> ## Content Index > Fetch the complete content index at: https://adamjrg.com/llms.txt > Use this file to discover other available public pages before exploring further. # What I Learned About the SC-900 Exam - URL: https://adamjrg.com/blog/what-i-learned-about-the-sc-900-exam/ - Published: 2026-11-05T00:56:22.000Z - Updated: 2026-11-05T00:56:22.000Z - Description: I worked through the SC-900 using free videos and Microsoft's own study guide. Here's what the exam covers, which ideas clicked, and how I'd prepare if I were starting today. - Author: Adam - Tags: Certifications, Microsoft security, #claude-written The SC-900 is Microsoft's entry-level exam for security, compliance and identity. It turned out to be a lot more approachable than I expected. I started with Christopher Nett's Microsoft SC-900 Study Cram on YouTube, then compared it with two other free courses and Microsoft's official study guide. I am passing my exam this week, so fingers crossed! ## What the SC-900 is It's the exam for the Microsoft Certified: Security, Compliance, and Identity Fundamentals certification. It checks that you understand the core ideas and know what each Microsoft security product is for. It does not test whether you can configure those products. Microsoft aims it at business stakeholders, new or existing IT professionals, and students. Some familiarity with Azure and Microsoft 365 helps, but there are no formal prerequisites. - Level: beginner (Fundamentals) - Time: 45 minutes - Passing score: 700 on a 1 to 1,000 scale - Delivery: proctored, online or at a test centre via Pearson VUE. Students can book through Certiport. - Retakes: allowed 24 hours after a first fail - Price: set by country, around 70£ in the UK (approximate) Microsoft also offers a free practice assessment and an exam sandbox, so you can try the question formats before the real thing. ## What the exam covers There are four skill areas in the official study guide (updated 21 October 2026). Microsoft's security tools make up the biggest part. - Microsoft security solutions (35 to 40%): Azure network security, Defender for Cloud, Microsoft Sentinel, Defender XDR - Microsoft Entra (25 to 30%): Entra ID, MFA, Conditional Access, RBAC, PIM, ID Protection - Microsoft compliance solutions (20 to 25%): Purview, Compliance Manager, sensitivity labels, DLP, eDiscovery - Security, compliance and identity concepts (10 to 15%): Zero Trust, shared responsibility, encryption, authentication vs authorisation The concepts section carries the least weight, but everything else builds on it. That's why most courses, the video included, start there. ## The concepts that clicked One idea runs through the whole exam: identity, rather than the network, is now the main security perimeter. Since I work in identity and access management, I was glad to see that. ### Shared responsibility In the cloud, the provider and the customer split the security work. How much each side owns depends on the service model. You keep more with IaaS and less with SaaS. Whatever the model, you always own your data, your identities and your devices. ### Defence in depth You protect a system in layers, from physical security through identity, network, compute and applications, down to the data. If one layer fails, the next can still stop an attacker. ### Zero Trust Never trust a request just because it comes from inside the network. It rests on three principles: - Verify explicitly - Use least-privilege access - Assume breach ### Authentication vs authorisation Authentication proves who you are. Authorisation decides what you're allowed to do once you're in. Federation lets one identity provider vouch for you across organisations, so you don't need a separate account everywhere. ### Encryption vs hashing Encryption can be reversed with the right key. Hashing is one-way, which is why it's used to store passwords. ### SIEM vs SOAR I found this distinction useful. A SIEM collects and analyses security data to spot threats. A SOAR then automates the response, for example by running a playbook that disables a compromised account. Microsoft Sentinel covers both. ## How the concepts map to products - Microsoft Entra: identity, including sign-in, MFA, Conditional Access, Privileged Identity Management and access reviews - Azure infrastructure security: DDoS Protection, Azure Firewall, WAF, network security groups, Bastion, Key Vault - Microsoft Defender for Cloud: cloud security posture management and workload protection - Microsoft Sentinel: cloud SIEM and SOAR - Microsoft Defender XDR: threat protection across Office 365, endpoints, identities and cloud apps - Microsoft Purview: compliance, covering data classification, sensitivity labels, DLP, retention, insider risk, eDiscovery and audit ## What the videos taught me All three agree that SC-900 asks you to describe and choose products. None of them expects you to build anything. Each also added something the others didn't. - Christopher Nett (a Microsoft security architect): every objective in the study guide starts with "describe", so you need to understand concepts, not implement them. Shared responsibility will almost certainly come up. For defence in depth, know what each layer does rather than memorising the list. - John Savill (Study Cram V2): the questions come rapid fire and mostly ask which solution meets a given requirement. The exam covers Azure, Entra and Microsoft 365, not just Azure. Know symmetric vs asymmetric encryption, and the difference between data residency, sovereignty and privacy. - Computer Networks Decoded (Full Course 2026): true MFA combines different factor types. A password plus a PIN doesn't count, because both are "something you know". The Service Trust Portal is where you find Microsoft's ISO, SOC and GDPR audit reports. Both crams suggest the same routine: watch once while you study, then rewatch the night before the exam. ## How I'd prepare Everything you need is free. I'd go in this order: 1. Watch a full study cram, like Christopher Nett's, to see the whole syllabus at once. 2. Work through Microsoft's free self-paced SC-900 learning path on Microsoft Learn. 3. Keep the study guide open as a checklist and tick off each "Describe..." objective. 4. Take the free practice assessment until you score well, then review every question you got wrong. 5. Try the exam sandbox so the question formats don't surprise you on the day. For each product, aim to explain what problem it solves and when you'd pick it over the others. A common trap is confusing similar tools, such as Defender for Cloud vs Defender for Cloud Apps, or sensitivity labels vs retention labels. ## Final thoughts SC-900 is a good first certification for anyone curious about cybersecurity or cloud. It's short and cheap, and it teaches the vocabulary that more advanced Microsoft security exams take for granted. A study cram and the free Microsoft Learn path are enough to get started. ## Sources - [Microsoft SC-900 Study Cram, Christopher Nett (YouTube)](https://youtu.be/79HpgR%5FTYlM?ref=adamjrg.com) - [SC-900 Study Cram V2, John Savill's Technical Training (YouTube)](https://youtu.be/-FJqb60wPSY?ref=adamjrg.com) - [SC-900 Full Course 2026, Computer Networks Decoded (YouTube)](https://youtu.be/7saDD65YQPc?ref=adamjrg.com) - [Study guide for Exam SC-900, Microsoft Learn](https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/sc-900?ref=adamjrg.com) - [Microsoft Certified: Security, Compliance, and Identity Fundamentals, Microsoft Learn](https://learn.microsoft.com/en-us/credentials/certifications/security-compliance-and-identity-fundamentals/?ref=adamjrg.com)