SC-900 Explored: My Honest Practice Numbers
Most cert-prep posts show you the victory lap. This one shows you the messy middle — because that's where I actually am, and pretending otherwise would betray the whole reason I write this stuff down.
62%
25 / 40 · full-length practice exam · September 3 · 22 min
That's the real number. It's not a passing-confidence number. SC-900's pass line is 700/1000, and 62% on a solid practice set is close enough to be encouraging and far enough to be honest work still ahead. So let me tell you exactly where I am, what the last week actually looked like (spoiler: not my best), and how I'm closing the gap in the nine days I've got left.
The part I'm not going to dress up
I stalled.
Not dramatically — life just happened. It's been a busy, distracted stretch, and my every-other-day cadence slipped. The 62% from September 3 sat there for longer than I'd like to admit while other things ate my calendar. If you follow along for the tidy study-plan version of cert prep, this is the part those posts quietly delete: the week where the plan and reality don't match, and you have to decide whether to spin it or say it.
I'm saying it. I lost some momentum. The interesting part is what happened when I got back on the horse this week.
The drilling is landing
Here's what turned the week around. Instead of re-reading modules — I'd already finished all four learning paths and every assessment — I went straight at the misses. Targeted drills, not passive review.
It's working:
A mixed-review drill: 10 for 10. A clean sweep across topics, including a trap question that would've caught me a week ago. That's the difference between recognizing an answer and actually owning the distinction.
Domain 4 quiz: 80% on 12 questions. Solid, and on material that used to be shakier.
That's the thing about targeted drilling versus re-reading: re-reading feels productive and changes nothing. Drilling the exact things you get wrong is uncomfortable and moves the number. Two focused sessions did more for my recall than another pass through the coursework would have.
What I'm actually studying with
Since "what should I use?" is the question I'd have wanted answered, here's my honest SC-900 stack — no affiliate anything, just what I reached for:
Microsoft Learn — all four learning paths. The free, official coursework: concepts, Entra, security solutions, and Purview. This was my backbone. Fifteen modules, every assessment passed, and it's genuinely enough to cover the exam objectives on its own.
Scott Duffy's SC-900 course on Udemy (Microsoft Security Fundamentals Exam Prep). For a second voice on the same material — hearing the concepts explained a different way helped the distinctions stick, especially in the areas Microsoft Learn moves through quickly.
Scott Duffy's SC-900 practice tests on Udemy. This is where my 62% came from, and where most of my drilling happens now. Practice questions are the single highest-value thing this close to exam day — they surface the confusable pairs that reading never will.
If I had to rank them for someone starting cold: Microsoft Learn to build it, practice tests to prove it. The course in the middle is the bridge, not the foundation.
Where the misses still cluster
I ran the same play I ran on my cold June baseline: don't just read the score, read the shape.
The shape is consistent. My misses still cluster in the same place they did at the start:
Compliance — specifically Purview and Compliance Manager. That's my Domain 4 for this exam, the soft spot that shows up every time the questions get specific.
Which is good news, weirdly. A gap that stays put is a gap you can plan around. It's not scattered noise across every domain — it's one identifiable region, the same one, holding still while everything around it firms up. That's a targetable problem, not a general-preparedness problem.
The trouble with Purview and Compliance Manager is the trouble with all of SC-900's compliance stack: it's a wall of branded tools that do adjacent-sounding things. Which tool owns retention? Which one scores your posture? Which one classifies data? The exam lives in those distinctions, and my last nine days go straight at them.
The plan for the final nine days
No new material. Everything from here is consolidation and recall under pressure:
Drill Compliance daily, not every-other-day. This is the one cluster that earns a break from my normal cadence — it's the gap, so it gets the reps.
Purview vs. Compliance Manager, side by side. Own which branded tool owns which exact verb — retention vs. posture vs. classification — until the confusable pairs stop being confusable.
Timed full-lengths to rebuild rhythm. The 62% was 22 minutes for 40 questions, so speed isn't my problem — consistency is. More full-lengths to turn a 62% into a comfortable, repeatable pass margin.
Protect the cadence this time. The stall taught me the real risk isn't the material — it's letting a busy week quietly eat the reps. Nine days, guarded.
How I'd explain this in a SOC interview
Ask me how I handle a metric that's trending the wrong way, and this is the story: I had an objective number I wasn't happy with, so I didn't rationalize it or bury it — I isolated where the failures clustered, confirmed the pattern was stable rather than random, and redirected my limited time straight at the highest-density problem area instead of spreading effort evenly across things that were already fine. That's triage under a deadline. In a SOC, you don't get infinite hours before the thing ships or the shift ends — you read where the signal concentrates, you commit your attention there, and you stop polishing the alerts that are already green. A 62% I'm honest about is more useful than a 90% I can't explain.
Nine days out. 62% and climbing. I'll show you the real number on the other side of September 20 — pass or lesson, it'll be the honest one.
Storm to SOC — read the map, then move. 💜
Comments