Knowing what Zero Trust or MFA means is one skill. Picking the right Microsoft capability for a business scenario is another, and it is the one the questions below practise. Take them cold, score yourself, and see which side you land on before you book.
Real SC-900 Practice Questions, Free, No Signup Required
These questions come directly from CertCompanion's exam bank for SC-900. No account, no trial, no credit card. Work through them one at a time without skipping back.
10 free SC-900 practice questions
These are real questions from our 230-question SC-900 bank - the same pool the full practice exam draws from, not simplified samples. Answer before you expand the explanation.
Question 1
A startup named 'AgileFirst Tech' is migrating its entire server infrastructure to Azure, adopting an Infrastructure as a Service (IaaS) model by using virtual machines. The IT team is defining their new operational responsibilities. In this IaaS cloud model, who is ultimately responsible for performing operating system updates and security patching on their Windows Server VMs?
- A. Microsoft's physical datacenter operations team
- B. The AgileFirst Tech IT administration team
- C. Azure's automated hypervisor management service
- D. The physical security guards at the Azure datacenter
Show answer and explanation
Correct answer: B. The AgileFirst Tech IT administration team
In the shared responsibility model for IaaS, the customer retains full control and responsibility for the software stack running on the infrastructure.
Why this is correct: The AgileFirst Tech IT administration team is responsible. For IaaS, the cloud provider, Microsoft, manages the physical hosts, physical network, and the physical datacenter. However, the customer is responsible for everything above the hypervisor, which includes the guest operating system, its configuration, patching, and the applications installed on it.
Why others are incorrect: Microsoft's teams manage the physical aspects and the virtualization layer, not the specific operating system you choose to install and run inside a VM. They ensure the server is on and the network is running, but you manage what is inside your virtual server.
Question 2
A new e-commerce platform, 'ShopSphere', is being built. The lead developer needs to choose a method for storing customer passwords. The primary security requirement is that if the user database is ever stolen, the attackers must not be able to figure out the original passwords. The process must be one-way, meaning the original password can never be recovered from the stored value. Which method should be used?
- A. Symmetric Encryption
- B. Asymmetric Encryption
- C. Hashing
- D. Data Obfuscation
Show answer and explanation
Correct answer: C. Hashing
Hashing is the correct choice for securely storing passwords because it is a one-way process.
Why this is correct: Hashing takes an input, like a password, and produces a fixed-size string of characters, which is the hash. This process cannot be reversed. When a user logs in, the system hashes the password they entered and compares it to the stored hash. This ensures the original password is never stored or revealed.
Why others are incorrect: Symmetric and Asymmetric encryption are two-way processes. They are designed to encrypt data and then decrypt it back to its original form, which is not safe for passwords. Data obfuscation just makes data harder to read for humans but is easily reversible and not a secure cryptographic method.
Question 3
A healthcare provider, 'WellCare Clinic', needs to allow patients to securely send their medical files over the internet. To do this, WellCare Clinic wants to publish a key that anyone can use to encrypt files for them. However, only the clinic should possess the corresponding secret key to decrypt and read these files. Which encryption methodology uses this type of public and private key pair?
- A. Symmetric encryption
- B. Hashing
- C. Asymmetric encryption
- D. Quantum encryption
Show answer and explanation
Correct answer: C. Asymmetric encryption
This scenario perfectly describes the use case for asymmetric encryption.
Why this is correct: Asymmetric encryption uses a pair of keys: a public key and a private key. The public key can be shared freely and is used to encrypt data. The corresponding private key is kept secret and is the only key that can decrypt the data. This allows for secure communication without sharing a secret key beforehand.
Why others are incorrect: Symmetric encryption uses a single, shared secret key for both encryption and decryption, which would be insecure to share publicly. Hashing is a one-way function and cannot be used for decryption. Quantum encryption is an advanced field not typically described by this standard model.
Question 4
At 'Global Logistics Inc.', a new junior analyst successfully signs into the company's internal portal. The system has confirmed their identity. The next step for the system is to check what this specific analyst is allowed to do: for example, can they only view shipping manifests, or are they also permitted to approve new shipping routes? Which security concept is responsible for defining this level of access?
- A. Authentication
- B. Auditing
- C. Administration
- D. Authorization
Show answer and explanation
Correct answer: D. Authorization
Authorization is the process of determining what an authenticated user is permitted to do.
Why this is correct: Authorization happens after authentication. Once the system knows who you are, authorization policies define your permissions, such as read, write, or delete access to specific resources like files or applications. It answers the question, What is this user allowed to do?.
Why others are incorrect: Authentication is the process of proving you are who you say you are, like with a password. Auditing is the process of logging and reviewing actions for security and compliance. Administration involves managing user accounts and their settings.
Question 5
An employee at 'FinSecure Bank' starts their day by logging into their Windows laptop. Later, they need to access the company's SharePoint site, a custom-built financial analytics app, and their HR portal. Thanks to a recently implemented system, the employee does not have to enter their credentials again for any of these applications after their initial login. What is the primary benefit of this single sign-on (SSO) system?
- A. It requires users to have multiple, complex passwords for better security.
- B. It allows users to log in once and access multiple authorized resources without re-authenticating.
- C. It ensures that a device can only be used by one specific employee.
- D. It automatically logs the user out of all systems every 15 minutes.
Show answer and explanation
Correct answer: B. It allows users to log in once and access multiple authorized resources without re-authenticating.
The core benefit of Single Sign-On (SSO) is enhancing user productivity and experience by reducing password fatigue.
Why this is correct: SSO enables a user to authenticate one time with a single set of credentials to gain access to multiple applications and resources they have permissions for. This simplifies the user experience and reduces the time spent logging into various systems.
Why others are incorrect: SSO aims to reduce the number of passwords a user needs to manage, not increase them. It does not lock a device to a single user, nor does it inherently define logout timers, although those can be part of an overall access policy.
Question 6
Two separate companies, 'PharmaCo' and 'ResearchLab', need to collaborate on a project. ResearchLab hosts a critical research application that PharmaCo's scientists need to access. Instead of creating new user accounts for PharmaCo employees within its own system, ResearchLab wants to trust the authentication performed by PharmaCo's identity system. What concept enables this trust relationship, allowing users from one organization to access resources in another?
- A. Single Sign-On (SSO)
- B. Federation
- C. Multi-Factor Authentication (MFA)
- D. Replication
Show answer and explanation
Correct answer: B. Federation
Federation establishes a trust relationship between two different organizations' identity systems.
Why this is correct: Federation allows an identity provider in one organization (like PharmaCo) to provide authentication credentials that are trusted by a service provider in another organization (like ResearchLab). This lets PharmaCo users access ResearchLab's app using their existing work credentials, without ResearchLab having to manage their accounts.
Why others are incorrect: SSO is often a result of federation, but federation is the underlying trust agreement that makes it possible across organizations. MFA is a method of authentication, not a way to connect organizations. Replication is about copying data, not establishing identity trust.
Question 7
A university plans to provide its alumni with access to a special portal hosted in its Azure subscription. They will use Microsoft Entra ID to manage these external identities and want to leverage the monthly active users (MAU) billing model. The university wants to ensure they are not charged for the first 50,000 active external users each month. What is the minimum edition of Microsoft Entra ID required to get this benefit?
- A. Microsoft Entra ID Free
- B. Microsoft Entra ID P1
- C. Microsoft Entra External ID
- D. Microsoft Entra ID P2
Show answer and explanation
Correct answer: B. Microsoft Entra ID P1
The free tier for the first 50,000 MAUs is a feature of the Premium editions.
Why this is correct: Both Microsoft Entra ID P1 and P2 include a free grant of 50,000 monthly active users (MAU) for external identities. Since the question asks for the minimum edition that provides this benefit, P1 is the correct answer. It offers the required feature at a lower cost than P2.
Why others are incorrect: The Free and External ID (pay-as-you-go) tiers do not include this free grant and would incur costs from the very first user.
Question 8
A manufacturing firm, 'BuildIt Corp', currently manages all its employee identities using an on-premises Active Directory Domain Services (AD DS). They are adopting Microsoft 365 and Azure and need to implement a hybrid identity model. They need a tool to synchronize user identities, including their password hashes, from their on-premises AD DS to their new cloud-based Microsoft Entra tenant. What Microsoft tool is designed for this purpose?
- A. Microsoft Entra Privileged Identity Management (PIM)
- B. Microsoft Sentinel
- C. Microsoft Entra Connect
- D. Active Directory Federation Services (AD FS)
Show answer and explanation
Correct answer: C. Microsoft Entra Connect
Microsoft Entra Connect is the bridge for creating a hybrid identity.
Why this is correct: Microsoft Entra Connect is the specific Microsoft tool designed to meet hybrid identity goals. Its core function is to synchronize identity data, including users, groups, and optionally password hashes, between an on-premises Active Directory and a Microsoft Entra ID tenant. This allows users to have a single identity for both on-premises and cloud resources.
Why others are incorrect: PIM is for managing elevated access. Microsoft Sentinel is a security monitoring tool. AD FS is a federation service, and while it's part of some hybrid models, it does not perform the synchronization itself.
Question 9
A government agency is upgrading its security and wants to implement a multi-factor authentication method that is resistant to phishing. They are considering a hardware device that generates a new 6-digit code every 30 seconds. This code must be entered after the user's password to grant access. Which authentication method relies on this time-based, one-time password (TOTP) principle?
- A. Password hash synchronization
- B. Windows Hello for Business
- C. Strong passwords
- D. OATH hardware tokens
Show answer and explanation
Correct answer: D. OATH hardware tokens
OATH hardware tokens are physical devices that generate time-based one-time passwords.
Why this is correct: OATH is a standard for generating one-time passwords, and OATH hardware tokens are physical authenticators that implement this standard. They typically have a small screen that displays a code that changes at a regular interval, such as every 30 or 60 seconds, providing a secure second factor for authentication.
Why others are incorrect: Password hash synchronization is a feature for hybrid identity, not an authentication method itself. Windows Hello uses biometrics or a PIN. Strong passwords are just a single factor of authentication.
Question 10
A financial services company needs to enforce multi-factor authentication (MFA) for its employees. They have a diverse workforce using various devices, including company-managed Windows laptops, personal iPhones, and Android tablets. Which two MFA methods available in Microsoft Entra ID would work across all these platforms?
- A. Fingerprint recognition via Windows Hello
- B. A voice call to a pre-registered phone number
- C. The Microsoft Authenticator app
- D. Face recognition via Windows Hello
Show answer and explanation
Correct answer: B. A voice call to a pre-registered phone number and C. The Microsoft Authenticator app
The key is finding methods that are not tied to a specific operating system or hardware.
Why these are correct: The Microsoft Authenticator app is available on both iOS and Android and can send push notifications or generate codes, making it universally compatible. A voice call can be made to any phone, whether it is a smartphone or a landline, making it a highly accessible and platform-independent method.
Why others are incorrect: Fingerprint and face recognition via Windows Hello for Business are excellent security features, but they are specific to the Windows operating system and require compatible hardware, so they would not work on iPhones or Android tablets.
Exam facts worth checking before you book
| Item | Detail |
|---|---|
| Passing score | 700 on a scaled score |
| Validity | Fundamentals certifications do not expire |
| Retake after a fail | Wait 24 hours before the second attempt, then 14 days between later attempts |
| Attempt limit | No more than 5 attempts in 12 months from the first attempt |
| Cost to retake | You pay for every attempt |
Microsoft shows the exam duration, the number of questions and the price in your region when you schedule, so check them on the official exam page rather than relying on a figure from a third-party site.
Official domain weights
| Domain | Official weight |
|---|---|
| Describe the concepts of security, compliance, and identity | 10–15% |
| Describe the capabilities of Microsoft Entra | 25–30% |
| Describe the capabilities of Microsoft security solutions | 35–40% |
| Describe the capabilities of Microsoft compliance solutions | 20–25% |
The two largest domains, Microsoft security solutions and Microsoft Entra, together make up 60–70% of the outline, so a weak result on those matters more than a weak result on the concepts domain.
How to Use This Sample Test
Answer all ten without looking anything up, and count an answer as correct only if it was your first instinct. Then read the explanation for every question, including the ones you got right: the explanations are where the distinctions between similar-sounding capabilities are spelled out. Ten questions are a small sample, so treat the result as a rough signal and use the full bank for a steadier reading.
What the Ten Sample Questions Cover
The sample leans toward the security-concepts and identity parts of the outline. Its ten questions cover the shared responsibility model for patching in an infrastructure-as-a-service migration, one-way hashing for stored passwords, asymmetric encryption with a public and private key pair, authentication versus authorization, single sign-on, federation between two organizations, external identities in Microsoft Entra ID, hybrid identity from an on-premises Active Directory, phishing-resistant multi-factor authentication with hardware keys, and MFA methods that work across device platforms.
Every question is a scenario with several plausible answers, so the skill being practised is matching what the business needs to the right capability, not reciting a definition.
What to Do Based on Your Result
Group the questions you missed by topic and drill that topic in the full bank. If the misses cluster in identity (Entra, multi-factor authentication, federation, external and hybrid identities), spend your time there, because that domain carries 25–30% of the outline. If they cluster in security or compliance solutions, those domains carry 35–40% and 20–25%, so work through the full bank for them before you book.
To go further, work through more questions and track your progress by domain at CertCompanion's SC-900 practice exam. For the rest of Microsoft's certification path, see the Microsoft exams hub.
Frequently Asked Questions
Does SC-900 expire? No. Microsoft states that Fundamentals certifications do not expire, so you earn it once.
What is the retake policy if I fail? Wait 24 hours after the first failed attempt. Between all later attempts there is a 14-day waiting period, up to 5 attempts. You may not take the same exam more than 5 times within 12 months of your first attempt, and you pay for each attempt.
What score do I need to pass? 700 on a scaled score.
Are these the real exam questions? No. They are practice questions from our own bank, each with an explanation. They help you find gaps; they do not reproduce the live exam.
How many free questions can I try? The ten above are free to read. You can start with 30 free questions in the full practice exam, with no account required.
The SC-900 asks you to match scenarios to Microsoft capabilities. Use the ten questions above as an honest baseline, read every explanation, and then work through the full bank domain by domain.
Start with 30 free questions at CertCompanion's SC-900 practice exam, no account required.
Checked against official Microsoft SC-900 exam documentation. Last verified 2026-10-27.