Chapter 3 of 4 · Microsoft SC-100
Design security solutions for infrastructure
Defender for Cloud posture, Arc, EASM, endpoints, service baselines, containers, networks and SSE.
- 6topics
- 33 minfast track
- 2diagrams and exhibits
- 25–30%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Security Posture Management with Defender for CloudSC-100 posture: Defender for Cloud secure score, foundational versus Defender CSPM, attack paths, workload protection plans and…Diagram6 min
- 2Hybrid and Multicloud with Azure Arc, EASM and Exposure ManagementSC-100 reach: Azure Arc for servers and Kubernetes, Defender External Attack Surface Management, and Security Exposure Management…5 min
- 3Securing Servers, Clients, IoT and OT EndpointsSC-100 endpoints: baselines, Defender for Servers, Intune compliance and app protection, Windows LAPS, and Defender for IoT for…6 min
- 4Securing SaaS, PaaS and IaaS ServicesSC-100 services: shared responsibility, security baselines for SaaS, PaaS and IaaS, web and IoT workload requirements, private…5 min
- 5Securing Containers and Azure AI ServicesSC-100 containers and AI: image and registry security, AKS hardening, Defender for Containers, and Azure AI services with private…5 min
- 6Network Security and Security Service EdgeSC-100 networks: segmentation, Azure Firewall, WAF, DDoS and Private Link, plus Entra Internet Access, Internet Access for…Diagram6 min
About this chapter
What this chapter covers
Infrastructure is where workloads run: servers, clients, devices, platform services, containers and networks, across Azure, other clouds and on premises. This domain is worth 25 to 30 percent of the exam. It covers security posture management in hybrid and multicloud environments, requirements for endpoints (servers, clients, mobile, IoT and operational technology), requirements for SaaS, PaaS and IaaS services (including containers and Azure AI services), and network security with Security Service Edge (SSE).
The key skill is specifying requirements and choosing the right protection plan or service for each layer, and knowing how Defender for Cloud ties them together.
How the topics fit together
- Security posture management with Defender for Cloud covers CSPM, secure score and cloud workload protection plans.
- Hybrid and multicloud with Azure Arc, EASM and Exposure Management covers extending management and finding the attack surface.
- Securing servers, clients, IoT and OT endpoints covers baselines, Intune, LAPS and Defender for IoT.
- Securing SaaS, PaaS and IaaS services covers per service baselines and web workloads.
- Securing containers and Azure AI services covers AKS, registries and AI service protection.
- Network security and Security Service Edge covers firewalls, WAF, DDoS, Entra Internet Access and Private Access.
Posture questions ask "what is misconfigured" (CSPM, recommendations). Protection questions ask "what is under attack" (workload protection plans, Defender XDR).
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with examples and tables.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full Microsoft SC-100 question bank has 770 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.