Microsoft SC-900 Exam Prep Study Guide 

Security, Compliance & Identity Fundamentals Exam Prep + 100 Practice Questions

Instant PDF Download — $16.97

Preparing for the Microsoft Security, Compliance, and Identity Fundamentals SC-900 exam?

Get focused preparation with the Noble Exam Prep Microsoft SC-900 Study Guide — a beginner-friendly digital resource covering Microsoft security, identity, compliance, Microsoft Entra, Defender, Sentinel, Purview, Zero Trust, and more.

This guide combines complete SC-900 domain review, 100 original practice questions with explanations, current Microsoft product terminology, product-selection tables, commonly confused Microsoft services, and a structured three-week study plan.

No prior IT certification or professional IT experience is required to get started.

Only $16.97

One-Time Purchase • Instant Digital PDF Download

What's Included?

Your Microsoft SC-900 exam prep PDF includes:

• Complete SC-900 domain review

• All four current exam domains

• 100 original practice questions

• Detailed answers and explanations

• Current Microsoft product names

• Retired-name → current-name reference

• Microsoft Entra ID review

• Conditional Access

• MFA & passwordless authentication

• Entra ID Protection

• Privileged Identity Management

• Identity governance

• Microsoft Defender product comparisons

• Microsoft Defender XDR

• Microsoft Defender for Cloud

• Microsoft Sentinel

• Microsoft Security Copilot

• Azure network security

• Microsoft Purview

• Compliance Manager

• Sensitivity & retention labels

• Data Loss Prevention

• Insider Risk Management

• eDiscovery

• Secure Score vs. Compliance Score

• Product-selection reference sheets

• Three-week study plan

• Test-day checklist

The guide moves through all four SC-900 domains before providing a complete 100-question practice exam, explanations, and final product-selection reference sheets.

Built Around the Current SC-900 Skills Outline

Don't Study Outdated Microsoft Product Names

SC-900 presents a unique problem for exam candidates.

Microsoft doesn't necessarily change the exam code when it updates the certification.

The exam remains SC-900, while Microsoft can revise the skills outline and change the names of products appearing on the exam.

That means a guide labeled “SC-900” can still contain outdated terminology.

This study guide addresses that problem directly.

Current Microsoft Product Names

Old Name vs. New Name

The guide includes a dedicated rename reference covering changes such as:

Azure Active Directory / Azure AD
→ Microsoft Entra ID

Azure AD Identity Protection
→ Microsoft Entra ID Protection

Azure AD Privileged Identity Management
→ Microsoft Entra Privileged Identity Management

Azure AD External Identities
→ Microsoft Entra External ID

Microsoft 365 Defender
→ Microsoft Defender XDR

Azure Security Center / Azure Defender
→ Microsoft Defender for Cloud

Microsoft Cloud App Security
→ Microsoft Defender for Cloud Apps

Azure Sentinel
→ Microsoft Sentinel

Microsoft 365 Compliance Center
→ Microsoft Purview Portal

Azure Information Protection
→ Microsoft Purview Information Protection

This rename map is one of the strongest features of the guide because candidates studying older courses can encounter product names that no longer match Microsoft's current exam terminology.

Complete SC-900 Domain Review

The guide covers all four current domains:

1.0 Security, Compliance & Identity Concepts — 10–15%

Review foundational concepts such as:

• Shared responsibility

• Zero Trust

• Defense in Depth

• CIA Triad

• Authentication

• Authorization

• Encryption

• Identity

• Governance

• Risk

• Compliance

2.0 Capabilities of Microsoft Entra — 25–30%

Study:

• Microsoft Entra ID

• Identity types

• MFA

• Passwordless authentication

• Conditional Access

• Identity Protection

• Privileged Identity Management

• Access Reviews

• Entitlement Management

• External ID

• Identity governance

3.0 Capabilities of Microsoft Security Solutions — 35–40%

Review:

• Microsoft Defender XDR

• Defender for Endpoint

• Defender for Office 365

• Defender for Identity

• Defender for Cloud Apps

• Defender for Cloud

• Microsoft Sentinel

• Security Copilot

• Azure network security

4.0 Capabilities of Microsoft Compliance Solutions — 20–25%

Learn:

• Microsoft Purview

• Compliance Manager

• Sensitivity labels

• Retention

• DLP

• Insider Risk

• Communication Compliance

• eDiscovery

• Audit

• Records Management

• Microsoft Priva

The included practice questions are distributed using the midpoint of Microsoft's published domain ranges.

100 Microsoft SC-900 Practice Questions

Don't just memorize Microsoft product names.

Practice selecting the right product for the requirement.

The guide contains 100 original SC-900 practice questions distributed across all four domains:

• 13 Security, Compliance & Identity Concepts questions

• 27 Microsoft Entra questions

• 38 Microsoft Security Solutions questions

• 22 Microsoft Compliance Solutions questions

The practice exam follows the same general weighting used throughout the study guide.

Detailed Answer Explanations

This study guide isn't simply a 100-question test followed by an answer key.

The explanations are intended to teach the distinction between the correct Microsoft product and the plausible distractors.

That matters because SC-900 frequently presents several familiar products and asks which one satisfies a particular requirement.

Examples:

Entra ID Protection or Defender for Identity?

Microsoft Sentinel or Defender XDR?

Secure Score or Compliance Score?

Sensitivity Label or Retention Label?

Azure Firewall or Network Security Group?

Defender for Endpoint or Defender for Cloud?

Understanding these differences is much more valuable than memorizing letters from a practice test.

Microsoft Entra Exam Prep

Microsoft Entra accounts for approximately 25–30% of the exam weighting described in the guide.

Review the Microsoft identity ecosystem, including:

• Microsoft Entra ID

• Entra Domain Services

• Entra Connect / Cloud Sync

• Internal users

• External users

• Workload identities

• Service principals

• Managed identities

• Groups

• Devices

• External ID

• B2B

• B2C

The guide particularly emphasizes managed identities as a way for applications to authenticate to Azure services without storing credentials in application code.

Authentication, MFA & Passwordless

Learn important authentication concepts involving:

Multifactor Authentication

True MFA requires factors from different categories.

A password plus another knowledge-based security question isn't the same as using genuinely different authentication factors.

Passwordless Authentication

Review methods such as:

• Windows Hello for Business

• FIDO2 security keys

• Microsoft Authenticator

Self-Service Password Reset

Allows users to reset passwords without requiring normal help-desk intervention.

Password Protection

Blocks weak, banned, and organization-specific prohibited passwords.

Conditional Access

Signals → Decision → Enforcement

Conditional Access is a major identity-security concept.

It can use signals such as:

• User

• Location

• Device

• Application

• Risk

to make an access decision and apply enforcement at sign-in.

Rather than applying the exact same requirement to every login, Conditional Access can adapt authentication and access requirements based on circumstances and risk.

The guide characterizes it as an important Zero Trust policy engine.

Entra ID Protection vs. Defender for Identity

One of the Most Important SC-900 Distinctions

These two products both involve identity security—but they monitor different environments.

Microsoft Entra ID Protection

Think:

Cloud Identity Risk

Detects indicators such as:

• Risky users

• Risky sign-ins

• Impossible travel

• Anonymous IP activity

• Leaked credentials

Microsoft Defender for Identity

Think:

On-Premises Active Directory

Uses signals from traditional Active Directory environments to identify threats such as:

• Lateral movement

• Compromised identities

• Pass-the-hash activity

The guide explicitly identifies this as a distinction candidates commonly get wrong.

Privileged Identity Management

Microsoft Entra Privileged Identity Management helps reduce standing administrative privilege.

Review concepts such as:

• Just-in-time access

• Time-limited role activation

• Approval requirements

• Auditing

• Privileged roles

The underlying idea:

Don't give someone permanent administrative access when they only need it occasionally.

Access Reviews & Entitlement Management

Access Reviews

Periodically verify that users still require the permissions they currently hold.

Think:

Does this person still need this access?

Entitlement Management

Package resources into access packages that can be:

• Requested

• Approved

• Provisioned

• Expired

This can be particularly useful when governing external partners at scale.

Entra Roles vs. Azure RBAC

Another exam distinction worth memorizing:

Microsoft Entra Roles

Control access to:

Entra ID and directory objects

Azure RBAC

Controls access to:

Azure resources

These are separate authorization systems.

Being a Global Administrator in Entra doesn't automatically mean someone has unlimited access to every Azure subscription and resource.

Microsoft Security Solutions — The Biggest Domain

Security Solutions accounts for 35–40% of the exam weighting in the guide.

This is where product recognition becomes especially important.

Rather than simply knowing cybersecurity terminology, candidates need to distinguish among multiple members of Microsoft's security ecosystem.

The Microsoft Defender Family

Know What Each Defender Protects

Microsoft Defender for Office 365

Think:

Email & Collaboration

Includes concepts such as:

• Safe Links

• Safe Attachments

• Anti-phishing

• Attack Simulation Training

Microsoft Defender for Endpoint

Think:

Devices

Includes:

• Endpoint Detection & Response

• Attack Surface Reduction

• Automated Investigation

• Vulnerability Management

Microsoft Defender for Identity

Think:

On-Premises Active Directory

Helps detect:

• Lateral movement

• Compromised identities

• Credential-related attacks

Microsoft Defender for Cloud Apps

Think:

SaaS Applications

Provides CASB-related functionality including:

• Shadow IT discovery

• Session control

Microsoft Defender XDR

Think:

Unified Detection & Response

Correlates signals from multiple Defender products into unified incidents.

Microsoft Defender for Cloud

Think:

Cloud Posture & Workloads

Works across:

• Azure

• AWS

• Google Cloud

and includes concepts such as Secure Score, regulatory compliance, and Defender plans.

The guide presents these together specifically because confusing one Defender product for another is a major exam risk.

Microsoft Sentinel Exam Prep

Microsoft Sentinel is Microsoft's cloud-native SIEM and SOAR platform.

Review components such as:

Data Connectors

Bring security data into Sentinel.

Analytics Rules

Turn security data into detections.

Incidents

Group related alerts into investigable cases.

Workbooks

Dashboards and visualizations.

Playbooks

Automated response using Logic Apps.

Hunting

Proactive security investigation before an alert occurs.

UEBA

Behavioral baselines that can identify suspicious activity involving otherwise valid credentials.

Microsoft Sentinel vs. Defender XDR

This is another valuable product-comparison point.

Microsoft Sentinel

Think:

SIEM + SOAR across the entire environment

It can ingest data from Microsoft, third-party, and custom sources.

Microsoft Defender XDR

Think:

Deep Microsoft-native extended detection and response

It correlates security signals from Microsoft's Defender ecosystem.

These services aren't necessarily competitors.

Organizations may use Defender XDR and Sentinel together, with Defender information feeding into Sentinel.

Microsoft Security Copilot

The guide also covers Microsoft Security Copilot.

Security Copilot applies generative AI to security activities such as:

• Incident summarization

• Investigation

• Security analysis

• Reporting

It can work across areas including:

• Defender

• Sentinel

• Entra

• Purview

This is another area where newer study material has an advantage over older SC-900 resources.

Azure Network & Platform Security

Review Azure security services such as:

Azure DDoS Protection

Helps protect availability against volumetric attacks.

Azure Firewall

Managed stateful network firewall with threat-intelligence capabilities.

Network Security Groups

Basic subnet/NIC traffic filtering.

Web Application Firewall

Protects against application-layer attacks such as:

• SQL injection

• Cross-site scripting

Azure Bastion

Provides RDP/SSH access without putting a public IP directly on the VM.

Azure Key Vault

Stores:

• Secrets

• Keys

• Certificates

These are commonly confused because all relate to security while solving very different problems.

Microsoft Purview Exam Prep

Compliance accounts for approximately 20–25% of the SC-900 weighting presented in the guide.

Microsoft Purview provides a large collection of data governance, compliance, risk, and information-protection capabilities.

Review:

• Compliance Manager

• Sensitivity Labels

• Retention

• DLP

• Sensitive Information Types

• Trainable Classifiers

• Content Explorer

• Activity Explorer

• Insider Risk Management

• Communication Compliance

• eDiscovery

• Audit

• Records Management

• Data Lifecycle Management

• Data Map

• Data Catalog

Sensitivity Labels vs. Retention Labels

Know the Difference

Sensitivity Labels

Think:

How should this information be protected?

They can apply controls such as:

• Classification

• Encryption

• Watermarks

• Access restrictions

and protection can travel with the content.

Retention Labels & Policies

Think:

How long should this information be kept?

They govern:

• Retention periods

• Lifecycle

• Actions at expiration

One concerns protection.

The other concerns retention.

Microsoft Purview Data Loss Prevention

DLP helps prevent sensitive information from leaving approved environments or being shared improperly.

The guide covers DLP across environments such as:

• Exchange

• SharePoint

• OneDrive

• Teams

• Endpoints

You will also review:

Sensitive Information Types

Pattern-based recognition for information such as:

• Credit card numbers

• Government identification numbers

Trainable Classifiers

Machine-learning-based recognition for content without a fixed pattern, such as:

• Résumés

• Source code

Insider Risk vs. Communication Compliance

Insider Risk Management

Think:

Risky activity by people inside the organization

Example:

A departing employee copying confidential company data.

Communication Compliance

Think:

Inappropriate or non-compliant communications

Example:

Messages that violate communication or regulatory policies.

Understanding which problem each tool solves is more valuable than memorizing the names.

Microsoft Purview eDiscovery

eDiscovery supports legal and investigative matters.

Capabilities can involve:

• Identifying relevant content

• Placing content under legal hold

• Reviewing material

• Exporting evidence

The guide also covers Audit for recording user and administrator activities and Records Management / Data Lifecycle Management for managing content through its full lifecycle.

Secure Score vs. Compliance Score

Don't Mix These Up

This is one of the guide's explicitly highlighted exam traps.

Microsoft Secure Score

Think:

Security Posture

Associated with the Defender environment.

Compliance Manager Compliance Score

Think:

Regulatory Progress

Associated with Microsoft Purview.

So:

“How strong is our security posture?” → Secure Score

“How are we progressing against a compliance framework?” → Compliance Score

Compliance Manager vs. Service Trust Portal

Another useful distinction:

Compliance Manager

Assesses your organization's environment against compliance requirements and provides improvement actions.

Service Trust Portal

Provides Microsoft's own audit reports and certifications.

A good memory hook from the guide:

Compliance Manager evaluates you.

Service Trust Portal gives you Microsoft's paperwork.

Microsoft Priva

The guide also includes Microsoft Priva for privacy-related topics.

Priva supports areas such as:

• Privacy risk management

• Data subject requests

• Privacy-related regulatory obligations

The guide connects this with Microsoft's privacy principles concerning customer ownership and control of data.

Three-Week SC-900 Study Plan

The guide provides a structured three-week study schedule.

Week 1 — Fundamentals + Microsoft Entra

Review:

• Zero Trust

• Shared responsibility

• Identity

• Authentication

• Entra ID

• Conditional Access

• Identity governance

Week 2 — Microsoft Security Solutions

Study:

• Defender XDR

• Defender products

• Defender for Cloud

• Microsoft Sentinel

• Azure network security

Week 3 — Microsoft Compliance

Review:

• Microsoft Purview

• Compliance Manager

• Labels

• DLP

• Insider Risk

• eDiscovery

Then complete the full practice exam.

The guide suggests aiming for 85%+ overall with no domain below 80% on its practice set before scheduling.

Who Is This SC-900 Study Guide For?

This guide may be useful for:

• Cybersecurity beginners

• IT beginners

• Cloud security students

• Microsoft 365 administrators

• Azure beginners

• Help desk professionals

• IT support professionals

• Compliance professionals

• Governance professionals

• Privacy professionals

• Business analysts

• Technology project managers

• Career changers

• Professionals pursuing Microsoft security certifications

• Anyone preparing for SC-900

The guide lists no formal prerequisite and identifies SC-900 as a foundational certification that can lead into role-based Microsoft credentials.

A Starting Point for Microsoft Security Certifications

SC-900 can serve as an entry point into Microsoft's broader security, identity, and compliance certification ecosystem.

The guide identifies potential progression into credentials such as:

SC-200 — Security Operations Analyst

SC-300 — Identity & Access Administrator

SC-401 and other role-based certifications

That makes SC-900 useful both as a standalone fundamentals credential and as a foundation for more specialized study.

Get the Microsoft SC-900 Study Guide

Security, Compliance & Identity Fundamentals Exam Prep PDF

Only $16.97

Your instant digital download includes:

✓ Complete SC-900 domain review
✓ All four exam domains
✓ 100 original practice questions
✓ Detailed answer explanations
✓ Current Microsoft terminology
✓ Complete retired-name → current-name map
✓ Microsoft Entra ID
✓ MFA & passwordless authentication
✓ Conditional Access
✓ Identity Protection
✓ Privileged Identity Management
✓ Access Reviews
✓ Defender product comparison tables
✓ Microsoft Defender XDR
✓ Defender for Cloud
✓ Microsoft Sentinel
✓ Microsoft Security Copilot
✓ Azure security services
✓ Microsoft Purview
✓ Compliance Manager
✓ Sensitivity & retention labels
✓ DLP
✓ Insider Risk
✓ eDiscovery
✓ Secure Score vs. Compliance Score
✓ Product-selection sheets
✓ Three-week study plan
✓ Test-day checklist

$16.97 — One-Time Purchase

Instant PDF Download

Stop Losing Points to Similar Microsoft Product Names

SC-900 isn't just a general cybersecurity exam.

A large portion of it is knowing which Microsoft product solves which problem.

Risky cloud sign-in? → Entra ID Protection

On-premises Active Directory attack? → Defender for Identity

Endpoint security? → Defender for Endpoint

Email phishing? → Defender for Office 365

Shadow IT? → Defender for Cloud Apps

Security data from across your environment? → Sentinel

Sensitive content leaving the organization? → Purview DLP

Regulatory progress? → Compliance Manager

That's why this guide's rename map and product-confusion tables are among its strongest selling points.

Digital Product Information

Product: Microsoft Security, Compliance & Identity Fundamentals Study Guide
Exam: SC-900
Format: Digital PDF
Length: 43 pages
Practice Questions: 100
Answer Explanations: Included
Product Selection Sheets: Included
Current Product Rename Map: Included
Price: $16.97
Delivery: Instant Digital Download
Publisher: Noble Exam Prep

This is a digital product. No physical book will be shipped.

Frequently Asked Questions

Which Microsoft exam does this guide cover?

This guide covers Microsoft Security, Compliance, and Identity Fundamentals — SC-900 and uses the current four-domain structure presented in the uploaded study material.

Does it include practice questions?

Yes. The guide includes 100 original practice questions, divided across all four SC-900 domains, with detailed explanations.

Does it use current Microsoft product names?

Yes. This is a major feature of the guide. It uses terminology such as Microsoft Entra ID, Defender XDR, Defender for Cloud Apps, Sentinel, and Microsoft Purview, while also providing a map of their former names.

Do I need previous cybersecurity experience?

The guide lists no prerequisite, making it suitable as a foundational Microsoft security-certification resource.

Does it cover Microsoft Entra?

Yes. Entra represents approximately 25–30% of the exam weighting presented in the guide and includes identity, authentication, Conditional Access, Identity Protection, PIM, governance, and related topics.

Does it cover Microsoft Defender?

Yes. The guide includes Microsoft Defender XDR, Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, and Defender for Cloud.

Does it cover Microsoft Purview?

Yes. Compliance topics include Compliance Manager, labels, DLP, eDiscovery, Insider Risk, Audit, Data Lifecycle Management, and other Purview capabilities.

Does SC-900 expire?

The uploaded guide states that Microsoft Fundamentals credentials do not expire.

Is this a physical book?

No. This is an instant-download digital PDF.

What is the price?

The complete SC-900 study guide is $16.97 as a one-time purchase.

Is this an official Microsoft product?

No. It is independently developed by Noble Exam Prep and is not affiliated with, authorized by, endorsed by, or sponsored by Microsoft.

Important Disclaimer

This study guide is independently developed by Noble Exam Prep for supplemental educational and exam-preparation purposes.

ExamPrepStudyGuides.com and Noble Exam Prep are not affiliated with, authorized by, endorsed by, or sponsored by Microsoft Corporation. Microsoft, Azure, Entra, Defender, Purview, Sentinel, and related product names are trademarks of the Microsoft group of companies.

This product does not contain or claim to contain confidential, recalled, leaked, or proprietary Microsoft examination questions. Practice questions are independently created educational materials.

Use of this study guide does not guarantee a passing examination score, Microsoft certification, employment, promotion, salary, or any other professional outcome.

Microsoft can revise the SC-900 skills outline and product terminology without changing the SC-900 exam code. Candidates should therefore verify the current official SC-900 skills outline and change log before scheduling their examination.