SC-900: Lessons & Preparation Route
Short lessons, worked examples, and practice that connects.
Search lessons, illustrated explanations and study references within this exam.
Security models and data-protection goals
Choose security controls by ownership, protection goal and the failure they must withstand.
Identity proof, permissions, and federation
Separate identity proof, identity-provider relationships and application permissions.
Entra identity types and hybrid identity
Identify the subject represented by an identity, then distinguish hybrid lifecycle from alignment.
Authentication methods and multifactor evidence
Judge factor evidence from the actual configuration and select password recovery by its prerequisites.
Conditional Access and role scope
Separate conditions on a sign-in request from permission to act, and distinguish directory administration from Azure-resource role scope.
Identity governance and risk decisions
Match continued-access review, temporary privilege and identity-risk investigation to different decisions.
Infrastructure security by protection purpose
Choose infrastructure protection by traffic criteria, administrative connectivity or secret-management purpose.
Cloud posture and workload protection
Distinguish posture assessment, development security and running-workload protection.
Sentinel detection, investigation, and response
Trace security operations from source ingestion to analysis, investigation and response.
Defender XDR and protection scopes
Choose Defender protection by asset/signal scope and distinguish component evidence from joined incidents.
Provider trust evidence and privacy principles
Separate provider assurance, customer control evidence and high-level privacy principles.
Purview Compliance Manager and score limits
Manage improvement work while keeping compliance scores separate from customer-control validation.
Classification, protection, and retention
Separate classification/protection, sharing controls and information lifecycle settings.
Insider risk, eDiscovery, and audit purposes
Match investigation tools to activity history, responsive content or potential insider-risk signals.
64 original formal tasks; related-concept reinforcement is included and is not 64 independent competencies.