Microsoft SC-100 Practice Exam

Microsoft Cybersecurity Architect Expert SC-100

The Microsoft Cybersecurity Architect Expert SC-100 exam validates the skills to design security solutions that follow Zero Trust principles across identity, devices, data, AI, applications, network and infrastructure. It is weighted across four domains: security best practices and priorities at 20 to 25 percent, security operations, identity and compliance at 25 to 30 percent, infrastructure security at 25 to 30 percent, and application and data security at 20 to 25 percent. Questions test choosing and justifying the right control for a scenario. This practice exam mirrors that scope with scenario-based single-answer and multiple-answer questions and drag-and-drop matching, each with a worked explanation.

Question bank updated : questions, answers, explanations and chapters.

Certification Overview

  • Exam name: SC-100
  • Vendor: Microsoft
  • Exam code: SC-100
  • Duration: 100 minutes
  • Total questions: about 55
  • Official passing score: 700 on a scale of 1 to 1,000 (source)
  • Our practice exam pass mark: 70%

Who Should Take This Exam?

Cybersecurity Architect, Security Architect, Solution Architect, Security Engineer, Security Operations Analyst, Identity Architect, Cloud Security Engineer, Security Consultant

Prerequisites

To earn the Cybersecurity Architect Expert certification you must also hold Identity and Access Administrator Associate, Security Operations Analyst Associate, or Cloud and AI Security Engineer Associate. Microsoft expects expert skills in at least one security area.

Topics Covered

  • Design solutions that align with security best practices and priorities
  • Design security operations, identity, and compliance capabilities
  • Design security solutions for infrastructure
  • Design security solutions for applications and data

Question Types

  • Multiple Choice (Single Answer)
  • Multiple Choice (Multiple Answers)
  • Drag and Drop

SC-100 Practice Questions

Our question bank contains 770+ practice questions for this certification. Sample questions from each exam chapter. Expand a question to see the answer choices. With a subscription, you get unlimited practice exams with randomised questions from our full question bank.

Design solutions that align with security best practices and priorities

An attacker holding a subscription Owner role could delete every Azure Backup recovery point for a retailer's SQL Server VMs before triggering ransomware. The retailer wants recovery points to survive a compromised administrator without buying another backup product. What should the architect recommend?
  • A. Enable cross-region restore so a secondary copy of the recovery points exists in the paired region
  • B. Switch the vault to geo-redundant storage so deleted recovery points can be restored from the secondary region
  • C. Apply a CanNotDelete lock to the resource group that contains the Recovery Services vault
  • D. Protect the vault with multi-user authorization through a Resource Guard owned by the security team Correct answer

Option D is correct because a Resource Guard enforces multi-user authorization on the Recovery Services vault, so a compromised subscription Owner cannot delete recovery points without approval from the separate security team, and no extra product is needed. Cross-region restore and geo-redundant storage only add copies and do not stop deletion by a privileged attacker. A CanNotDelete lock on the resource group can be removed by an Owner.

Forensics has not yet found how attackers reached a manufacturer's network, and its domain controllers are suspected to be compromised. The ERP system must be running within 4 hours, and clean recovery points exist in an immutable vault. Which recovery approach best balances the deadline against the risk of reinfection?
  • A. Restore the ERP servers into an isolated network, rebuilding identity from a clean domain controller backup Correct answer
  • B. Restore the ERP servers over the encrypted VMs in the production network and reset all service account passwords afterwards
  • C. Scan the recovery points for malware first, then restore the ERP servers into the production network from a clean one
  • D. Fail the ERP servers over with Azure Site Recovery to the paired region using the latest replicated recovery point

Option A is correct because the domain controllers may be compromised, so identity must be rebuilt from a clean backup and the ERP servers brought up in an isolated network where reinfection can be contained, which still fits a 4-hour target. Restoring over the encrypted VMs in production or restoring into production after a scan keeps the attacker's possible foothold in play. Site Recovery to the paired region replicates the latest, possibly already compromised, state.

A hospital has 90 days to reduce ransomware impact. Its backups have never been restored in a test, domain admins sign in to ordinary workstations, and a few servers expose RDP to the internet. Following Microsoft's ransomware protection guidance, which workstream should start first?
  • A. Remove direct internet exposure of RDP by publishing management access through Azure Bastion
  • B. Back up critical systems to offline or immutable storage and rehearse a full restore Correct answer
  • C. Separate privileged accounts from daily-use workstations with privileged access workstations and tiered administration
  • D. Deploy Defender for Endpoint with attack surface reduction rules in block mode on all endpoints

Option B is correct because Microsoft's ransomware guidance starts with preparing a recovery plan: offline or immutable backups of critical systems and a tested restore, since that is what lets the hospital refuse to pay if attacked. Removing RDP exposure, privileged access workstations and endpoint hardening all reduce risk, but they come after recovery is assured, and untested backups are the largest gap here.

A legal team requires exported audit archives in an Azure storage account to stay unmodified and undeletable for seven years. Which feature should the architect recommend?
  • A. Soft delete for blobs and containers
  • B. Blob versioning with a lifecycle management policy that archives old versions
  • C. A CanNotDelete lock on the storage account
  • D. A time-based retention policy on immutable blob storage Correct answer

Option D is correct because a time-based retention policy on immutable blob storage (WORM) keeps blobs unmodified and undeletable for the set period, which can be seven years. Soft delete and versioning allow deletion or overwrite and only keep recoverable copies. A CanNotDelete lock protects the account resource, not the blobs inside it.

A logistics firm must be able to restore Azure VMs from backup into the paired region while its primary region is unavailable. Which TWO settings should the architect configure on the Recovery Services vault? (Choose two)
  • A. Soft delete with extended retention on the vault
  • B. Geo-redundant storage as the backup storage redundancy Correct answer
  • C. Zone-redundant storage as the backup storage redundancy
  • D. Cross Region Restore enabled on the vault Correct answer
  • E. Locked immutability on the vault

Options B and D are correct because restoring into the paired region needs the backup data to be replicated there (geo-redundant storage) and Cross Region Restore enabled on the vault so the secondary copy can be used while the primary region is down. Zone-redundant storage stays inside one region, soft delete and immutability protect against tampering rather than regional loss.

Design security operations, identity, and compliance capabilities

A global manufacturer enforces MFA for all administrators through Conditional Access with a third-party MFA provider. An outage at that provider locked every administrator out of the tenant for hours. Which design prevents a repeat lockout without weakening MFA for daily admin work?
  • A. Add a second MFA provider and require both for every admin sign-in
  • B. Exclude the Global Administrator role from the MFA policy during outages
  • C. Two cloud-only emergency accounts secured with FIDO2 keys and sign-in alerts Correct answer
  • D. Keep synced on-premises admin accounts as the fallback path

Option C is correct because Microsoft's guidance is to keep two cloud-only emergency access accounts protected with phishing-resistant FIDO2 keys, excluded from the normal Conditional Access dependency on the failed provider and monitored with sign-in alerts. A second provider required for every sign-in (A) adds another failure point, excluding the Global Administrator role (B) weakens MFA for daily work, and synced on-premises accounts (D) depend on infrastructure that may be unavailable.

Regulators require weekly Azure SQL Database backups to be kept for seven years, and the platform team wants the least administrative effort. Which feature should the architect recommend?
  • A. Point-in-time restore retention raised to seven years
  • B. Geo-replication to a second region
  • C. A long-term retention policy on the database Correct answer
  • D. A monthly runbook that exports a BACPAC to storage

Option C is correct because Azure SQL Database long-term retention (LTR) policies keep weekly, monthly or yearly full backups for up to ten years with no manual work. Point-in-time restore (A) is limited to 35 days, geo-replication (B) is for availability rather than archival, and a BACPAC runbook (D) is the high-effort manual approach.

Auditors require yearly VM recovery points kept for ten years at the lowest storage cost, and restore times of several hours are acceptable. Recent daily points still need fast restores. Which vault design should the architect recommend?
  • A. Instant restore snapshot retention extended for ten years
  • B. Vault-standard for daily points, archive tier for yearly points Correct answer
  • C. A yearly managed disk snapshot copied to cool blob storage
  • D. Vault-standard tier with geo-redundant storage for all points

Option B is correct because Azure Backup keeps recent points in the Vault-standard tier for fast restores and can move long-retained recovery points to the lower-cost Vault-archive tier, where rehydration takes hours. Instant restore snapshots (A) are kept only for a few days, snapshot copies (C) are a manual unmanaged design, and keeping everything in Vault-standard (D) costs more.

Regulators require audit records for the 300 finance users to be kept for five years across Exchange, SharePoint and Teams. Other users keep the default retention, and records must stay in Microsoft Purview rather than be exported. Which two actions should the architect include in the design? (Choose two.)
  • A. Set AuditLogAgeLimit on the finance mailboxes to five years
  • B. Publish a retention label policy to cover the unified audit log
  • C. Create an Audit (Standard) retention policy for the finance users with a five-year duration
  • D. Assign the 10-Year Audit Log Retention add-on license to the finance users Correct answer
  • E. Create an Audit (Premium) retention policy for the finance users with a five-year duration Correct answer

Options D and E are correct because retention beyond one year in the Microsoft Purview unified audit log requires Audit (Premium) retention policies together with the 10-Year Audit Log Retention add-on license for the users, and records stay in Purview. Option A only affects mailbox audit age limits, option B retention labels do not govern audit records, and option C is wrong because Standard audit keeps records only 180 days and cannot extend to five years.

A managed security provider will run Microsoft Sentinel for 20 customers. Each customer must keep its data in its own tenant and subscription, and provider analysts must work from one portal without switching directories or holding guest accounts. Which two design elements meet the requirements? (Choose two.)
  • A. Invite provider analysts as B2B guests in each customer tenant and assign Sentinel roles to them
  • B. Assign Global Reader in each customer Entra tenant to the provider analyst group
  • C. Triage incidents from the customer workspaces in one queue by using the multiple workspace view Correct answer
  • D. Forward customer logs through diagnostic settings to one provider-owned workspace
  • E. Onboard customer subscriptions to Azure Lighthouse with Sentinel Responder delegated to the provider group Correct answer

Options C and E are correct because Azure Lighthouse delegates customer subscriptions (with Sentinel Responder) to the provider's own tenant without guest accounts, and the multiple workspace view lets analysts triage incidents from all customer workspaces in one queue. Options A and B require guest or per-tenant accounts, and option D centralises data in one provider-owned workspace, breaking per-customer data separation.

Design security solutions for infrastructure

An e-commerce firm has three public IP addresses in one VNet and has been hit by volumetric attacks. The business wants access to the DDoS Rapid Response team during an attack and cost protection for resources that scale out. Which service level should be recommended?
  • A. DDoS IP Protection on each public IP
  • B. A WAF rate-limiting rule on the gateway
  • C. DDoS Network Protection on the VNet Correct answer
  • D. Azure Front Door Standard with default protection

Option C is correct because DDoS Network Protection is the tier that includes DDoS Rapid Response support and cost protection for scale-out resources, and it covers all public IPs in the VNet. DDoS IP Protection lacks both of those features, a WAF rate-limit rule only works at layer 7 on the gateway, and Front Door's default protection gives neither.

Contractors must administer 150 Azure VMs for two-hour windows. The VMs have no public IP addresses, contractors have no VPN, and their laptops must not need installed agents or clients. Which access design should the architect recommend?
  • A. Azure Bastion with Entra ID sign-in and browser-based sessions Correct answer
  • B. Azure Firewall DNAT rules that publish RDP and SSH
  • C. Just-in-time VM access with a public IP on each VM
  • D. A point-to-site VPN profile issued to each contractor

Option A is correct because Azure Bastion gives browser-based RDP/SSH over TLS to VMs with no public IP, no VPN and no client or agent, and it can use Entra ID sign-in. Firewall DNAT and public IPs expose management ports to the internet, and a point-to-site VPN needs a client on each laptop.

Engineering owners ignore Defender for Cloud recommendations because nobody is assigned to them. The security lead wants owners and due dates set automatically, with overdue reminders sent to managers. What should the architect recommend?
  • A. An Azure Policy initiative that denies noncompliant resources
  • B. A Sentinel automation rule that creates a ticket per recommendation
  • C. Governance rules in Defender for Cloud Correct answer
  • D. A weekly Secure Score report emailed to all owners

Option C is correct because governance rules in Defender for Cloud assign an owner and a remediation due date to recommendations automatically and send overdue notifications to the owner's manager. Policy deny only blocks resources, a Sentinel rule creates tickets without owner and due-date tracking, and an emailed report assigns nothing.

Auditors of a multinational will review how its posture assessment of Azure subscriptions and AWS accounts relates to external standards, and the CISO must pick one control framework for both clouds. Which TWO statements support adopting the Microsoft cloud security benchmark? (Choose two.)
  • A. Its guidance covers AWS and GCP resources as well as Azure resources Correct answer
  • B. Its controls are mapped to CIS Controls and to NIST SP 800-53 Correct answer
  • C. Its results are scored in Purview Compliance Manager, not Defender for Cloud
  • D. Passing its assessments earns the organization an ISO 27001 certificate
  • E. Its scope covers Azure and Microsoft 365 services

Options A and B are correct because the Microsoft cloud security benchmark is a multicloud framework: its guidance covers AWS and GCP as well as Azure, and its controls are mapped to CIS Controls and NIST SP 800-53, so one framework can serve both clouds and external reviewers. Option C is wrong because the benchmark is assessed in Defender for Cloud, not scored in Purview Compliance Manager. Option D is wrong because a benchmark does not grant an ISO 27001 certificate. Option E is wrong because the benchmark is not about Microsoft 365 services, so it is not a reason to adopt it for AWS.

A utility will onboard 800 Windows and Linux servers in five datacenters to Azure Arc with a deployment script that needs an Azure credential. Security wants that credential to hold the least privilege and live only as long as the rollout. Which TWO choices meet this? (Choose two.)
  • A. Run the script by hand on each server, signing in with a subscription Owner account that uses MFA
  • B. Use a service principal that holds only the Azure Connected Machine Onboarding role on the target resource group Correct answer
  • C. Reuse the CI/CD service principal that already has Contributor on the subscription
  • D. Give the service principal the Azure Connected Machine Resource Administrator role at subscription scope
  • E. Let the service principal secret expire soon after the rollout and delete the principal once it ends Correct answer

Options B and E are correct because a service principal limited to the Azure Connected Machine Onboarding role on the target resource group has only the rights the onboarding needs, and letting its secret expire and deleting it afterwards limits its lifetime to the rollout. Options C and D grant far more than onboarding needs, and option A uses an Owner account by hand on 800 servers, which is neither least privilege nor short-lived.

Design security solutions for applications and data

A government agency must hold its own encryption key for data in a Recovery Services vault and be able to revoke access to that data. Which approach should the architect recommend?
  • A. Azure Disk Encryption on the source VMs
  • B. Confidential VMs for the protected workloads
  • C. Infrastructure encryption on the vault storage
  • D. A customer-managed key on the vault, held in Key Vault Correct answer

Option D is correct because a customer-managed key held in the agency's own Key Vault encrypts the Recovery Services vault data, and revoking the vault's access to that key makes the backups unreadable. Azure Disk Encryption protects the source VM disks, not the vault. Confidential VMs protect data in use, and infrastructure encryption is a Microsoft-managed second layer, so neither gives the agency its own revocable key.

Developers keep source in GitHub and Azure DevOps. The CISO wants infrastructure-as-code and code vulnerabilities shown in Defender for Cloud beside the deployed resources they affect. What should the architect do?
  • A. Enable Defender for Containers on the build agents
  • B. Import a third-party scanner's results every night as a CSV file
  • C. Connect the GitHub and Azure DevOps organizations to Defender for Cloud Correct answer
  • D. Forward repository audit logs to a Sentinel workspace

Option C is correct because connecting the GitHub and Azure DevOps organizations to Defender for Cloud (DevOps security) surfaces IaC misconfigurations and code vulnerabilities beside the deployed cloud resources they affect. Defender for Containers protects container workloads, not source repositories. A nightly CSV import and forwarding audit logs to Sentinel do not provide code-to-cloud context in Defender for Cloud.

A bank exposes REST APIs through Azure API Management. It wants to find unauthenticated or unused APIs and detect anomalous usage such as data exfiltration. Which Defender for Cloud plan fits?
  • A. Defender for Resource Manager
  • B. Defender for App Service
  • C. Defender CSPM
  • D. Defender for APIs Correct answer

Option D is correct because Defender for APIs onboards Azure API Management APIs, identifies unauthenticated, inactive or dormant APIs, and detects anomalous usage such as data exfiltration. Defender for Resource Manager monitors management-plane operations, Defender for App Service covers App Service hosts, and Defender CSPM covers posture rather than runtime API threat detection.

Criminals send invoices that appear to come from a company's own domain. The architect wants receiving mail systems to be able to verify that messages claiming the domain are legitimate, and to quarantine or reject those that fail. Which THREE controls should be published or enabled for the domain? (Choose three)
  • A. BIMI record with a verified brand logo
  • B. DNSSEC signing of the mail exchanger zone
  • C. DKIM signing of outbound mail Correct answer
  • D. MTA-STS policy for inbound mail connections
  • E. DMARC policy set to quarantine or reject Correct answer
  • F. SPF record listing authorized sending hosts Correct answer

Options C, E and F are correct because SPF lists the hosts allowed to send for the domain, DKIM signs outbound mail so receivers can verify it was not forged or altered, and DMARC tells receivers to quarantine or reject mail that fails both checks. BIMI only displays a brand logo, DNSSEC protects DNS answers rather than sender identity, and MTA-STS enforces TLS for inbound mail transport; none of them lets receivers verify or reject spoofed senders.

A SaaS provider hosts 400 customers in a shared Azure SQL database. A few regulated customers demand strong isolation, and a coding error recently risked exposing one customer's rows to another. Which TWO design decisions should the architect recommend? (Choose two)
  • A. Zone-redundant deployment of the shared database
  • B. Dynamic data masking on the tenant ID column
  • C. Row-level security filtering rows by a tenant ID in session context Correct answer
  • D. Dedicated deployment stamps for the regulated customers Correct answer
  • E. Developer-written WHERE clauses on tenant ID in every query

Options C and D are correct because row-level security enforces tenant filtering in the database itself, so a coding error in a query cannot expose another customer's rows, and dedicated stamps give the regulated customers genuine isolation. Zone redundancy is about availability, dynamic data masking only obscures values for non-privileged users and does not filter rows, and relying on developers to write WHERE clauses is exactly the weakness that caused the problem.

Free Study Guide

Read the free Microsoft SC-100 study guide: every exam topic explained in plain English, with diagrams, exam tips and the mistakes to avoid.

More Microsoft Practice Exams

All Microsoft practice exams →

Practise with realistic mock exams to prepare for your Microsoft certification.