You've done the four domains. This is the dress rehearsal — and then two things to take into the exam room with you: a glossary you can screenshot, and the strategy I actually used on the day.
New to the series? Start with Part 0 — how the exam works and how to build a free lab. Objectives updated July 28, 2026 — always confirm on the official study guide.
🎓 The mock exam: 30 questions, timed
The mock exam is on the interactive page, and it runs in real exam mode — which matters more than it sounds.
👉 Take the timed mock exam
- 30 questions, weighted like the real exam: 5 on concepts, 9 on Entra, 10 on security solutions, 6 on compliance. Domain 3 is the biggest for a reason.
- A 35-minute clock, which you start when you're ready.
- No feedback until you submit. You can change answers, but nothing turns green or red while you work. This is the part that makes it useful: per-question feedback teaches, and that's what the domain quizzes are for — a mock exam has to measure, and it can't measure you if it's helping you.
- On submit: your score, a breakdown by section so you can see exactly which domain is dragging you down, and a full review with the reasoning for every question.
Scoring guide: 27–30, book the exam. 24–26, review your weakest section and retake in two days. Below 24, go back to that domain and redo its labs — at that level the gap is conceptual, not memorization.
One rule, and it's on you: do it once, properly, before you look at anything else. A mock exam you take with the write-up open in another tab tells you nothing.
And when you're done with mine, take Microsoft's own free practice assessment. Mine tests the same concepts; theirs is written by the people who write the exam, so the phrasing is closer. Do both.
⚠️ On exam dumps. These 30 questions are original, written from the published objectives. They are not real exam questions and are not meant to resemble them. If you find a site promising "real SC-900 questions", close it: the Microsoft Certification Exam Candidate Agreement prohibits obtaining or distributing exam content by any means — including memorization — and the penalty is having your credentials revoked and being banned from the programme. You'd be risking the certification to learn less.
📖 One-page glossary
Screenshot this. If you can say one sentence about each name, you're ready.
Identity
| Term | One-liner |
|---|---|
| Microsoft Entra ID | Cloud identity and access management service |
| Entra External ID | Identities for customers and partners (formerly B2C) |
| Entra ID Protection | Detects risky users and sign-ins in the cloud (P2) |
| Conditional Access | If-this-then-that access policies (P1) |
| PIM | Just-in-time, approval-based privileged roles (P2) |
| Access reviews | Periodic attestation of who still needs access |
| Entitlement management | Access packages with approval and expiry |
| SSPR | Self-service password reset |
| Managed identity | An identity for a workload that Azure manages |
| Administrative unit | Scopes admin rights to part of the directory |
| Verified ID | Decentralized verifiable credentials |
| Permissions Management | CIEM across Azure, AWS and GCP |
Security
| Term | One-liner |
|---|---|
| Defender XDR | Correlates alerts across Defender products into incidents |
| Defender for Endpoint | Device protection and EDR |
| Defender for Office 365 | Email and collaboration protection |
| Defender for Identity | On-premises Active Directory protection |
| Defender for Cloud Apps | CASB for SaaS, shadow IT discovery |
| Defender for Cloud | Cloud posture (CSPM) and workload protection (CWPP) |
| Microsoft Sentinel | Cloud-native SIEM and SOAR |
| Secure Score | Prioritized posture measurement |
| NSG | Basic allow/deny network rules |
| Azure Firewall | Managed stateful firewall |
| WAF | Protects web apps from OWASP-style attacks |
| Azure Bastion | RDP/SSH without public IPs |
| DDoS Protection | Mitigates volumetric attacks |
| Key Vault | Stores keys, secrets and certificates |
Compliance
| Term | One-liner |
|---|---|
| Microsoft Purview | The compliance platform and portal |
| Sensitivity label | Protects content; travels with the file |
| Retention label/policy | Controls how long content is kept |
| DLP | Prevents risky sharing of sensitive information |
| Records management | Makes items immutable for their retention period |
| Insider Risk Management | Detects risky internal activity |
| Communication Compliance | Detects inappropriate messages |
| eDiscovery | Finds and preserves content for legal cases |
| Audit | Records what happened, and for how long it's kept |
| Compliance Manager | Assessments and compliance score |
| Service Trust Portal | Microsoft's own audit reports and certifications |
| Microsoft Priva | Privacy risk management |
🎯 Exam-day strategy
Before
- Take the official practice assessment linked from the study guide. It's free and its wording is the closest to the real thing.
- Re-read only your index cards on the last day. No new material.
- Check the "Skills measured as of" date one final time.
During
- Read the last line of the question first. It tells you what's actually being asked; the paragraph above is often scenario padding.
- Watch for the number of answers required. If it says "select two," an otherwise perfect single answer is wrong.
- Eliminate by surface. Most Defender questions resolve instantly once you ask "what is being protected here — a device, a mailbox, on-prem AD, or a SaaS app?"
- Licence keywords are decisive. If the scenario mentions risk-based policies or just-in-time roles, you're in P2 territory.
- Mark and move on. Nothing costs more points than spending four minutes on one question. Flag it, finish the exam, come back.
- Don't overthink the "best" answer. Fundamentals exams reward the textbook answer, not the clever one.
After
- You get your result on screen immediately.
- Add the badge to LinkedIn the same day, and write a short post about what you learned. That post gets more reach than the badge alone — and, if you did the labs in this series, you have screenshots to prove you practiced.
That's the series
- Part 0 — How the exam works + how to build a free lab in 2026
- Part 1 — Security, compliance and identity concepts
- Part 2 — Microsoft Entra capabilities
- Part 3 — Microsoft security solutions
- Part 4 — Microsoft Purview and compliance
- Part 5 — this one
And the thing that ties it together: the interactive quiz and labs — 48 questions with every option explained, 8 self-grading labs and this mock exam. Free, no sign-up, and the whole thing is open on GitHub if you want to fork it or fix something.
Why I wrote this
I passed the SC-900 and then went looking for what I'd have wanted while studying. What I found was mostly definitions copied out of the learning path, plus dump sites. So I wrote the series I was looking for, and I held it to three rules: explain why the wrong answers are wrong, link every claim to Microsoft Learn with the date it was verified, and build a lab for anything that can be clicked.
Come back and comment your score — I'd genuinely like to know which domain gave you the most trouble, because that's what tells me which post to improve. And if a future exam update makes something here wrong, tell me and I'll edit it. These posts are maintained, not abandoned.
Next for me: SC-300. Same treatment.
Good luck. 🚀
Top comments (0)