enabled by default for onboarded subscriptions at no cost?
- ADefender CSPM, the paid plan that adds capabilities such as attack path analysis and risk prioritisation.
- BDefender for Servers, the paid plan that provides threat detection for Windows and Linux machines.
- CFoundational CSPM, the free plan enabled by default for onboarded subscriptions and accounts.check_circle Correct
- DDefender for Storage, the paid plan that protects storage accounts against malware and threats.
Foundational CSPM is the free plan enabled by default, while Defender CSPM is the paid plan that adds advanced posture capabilities. The grounding states that Defender for Cloud offers two CSPM plans and that Foundational CSPM is free and enabled by default for all onboarded subscriptions and accounts, while Defender CSPM is the paid plan with extra capabilities.
Why A is wrong: Defender CSPM is the paid plan that adds advanced features, so it is not the free option enabled by default that the scenario requires.
Why B is wrong: Defender for Servers is a workload protection plan for machines, not a CSPM plan, and it is a paid plan rather than the free posture option.
Why C is correct: Correct. The grounding states that Defender for Cloud offers two CSPM plans and that Foundational CSPM is free and enabled by default for all onboarded subscriptions and accounts, while Defender CSPM is the paid plan with extra capabilities.
Why D is wrong: Defender for Storage is a paid workload protection plan for storage accounts, not the free posture management plan enabled by default.
More free SC-900 practice questions with worked answersFrequently asked questions
- How many questions are on the SC-900 exam?
- The Microsoft Security, Compliance, and Identity Fundamentals (SC-900) exam has Typically 40 to 60 questions questions and runs for 45 minutes. The format is multiple choice and multiple response, at a pearson vue testing center or online proctored.
- What score do I need to pass SC-900?
- The pass mark is 700 / 1000. Examworthy gives you a per-domain readiness score so you can see which domains are holding you back before you book.
- How much does the SC-900 exam cost?
- The exam costs 99 USD to sit. Practising on Examworthy is free to start, with a worked explanation on every question.
- Is there a SC-900 practice exam?
- Yes. Examworthy's exam mode runs a timed SC-900 practice exam (mock) paced to match the real exam, scored per domain so you can see exactly where you stand against the blueprint. Timed mocks are free with an account.
- How does Examworthy help me prepare for SC-900?
- Every practice question carries a worked explanation and a per-distractor rationale, mapped to the official blueprint domains. You learn why each answer is right or wrong, not just the letter.
- Is Examworthy affiliated with Microsoft?
- No. Examworthy is not affiliated with or endorsed by Microsoft. Our questions are original, blueprint-aligned practice material; we never reproduce live exam items.
Examworthy is not affiliated with or endorsed by Microsoft. All questions are original, blueprint-aligned practice material. We never reproduce live exam items. SC-900 and related marks belong to their respective owners.
