This is the free Microsoft SC-900 practice question bank —
120 of 235 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-10-04.
Every answer is verified against official Microsoft documentation —
see our methodology.
Question 1
HOTSPOT
-
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
No
Yes
Explanation: Azure DDoS Protection mitigates volumetric, protocol, and resource-layer DDoS attacks, not man-in-the-middle attacks. DDoS Network Protection is not enabled by default (only Basic protection is included). It does protect against protocol attacks.
Question 1
HOTSPOT
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
Yes
No
Explanation: Microsoft 365 groups accept users as members, not managed identities or devices. Security groups can include service principals.
Question 2
What is a feature of Microsoft Defender for Cloud Apps?
A. cloud workload protection platform (CWPP)
B. automated investigation and response (AIR)
C. SaaS security posture management (SSPM)
D. cloud security posture management (CSPM)
Show Answer
Correct Answer: C
Explanation: Microsoft Defender for Cloud Apps is a CASB solution that includes SaaS security posture management (SSPM) capabilities for assessing and improving the security configuration of SaaS applications. CWPP and CSPM are core capabilities of Microsoft Defender for Cloud, while AIR is primarily associated with other Microsoft Defender products such as Defender for Endpoint and Defender for Office 365.
Question 2
You need to create a workflow that runs automatically when a user account is provisioned or its properties are updated.
Which Microsoft Entra feature should you use?
A. entitlement management
B. Conditional Access policies
C. lifecycle workflows
D. access reviews
Show Answer
Correct Answer: C
Explanation: Microsoft Entra lifecycle workflows can automatically run workflows in response to user lifecycle events, including account provisioning and changes to user properties.
Question 3
You company is evaluating various security products, including a security information and event management (SIEM) solution.
You need to provide information about the functionality of SIEM solutions.
What is a function of a SIEM solution?
A. the ability to review network activity and provide reports about which applications and services can communicate
B. an alerting system that triggers an alert when users reach their Azure spending limit
C. the ability to review logs and provide reports about malicious activity
D. automated incident remediation
Show Answer
Correct Answer: C
Explanation: A SIEM (Security Information and Event Management) collects, correlates, and analyzes security logs from multiple sources to detect suspicious or malicious activity and generate alerts and reports. Reviewing logs and reporting on malicious activity is a core SIEM capability. Network communication policy reporting is not its primary function, cost alerts are unrelated to SIEM, and automated incident remediation is primarily a SOAR capability, though some platforms integrate both.
Question 3
HOTSPOT
Select the answer that correctly completes the sentence.
Show Answer
Correct Answer: detective
Explanation: System access and regulatory compliance audits review activity and identify issues, so they are detective actions.
Question 4
You are reviewing rules in an Azure network security group (NSG).
You need to identify which NSG rules are default rules, and which are custom rules.
Which property should you use?
A. Source
B. Protocol
C. Priority
D. Port
Show Answer
Correct Answer: C
Explanation: Use the priority property. Default NSG rules have priorities 65000, 65001, and 65500; custom rules use priorities from 100 to 4096.
Question 5
HOTSPOT
-
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
No
Yes
Explanation: Federated trust is configured through Microsoft Entra ID, not the Service Trust Portal. Vulnerability disclosures are handled through Microsoft security channels. The Service Trust Portal provides cloud compliance documentation and audit reports.
Question 5
What is the role of Microsoft Purview insider risk management in maintaining the compliance status of a company?
A. to detect and prevent communication policy breaches
B. to audit and assess the company's resources to ensure ongoing compliance with data regulations and standards
C. to detect potentially harmful user activities and assign risk scores to the activities
D. to find, preserve, and export content from various locations in response to legal, regulatory, and corporate requests for data
Show Answer
Correct Answer: C
Explanation: Microsoft Purview Insider Risk Management identifies potentially risky user activities using signals across Microsoft 365 and assigns risk scores to help investigators prioritize and respond to insider risks. The other options describe different Microsoft Purview capabilities: communication compliance (A), compliance/audit and assessment (B), and eDiscovery (D).
Question 6
HOTSPOT
-
Select the answer that correctly completes the sentence.
Show Answer
Correct Answer: Jupyter notebooks
Explanation: Microsoft Sentinel integrates Jupyter notebooks for advanced hunting, analytics, and Python-based machine learning. Data connectors ingest data, playbooks automate responses, and workbooks provide visualization.
$19
Get all 235 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
