10 exam-style questions with answers and explanations, straight from our 1,030-question bank. Tap an answer to check yourself. When you're ready, take the scored version in the free practice test.
These 10 free SC-900 questions are organized by exam domain, so you can see how each part of the Microsoft Certified: Security, Compliance, and Identity Fundamentals blueprint is tested. Reveal the answer and explanation under each question.
A company moves its custom web application from an Azure virtual machine to Azure App Service, using the service's built-in managed runtime. After the move, which security task still belongs to the company?
Correct answer: A - Fixing vulnerabilities in libraries packaged with its application code.
A software publisher distributes an installation file and publishes its SHA-256 digest through a separately trusted channel. An engineer computes the downloaded file's SHA-256 digest and gets a different value. What does that comparison establish?
Correct answer: B - The downloaded bytes differ from the bytes represented by the published digest.
An employee is authorized to use a finance app. An enabled Conditional Access policy requires both MFA and a compliant device; the employee satisfies both. A second policy matches the employee's location and specifies Block access, but is in report-only mode. No other policies apply. What is the expected outcome?
Correct answer: C - Access is allowed; the location policy's report-only result is logged.
A database engineer needs the Azure Contributor role on a production resource group only during maintenance. Each activation must be approved, expire after two hours, and leave no active assignment between maintenance windows. Which Microsoft Entra capability fits this model?
Correct answer: C - Privileged Identity Management
After attackers relay employees' passwords and SMS codes through a fake sign-in site, the company requires phishing-resistant MFA for its payroll application. Which authentication method meets that requirement?
Correct answer: B - A FIDO2 security key unlocked with a local PIN.
An Azure-hosted booking site receives requests that insert unexpected database commands into its search parameters. Request volume is close to normal, and the traffic uses HTTPS through an allowed port. Which control most directly addresses the attack described?
Correct answer: B - Inspect the requests with Azure Web Application Firewall.
The operations team must open an RDP session to an Azure virtual machine from a web browser. The VM must not have a public IP address, and the administrator's computer must not need a VPN connection. Which Azure service is designed for this access pattern?
Correct answer: C - Azure Bastion
A Windows laptop onboarded to Microsoft Defender for Endpoint is actively encrypting files on a network share. A responder has confirmed ransomware and is authorized to take response actions. What should the responder do first to limit spread while preserving the device for investigation?
Correct answer: D - Isolate the laptop through Microsoft Defender for Endpoint.
Microsoft Purview Compliance Manager shows 312 earned points out of 480 available points. The totals already account for actions shared across assessments. Which statement accurately summarizes this result for a management report?
Correct answer: D - The organization has earned 65% of its available improvement-action points.
An approved external auditor must read a confidential Excel workbook after downloading it from SharePoint. The workbook is currently unencrypted. Protection must stay with the downloaded file and restrict opening to named authorized recipients. Which approach meets both requirements?
Correct answer: B - Apply a sensitivity label that encrypts the workbook for those recipients.
The full bank has 1,020 more SC-900 questions with explanations.
Continue in the free practice test →
View plans