Documentation review: 23 October 2026 · Current objectives: 21 October 2026 · ES / EN
Understand what each service protects
SC-900 introduces security, compliance and identity fundamentals across the Microsoft ecosystem. It targets students, IT professionals and business users familiar with Azure and Microsoft 365. The goal is to understand responsibilities and choose capabilities for a scenario before memorizing product names.
The 21 October 2026 update is now effective. The reviewed English and Spanish guides show that scope. Minor changes concern identity types and Defender XDR protection; the four domains and their weights remain unchanged.
Microsoft updates the English exam first. Exam versions in other languages may be updated later; check the official information when booking.
The four domains and practice bank
Security, compliance and identity concepts
10–15 %Shared responsibility, defense in depth, Zero Trust, encryption and hashing, GRC, authentication, authorization, directories and federation.
25 questions in the bankMicrosoft Entra
25–30 %Identity types, workloads and hybrid identity. Authentication methods, MFA, passwords, Conditional Access, roles, governance, reviews, PIM and Identity Protection.
55 questions in the bankMicrosoft security solutions
35–40 %Azure infrastructure protection, Defender for Cloud, CSPM and workload protection. Sentinel, SIEM and SOAR. Defender XDR and its protection and intelligence capabilities.
75 questions in the bankMicrosoft compliance solutions
20–25 %Service Trust Portal and privacy. Purview, Compliance Manager, classification, labels, DLP, retention and records. Insider risk, eDiscovery and audit.
45 questions in the bankComparisons for solving scenarios
Start with the resource to protect, the available signal and the required action. Two products can integrate without performing the same function. Notice whether the case asks you to prevent, detect, investigate, grant access or preserve evidence.
| Requirement | Capability to evaluate | Key distinction |
|---|---|---|
| Decide access using user, device and context | Microsoft Entra Conditional Access | Evaluates signals to apply access controls; MFA is one possible control. |
| Activate a privileged role for an approved period | Microsoft Entra PIM | Reduces standing privileges through activation and elevation conditions. |
| Periodically review whether someone still needs access | Access reviews | Reevaluate existing assignments; they differ from on-demand role activation. |
| Assess user and sign-in risks | Microsoft Entra ID Protection | Helps detect and address identity risks; distinguish detection, policy and investigation. |
| Investigate correlated endpoint, email and identity threats | Microsoft Defender XDR | Correlates signals and supports investigation and response across protection products. |
| Analyze events from different sources and automate responses | Microsoft Sentinel | Combines SIEM and SOAR capabilities and can integrate with Defender; the functions complement each other. |
| Review cloud resource posture and protect workloads | Microsoft Defender for Cloud | Distinguish CSPM recommendations from workload protection during execution. |
| Protect web requests against application attacks | Azure Web Application Firewall | Focuses on web application traffic; it differs from NSG rules and DDoS mitigation. |
| Store and control access to secrets, keys and certificates | Azure Key Vault | Centralizes those sensitive objects. Identities and their permissions are still required. |
| Classify a document and apply configured protection | Purview sensitivity labels | A label can have protection controls; not every label encrypts by definition. |
| Detect and restrict actions exposing sensitive data | Microsoft Purview DLP | Actions depend on configured rules and locations; policies can also notify or audit. |
| Retain or delete content according to its lifecycle | Purview retention and records management | Retention manages lifecycle; it does not replace sensitivity classification. |
| Organize compliance assessments and improvement actions | Microsoft Purview Compliance Manager | The score helps prioritize actions and does not by itself certify legal compliance. |
| Find and preserve content for an investigation | Microsoft Purview eDiscovery | Differs from Audit, which records activities, and Insider Risk Management, which helps investigate insider-risk signals. |
How to study with this material
- Work through the four Learn domains. Summarize each capability by what it protects, which signal it uses and which action it enables.
- Use short practice sessions and open the references in explanations. The bank combines single choice, multiple choice, yes/no and matching.
- Review distinctions behind mistakes, then complete a timed session. The simulator uses 45 minutes; the official exam question count can vary.
- Switch between ES and EN to learn the terminology. The selector preserves the practice session and both languages use the same answer keys.
Interpret the result: 70% is a learning target and is not equivalent to Microsoft’s scaled score of 700. Questions are original and independent; they are not official items and do not guarantee a pass.
Researched sources, forums and practice banks
The bank contains 200 bilingual questions with explanations and references to 72 distinct official pages. Research also covers 20 resources and discussions. Entries state actual access: a commercial listing, indexed excerpt or verified link is not equivalent to auditing a complete bank.
Microsoft Learn · SC-900Official
English and Spanish guides reviewed: objectives effective 21 October 2026 and four domains. This is the scope reference for the bank.
Microsoft Practice AssessmentOfficial
Free official self-assessment linked from the guide. The link was verified; its interactive bank was neither extracted nor audited.
ExamTopicsCommunity
Indexed excerpts and a Zero Trust discussion with official references were reviewed. Opening the bank returned 403. Posts have different dates; authenticity as actual exam content is not established.
ITExamsIndependent practice
The page advertises 252 questions and displays several as images. Its footer says it does not offer actual Microsoft questions. All 252 were not reviewed and the images were not imported.
CertsHeroIndependent practice
Public sample from an advertised 215-question bank. It retains names such as Azure AD and Microsoft 365 Compliance Center; check current terminology and portals. The bank was not imported.
TheExamsLabIndependent practice
The indexed catalog advertises 504 questions dated September 2026. The attempted question page was inaccessible; its answers are not claimed to have been reviewed.
WhizlabsIndependent practice
The indexed listing describes tests and labs but mixes older beta, duration and yearly-renewal information. Microsoft states that Fundamentals credentials do not expire. Direct opening returned only the title.
MeasureUpIndependent practice
Public listing: 124 questions, an advertised 08/2025 update and automated translations from English. The product was not purchased and its paid bank was not audited.
SkillCertProIndependent practice
The listing shows 410+ questions, 412 in the description and a 15-Oct-2026 update. Its commercial claim about real exams is unverified. Content was neither purchased nor copied.
Coding N ConceptsIndependent practice
Public article advertising 52 questions and noting the October 2026 update. It identifies its material as independent. Useful for identifying scenarios, while primary documentation remains authoritative.
CertUpIndependent practice
The indexed guide describes domains, formats and an example. Direct opening returned no content. Indicative exam-format figures are checked against Microsoft; a complete bank was not audited.
ExperTrainIndependent practice
Advertised 25-question original quiz with domain breakdowns and explanations. The page distinguishes practice percentages from the official scaled score. The interactive bank was not extracted.
Brains4CloudIndependent practice
Indexed article on the October 2026 scope and Entra, Defender, Sentinel and Purview comparisons. Its estimated question count is not presented as a fixed official figure.
Udemy · CertifyDeckIndependent practice
The indexed listing advertises three 40-question sessions with explanations and references. Paid content was neither accessible nor audited; marketing claims do not validate answers.
MicrosoftLearning · SC-900Repository
Official course repository reviewed as a training resource. Read its activity instructions and requirements; no Microsoft environments were executed during this review.
RickKotlarz · SC-900Repository
Public domain-based notes include historical terminology and descriptions, including older product and tier names. Useful for reviewing concepts when checked against current documentation.
Reddit · Material actualizadoCommunity
September 2026 discussion about course and video currency. It reflects community opinions; neither a course recommendation nor a testimonial proves current coverage.
Reddit · Experiencia de segundo intentoCommunity
Personal experience highlighting Purview and service distinctions. Used as a signal to explain comparisons better, without inferring pass probabilities or guaranteed exam topics.
Reddit · Experiencia de preparaciónCommunity
May 2025 account of Learn, videos and practice tests. Historical context: counts, perceived difficulty and names from that time are not adopted as facts about the current exam.
CertiAceIndependent practice
Indexed guide collecting documentation, videos and articles by objective, also mentioned by the community. No bank was extracted and every link in its collection was not checked.
Commercial banks were neither purchased nor imported. Wording and translations were reviewed against official documentation, distinguishing current names from historical references. This is a dated documentary review; Microsoft services were not executed and automatic future maintenance is not claimed.
Check the current official objectives · Official Microsoft Practice Assessment