SC-900 Security, Compliance & Identity: 500 Questions
Entra ID, Defender XDR, Sentinel and Purview: 5 x 100 questions with an explanation for every answer option
Have you studied enough to pass SC-900, or does it only feel that way? Five practice tests of 100 questions each give you an honest answer before you spend the exam fee.
All 500 questions are written against the SC-900 study guide with skills measured as of October 21, 2026, and weighted like it: concepts of security, compliance and identity (10-15%), the capabilities of Microsoft Entra (25-30%), Microsoft security solutions (35-40%) and Microsoft compliance solutions (20-25%). Every correct answer is based on a Microsoft Learn page, and no fact is the correct answer in more than one question.
SC-900 has no retired predecessor, but the exam has moved under older practice material. Azure AD is now Microsoft Entra ID, Microsoft 365 Defender is Microsoft Defender XDR, compliance work happens in the Microsoft Purview portal, Audit (Standard) keeps records for 180 days, and the October 2026 update speaks of workload identities and Microsoft Threat Intelligence. A question bank built on the old names and defaults trains you for an exam that no longer exists.
The five tests get harder in how they ask, not in how obscure they get:
- Test 1, Groundwork: direct questions on the core concepts. Take it cold as a baseline.
- Test 2, In Practice: short scenarios that separate services candidates confuse.
- Test 3, Trade-offs: two answers look right and one constraint decides.
- Test 4, Under the Hood: how Entra, Defender, Sentinel and Purview actually work.
- Test 5, Exam Day: long mixed scenarios on a tight clock, your readiness check.
Every answer option has its own explanation, so a wrong pick tells you what that option really is. Each question also has a summary that explains the right answer, rules out the others and links to the Microsoft Learn page it is based on.
After each attempt PrepKiwi shows your score per domain, so you can see whether Entra, Defender or Purview needs more work. The pass mark is 80% on tests 1 to 4 and 85% on test 5, deliberately above the real exam, because practising at home is easier than a proctored session.
What this practice set is not: a video course, a copy of real exam questions, or a guarantee. It is a well-explained question bank that shows you where you stand on SC-900. Pair it with the free Microsoft Learn learning paths and you will know exactly what to study next.
Groundwork: Core Security, Identity and Compliance Concepts
100 questions · 155 minutes · pass mark 80%
Your baseline. 100 direct questions on the ideas the rest of this practice set builds on: shared responsibility, Zero Trust, defense-in-depth, encryption and hashing, authentication versus authorization, and what Microsoft Entra ID, Microsoft Defender XDR, Microsoft Sentinel and Microsoft Purview each do. One concept per question, short stems, 12 of them multiple-answer. Take it cold, before you study, to see where you stand. You have 155 minutes and need 80% to pass. That bar is higher than the real exam on purpose: at home, with no proctor and no pressure, you should clear it comfortably before you book. Every answer option has its own explanation, and every question links to the Microsoft Learn page it is based on.
In Practice: Telling Microsoft Security Services Apart
100 questions · 155 minutes · pass mark 80%
100 short workplace scenarios where the hard part is picking the right service, not remembering a definition. Conditional Access or ID Protection? Azure Firewall or a network security group? Sentinel or Defender XDR? Sensitivity label or retention label? Each question puts two neighbouring features side by side, the pairs that candidates mix up most. 14 questions are multiple-answer. You have 155 minutes and need 80% to pass. Read the explanation for the options you did not pick as well: that is where the distinctions are.
Trade-offs: When Two Answers Look Right
100 questions · 155 minutes · pass mark 80%
100 questions where two answers both look defensible and one detail in the scenario decides: a license tier, cloud versus on-premises, preventing versus detecting, retaining versus deleting, an identity control versus a network control. Expect longer stems and read them to the end, because the constraint that settles the question is often in the last sentence. 14 questions are multiple-answer. You have 155 minutes and need 80% to pass. If you score lower here than on test 2, you know the services but not yet when to choose which.
Under the Hood: How Entra, Defender and Purview Work
100 questions · 135 minutes · pass mark 80%
100 questions on how things actually work: what an NSG does with rule priorities, where Compliance Manager lives, what PIM changes about an admin role, how long standard audit records are kept, what Microsoft Defender for Identity watches and what it does not. Short stems, concrete answers, 16 multiple-answer questions. You have 135 minutes and need 80% to pass. This is the test that exposes gaps hidden by good guessing on scenario questions.
Exam Day: Full-Length SC-900 Simulation
100 questions · 145 minutes · pass mark 85%
The readiness gate. 100 long, mixed-domain scenarios with several constraints each, weighted like the October 21, 2026 study guide: concepts, Microsoft Entra, Microsoft security solutions and Microsoft Purview compliance. 16 questions are multiple-answer. You have 145 minutes, the least thinking time per question in this practice set, and you need 85% to pass. The bar is higher than the real exam on purpose: practice at home is easier than a proctored session, so a comfortable pass here is the signal to book. Sit it in one uninterrupted session, and only after tests 1 to 4.
What you will practice
- Test your knowledge across all four SC-900 domains with 500 questions weighted to the October 2026 study guide
- Tell apart services that candidates confuse, such as Conditional Access and ID Protection or Sentinel and Defender XDR
- Learn from an explanation for every answer option plus a summary with a link to the Microsoft Learn source
- Work from basic concepts to full-length scenarios and finish with a timed simulation that shows if you are ready
- Find your weakest domain from the per-domain score and target your revision where it pays off most
- Use current product names: Microsoft Entra ID, Defender XDR, Microsoft Threat Intelligence, the Purview portal
Exam domains covered
Who is this for
This practice set is for anyone preparing for SC-900: Microsoft Security, Compliance, and Identity Fundamentals. That includes IT professionals moving towards a security, identity or compliance role, administrators and developers who need to speak the language of Microsoft Entra, Defender and Purview, students and career changers who want a first Microsoft security certification, and non-technical roles such as auditors, compliance officers, project managers and sales engineers who work with these products. SC-900 has no retired predecessor, but it has changed steadily: Azure AD became Microsoft Entra ID, Microsoft 365 Defender became Microsoft Defender XDR, the compliance portal became the Microsoft Purview portal, and the October 21, 2026 update reworded the Entra identity types and the threat intelligence objective. Older question banks still use the old names and scope. This practice set is a bank of practice questions with explanations. It shows you what you know and why an answer is right; it does not replace a course or hands-on practice.
Requirements
- No prior security certification is needed. Basic familiarity with Microsoft 365 and Azure helps, but every explanation starts from the concept.
- These are practice tests, not a video course. Use them alongside the free SC-900 learning paths on Microsoft Learn, not instead of them.
- A computer or phone with a browser and a few uninterrupted hours for the final simulation test.
Free exam guide
Not sure what to expect? Read how the exam is built, what it covers and how to prepare.