How are SC-900 questions generated?

dotCreds builds SC-900 practice questions from public exam objectives and Microsoft Learn and exam-objective references. The questions are written for realistic study practice, not copied from exam dumps.

How are explanations sourced?

Each question includes an explanation and, when available, a source link back to the provider documentation or reference used to validate the answer. That keeps the practice tied to study material you can actually review.

The page tracks today's answered count and accuracy for the 10-question daily set, then saves a 7-day score history on this device so you can see your recent practice trend.

The site is the fastest way to start SC-900 practice without installing anything. It is built for daily recall, quick weak-topic discovery, and source-backed explanations you can review immediately.

Free SC-900 Practice Test

SC-900 Practice Test

Start today’s free 10-question SC-900 set with source-backed explanations, local progress, and a fresh rotation every morning.

10 Free Daily Questions Source-backed Explanations 200 Verified Questions

Questions updated at Aug 7, 2026, 2:36 PM CDT

Unlock the full SC-900 bank

200 verified questions Exam Mode Practice Mode Detailed explanations Weak-area review No subscription - one-time unlock

Get the complete source-backed bank with Interview Questions, the full Study Guide, full Course Notes, detailed explanations, weak-area review, and exam-style practice.

Interview Questions Full Study Guide Full Course Notes Exam Mode Practice Mode Guided Course Detailed explanations Weak-area review No subscription

What you get with free practice

10 Free Questions Daily Fresh set every day from the live bank

Detailed Explanations Learn with clear source-backed answers

Track Your Progress Daily history and performance insights

Upgrade Anytime Unlock the full bank when you are ready

Question 1 of 10

Objective Describe how security policies, standards, and recommendations improve cloud security posture Describe the capabilities of Microsoft security solutions

A storage resource passed an enabled Defender for Cloud security standard when deployed. Its configuration is later changed so that it no longer satisfies a control. Which behavior allows Defender for Cloud to identify the new failure and produce remediation guidance?

Concept tested:

Source:Security policies in Microsoft Defender for Cloud

Question 2 of 10

Objective Describe Microsoft Entra ID Governance Describe the capabilities of Microsoft Entra

A company manually creates identities when people join, adds new access through tickets when they change jobs, and often leaves accounts and entitlements active after departure. It wants automated lifecycle changes plus evidence that access was approved and removed. What should it implement?

Concept tested:

Question 3 of 10

Objective Describe federation Describe the concepts of security, compliance, and identity

After an acquisition, the parent company and subsidiary must keep their identity systems separate for six months. The parent company's application must nevertheless trust sign-ins that the subsidiary already performs, without copying the subsidiary's directory objects. What should the identity team configure?

Concept tested:

Question 4 of 10

Objective Describe data loss prevention Describe the capabilities of Microsoft compliance solutions

An organization wants one Purview DLP strategy to monitor or restrict sensitive-data use in supported Microsoft 365 workloads and on managed endpoints. Which statement about DLP scope is correct?

Concept tested:

Question 5 of 10

Objective Describe authentication methods Describe the capabilities of Microsoft Entra

Employees must stop entering passwords during routine workstation sign-in. A Temporary Access Pass may be used only to enroll or recover the strong method, not as the permanent daily method. Which method should the company deploy?

Concept tested:

Question 6 of 10

Objective Describe directory services and Active Directory Describe the concepts of security, compliance, and identity

During a hybrid-cloud migration, administrators need one organized inventory where user, group, and device objects can be found and managed for authentication and access policy. Which directory capability meets that requirement?

Concept tested:

Question 7 of 10

Objective Describe Microsoft Defender Threat Intelligence Describe the capabilities of Microsoft security solutions

A threat-research team wants curated information organized around a particular threat actor, including associated tools and known vulnerabilities. Which Microsoft Defender Threat Intelligence resource should the team review?

Concept tested:

Question 8 of 10

Objective Describe Compliance Manager Describe the capabilities of Microsoft compliance solutions

While reviewing an assessment, a team needs to determine whether each control is implemented by the customer, implemented by Microsoft, or divided between both parties. Which Compliance Manager information should it review?

Concept tested:

Question 9 of 10

Objective Describe identity providers Describe the concepts of security, compliance, and identity

A development team is building a claims application but does not want the application to maintain user passwords. It needs a trusted service to maintain identity information, authenticate users, issue identity tokens, and record sign-in activity. What should the identity engineer implement?

Concept tested:

Question 10 of 10

Objective Describe network segmentation with Azure virtual networks Describe the capabilities of Microsoft security solutions

Development and production resources must use separate private Azure network address spaces, but approved traffic must still flow between them through controlled connectivity. Which design creates the required isolation boundaries?

Concept tested:

Unlock the full SC-900 bank.

Get the full bank, Exam Mode, Practice Mode, question sets, random tests, readiness tracking, saved box scores, and review tools for this exam.

The PDF versions keep questions first and move the answer review, explanations, and distractor notes to the back of the file.

200 verified exam-style questions Every choice explained Exam Mode and Practice Mode Question sets and random tests Readiness score and trends Previous test box scores

You've answered 0/10 questions in today's set.

Locked: 190 more questions in the full bank.

Locked: exam simulation mode, practice mode, readiness tracking, and saved review history.

Checkout stays on this page, so you can keep practicing, unlock the full bank, and start Exam Mode or Practice Mode when you are ready.

Cheat Sheets

Question 1 A storage resource passed an enabled Defender for Cloud security standard when deployed. Its configuration is later changed so that it no longer satisfies a control. Which behavior allows Defender for Cloud to identify the new failure and produce remediation guidance?

Answer choices

A. The original deployment result remains final until an analyst creates an incident
B. A Sentinel playbook changes the standard whenever a resource drifts
C. An annual manual review replaces policy evaluation for existing resources
D. Defender for Cloud continuously reevaluates resources against enabled standards

Correct answer

Defender for Cloud continuously reevaluates resources against enabled standards

Defender for Cloud continuously evaluates resources against enabled standards, so later configuration drift can cause a control to fail and generate a recommendation with affected resources and remediation guidance. A successful deployment-time result is not treated as permanent compliance.

Wrong-answer review

A. The original deployment result remains final until an analyst creates an incident: Posture is reevaluated continuously and is not frozen by the initial deployment result.
B. A Sentinel playbook changes the standard whenever a resource drifts: Sentinel playbooks automate incident response rather than redefining Defender for Cloud standards on drift.
C. An annual manual review replaces policy evaluation for existing resources: Annual manual review does not meet the documented continuous evaluation behavior.

Extra learning features

Why this matters

If Defender for Cloud fails to identify configuration drift, the organization faces the risk of a compromised resource being exposed to attack, potentially leading to data breaches and significant financial losses. Continuous evaluation is crucial for proactive protection.

Objective/domain: Describe the capabilities of Microsoft security solutions

Question 2 A company manually creates identities when people join, adds new access through tickets when they change jobs, and often leaves accounts and entitlements active after departure. It wants automated lifecycle changes plus evidence that access was approved and removed. What should it implement?

A. Password Protection and smart lockout for every employee account
B. Microsoft Entra ID Governance for identity and access lifecycle management
C. Conditional Access rules based only on office network locations
D. Microsoft Sentinel analytics without any identity-lifecycle integration

Microsoft Entra ID Governance for identity and access lifecycle management

Objective/domain: Describe the capabilities of Microsoft Entra

Source: What is Microsoft Entra ID Governance?

Question 3 After an acquisition, the parent company and subsidiary must keep their identity systems separate for six months. The parent company's application must nevertheless trust sign-ins that the subsidiary already performs, without copying the subsidiary's directory objects. What should the identity team configure?

A. Merge both directories immediately and retire the subsidiary's authentication system.
B. Synchronize the subsidiary's directory objects into the parent directory each hour.
C. Establish federation so the application trusts authentication performed by the subsidiary's identity provider.
D. Create local parent-company accounts for every subsidiary user until the directories can be merged.

Establish federation so the application trusts authentication performed by the subsidiary's identity provider.

Objective/domain: Describe the concepts of security, compliance, and identity

Source: Identity and access management fundamental concepts

Question 4 An organization wants one Purview DLP strategy to monitor or restrict sensitive-data use in supported Microsoft 365 workloads and on managed endpoints. Which statement about DLP scope is correct?

A. DLP can protect only Exchange email and no other supported location
B. DLP applies only after content is declared a regulatory record
C. DLP can cover supported Microsoft 365 workloads, endpoints, and other integrated locations
D. DLP is a network firewall that inspects only layer 3 and layer 4 traffic

DLP can cover supported Microsoft 365 workloads, endpoints, and other integrated locations

Objective/domain: Describe the capabilities of Microsoft compliance solutions

Source: Learn about data loss prevention

Question 5 Employees must stop entering passwords during routine workstation sign-in. A Temporary Access Pass may be used only to enroll or recover the strong method, not as the permanent daily method. Which method should the company deploy?

A. Windows Hello for Business
B. A permanent Temporary Access Pass
C. A longer memorized password
D. Two security questions

Windows Hello for Business

Source: Authentication methods and features

Question 6 During a hybrid-cloud migration, administrators need one organized inventory where user, group, and device objects can be found and managed for authentication and access policy. Which directory capability meets that requirement?

A. Encrypt all traffic exchanged between on-premises and cloud networks.
B. Store and organize identity, group, and device objects for centralized management.
C. Detect and automatically remediate vulnerabilities on every managed device.
D. Translate each industry's regulations into mandatory technical controls.

Store and organize identity, group, and device objects for centralized management.

Source: Microsoft Entra ID documentation

Question 7 A threat-research team wants curated information organized around a particular threat actor, including associated tools and known vulnerabilities. Which Microsoft Defender Threat Intelligence resource should the team review?

A. A vulnerability asset inventory
B. An intel profile
C. A Defender for Cloud regulatory standard
D. A Microsoft Sentinel automation rule

An intel profile

Source: Microsoft Threat Intelligence in Microsoft Defender XDR

Question 8 While reviewing an assessment, a team needs to determine whether each control is implemented by the customer, implemented by Microsoft, or divided between both parties. Which Compliance Manager information should it review?

A. The initial compliance-score baseline only
B. Control ownership
C. Microsoft Sentinel automation rules
D. Purview Activity explorer labels

Control ownership

Source: Microsoft Purview Compliance Manager

Question 9 A development team is building a claims application but does not want the application to maintain user passwords. It needs a trusted service to maintain identity information, authenticate users, issue identity tokens, and record sign-in activity. What should the identity engineer implement?

A. Use an identity provider to manage the identities, authenticate users, issue trusted tokens, and audit sign-ins.
B. Store password hashes in the claims database and let the application authenticate every user locally.
C. Use a network firewall to authenticate users before forwarding traffic to the claims application.
D. Send application events to a log workspace but keep identity creation and authentication inside the application.

Use an identity provider to manage the identities, authenticate users, issue trusted tokens, and audit sign-ins.

Question 10 Development and production resources must use separate private Azure network address spaces, but approved traffic must still flow between them through controlled connectivity. Which design creates the required isolation boundaries?

A. Place every resource on the public internet and distinguish environments by DNS name.
B. Put both environments in one subnet with no routing or traffic controls.
C. Create one network interface for all resources and separate access only by user account.
D. Place each environment in its own virtual network and connect them with controlled peering and traffic rules.

Place each environment in its own virtual network and connect them with controlled peering and traffic rules.

Source: Azure virtual network overview

SC-900 Practice Test

Unlock the full SC-900 bank

Practice with explanations that teach.

What you get with free practice

A storage resource passed an enabled Defender for Cloud security standard when deployed. Its configuration is later changed so that it no longer satisfies a control. Which behavior allows Defender for Cloud to identify the new failure and produce remediation guidance?

A company manually creates identities when people join, adds new access through tickets when they change jobs, and often leaves accounts and entitlements active after departure. It wants automated lifecycle changes plus evidence that access was approved and removed. What should it implement?

An organization wants one Purview DLP strategy to monitor or restrict sensitive-data use in supported Microsoft 365 workloads and on managed endpoints. Which statement about DLP scope is correct?

Employees must stop entering passwords during routine workstation sign-in. A Temporary Access Pass may be used only to enroll or recover the strong method, not as the permanent daily method. Which method should the company deploy?

During a hybrid-cloud migration, administrators need one organized inventory where user, group, and device objects can be found and managed for authentication and access policy. Which directory capability meets that requirement?

A threat-research team wants curated information organized around a particular threat actor, including associated tools and known vulnerabilities. Which Microsoft Defender Threat Intelligence resource should the team review?

While reviewing an assessment, a team needs to determine whether each control is implemented by the customer, implemented by Microsoft, or divided between both parties. Which Compliance Manager information should it review?

A development team is building a claims application but does not want the application to maintain user passwords. It needs a trusted service to maintain identity information, authenticate users, issue identity tokens, and record sign-in activity. What should the identity engineer implement?

Development and production resources must use separate private Azure network address spaces, but approved traffic must still flow between them through controlled connectivity. Which design creates the required isolation boundaries?

You are viewing today’s free 10. Unlock 190 more questions.

Build your practice session

Set your target once.

Customize your session

Unlock the full SC-900 bank.

7-day score keeper

Keep today’s practice moving

Answer choices

Correct answer

Wrong-answer review

Extra learning features

Why this matters

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

How are SC-900 questions generated?

How are explanations sourced?

What score do I get?

Why use this site?