About these questions
These five questions are original. We wrote them to match the style of the SC-900 skills measured, with the domains in rough proportion to their weight. They are not real exam questions, and the real exam will word things differently.
How to use these
Try each question without looking at your notes, and pick an answer before you open the explanation. Then read the explanation even when you were right, because the reason the closest wrong option fails is where the learning is. Note any domain where you slipped and revisit it in the domains explained page.
Question 1 (Describe the concepts of security, compliance, and identity)
An online bookshop lets customers sign in with an account they already have at a large email provider, so customers never create a separate password for the shop. Which concept does this describe?
- A. Hybrid identity
- B. Federation
- C. Passwordless authentication
- D. Single sign-on within one directory
Show the answer and explanation
Correct answer: B. Federation means the shop trusts an external identity provider to authenticate the user and accepts the result. The customer proves who they are to the email provider, not to the shop. Hybrid identity, the closest wrong option, describes connecting an on-premises directory to a cloud directory such as Microsoft Entra ID, which is not what happens here. Passwordless authentication would remove passwords altogether, but the customer here still uses an existing account that may well have one.
Question 2 (Describe the capabilities of Microsoft Entra)
Employees at a clinic report getting repeated Microsoft Authenticator approval prompts that they did not start. The security team wants to stop staff from approving a prompt by accident with a single tap. Which capability helps most?
- A. Self-service password reset
- B. A Temporary Access Pass
- C. Number matching for push notifications
- D. Smart lockout
Show the answer and explanation
Correct answer: C. With number matching, the user must type a number shown on the sign-in screen into the Authenticator app. An attacker who triggers prompts cannot supply that number, so a careless tap no longer approves the request. Smart lockout is the closest wrong option. It limits repeated failed sign-ins, but this scenario involves prompts the user never started, and a tap is not a failed attempt. Self-service password reset and a Temporary Access Pass are credential recovery and onboarding tools.
Question 3 (Describe the capabilities of Microsoft security solutions)
A retailer wants Microsoft Defender for Cloud to detect threats against its Linux virtual machines and its Azure SQL databases. Which two Defender plans should it turn on? Choose two.
- A. Defender for Servers
- B. Defender for Storage
- C. Defender for Key Vault
- D. Defender for Databases
- E. Defender for App Service
Show the answer and explanation
Correct answers: A and D. Defender for Servers protects virtual machines, including Linux ones, and Defender for Databases covers database services such as Azure SQL. Defender for Storage is the closest wrong option because databases and storage accounts both hold data, but it protects storage accounts, not SQL databases. Defender for Key Vault and Defender for App Service protect other resource types that the scenario does not mention.
Question 4 (Describe the capabilities of Microsoft security solutions)
A security analyst needs to run a custom Python machine-learning model over security data and combine it with a dataset stored on a local server, all inside Microsoft Sentinel. Which Sentinel feature supports this?
- A. Workbooks
- B. Notebooks
- C. Watchlists
- D. Analytics rules
Show the answer and explanation
Correct answer: B. Notebooks let analysts run code, such as Python, against Sentinel data for advanced hunting and analysis. Workbooks, the closest wrong option, build dashboards and visualizations from data but are not the place to run a custom machine-learning model. Watchlists hold reference data you bring in, so they could feed the dataset, but they do not run code. Analytics rules detect threats on a schedule or in near real time.
Question 5 (Describe the capabilities of Microsoft compliance solutions)
A compliance officer wants to see which users removed or lowered sensitivity labels on documents during the last ten days, and when each change happened. Which Microsoft Purview tool shows this?
- A. Content explorer
- B. Compliance Manager
- C. Activity explorer
- D. A retention label policy
Show the answer and explanation
Correct answer: C. Activity explorer lists actions people took on labeled content, such as changing or removing a label, with times and users. Content explorer is the closest wrong option. It shows where labeled content lives and what it is, but not the history of user actions. Compliance Manager tracks progress against regulations, and a retention label policy controls how long content is kept.
More guides for SC-900
- SC-900 Study Plan: 4-Week and 8-Week
- Is the SC-900 Exam Hard?
- SC-900 Prerequisites and Skills Check
- SC-900 Renewal and Retakes Explained
- Is SC-900 Worth It? An Honest Look
- SC-900 Cheat Sheet: Key Facts to Review
- AZ-900 vs SC-900: Which Exam First?
Next step
If these felt comfortable, check the exam format and book. If a domain felt shaky, try more questions in the SC-900 practice tests.