Free Microsoft SC-900 practice questions

10 free Microsoft SC-900 practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 252 questions. Work through them, then open each answer to check your reasoning.

Get all 252 questions (US$39) · Download these 10 as a PDF

Question 1

Which score measures an organization's progress in completing actions that help reduce risks associated to data protection and regulatory standards?

  1. Microsoft Secure Score
  2. Productivity Score
  3. Secure score in Azure Security Center
  4. Compliance score
Show answer and explanation

Correct answer: D. Compliance score

Compliance Score specifically measures an organization's progress in completing actions that reduce risks associated with data protection and regulatory compliance standards. It tracks improvements in security posture relative to regulatory requirements like GDPR, HIPAA, and ISO standards. Microsoft Secure Score focuses on general security improvements, Productivity Score measures organizational efficiency, and Azure Security Center Secure Score addresses infrastructure-level security risks.

Why the other options are wrong

  • A. Microsoft Secure Score measures general security improvements across Microsoft 365 and Azure, not specifically compliance and regulatory standards.
  • B. Productivity Score measures organizational efficiency and user engagement, not compliance or risk reduction.
  • C. Azure Security Center Secure Score focuses on infrastructure and resource-level security recommendations, not regulatory compliance tracking.

Question 2

What do you use to provide real-time integration between Azure Sentinel and another security source?

  1. Azure AD Connect
  2. a Log Analytics workspace
  3. Azure Information Protection
  4. a connector
Show answer and explanation

Correct answer: D. a connector

Connectors are the mechanism used to provide real-time integration between Azure Sentinel and other security sources, data sources, and applications. Connectors enable continuous data ingestion and synchronization from external systems into Azure Sentinel for analysis and threat detection. Azure AD Connect is for directory synchronization, Log Analytics workspaces are storage repositories, and Azure Information Protection is a data governance tool.

Why the other options are wrong

  • A. Azure AD Connect is used for synchronizing on-premises directories with Azure AD, not for integrating security sources with Sentinel.
  • B. Log Analytics workspaces store and analyze data but are not the mechanism for rea-ime integration with external security sources.
  • C. Azure Information Protection is a data classification and protection tool, unrelated to Sentinel integration with security sources.

Question 3

Which Microsoft portal provides information about how Microsoft cloud services comply with regulatory standard, such as International Organization for Standardization (ISO)?

  1. the Microsoft Endpoint Manager admin center
  2. Azure Cost Management + Billing
  3. Microsoft Service Trust Portal
  4. the Azure Active Directory admin center
Show answer and explanation

Correct answer: C. Microsoft Service Trust Portal

The Microsoft Service Trust Portal is the dedicated resource that provides detailed information about how Microsoft cloud services comply with various regulatory standards including ISO, HIPAA, GDPR, SOC 2, and others. It contains compliance reports, audit findings, and trust documentation. Endpoint Manager is for device management, Cost Management is for billing analysis, and Azure AD admin center is for identity management.

Why the other options are wrong

  • A. Microsoft Endpoint Manager admin center is used for managing devices and applications, not for viewing regulatory compliance information.
  • B. Azure Cost Management + Billing is for tracking and optimizing cloud spending, not for compliance documentation.
  • D. The Azure Active Directory admin center manages user identities and access controls, not regulatory compliance information.

Question 4

In the shared responsibility model for an Azure deployment, what is Microsoft solely responsible for managing?

  1. the management of mobile devices
  2. the permissions for the user data stored in Azure
  3. the creation and management of user accounts
  4. the management of the physical hardware
Show answer and explanation

Correct answer: D. the management of the physical hardware

In the Azure shared responsibility model, Microsoft is solely responsible for managing the physical hardware, data centers, network infrastructure, and physical security. Customers are responsible for managing their own data, applications, user accounts, identities, and access permissions. Mobile device management, user permissions, and user account creation are customer responsibilities.

Why the other options are wrong

  • A. Mobile device management is a customer responsibility within the shared responsibility model.
  • B. Permissions for user data stored in Azure are managed by the customer, not Microsoft.
  • C. Creation and management of user accounts is the customer's responsibility in Azure deployments.

Question 5

In the Microsoft Cloud Adoption Framework for Azure, which two phases are addressed before the Ready phase? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.

  1. Plan
  2. Manage
  3. Adopt
  4. Govern
  5. Define Strategy
Show answer and explanation

Correct answer: A, E

A. Plan E. Define Strategy The Microsoft Cloud Adoption Framework for Azure follows a sequence where Define Strategy and Plan phases occur before the Ready phase. Define Strategy establishes the business case and cloud strategy, Plan creates a detailed implementation plan, and then Ready prepares the Azure environment. The Adopt and Govern phases come after Ready in the framework sequence.

Why the other options are wrong

  • B. Manage comes after Ready and Adopt phases, not before Ready.
  • C. Adopt (implementing and migrating workloads) comes after the Ready phase.
  • D. Govern comes after Adopt in the framework sequence, following the Ready phase.

Question 6

What is an example of encryption at rest?

  1. encrypting communications by using a site-to-site VPN
  2. encrypting a virtual machine disk
  3. accessing a website by using an encrypted HTTPS connection
  4. sending an encrypted email
Show answer and explanation

Correct answer: B. encrypting a virtual machine disk

Encryption at rest specifically refers to encrypting data when it is stored or dormant on physical media. Encrypting a virtual machine disk is a classic example of encryption at rest, protecting stored data from unauthorized access. Site-to-site VPN encryption protects data in transit, HTTPS encryption is for data in transit over networks, and encrypted email protects data in transit during transmission.

Why the other options are wrong

  • A. Site-to-site VPN encryption protects data in transit between networks, not at rest.
  • C. HTTPS encryption secures communications in transit, which is encryption in transit, not at rest.
  • D. Sending encrypted email protects data during transmission, which is encryption in transit, not at rest.

Question 7

Which three statements accurately describe the guiding principles of Zero Trust? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.

  1. Define the perimeter by physical locations.
  2. Use identity as the primary security boundary.
  3. Always verify the permissions of a user explicitly.
  4. Always assume that the user system can be breached.
  5. Use the network as the primary security boundary.
Show answer and explanation

Correct answer: B, C, D

B. Use identity as the primary security boundary. C. Always verify the permissions of a user explicitly. D. Always assume that the user system can be breached. Zero Trust security principles include using identity as the primary security boundary (replacing network perimeter), always explicitly verifying user permissions rather than assuming trust, and assuming that breaches can occur so continuous verification is necessary. These principles shift security from network-centric to identity-centric models. Defining perimeters by physical location and using the network as the primary boundary are traditional security approaches that Zero Trust specifically rejects.

Why the other options are wrong

  • A. Defining the perimeter by physical locations is a traditional approach that Zero Trust explicitly rejects in favor of identity-based boundaries.
  • E. Using the network as the primary security boundary is the legacy approach that Zero Trust replaces with identity as the primary boundary.

Question 8

What can you use to provide a user with a two-hour window to complete an administrative task in Azure?

  1. Azure Active Directory (Azure AD) Privileged Identity Management (PIM)
  2. Azure Multi-Factor Authentication (MFA)
  3. Azure Active Directory (Azure AD) Identity Protection
  4. conditional access policies
Show answer and explanation

Correct answer: A. Azure Active Directory (Azure AD) Privileged Identity Management (PIM)

Management (PIM) Azure AD Privileged Identity Management (PIM) enables time-bound access elevation for administrative tasks, allowing organizations to grant users elevated permissions for a specific duration (such as a two-hour window). PIM is specifically designed for just-in-time privileged access. MFA is for authentication verification, Identity Protection is for anomalous sign-in detection, and conditional access enforces access policies but does not specifically provide time-limited administrative access windows.

Why the other options are wrong

  • B. Azure Multi-Factor Authentication verifies user identity through multiple factors but does not provide time-limited access windows for administrative tasks.
  • C. Azure AD Identity Protection detects anomalous and risky sign-in patterns but does not provide time-limited administrative access.
  • D. Conditional access policies enforce access rules and conditions but are not specifically designed for time-limited administrative task windows like PIM provides.

Question 9

In a hybrid identity model, what can you use to sync identities between Active Directory Domain Services (AD DS) and Azure Active Directory (Azure AD)?

  1. Active Directory Federation Services (AD FS)
  2. Microsoft Sentinel
  3. Azure AD Connect
  4. Azure AD Privileged Identity Management (PIM)
Show answer and explanation

Correct answer: C. Azure AD Connect

Azure AD Connect is the Microsoft tool designed specifically to synchronize identities between on-premises Active Directory Domain Services and Azure Active Directory. It enables hybrid identity management by ensuring consistent user accounts, groups, and contacts across both environments.

Why the other options are wrong

  • A. AD FS is used for federation and single sign-on, not for identity synchronization between AD DS and Azure AD.
  • B. Microsoft Sentinel is a security information and event management (SIEM) solution, not an identity synchronization tool.
  • D. Azure AD PIM is for privileged identity management and access control, not for syncing identities between directories.

Question 10

What is the purpose of Azure Active Directory (Azure AD) Password Protection?

  1. to control how often users must change their passwords
  2. to identify devices to which users can sign in without using multi-factor authentication (MFA)
  3. to encrypt a password by using globally recognized encryption standards
  4. to prevent users from using specific words in their passwords
Show answer and explanation

Correct answer: D. to prevent users from using specific words in their passwords

Azure AD Password Protection prevents users from using weak passwords by maintaining a global banned password list and custom banned password lists specific to organizations. It blocks passwords containing common words, variations of the organization name, and other easily guessable terms.

Why the other options are wrong

  • A. Password expiration policies are controlled through separate password policy settings, not Password Protection specifically.
  • B. Device access without MFA is controlled through conditional access policies, not Password Protection.
  • C. Encryption of passwords is a security transport mechanism, not the purpose of Password Protection which focuses on preventing weak password choices.

That was 10 of 252.

The full Microsoft SC-900 pack has all 252 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.

Get the full pack