Not sure which Security exam to take? This table compares level, study time, and exam format, with free practice for each on MS Exam Lab.
Other tracks: Azure · Data & AI · Dynamics 365 · GitHub · Modern Work · Office · Power Platform · Security · Windows
Security certs map to the defender's side of the house: SC-900 for concepts, SC-300 for identity and access, SC-200 for threat hunting with Sentinel, and AZ-500 for securing Azure workloads themselves. With compliance pressure rising across every industry, these certs hold their value well and pair naturally with an Azure or M365 foundation.
| Certification | Level | Study time | Exam format | Practice |
|---|---|---|---|---|
| SC-900: Security, Compliance, and Identity Fundamentals | Fundamentals | 1–2 weeks | ~45 questions, 45 min | Practice free |
| SC-500: Cloud and AI Security Engineer Associate | Associate | 4–6 weeks | ~50 questions, 120 min | Practice free |
Most people start with SC-900 (Security, Compliance, and Identity Fundamentals), a Fundamentals-level cert that builds the base before the more role-specific Security exams.
SC-900 is Fundamentals-level and proves broad, conceptual knowledge. SC-500 is Associate-level and proves you can perform real tasks with the product. SC-900 is a common (not required) on-ramp to SC-500.
No. Microsoft doesn't require SC-900 before SC-500. But if you're new to Security, starting with SC-900 makes SC-500 much easier.
Yes. MS Exam Lab offers free, unlimited practice for every Security certification, weighted to the official skills outline.