SC-900 Interactive Quiz, Labs & Timed Mock Exam

Domain 1 — Security, compliance and identity concepts

The vocabulary the other 85% of the exam is written in: shared responsibility, Zero Trust, the CIA triad, cryptography and authN vs authZ.

12 questions Lab · Shared responsibility Lab · Zero Trust pillars

📝 Practice quiz — 12 questions

Pick an answer and you immediately see why it's right or wrong, along with the reasoning for the other three options.

How to get the most out of this: before clicking, say out loud why you are rejecting each of the other three options. The real exam is won by elimination, not by recognition. The options are shuffled on every attempt, so retaking it tests the concept and not the position you memorized.

Answered0 / 12

Correct0

0 / 12

🧪 Lab 1 — The shared responsibility model

Fill the table from memory. For each resource, decide who is responsible in each service model.

Who owns what?

Time: 5 minutes · No lookups. The point is to find out what you actually remember.

Resource	On-premises	IaaS	PaaS	SaaS

🧪 Lab 2 — Map your own laptop to Zero Trust

No tenant, no trial, no cost. Just the device you're reading this on.

What is protecting you right now?

Time: 15 minutes · Under each of the six Zero Trust pillars, write what protects you today. Leave it blank if the honest answer is "nothing" — the blanks are the point of the exercise.

Part 1 — Security, compliance and identity concepts

The write-up behind these questions: the diagrams, the exam traps, and the reasoning for every concept in this domain.

Read Part 1 on DEV →

Domain 2 — Microsoft Entra capabilities

A quarter of the exam, and the domain that pays off most in a real job: tenant objects, authentication methods, Conditional Access and the licence tiers that decide several questions.

12 questions Lab · Licensing tiers Lab · Conditional Access

📝 Practice quiz — 12 questions

Same format. Every option explained, options shuffled on each attempt.

Watch the licence keywords. Several questions in this domain are decided by one word in the scenario. Risk-based policies or just-in-time roles mean P2. If you can't justify the tier, you're guessing.

Answered0 / 12

Correct0

0 / 12

🧪 Lab 3 — The licensing table

For each feature, pick the minimum Entra ID tier that includes it. This table alone is worth several exam questions.

What's the cheapest tier that gets me this?

Time: 5 minutes · From memory. "Minimum" matters: Conditional Access works in P2 too, but P1 is the answer.

Feature	Minimum tier required

🧪 Lab 4 — Build a Conditional Access policy

Conditional Access is an if-this-then-that engine. Read each requirement and pick the condition and the control that implement it.

Translate the requirement into a policy

Time: 10 minutes · This is exactly how the exam phrases its Conditional Access scenarios.

Part 2 — Microsoft Entra capabilities

Tenant objects, hybrid identity, authentication methods, Conditional Access and the licensing table — explained with diagrams.

Read Part 2 on DEV →

Domain 3 — Microsoft security solutions

The biggest domain of the exam, and the one people lose points on for a silly reason: nine products whose names all start with "Microsoft Defender". The fix is one mental model — every Defender protects a different surface.

12 questions Lab · Which Defender? Lab · Azure network security

📝 Practice quiz — 12 questions

Same format. Every option explained, options shuffled on each attempt.

Ask one question before you answer: what is being protected here — a device, a mailbox, on-premises Active Directory, a SaaS app, or cloud infrastructure? Most of this domain resolves the moment you name the surface.

Answered0 / 12

Correct0

0 / 12

🧪 Lab 5 — Which Defender catches this?

Six incidents. For each one, name the product that would detect it. This is the single most useful exercise in the domain.

Match the incident to the product

Time: 5 minutes · From memory. Say the surface out loud before you choose: device, mailbox, on-prem AD, SaaS app, cloud resource, or cloud identity.

Incident	Which product detects it?

🧪 Lab 6 — Azure network security

You don't have to configure these on the exam. You do have to recognize which one solves which requirement.

Pick the right service

Time: 5 minutes · Watch the layer: a rule about ports and IPs is not the same as a rule about an HTTP payload.

Requirement	Which Azure service?

Part 3 — Microsoft security solutions

The Defender XDR family, Defender for Cloud, Microsoft Sentinel and Azure network security — with the two diagrams that stop you mixing up nine similar names.

Read Part 3 on DEV →

Domain 4 — Microsoft Purview and compliance

The smallest domain, and the one most people under-study because it sounds like paperwork. That's a mistake: the content is concrete, the questions are the least ambiguous in the exam, and these are the easiest points available.

12 questions Lab · Which control? Lab · Where do I go?

📝 Practice quiz — 12 questions

Same format. Every option explained, options shuffled on each attempt.

Read the verb in the question. Protect or encrypt → sensitivity label. Keep or delete → retention. Prevent from leaving → DLP. Find for a legal case → eDiscovery. That one habit answers most of this domain.

Answered0 / 12

Correct0

0 / 12

🧪 Lab 7 — Which control solves this?

Six business requirements in plain English. Pick the Purview capability that implements each one.

Requirement to control

Time: 5 minutes · This is exactly how the exam phrases domain 4. The requirement is always business language; you supply the product name.

Requirement	Which capability?

🧪 Lab 8 — Where do I go for this?

Half of domain 4 is knowing which portal or tool answers a given question. These six get confused constantly.

Question to tool

Time: 5 minutes · Watch the direction: some of these are about Microsoft's compliance, and some are about yours.

What you need	Which tool?

Part 4 — Microsoft Purview and compliance

Labels, DLP, retention, records, insider risk and eDiscovery — the data lifecycle in one diagram, plus a lab where you build a DLP rule that blocks a credit card number.

Read Part 4 on DEV →

🎓 Mock exam — 30 questions

The dress rehearsal. Weighted roughly like the real exam: 5 on concepts, 9 on Entra, 10 on security solutions, 6 on compliance.

Do this properly or don't do it. 35 minutes, no notes, no going back to the write-ups. Answer all 30 — you get no feedback until you submit, exactly like the real thing. That's the whole point: this measures whether you're ready, and it can only do that if you don't peek.

Answered0 / 30

Time35:00

0 / 30

Part 5 — Mock exam, glossary and exam-day strategy

The one-page glossary of every product name in SC-900, plus how to read a question, when to move on, and how to handle the multi-select items that trip most people up.

Read Part 5 on DEV →