How are SC-900 questions generated?

dotCreds builds SC-900 practice questions from public exam objectives and Microsoft Learn and exam-objective references. The questions are written for realistic study practice, not copied from exam dumps.

How are explanations sourced?

Each question includes an explanation and, when available, a source link back to the provider documentation or reference used to validate the answer. That keeps the practice tied to study material you can actually review.

The page tracks today's answered count and accuracy for the 10-question daily set, then saves a 7-day score history on this device so you can see your recent practice trend.

The site is the fastest way to start SC-900 practice without installing anything. It is built for daily recall, quick weak-topic discovery, and source-backed explanations you can review immediately.

Free SC-900 Practice Test

SC-900 Practice Test

Start today’s free 10-question SC-900 set with source-backed explanations, local progress, and a fresh rotation every morning.

10 Free Daily Questions Source-backed Explanations 200 Verified Questions

Questions updated at Aug 7, 2026, 10:05 AM CDT

Unlock the full SC-900 bank

200 verified questions Exam Mode Practice Mode Detailed explanations Weak-area review No subscription - one-time unlock

Get the complete source-backed bank with Interview Questions, the full Study Guide, full Course Notes, detailed explanations, weak-area review, and exam-style practice.

Interview Questions Full Study Guide Full Course Notes Exam Mode Practice Mode Guided Course Detailed explanations Weak-area review No subscription

What you get with free practice

10 Free Questions Daily Fresh set every day from the live bank

Detailed Explanations Learn with clear source-backed answers

Track Your Progress Daily history and performance insights

Upgrade Anytime Unlock the full bank when you are ready

Question 1 of 10

Objective Define authentication Describe the concepts of security, compliance, and identity

A user successfully signs in to a payroll application but receives an access-denied message when opening payroll reports. Which statement best describes the two checks?

Concept tested:

Source:Identity and access management fundamental concepts

Question 2 of 10

Objective Describe the benefits of Content explorer and Activity explorer Describe the capabilities of Microsoft compliance solutions

A compliance analyst knows where labeled files are stored but needs to review which users applied, changed, or removed labels and what other information-protection actions occurred. Which Purview tool should the analyst use?

Concept tested:

Question 3 of 10

Objective Describe the Zero Trust model Describe the concepts of security, compliance, and identity

A contractor needs two hours of access to a payment application. The contractor is on the corporate network, but the device risk can change during the session. Which design applies both verify explicitly and least privilege?

Concept tested:

Question 4 of 10

Objective Describe Microsoft Defender for Office 365 Describe the capabilities of Microsoft security solutions

Attackers are sending email that displays the chief executive's name and uses a lookalike sender identity to request urgent payments. Which Defender for Office 365 capability most directly addresses this threat?

Concept tested:

Question 5 of 10

Objective Describe authentication methods Describe the capabilities of Microsoft Entra

A new employee has no registered strong authentication method yet and cannot complete passwordless enrollment. The help desk needs a credential that expires and is used only to bootstrap that enrollment. What should it issue?

Concept tested:

Question 6 of 10

Objective Describe network segmentation with Azure virtual networks Describe the capabilities of Microsoft security solutions

Development and production resources must use separate private Azure network address spaces, but approved traffic must still flow between them through controlled connectivity. Which design creates the required isolation boundaries?

Concept tested:

Question 7 of 10

Objective Describe the privacy principles of Microsoft Describe the capabilities of Microsoft compliance solutions

During a privacy review, a customer asks Microsoft to explain how its data is collected, stored, processed, and protected. Which Microsoft privacy principle directly addresses that request?

Concept tested:

Question 8 of 10

Objective Describe Microsoft Entra Conditional Access Describe the capabilities of Microsoft Entra

A finance application must remain available to employees, but sign-ins assessed as high risk from unmanaged devices must satisfy both stronger authentication and device requirements. The organization does not want to block ordinary low-risk access. Which configuration meets the requirement?

Concept tested:

Question 9 of 10

Objective Describe Microsoft Defender XDR services Describe the capabilities of Microsoft security solutions

An attack begins with a phishing email, compromises an employee identity, and then executes on an endpoint. Analysts want the related signals correlated into one incident with cross-domain context. Which service provides that experience?

Concept tested:

Question 10 of 10

Objective Describe password protection and management capabilities Describe the capabilities of Microsoft Entra

The security team wants users to enroll security information once for both MFA and self-service password recovery. It also wants repeated malicious password guesses blocked while minimizing disruption to legitimate users. Which combination satisfies both requirements?

Concept tested:

Unlock the full SC-900 bank.

Get the full bank, Exam Mode, Practice Mode, question sets, random tests, readiness tracking, saved box scores, and review tools for this exam.

The PDF versions keep questions first and move the answer review, explanations, and distractor notes to the back of the file.

200 verified exam-style questions Every choice explained Exam Mode and Practice Mode Question sets and random tests Readiness score and trends Previous test box scores

You've answered 0/10 questions in today's set.

Locked: 190 more questions in the full bank.

Locked: exam simulation mode, practice mode, readiness tracking, and saved review history.

Checkout stays on this page, so you can keep practicing, unlock the full bank, and start Exam Mode or Practice Mode when you are ready.

Cheat Sheets

Question 1 A user successfully signs in to a payroll application but receives an access-denied message when opening payroll reports. Which statement best describes the two checks?

Answer choices

A. Authentication confirms what data the user may access, while authorization confirms the user’s identity.
B. Authentication and authorization are the same check, so a successful sign-in should grant every permission.
C. Authentication confirms the identity, while authorization determines whether that authenticated identity may access the payroll reports.
D. Authorization verifies the user’s MFA factors, while authentication assigns access permissions.

Correct answer

Authentication confirms the identity, while authorization determines whether that authenticated identity may access the payroll reports.

Authentication establishes who or what the identity is. Authorization is the separate decision about which resources that authenticated identity may access, so a successful sign-in does not by itself grant access to the payroll reports.

Wrong-answer review

A. Authentication confirms what data the user may access, while authorization confirms the user’s identity.: The roles are reversed: authentication establishes identity, while authorization evaluates access to a resource.
B. Authentication and authorization are the same check, so a successful sign-in should grant every permission.: Authentication and authorization are related but distinct checks; signing in does not grant every permission.
D. Authorization verifies the user’s MFA factors, while authentication assigns access permissions.: MFA is an authentication method, while permissions are part of authorization; the choice reverses both concepts.

Extra learning features

Why this matters

A successful sign-in does not guarantee access to the payroll reports, highlighting the critical distinction between authentication and authorization, preventing unauthorized access to sensitive financial data. This separation is fundamental to secure access management. (34 words)

Objective/domain: Describe the concepts of security, compliance, and identity

Question 2 A compliance analyst knows where labeled files are stored but needs to review which users applied, changed, or removed labels and what other information-protection actions occurred. Which Purview tool should the analyst use?

A. Content explorer only
B. Microsoft Defender XDR advanced hunting
C. Activity explorer
D. Microsoft Entra sign-in logs

Activity explorer

Objective/domain: Describe the capabilities of Microsoft compliance solutions

Source: Microsoft Purview Information Protection

Question 3 A contractor needs two hours of access to a payment application. The contractor is on the corporate network, but the device risk can change during the session. Which design applies both verify explicitly and least privilege?

A. Trust the session for the rest of the day because it began on the corporate network
B. Approve permanent access after checking only the contractor's password at first sign-in
C. Evaluate identity, device, and risk signals continuously and grant time-limited access only to the required application
D. Allow access from any managed device and review the contractor's activity at the end of the month

Evaluate identity, device, and risk signals continuously and grant time-limited access only to the required application

Source: Zero Trust as a security foundation

Question 4 Attackers are sending email that displays the chief executive's name and uses a lookalike sender identity to request urgent payments. Which Defender for Office 365 capability most directly addresses this threat?

A. Anti-phishing policies with impersonation protection
B. Safe Attachments detonation
C. Defender for Endpoint EDR
D. Azure DDoS Protection

Anti-phishing policies with impersonation protection

Objective/domain: Describe the capabilities of Microsoft security solutions

Source: Microsoft Defender for Office 365 features

Question 5 A new employee has no registered strong authentication method yet and cannot complete passwordless enrollment. The help desk needs a credential that expires and is used only to bootstrap that enrollment. What should it issue?

A. A Temporary Access Pass
B. A permanent shared password
C. An access-review decision
D. A device-compliance exception

A Temporary Access Pass

Objective/domain: Describe the capabilities of Microsoft Entra

Source: Authentication methods and features

Question 6 Development and production resources must use separate private Azure network address spaces, but approved traffic must still flow between them through controlled connectivity. Which design creates the required isolation boundaries?

A. Place every resource on the public internet and distinguish environments by DNS name.
B. Put both environments in one subnet with no routing or traffic controls.
C. Create one network interface for all resources and separate access only by user account.
D. Place each environment in its own virtual network and connect them with controlled peering and traffic rules.

Place each environment in its own virtual network and connect them with controlled peering and traffic rules.

Source: Azure virtual network overview

Question 7 During a privacy review, a customer asks Microsoft to explain how its data is collected, stored, processed, and protected. Which Microsoft privacy principle directly addresses that request?

A. Purpose limitation, because it states the service purpose instead of explaining processing
B. Transparency
C. Customer control, because the customer can modify data without processing information
D. Legal protection, because every processing detail is a government request

Transparency

Source: Microsoft Privacy Principles

Question 8 A finance application must remain available to employees, but sign-ins assessed as high risk from unmanaged devices must satisfy both stronger authentication and device requirements. The organization does not want to block ordinary low-risk access. Which configuration meets the requirement?

A. Block the finance application for every user and device regardless of sign-in context.
B. Require multifactor authentication for every cloud application but ignore device state and sign-in risk.
C. Mark the corporate network as trusted and grant all requests originating there without further evaluation.
D. Create a Conditional Access policy using application, risk, and device signals that requires MFA and a compliant device.

Create a Conditional Access policy using application, risk, and device signals that requires MFA and a compliant device.

Source: Microsoft Entra Conditional Access: Zero Trust policy engine

Question 9 An attack begins with a phishing email, compromises an employee identity, and then executes on an endpoint. Analysts want the related signals correlated into one incident with cross-domain context. Which service provides that experience?

A. Azure DDoS Protection
B. Microsoft Defender XDR
C. Azure Key Vault
D. Microsoft Purview Records Management

Microsoft Defender XDR

Source: Microsoft Defender XDR overview

Question 10 The security team wants users to enroll security information once for both MFA and self-service password recovery. It also wants repeated malicious password guesses blocked while minimizing disruption to legitimate users. Which combination satisfies both requirements?

A. Password Protection for registration and access reviews for password guessing
B. Separate MFA and SSPR enrollment portals plus permanent account lockout after one failure
C. Combined MFA and SSPR registration together with smart lockout
D. Conditional Access registration together with entitlement management for password guessing

Combined MFA and SSPR registration together with smart lockout

Source: Combined registration for SSPR and Microsoft Entra multifactor authentication

SC-900 Practice Test

Unlock the full SC-900 bank

Practice with explanations that teach.

What you get with free practice

A user successfully signs in to a payroll application but receives an access-denied message when opening payroll reports. Which statement best describes the two checks?

A compliance analyst knows where labeled files are stored but needs to review which users applied, changed, or removed labels and what other information-protection actions occurred. Which Purview tool should the analyst use?

A contractor needs two hours of access to a payment application. The contractor is on the corporate network, but the device risk can change during the session. Which design applies both verify explicitly and least privilege?

Attackers are sending email that displays the chief executive's name and uses a lookalike sender identity to request urgent payments. Which Defender for Office 365 capability most directly addresses this threat?

A new employee has no registered strong authentication method yet and cannot complete passwordless enrollment. The help desk needs a credential that expires and is used only to bootstrap that enrollment. What should it issue?

Development and production resources must use separate private Azure network address spaces, but approved traffic must still flow between them through controlled connectivity. Which design creates the required isolation boundaries?

During a privacy review, a customer asks Microsoft to explain how its data is collected, stored, processed, and protected. Which Microsoft privacy principle directly addresses that request?

A finance application must remain available to employees, but sign-ins assessed as high risk from unmanaged devices must satisfy both stronger authentication and device requirements. The organization does not want to block ordinary low-risk access. Which configuration meets the requirement?

An attack begins with a phishing email, compromises an employee identity, and then executes on an endpoint. Analysts want the related signals correlated into one incident with cross-domain context. Which service provides that experience?

The security team wants users to enroll security information once for both MFA and self-service password recovery. It also wants repeated malicious password guesses blocked while minimizing disruption to legitimate users. Which combination satisfies both requirements?

You are viewing today’s free 10. Unlock 190 more questions.

Build your practice session

Set your target once.

Customize your session

Unlock the full SC-900 bank.

7-day score keeper

Keep today’s practice moving

Answer choices

Correct answer

Wrong-answer review

Extra learning features

Why this matters

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

How are SC-900 questions generated?

How are explanations sourced?

What score do I get?

Why use this site?