SC-100: Microsoft Cybersecurity Architect Expert — Questions and Answers

Question 1: Which Microsoft Sentinel feature uses built-in ML to detect multi-stage attacks by correlating low-fidelity alerts into high-confidence incidents?

Hunting queries
Playbooks
Fusion detection (Correct answer)
Workbooks

Correct answer: Fusion detection

Microsoft Sentinel's Fusion engine uses ML to correlate multiple low-severity alerts across data sources into high-fidelity multi-stage attack incidents.

Question 2: What is the primary purpose of assessment in the SC-100 context?

To fulfill administrative requirements only
To replace professional judgment
To gather information for informed decision-making (Correct answer)
To rank individuals competitively

Correct answer: To gather information for informed decision-making

Assessment is fundamentally about gathering reliable information to support informed professional decisions and appropriate interventions.

Question 3: What is a data breach?

A legal audit of company files.
Authorized access to secure files.
Unauthorized access to sensitive data (Correct answer)
Routine system backup.

Correct answer: Unauthorized access to sensitive data

A data breach occurs when sensitive, protected, or confidential data is accessed, viewed, stolen, or used by an unauthorized individual or entity. This unauthorized access can lead to significant financial losses, reputational damage, and legal consequences for an organization. It represents a critical failure in security controls designed to protect information assets.

Question 4: Which design pattern should a cybersecurity architect use to prevent a compromised workload in one Azure subscription from pivoting to resources in another subscription?

Enable Azure AD Privileged Identity Management (PIM) for subscription access
Use separate VNets per subscription with no peering and enforce Azure Firewall for any cross-subscription traffic (Correct answer)
Place all workloads in a single VNet with NSG segmentation
Deploy all workloads in the same resource group

Correct answer: Use separate VNets per subscription with no peering and enforce Azure Firewall for any cross-subscription traffic

Isolating subscriptions with separate VNets and routing any required cross-subscription traffic through Azure Firewall limits blast radius if one subscription is compromised.

Question 5: A company needs to secure administrative access to Azure VMs without exposing RDP or SSH ports to the internet. Which service provides browser-based secure access?

Network Watcher
Azure AD Application Proxy
Azure Bastion (Correct answer)
Azure VPN Gateway point-to-site

Correct answer: Azure Bastion

Azure Bastion provides secure RDP and SSH connectivity to VMs directly through the Azure portal without exposing management ports to the internet.

Question 6: An organization's compliance requirement mandates that all administrative actions on production Azure resources be reviewed and approved before execution. Which service supports just-in-time privileged access with approval workflows?

Conditional Access policies
Microsoft Entra Access Reviews
Azure Active Directory Privileged Identity Management (PIM) (Correct answer)
Azure Role-Based Access Control (RBAC)

Correct answer: Azure Active Directory Privileged Identity Management (PIM)

Azure AD Privileged Identity Management (PIM) enables just-in-time role activation with required approval workflows for elevated access.

Question 7: Which foundational principle is MOST important for success in the Microsoft Cybersecurity Architect Expert profession?

Maximizing financial returns on every engagement
Commitment to continuous learning, ethical practice, and quality outcomes (Correct answer)
Maintaining the minimum requirements for certification
Specializing in only one narrow area of practice

Correct answer: Commitment to continuous learning, ethical practice, and quality outcomes

Success in any professional field requires a commitment to continuous learning to stay current, ethical practice to maintain trust and integrity, and a focus on quality outcomes that serve stakeholders and the public interest.

Question 8: An architect needs to enforce that Azure resources in a subscription can only be deployed to approved geographic regions. Which Azure construct achieves this?

Resource locks
Management group RBAC
Azure Blueprints only
Azure Policy with allowed locations definition (Correct answer)

Correct answer: Azure Policy with allowed locations definition

Azure Policy's built-in 'Allowed locations' definition denies deployment of resources to any region not explicitly listed in the policy parameters.

Question 9: In SC-100 certification, what does redundancy in system design primarily provide?

Simplified maintenance
Lower initial cost
Increased complexity
Fault tolerance and high availability (Correct answer)

Correct answer: Fault tolerance and high availability

Redundancy provides fault tolerance by ensuring that if one component fails, backup components maintain system availability.

Question 10: What is defense in depth in the context of SC-100 security?

Focusing only on perimeter security
Implementing multiple layers of security controls (Correct answer)
Relying solely on encryption
Using one strong security control

Correct answer: Implementing multiple layers of security controls

Defense in depth uses multiple layers of security controls so that if one layer fails, additional layers continue to provide protection.

Question 11: During a threat model review for a containerized application on AKS, which control specifically prevents privilege escalation by a compromised container?

Apply Azure RBAC roles to the AKS cluster
Enable Azure Policy for AKS to disallow privileged containers (Correct answer)
Use Azure Defender for Containers to scan images
Configure network policies to restrict egress from pods

Correct answer: Enable Azure Policy for AKS to disallow privileged containers

Azure Policy for AKS can enforce pod security standards that prevent containers from running as privileged, blocking privilege escalation paths.

Question 12: A cybersecurity architect must communicate risk to a non-technical executive board. Which risk representation is most appropriate?

Raw vulnerability scanner output from Defender for Cloud
Heat map showing likelihood vs. impact for top risks in business terms (Correct answer)
Detailed CVE list with CVSS scores
Technical exploit chains with proof-of-concept code

Correct answer: Heat map showing likelihood vs. impact for top risks in business terms

A risk heat map translates technical findings into business-language likelihood and impact, making it suitable for executive-level risk communication.

Question 13: Which Azure Private Link feature prevents data exfiltration by ensuring traffic to Azure PaaS services never traverses the public internet?

Azure Firewall DNAT rules
Private Endpoints (Correct answer)
Service Endpoints with service endpoint policies
VNet peering with gateway transit

Correct answer: Private Endpoints

Private Endpoints assign a private IP from your VNet to an Azure PaaS service, keeping all traffic on the Microsoft backbone and preventing data exfiltration via the public internet.

Question 14: When using Azure Firewall Premium, which feature provides IDPS (Intrusion Detection and Prevention) capabilities?

Network rules with IP groups
DNS proxy with custom DNS servers
Signature-based IDPS engine with alert and deny modes (Correct answer)
Application rules with FQDN filtering

Correct answer: Signature-based IDPS engine with alert and deny modes

Azure Firewall Premium includes a signature-based IDPS engine that can detect and optionally block known threats based on threat intelligence signatures.

Question 15: Which Microsoft Defender for Identity detection identifies when an attacker performs reconnaissance by enumerating domain users via LDAP or SAMR protocols?

Pass-the-hash detection
Golden Ticket attack detection
Account enumeration reconnaissance (Correct answer)
Lateral movement path detection

Correct answer: Account enumeration reconnaissance

Microsoft Defender for Identity detects account enumeration reconnaissance by monitoring LDAP and SAMR queries used to map out user accounts in the domain.

Question 16: What is the MOST effective way for new SC-100 professionals to build competency in their field?

Focusing solely on the most advanced topics
Studying certification materials exclusively
Learning entirely through trial and error
Combining formal education, mentored practice, and ongoing professional development (Correct answer)

Correct answer: Combining formal education, mentored practice, and ongoing professional development

Building professional competency requires a multi-faceted approach: formal education provides foundational knowledge, mentored practice develops applied skills under guidance, and ongoing professional development ensures continuous growth and currency in the field.

Question 17: A company uses shared workstations. Which Zero Trust control most effectively prevents credential theft from being used to access cloud resources from an unauthorized device?

Require all users to reset passwords every 30 days
Enforce device compliance as a Conditional Access requirement, blocking access from unmanaged or non-compliant devices (Correct answer)
Disable multi-factor authentication for shared accounts
Allow access only during business hours

Correct answer: Enforce device compliance as a Conditional Access requirement, blocking access from unmanaged or non-compliant devices

Device compliance requirements in Conditional Access ensure that even valid credentials cannot be used to access resources unless the device meets security standards such as encryption and patch level.

Question 18: A security architect is reviewing the AppLocker/WDAC policies for application control on developer workstations. Which Microsoft Defender feature provides similar application control for containerized workloads on AKS?

Azure Monitor container insights
Kubernetes network policies for pod communication
Microsoft Defender for Containers image scanning
Azure Policy add-on for AKS enforcing allowed image registries (Correct answer)

Correct answer: Azure Policy add-on for AKS enforcing allowed image registries

Azure Policy for AKS can enforce that only images from approved registries are deployed, acting as application control for containerized workloads.

Question 19: Your organization's application uses Azure Service Bus for inter-service messaging. Which security control should you recommend to prevent unauthorized services from publishing messages?

Restrict access using Azure Service Bus Shared Access Signatures scoped to Send permission (Correct answer)
Enable Microsoft Defender for Service Bus
Use Azure Monitor alerts to detect unauthorized publishers
Place Service Bus behind an Azure Load Balancer

Correct answer: Restrict access using Azure Service Bus Shared Access Signatures scoped to Send permission

Scoped Shared Access Signatures grant only the Send permission to authorized publishers, preventing unauthorized services from publishing messages.

Question 20: Which Microsoft solution provides Secure Access Service Edge (SASE) capabilities by combining network security and SD-WAN, aligning with Zero Trust network access principles?

Azure AD Application Proxy
Microsoft Entra Internet Access (Global Secure Access) (Correct answer)
Azure ExpressRoute
Azure Virtual WAN with Firewall

Correct answer: Microsoft Entra Internet Access (Global Secure Access)

Microsoft Entra Internet Access (part of Global Secure Access) delivers identity-centric, Zero Trust network access controls aligned with SASE architecture principles.

Question 21: An architect is designing data sovereignty controls for a financial institution. Which Azure policy assignment scope provides the broadest coverage with a single assignment across all subscriptions in a tenant?

Individual resource scope
Management group (root tenant) scope (Correct answer)
Resource group scope
Subscription scope

Correct answer: Management group (root tenant) scope

Assigning Azure Policy at the root management group scope applies the policy to all subscriptions and resources within the entire Azure tenant.

Question 22: When designing an application security architecture for a Zero Trust model, which principle most directly applies to API-to-API communication between microservices?

Implement IP allowlisting between microservice endpoints
Assume all internal network traffic is trusted
Use mutual TLS (mTLS) to authenticate both client and server for each request (Correct answer)
Rely on network segmentation with NSGs to control microservice communication

Correct answer: Use mutual TLS (mTLS) to authenticate both client and server for each request

Mutual TLS enforces identity verification on both sides of every connection, directly implementing Zero Trust's 'verify explicitly' principle for microservice communication.

Question 23: An architect is designing the identity model for a new microservices application. Each service needs to call other services without user context. Which OAuth 2.0 flow is appropriate?

Implicit flow
On-behalf-of (OBO) flow
Client credentials flow (Correct answer)
Authorization code flow

Correct answer: Client credentials flow

The client credentials flow is designed for machine-to-machine authentication where a service authenticates using its own identity, not on behalf of a user.

Question 24: How does the SC-100 body of knowledge relate to daily professional practice?

It is relevant only for academic research
It only applies during certification exams
It is theoretical and has limited practical application
It provides the foundational framework that guides decision-making and standard practices (Correct answer)

Correct answer: It provides the foundational framework that guides decision-making and standard practices

The body of knowledge provides the foundational framework of principles, standards, and best practices that professionals use to guide their daily decision-making, ensure consistent quality, and maintain alignment with industry standards.

Question 25: What is the best practice for maintaining network security architecture performance over time?

Implement scheduled preventive maintenance (Correct answer)
Outsource all maintenance
Wait for failures before acting
Upgrade all equipment annually

Correct answer: Implement scheduled preventive maintenance

Scheduled preventive maintenance catches potential issues before they cause failures, maintaining reliability and extending equipment life.

Question 26: Which authentication factor is classified as "something you are"?

Password
Smart card
Biometric data (Correct answer)
Security token

Correct answer: Biometric data

Biometric data such as fingerprints, facial recognition, or retinal scans represents the "something you are" authentication factor.

Question 27: Which Azure Firewall feature helps reduce the administrative overhead of maintaining IP address-based rules for frequently changing service IPs?

Threat intelligence-based filtering
IP Groups that aggregate addresses into reusable objects
Application rules with wildcard FQDNs
Service tags representing Azure service IP ranges (Correct answer)

Correct answer: Service tags representing Azure service IP ranges

Service tags abstract Azure service IP ranges that Microsoft manages, so rules referencing service tags automatically stay current without manual IP list maintenance.

Question 28: Which approach best supports a 'never trust, always verify' model for server-to-server communication within an Azure VNet?

Allow all traffic within the VNet using permissive NSG rules
Use shared secrets stored in environment variables
Implement mutual TLS (mTLS) with certificate-based authentication between services (Correct answer)
Rely on VNet isolation and disable encryption between services

Correct answer: Implement mutual TLS (mTLS) with certificate-based authentication between services

Mutual TLS requires both client and server to authenticate with certificates, ensuring neither side implicitly trusts the other purely based on network location.

Question 29: When advising on a security strategy for a highly regulated organization, which approach to security policy management best balances agility with governance?

Implementing only the minimum policies required by regulators to reduce overhead
Implementing immutable policies that never change to ensure regulatory stability
Adopting a living policy management lifecycle with scheduled reviews, exception processes, and change control (Correct answer)
Delegating all policy decisions to individual business units to maximize agility

Correct answer: Adopting a living policy management lifecycle with scheduled reviews, exception processes, and change control

A living policy lifecycle with formal reviews, exceptions, and change control allows policies to evolve with the threat landscape while maintaining governance accountability.

Question 30: Which NIST framework function focuses specifically on identifying and understanding cybersecurity risks to systems, people, assets, and data?

Identify (Correct answer)
Respond
Detect
Protect

Correct answer: Identify

The NIST CSF 'Identify' function establishes the organizational understanding needed to manage cybersecurity risk to systems, assets, data, and capabilities.

Question 31: When designing a secure network architecture for Azure SQL Database, which combination provides the strongest data-plane isolation?

VNet integration with read replicas in a secondary region
Private endpoint with public network access disabled and Azure AD authentication enforced (Correct answer)
Service endpoint without disabling public access
Public endpoint with firewall rules allowing corporate IP ranges

Correct answer: Private endpoint with public network access disabled and Azure AD authentication enforced

Combining a private endpoint with public network access disabled ensures all database traffic stays on private networks, and AAD authentication eliminates password-based credential risks.

Question 32: What is the primary purpose of encryption in SC-100 security?

To make data transfer slower
To protect data confidentiality during storage and transmission (Correct answer)
To compress data
To organize data more efficiently

Correct answer: To protect data confidentiality during storage and transmission

Encryption protects data confidentiality by converting information into an unreadable format that can only be decoded with the proper key.

Question 33: Which SC-100 concept involves continuously evaluating security controls against emerging threats rather than performing assessments on an annual schedule?

Compliance gap analysis
Annual penetration testing
Point-in-time risk assessment
Continuous threat and vulnerability management (Correct answer)

Correct answer: Continuous threat and vulnerability management

Continuous threat and vulnerability management provides ongoing risk visibility by constantly assessing controls against new CVEs, threat intelligence, and configuration drift.

Question 34: An organization wants to implement software composition analysis (SCA) in its Azure DevOps pipeline to identify open-source vulnerabilities. Which Microsoft service provides this capability natively?

Azure Policy
Microsoft Sentinel
Azure Security Center Secure Score
Microsoft Defender for DevOps (Correct answer)

Correct answer: Microsoft Defender for DevOps

Microsoft Defender for DevOps integrates with Azure DevOps and GitHub to provide SCA, secret scanning, and IaC security scanning within the pipeline.

Question 35: What is the fundamental principle behind zero trust architecture in the SC-100 domain?

Using the newest technology exclusively
Cost minimization at all costs
Balancing performance, reliability, and efficiency (Correct answer)
Following a single vendor solution

Correct answer: Balancing performance, reliability, and efficiency

Effective technical design requires balancing performance requirements with reliability needs and operational efficiency.

Question 36: An organization uses Azure Static Web Apps to host a single-page application. Which security header should the architect configure to prevent clickjacking attacks?

X-Frame-Options (Correct answer)
Strict-Transport-Security
Content-Security-Policy
X-Content-Type-Options

Correct answer: X-Frame-Options

The X-Frame-Options header (or CSP frame-ancestors directive) prevents the page from being embedded in iframes on other domains, mitigating clickjacking.

Question 37: What is the primary consideration when implementing changes to network security architecture?

Vendor preference
Personal convenience
Speed of implementation
Impact assessment and change management (Correct answer)

Correct answer: Impact assessment and change management

Impact assessment and proper change management ensure that modifications do not introduce unexpected problems or service disruptions.

Question 38: Which statement BEST describes the relationship between Microsoft Cybersecurity Architect Expert certification requirements and industry evolution?

Requirements evolve periodically to reflect advances in knowledge, technology, and practice standards (Correct answer)
Changes only occur when government mandates new requirements
Requirements become less stringent over time
Certification requirements never change once established

Correct answer: Requirements evolve periodically to reflect advances in knowledge, technology, and practice standards

Certification requirements evolve to keep pace with advances in professional knowledge, technological developments, and changes in practice standards. This ensures that certified professionals remain current and competent in a changing professional landscape.

Question 39: An organization wants to implement micro-segmentation for its Azure workloads to limit lateral movement. Which Azure service best enables this at the workload level?

Azure DDoS Protection Standard
Application Security Groups (ASGs) (Correct answer)
Azure Bastion
Azure Firewall Premium

Correct answer: Application Security Groups (ASGs)

Application Security Groups allow you to group VMs logically and define NSG rules based on those groups, enabling micro-segmentation without managing IP addresses.

Question 40: A security architect is designing a DevSecOps pipeline in Azure DevOps. At which stage should static application security testing (SAST) be integrated?

During the test stage after functional tests pass
During the build stage to analyze source code before compilation (Correct answer)
During the monitoring stage using runtime analysis
During the release stage after deployment to production

Correct answer: During the build stage to analyze source code before compilation

SAST analyzes source code or binaries and should run during the build stage to catch vulnerabilities as early as possible in the pipeline.

SC-100: Microsoft Cybersecurity Architect Expert

This certification validates the skills of cybersecurity architects to design and evolve cybersecurity strategies to protect an organization's mission and business processes across a hybrid and multi-cloud environment.

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds