MS-900 Cheat Sheet

#	Domain	Weight	Questions	Practice
1.0	Describe cloud concepts	8%	165	Practice →
3.0	Describe security, compliance, privacy, and trust in Microsoft 365	29%	279	Practice →
Total	37%	866

Domain

Weight

Questions

Practice

1.0

Describe cloud concepts

165

Practice →

3.0

Describe security, compliance, privacy, and trust in Microsoft 365

29%

279

Practice →

Total

37%

866

Domain Quick Reference

1.0Describe cloud concepts

Cloud concepts questions test the IaaS/PaaS/SaaS model, shared responsibility, cloud economic benefits and the public/private/hybrid deployment models.

Key concepts

✓IaaS, PaaS and SaaS responsibilities and real-world examples.
✓Public, private, hybrid and community cloud deployment models.
✓CapEx vs OpEx trade-offs and the economic case for cloud.
✓The shared responsibility model between Microsoft and the customer.

Watch out for

⚠IaaS gives you infrastructure control; SaaS gives you only the application.
⚠Hybrid cloud combines on-premises and public cloud — not two public clouds.
⚠The customer is always responsible for data and identity even in SaaS.
⚠CapEx is upfront spend; OpEx is ongoing spend — cloud shifts most costs to OpEx.

3.0Describe security, compliance, privacy, and trust in Microsoft 365

Map each risk to the right tool: Defender for threat protection, Purview for compliance and data governance, Entra for identity. Most critical: know shared responsibility and that Microsoft secures the cloud, you secure your data.

29%

Key concepts

✓Identify Microsoft Defender for Office 365 protections against phishing, malware, and zero-day threats.
✓Describe Microsoft Purview solutions for data classification, DLP, eDiscovery, and insider risk management.
✓Explain Microsoft Entra ID capabilities: conditional access, MFA, identity protection, and privileged identity management.
✓Recognize compliance offerings: Service Trust Portal, compliance manager, audit logs, and data residency options.

Watch out for

⚠Confusing Microsoft Defender for Office 365 with Defender for Endpoint, or assuming Defender for Identity is included in all plans.
⚠Mixing up Microsoft Purview compliance features like DLP and retention labels, or thinking they apply to all workloads by default.
⚠Believing Microsoft Entra ID Premium features like conditional access are available in free or basic Microsoft 365 plans.

Exam Day Reminders

→Read every question stem fully — look for qualifiers like 'MOST likely,' 'BEST,' or 'EXCEPT.'

→Flag uncertain questions and come back — don't waste time on one question.

→Eliminate obviously wrong options first, then choose between remaining ones.

→Trust your first instinct unless you have a specific reason to change.

→For MS-900, scenarios typically have one clearly best answer — look for the option that matches the specific constraints in the question.

#	Domain	Weight	Questions	Practice
1.0	Describe cloud concepts	8%	165	Practice →
3.0	Describe security, compliance, privacy, and trust in Microsoft 365	29%	279	Practice →
Total	37%	866

Domain

Weight

Questions

Practice

1.0

Describe cloud concepts

165

Practice →

3.0

Describe security, compliance, privacy, and trust in Microsoft 365

29%

279

Practice →

Total

37%

866

Domain Quick Reference

1.0Describe cloud concepts

Cloud concepts questions test the IaaS/PaaS/SaaS model, shared responsibility, cloud economic benefits and the public/private/hybrid deployment models.

Key concepts

✓IaaS, PaaS and SaaS responsibilities and real-world examples.
✓Public, private, hybrid and community cloud deployment models.
✓CapEx vs OpEx trade-offs and the economic case for cloud.
✓The shared responsibility model between Microsoft and the customer.

Watch out for

⚠IaaS gives you infrastructure control; SaaS gives you only the application.
⚠Hybrid cloud combines on-premises and public cloud — not two public clouds.
⚠The customer is always responsible for data and identity even in SaaS.
⚠CapEx is upfront spend; OpEx is ongoing spend — cloud shifts most costs to OpEx.

3.0Describe security, compliance, privacy, and trust in Microsoft 365

29%

Key concepts

✓Identify Microsoft Defender for Office 365 protections against phishing, malware, and zero-day threats.
✓Describe Microsoft Purview solutions for data classification, DLP, eDiscovery, and insider risk management.
✓Explain Microsoft Entra ID capabilities: conditional access, MFA, identity protection, and privileged identity management.
✓Recognize compliance offerings: Service Trust Portal, compliance manager, audit logs, and data residency options.

Watch out for

⚠Confusing Microsoft Defender for Office 365 with Defender for Endpoint, or assuming Defender for Identity is included in all plans.
⚠Mixing up Microsoft Purview compliance features like DLP and retention labels, or thinking they apply to all workloads by default.
⚠Believing Microsoft Entra ID Premium features like conditional access are available in free or basic Microsoft 365 plans.

Exam Day Reminders

→Read every question stem fully — look for qualifiers like 'MOST likely,' 'BEST,' or 'EXCEPT.'

→Flag uncertain questions and come back — don't waste time on one question.

→Eliminate obviously wrong options first, then choose between remaining ones.

→Trust your first instinct unless you have a specific reason to change.

→For MS-900, scenarios typically have one clearly best answer — look for the option that matches the specific constraints in the question.

MS-900 Exam Blueprint — At a Glance

Domain Quick Reference

1.0Describe cloud concepts

3.0Describe security, compliance, privacy, and trust in Microsoft 365

Exam Day Reminders

More MS-900 resources

MS-900 Cheat Sheet

MS-900 Exam Blueprint — At a Glance

Domain Quick Reference

1.0Describe cloud concepts

3.0Describe security, compliance, privacy, and trust in Microsoft 365

Exam Day Reminders

More MS-900 resources