SC-900 Debrief: The Honest Version

Sep 21

5 min read

I didn't pass.

668 out of 700. Thirty-two points short of the line, on 42 of 45 questions. If you followed this journey — the 40% cold baseline, the stalled week, the climb to a practice-exam pass — you followed it all the way to this, too. No tidy fiction where the last chapter quietly rewrites itself into a win. This is the real ending, which means it's really a middle.

So here's the honest debrief: what the exam was actually like, where it slipped, and exactly what I'm doing about it.

How it compared to the CC

My first ISC2 CC attempt ended in an anomaly — a hard stop at 90 questions in a test center, then a formal inquiry to earn a retake. So I walked into SC-900 braced for the environment to be the enemy. It wasn't. And that's the first real win to name: the online-proctored experience went smoothly.

OnVUE — the at-home proctoring — did exactly what I prepped it to do. I'd installed the software early, run the system test on my real machine, tested the mic and camera, and done the recorded check-in dry run. So on exam day, the check-in, the ID scan, the room sweep, the whole recorded process was familiar, not frightening. After a test-center experience that went sideways, sitting an exam calmly from my own space was genuinely reassuring. That anxiety I wrote about the morning of? The setup work paid it down.

The environment wasn't what got me. The format was.

The thing I underestimated: the format

Here's what I'll tell anyone prepping SC-900, because I wish someone had said it to me this plainly: the content is only half the exam. The format is the other half.

This test leaned hard on true/false statements and drag-and-drop questions, and those two formats punish something multiple choice doesn't — almost knowing it.

On multiple choice, my strongest skill is elimination: rule out the wrong answers, reason toward the best one. It's how I passed the CC. But true/false takes that away — it's a statement and a coin flip, and the whole answer often hinges on one qualifier word (only, always, all, requires). And drag-and-drop is worse: it's all-or-nothing matching, no partial credit, no elimination. If you're 90% sure on three items and shaky on one, one wrong placement can sink the whole question.

My two known soft spots — Entra identity and the Microsoft security solutions stack — were exactly the confusable material those formats weaponize. When my official score report came back, it named the culprit even more precisely than I could: my weakest section by far was Microsoft security solutions — which happens to be the single heaviest-weighted part of the exam (35–40% of the score). Being weakest in the biggest domain is a big slice of those 32 points right there.

(One genuinely encouraging thing the report showed, worth naming: Compliance — my scary 40% gap back in June — had climbed to one of my strongest sections. The daily drilling worked. The gap I feared most wasn't the one that got me. That's a lesson in itself: your old weak spot and your current weak spot aren't the same thing, so you have to keep re-checking the map.)

I basically knew the tools. On multiple choice, "basically" might've squeaked through. On drag-and-drop, "basically" isn't a passing answer. You need to know exactly which tool owns which verb, cold, with no lifeline.

That's the 32 points. Not a domain I never learned — a margin the format exposed.

The timeline, honestly

The other honest piece is how I got here. People say SC-900 needs two weeks. Maybe it does — if you already work inside the Microsoft ecosystem. I don't. Coming from healthcare data analytics, Entra, Purview, and Sentinel were genuinely new vocabulary, not a review.

My runway was shorter than it looked. I passed the CC retake on August 15 — and then I relaxed, because I'd been holding tension since June. That exhale was human and probably necessary, but it meant SC-900 prep really started after it, on a compressed, back-loaded schedule. I climbed fast once I started (40% in June to an 82% practice pass), but "fast" from a late start left me right at the line instead of comfortably over it. That right-at-the-line on practice became just-under on the real thing.

That's the lesson I'm taking more than any tool distinction: for a from-scratch cert, believe your own timeline over the crowd's average.

The retake plan

I'm not spiraling. I'm 32 points and two named topics away, and I already know the method that closes exactly this kind of gap — on my practice exam I went from 64% to an 82% pass in a single day by reviewing every question, right and wrong, until I understood why each correct answer was correct. Now I point that at the two soft spots.

The plan, roughly two weeks out:

Week one — close the content gaps, aimed where the report points. My score report handed me a gift: Microsoft's own named Top 3 skills to prioritize, all sitting in that weakest Security-solutions domain — threat protection with Microsoft 365 Defender, basic security capabilities in Azure, and security capabilities of Microsoft Sentinel. That's the bullseye. I'll also tighten the identity distinctions that still trip me: user risk vs. sign-in risk, SSPR vs. Conditional Access vs. Password Protection.
Week two — drill the format, not just the facts. Practice the material as matching (cold, no elimination) and as true/false (hunting the qualifier word). Full-length practice exams to rebuild stamina across all three question types.
The gate: I don't rebook until I'm clearing the official Microsoft practice exam comfortably — not squeaking over. Last time "just over" on practice became "just under" on the real exam. The bar is a confident margin now.

This time the two weeks are clean — no draining first exam eating my focus, no first-timer environment unknowns, no mystery about the format. Everything that was an unknown on September 20 is now a named item on a list.

Why I'm telling you the real number

The tidy wins are everywhere, and the honest near-misses aren't — and the honest ones are more useful.

When I posted "668, didn't pass" last night, more people showed up than for most of my wins. Someone said it was brave to post the real result because it can help others. That's the whole reason this blog exists. If you're prepping for the SC-900 and you're scared of the drag-and-drop questions now — good. That fear is worth more than a stranger's clean pass screenshot. I just handed you the thing I didn't know going in.

A failed exam is a data point, not a verdict. I read the map, I found where it went wrong, and I move. That's the whole job — in a SOC and here.

How I'd explain this in a SOC interview

Ask me about a time I fell short of a goal and how I handled it, and this is the answer: I got an objective result I wasn't happy with, so I didn't rationalize it or hide it — I broke down exactly where it went wrong, separated the root cause (a format that punished margin-level knowledge in two specific areas) from the noise, and built a targeted plan against the actual gap instead of starting over. Then I documented it publicly, because owning a miss honestly builds more trust than hiding it. That's the same temperament I'd bring to a missed detection or a bad call on shift: no defensiveness, just root cause and correction. The result isn't the identity. What you do next is.

Retake's coming. Same map, sharper this time.

Storm to SOC — read the map, then move. 💜