SC-100: Microsoft Cybersecurity Architect Practice Exam

What the SC-100 exam covers

• Design solutions that align with security best practices and priorities202 questions
• Design security operations, identity, and compliance capabilities212 questions
• Design security solutions for infrastructure211 questions
• Design security solutions for applications and data188 questions

Free SC-100 sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 813.

1. Question 1Design solutions that align with security best practices and priorities

   You are designing a Zero Trust strategy for a large enterprise migrating to Microsoft 365 and Azure. Leadership asks you to summarize the foundational principles that must govern every design decision. According to Microsoft's Zero Trust model, which set of guiding principles should you present?

   • ATrust but verify, network segmentation, and perimeter hardening
   • BVerify explicitly, use least privilege access, and assume breachCorrect
   • CEncrypt everything, block all inbound traffic, and require VPN
   • DCentralize identity, disable legacy protocols, and audit quarterly
   ✓ Correct answer: B

   Microsoft defines Zero Trust with exactly three guiding principles: verify explicitly (authenticate and authorize on all available signals), use least privilege access (JIT/JEA and risk-based adaptive policies), and assume breach (minimize blast radius, segment access, verify end-to-end encryption, use analytics for detection).

   Why the other options are wrong

   • ATrust but verify and perimeter hardening describe the legacy castle-and-moat model that Zero Trust explicitly replaces.
   • CThese are individual controls, not the strategic principles that define the Zero Trust model.
   • DCentralizing identity and disabling legacy protocols are tactics, not the three defining Zero Trust principles.
2. Question 2Design solutions that align with security best practices and priorities

   A financial services company must survive a full regional Azure outage for its transaction-processing platform. The business states a recovery time objective (RTO) of 15 minutes and a recovery point objective (RPO) of near-zero. As the cybersecurity architect, which regional resiliency design best satisfies both objectives?

   • ADeploy to a single region across three availability zones and rely on Azure Backup with geo-redundant storage
   • BDeploy an active-active multi-region architecture with near-synchronous replication and automated failover routingCorrect
   • CDeploy to a single region and restore from a geo-restored backup in a paired region when an outage occurs
   • DDeploy to a single region and use Azure Site Recovery with a 4-hour replication interval to a secondary region
   ✓ Correct answer: B

   A near-zero RPO requires data to be continuously replicated to a second region, and a 15-minute RTO requires the secondary to already be running and reachable through automated traffic routing (for example Front Door or Traffic Manager). Active-active satisfies both because there is no cold-start restore step and no meaningful data loss window.

   Why the other options are wrong

   • AAvailability zones protect against datacenter-level failures inside one region but do not survive the loss of the entire region.
   • CGeo-restoring a backup after an outage introduces hours of RTO and loses all data written since the last backup, violating both objectives.
   • DA 4-hour Site Recovery replication interval yields an RPO of up to 4 hours, far exceeding the near-zero requirement.
3. Question 3Design solutions that align with security best practices and priorities

   Your organization runs workloads in Azure, AWS, and GCP and wants a single, consistent baseline of security controls that maps to established industry frameworks and is used to measure posture across all three clouds. Which Microsoft framework should you adopt as the foundation of your cross-cloud security design?

   • AThe Microsoft Cloud Security Benchmark (MCSB)Correct
   • BThe Azure Security Benchmark v2 applied only to Azure subscriptions
   • CThe CIS Microsoft Azure Foundations Benchmark
   • DThe Well-Architected Framework reliability pillar
   ✓ Correct answer: A

   MCSB provides prescriptive control domains (network security, identity management, data protection, and others) with per-cloud implementation guidance for Azure, AWS, and GCP, and it maps to frameworks such as CIS, NIST, and PCI DSS. It is the built-in default initiative in Microsoft Defender for Cloud, so adopting it gives you one consistent control set and secure-score measurement across all three clouds.

   Why the other options are wrong

   • BThe Azure Security Benchmark v2 predates MCSB and covers Azure only, so it cannot serve as a consistent baseline across AWS and GCP.
   • CThe CIS Azure Foundations Benchmark is Azure-specific and does not provide unified multicloud control guidance for AWS and GCP.
   • DThe Well-Architected reliability pillar addresses resiliency and availability, not a cross-cloud security control baseline.
4. Question 4Design security operations, identity, and compliance capabilities

   A financial services company must eliminate password-based phishing entirely for its workforce. The design must satisfy phishing-resistant MFA per NIST AAL3 guidance while allowing employees to sign in to Windows 11 devices and web apps without carrying separate hardware for every scenario. Which authentication method should the architect standardize on as the primary phishing-resistant credential?

   • AMicrosoft Authenticator push notifications with number matching
   • BPasskeys (FIDO2) via Windows Hello for Business and platform/security-key passkeysCorrect
   • CSMS one-time passcodes as a second factor
   • DOATH TOTP hardware tokens
   ✓ Correct answer: B

   Phishing resistance requires the credential to be cryptographically bound to the relying party origin so it cannot be replayed on a spoofed site. FIDO2/WebAuthn passkeys, delivered through Windows Hello for Business on managed PCs and platform or security-key passkeys elsewhere, satisfy this and are Microsoft's recommended phishing-resistant workforce credential in 2025.

   Why the other options are wrong

   • APush with number matching resists MFA fatigue but is not phishing-resistant because the credential is not bound to the site origin.
   • CSMS OTP is explicitly discouraged and is vulnerable to SIM swap, interception, and phishing.
   • DOATH TOTP codes can be phished and relayed in real time, so they do not meet phishing-resistant requirements.
5. Question 5Design security operations, identity, and compliance capabilities

   Your SOC wants every high-severity Microsoft Sentinel incident that involves a compromised user to automatically disable the account in Microsoft Entra ID, add the user to a watchlist, and post to a Microsoft Teams channel, with no analyst action required for the containment step. Which design should you recommend?

   • BAn automation rule that triggers on incident creation and runs a Sentinel playbook (Logic App) performing the disable, watchlist, and Teams actionsCorrect
   • AA scheduled analytics rule that reruns the containment KQL queries every five minutes and disables any matching compromised user accounts
   • CA workbook containing an embedded PowerShell runbook that on-call analysts launch manually whenever a high-severity user incident appears
   • DA Microsoft Entra Conditional Access policy that blocks the compromised user only after a sign-in risk detection is subsequently raised
   ✓ Correct answer: B

   In Sentinel, an automation rule can fire on incident creation, filter for severity and entity conditions, and invoke a playbook built on Azure Logic Apps. The playbook uses the Entra ID and Teams connectors to disable the account, update a watchlist, and notify the channel automatically, satisfying the no-analyst-action containment requirement.

   Why the other options are wrong

   • AA scheduled analytics rule detects and creates alerts on a timer but does not orchestrate the disable, watchlist, and Teams response actions.
   • CA workbook with a manually launched runbook requires analyst action, violating the no-analyst-action containment requirement.
   • DConditional Access blocks based on sign-in risk and cannot perform the account disable, watchlist add, and Teams post the scenario needs.
6. Question 6Design security solutions for infrastructure

   An enterprise is consolidating dozens of regional VNets. The security architect wants centralized, transitive routing, integrated firewall inspection of branch, VNet, and internet traffic, and automated route propagation without manually maintaining user-defined routes across peerings. Which connectivity design best meets these goals?

   • AA traditional hub-spoke topology using VNet peering with a network virtual appliance and manually managed UDRs in each spoke
   • BAzure Virtual WAN with a Secured Virtual Hub running Azure Firewall and routing intent policiesCorrect
   • CGlobal VNet peering meshed directly between every regional VNet
   • DA single flat VNet spanning all regions with subnets per business unit
   ✓ Correct answer: B

   Virtual WAN offers a managed hub with any-to-any transitive connectivity across VNets, branches, and users. Converting the hub to a Secured Virtual Hub deploys Azure Firewall (or a supported partner NVA) into the hub, and routing intent policies automatically program routes so that internet and private traffic are steered through the firewall without hand-authored UDRs, meeting the scale and centralized-inspection goals.

   Why the other options are wrong

   • AClassic hub-spoke with peering is not transitive by default and requires per-spoke UDR maintenance, which is exactly the operational burden the architect wants to avoid.
   • CA full peering mesh scales poorly, provides no central inspection point, and multiplies management overhead.
   • DA single flat VNet eliminates segmentation, cannot span regions as one VNet, and provides no inspection boundary.
7. Question 7Design security solutions for infrastructure

   An organization runs production workloads across Azure, three AWS accounts, and two Google Cloud projects. The security team wants a single Cloud Security Posture Management (CSPM) view that surfaces misconfigurations and a unified secure score for all three clouds. Which Microsoft Defender for Cloud capability should the architect enable to achieve this?

   • AA separate Microsoft Sentinel workspace per cloud with cross-workspace queries
   • BAzure Arc-enabled Kubernetes on each cloud's managed cluster
   • CDefender for Cloud multicloud connectors for AWS and GCPCorrect
   • DAzure Lighthouse delegated resource management for the AWS and GCP subscriptions
   ✓ Correct answer: C

   The AWS and GCP connectors use agentless, API-based integration (via a CloudFormation stack or GCP Cloud Shell script) to discover resources, run CSPM assessments, and roll findings into the same secure score and recommendations experience as Azure, giving one unified posture view across all three clouds.

   Why the other options are wrong

   • ASentinel is a SIEM for detection and response, not a CSPM tool, and per-cloud workspaces would fragment rather than unify the posture view.
   • BArc-enabled Kubernetes covers only clusters, not the full account or project posture, and does not deliver a multicloud secure score.
   • DAzure Lighthouse delegates management of Azure tenants and does not connect AWS or GCP resources to Defender for Cloud.
8. Question 8Design security solutions for infrastructure

   You must design secure administrative access to Azure VMs that have no public IP addresses. Requirements: administrators connect over RDP and SSH from the Azure portal in a browser using TLS, no client agent or public IP is required on the VMs, and no inbound management ports are exposed to the internet. Which service should you include?

   • AAzure BastionCorrect
   • BA jump box VM with a public IP in the same virtual network
   • CPoint-to-site VPN with per-user certificates
   • DAzure Firewall Premium with TLS inspection
   ✓ Correct answer: A

   Azure Bastion is a fully managed PaaS service deployed into a virtual network. It brokers RDP and SSH connectivity through the Azure portal over TLS 443, so target VMs need no public IP and no inbound 3389 or 22 exposure to the internet, and no agent is required on the VMs. This matches all stated requirements.

   Why the other options are wrong

   • BA jump box needs a public IP and open management port, exposing an internet-facing surface the requirements forbid.
   • CPoint-to-site VPN requires client software and does not deliver browser-based access from the portal.
   • DAzure Firewall protects egress and inspection but does not broker interactive RDP or SSH sessions to VMs.
9. Question 9Design security solutions for applications and data

   A healthcare provider must ensure that documents labeled Highly Confidential are encrypted so that only members of the Clinical Staff group can open them, even if a file is copied to an unmanaged USB drive or personal email. Which sensitivity label protection setting satisfies this requirement?

   • AContent marking that adds a Highly Confidential watermark to every page of the document
   • BEncryption with assigned permissions granting only the Clinical Staff group rights to open the fileCorrect
   • CA DLP policy that blocks copying the file to removable media devices
   • DConditional Access requiring a compliant, policy-managed device before the file can ever be opened
   ✓ Correct answer: B

   When a sensitivity label applies encryption with assigned permissions, the protection travels with the file. Only identities in the specified group with the granted usage rights (for example Co-Author) can decrypt and open it, regardless of where the file is stored or copied. This persistent protection is the only option that enforces access on an unmanaged USB drive or personal email.

   Why the other options are wrong

   • AA watermark is a visual marking only; it does not restrict who can open the file.
   • CEndpoint DLP can block copying to USB on managed devices but does not protect the file once it has left, and does not control who can open it.
   • DConditional Access controls sign-in to services, not the ability to open an already-copied file on an unmanaged device.
10. Question 10Design security solutions for applications and dataSelect all that apply

    You are designing protection for SaaS and internal web applications. The design must discover and control unsanctioned SaaS usage (shadow IT) and enforce real-time session controls such as blocking downloads of sensitive data to unmanaged devices. Which two Microsoft capabilities should the design include? (Choose two.)

    • AMicrosoft Defender for Cloud Apps for SaaS discovery and governanceCorrect
    • BConditional Access App Control (session policies) integrated with Defender for Cloud AppsCorrect
    • CAzure Import/Export service
    • DAzure Traffic Manager
    ✓ Correct answer: A, B

    Defender for Cloud Apps (the Microsoft CASB) discovers cloud app usage from network logs and lets you sanction or block apps, addressing shadow IT. Conditional Access App Control routes app sessions through the CASB reverse proxy so you can apply real-time session policies, such as blocking or protecting downloads to unmanaged devices. Together they meet both the discovery/governance and real-time session-control requirements.

    Why the other options are wrong

    • CAzure Import/Export ships disks for bulk data transfer, unrelated to SaaS discovery or session control.
    • DTraffic Manager is DNS-based load balancing and has no application security or CASB function.

Who this SC-100 practice exam is for

This practice set is for anyone preparing for the SC-100: Microsoft Cybersecurity Architect exam - from first-time candidates building a foundation to experienced Microsoft practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this SC-100 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real SC-100 exam.

Related Microsoft resources

• SC-100 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• SC-200 practice examRelated
• AZ-140 practice examRelated
• AZ-900 practice examRelated

SC-100 practice exam FAQ