Microsoft Cybersecurity Architect (SC-100) - Practice Questions¶
15 design questions for SC-100 prep. SC-100 is a design exam: more than one option usually works, and the constraint in the question decides which is correct. Read the qualifier before the options.
Cert page: exams/azure/sc-100/
Question 1¶
Scenario: A company must ensure backups survive an attack in which an administrator account is fully compromised. Cost is a secondary concern. What should the design include?
A. More frequent backup schedules, with hourly recovery points in the same vault B. Immutable vault with soft delete and multi-user authorization using a Resource Guard C. Geo-redundant storage on the Recovery Services vault, with cross-region restore enabled for the protected workloads D. A second vendor's backup product, writing to a separate subscription
Answer
**Correct: B** **Why:** The threat is an authorized identity performing destructive operations. Immutability prevents deletion or retention reduction within the retention period, and multi-user authorization requires a second approver held in a separate subscription. Geo-redundancy protects against regional failure, not against authorized deletion. More frequent backups create more recovery points that the same compromised identity could delete. A second product duplicates cost without addressing identity compromise.Question 2¶
Scenario: An organization must prevent engineers from holding standing subscription Owner rights while allowing them to perform occasional administrative work. The tenant has Microsoft Entra ID P2. Least administrative effort is required.
A. Conditional Access requiring MFA and a compliant device for every administrator sign-in to the Azure portal B. An entitlement management access package that grants the Owner role for a set period after a manager approves C. Privileged Identity Management with eligible assignments, approval, and time limits D. A scheduled script in an Automation runbook that adds and removes the Owner role assignments when engineers ask
Answer
**Correct: C** **Why:** PIM is the feature for just-in-time privileged role activation with approval, justification, and time bounds. Conditional Access governs the conditions of a sign-in, not standing role assignment. Entitlement management covers resource entitlement, not directory or Azure role activation. A script is custom effort to build and maintain, which fails the least-effort constraint.Question 3¶
Scenario: A retailer has 12 subscriptions across three regions and two Entra tenants after an acquisition. A single central SOC operates it. EU log data must remain in EU regions, and the logging bill is unsustainable. What Sentinel design fits?
A. Migrate the acquired tenant into the main tenant first, then use a single workspace for all twelve subscriptions B. One workspace per subscription, each in the region of its resources, with analytics rules copied to all twelve C. One workspace per data residency boundary, cross-workspace queries, and Azure Lighthouse D. One global US workspace, with table-level RBAC for the EU data
Answer
**Correct: C** **Why:** Workspace count is driven by data residency and tenancy, not subscription count. Two workspaces satisfy the EU boundary, cross-workspace queries keep a single SOC investigation surface, and Lighthouse provides cross-tenant access without a tenant migration project. A global workspace violates residency. Twelve workspaces are costly and fragment investigation. Tenant migration is a large project when Lighthouse achieves the operational goal now.Question 4¶
Scenario: An insurer requires that application VMs reach Azure Storage without traffic traversing the public internet, that the storage account is unreachable from any other network, and that on-premises systems over ExpressRoute reach it privately.
A. Service endpoints on the VM subnet, with the storage firewall limited to that subnet so only its VMs connect B. Storage firewall rules allowlisting the on-premises public IP range of the ExpressRoute Microsoft peering circuit C. Private endpoint with public network access disabled, plus a linked private DNS zone and on-premises conditional forwarders D. A service endpoint for the VM subnet and a private endpoint for the on-premises systems
Answer
**Correct: C** **Why:** Only a private endpoint gives the resource a private IP and allows disabling public access entirely, and only it extends to on-premises over ExpressRoute. Service endpoints keep a public IP on the resource and do not work from on-premises. IP allowlisting still traverses the public internet. Configuring both is redundant and makes DNS resolution ambiguous. The private DNS component is part of the correct answer, not an optional extra.Question 5¶
Scenario: An organization runs Azure, AWS, GCP, and VMware on-premises. It wants one posture view, one ISO 27001 compliance report across all environments, and runtime threat detection on servers, with minimal agent sprawl.
A. Separate compliance reporting per cloud, with each platform's native tool and the results merged by hand for the audit B. Defender for Cloud with AWS and GCP connectors, Azure Arc for VMware, and Defender for Servers Plan 2 C. Deploy Defender for Endpoint independently on every server, and onboard each one to the Defender portal by script D. A third-party CSPM product with agentless scanning of the three clouds
Answer
**Correct: B** **Why:** Defender for Cloud is the single posture plane; native connectors bring AWS and GCP in agentlessly; Arc projects the VMware servers into Azure Resource Manager; and Defender for Servers Plan 2 deploys Defender for Endpoint through Arc rather than as a separate agent stack, satisfying the agent-sprawl constraint. A third-party tool adds a product the native connectors make unnecessary. Separate reports fail the single-report requirement.Question 6¶
Scenario: A hospital group must keep on-premises Active Directory authoritative and has a compliance requirement that password hashes must not be stored in the cloud in any form. Which hybrid identity method fits, and what is the consequence?
A. Password hash sync, which stores a hash of the password hash in Entra ID; there is no consequence B. Cloud-only identities, which remove the sync client; on-premises authority is lost C. AD FS federation, which is the simplest option to operate because Microsoft hosts the whole farm and all of the proxies for you D. Pass-through authentication with redundant connectors; cloud sign-in depends on on-premises connector availability
Answer
**Correct: D** **Why:** PTA validates credentials against on-premises AD without storing any hash in Entra ID, satisfying the constraint. The consequence is that sign-in depends on connector availability, so a datacenter outage breaks cloud authentication. Password hash sync is Microsoft's default recommendation but is excluded by the constraint. Cloud-only loses on-premises authority. AD FS meets the constraint but adds substantial infrastructure and is the option Microsoft guidance steers away from.Question 7¶
Scenario: A payments company must isolate its cardholder data environment, inspect all traffic between it and the rest of the estate including TLS-encrypted flows, prevent direct internet egress, and produce PCI DSS assessment evidence.
A. Azure Firewall Premium in the hub with TLS inspection and IDPS, forced tunneling, a dedicated CDE subscription, and the PCI DSS initiative B. A single subscription with resource groups as the compliance boundary, using RBAC and tags to scope the audit evidence C. Azure Firewall Standard in a hub, with NSGs in the spoke, and its threat intelligence filtering set to alert and deny D. NSGs and application security groups only, with flow logs enabled and sent to a Log Analytics workspace for the auditors
Answer
**Correct: A** **Why:** Premium is the tier that provides TLS inspection and IDPS, which Standard lacks. Forced tunneling removes direct internet routes. Aligning the compliance boundary with a subscription and management group gives clean policy, RBAC, and audit scoping. The regulatory compliance dashboard supplies assessment evidence. NSGs alone offer no layer 7 inspection.Question 8¶
Scenario: A company is deploying an internal AI assistant over SharePoint and OneDrive. Legal is concerned employees will surface documents they should not see. Reclassifying the entire document estate by hand is not acceptable.
A. Rely on the assistant's built-in filtering, which hides sensitive documents from users whatever the permissions say B. Block the assistant from all sites containing sensitive data, using a restricted search setting for those sites C. Manually classify the highest-risk document libraries first, then extend D. Fix oversharing at the source, then apply Purview auto-labeling, DLP for AI applications, and DSPM for AI
Answer
**Correct: D** **Why:** An AI assistant honors existing permissions, so oversharing in SharePoint becomes exposure in the assistant. The correct sequence is fix permissions, then classify at scale with auto-labeling, then enforce with DLP, then monitor with DSPM for AI. Blocking sites defeats the deployment. Built-in filtering enforces permissions, it does not fix them. Manual classification fails the stated constraint.Question 9¶
Scenario: A design must ensure that a recommendation about misconfigured storage accounts appears in a compliance report, and that exploitation attempts against those accounts raise alerts. Which Defender for Cloud capabilities are needed?
A. CSPM for the recommendation and Defender for Storage for runtime alerting B. CSPM only, since it also raises alerts when it sees an exploitation attempt against a misconfigured account C. Azure Policy only, with an audit effect for the compliance report and an alert rule on the activity log D. Defender for Storage only, which reports the misconfiguration and also raises the exploitation alerts
Answer
**Correct: A** **Why:** Posture and compliance recommendations come from CSPM, which is largely free. Runtime threat detection, including malware scanning and anomalous access alerts, requires the paid Defender for Storage workload plan. The two halves answer different requirements, and questions frequently include both in one scenario.Question 10¶
Scenario: Which Zero Trust principle does requiring a compliant device through Conditional Access primarily implement?
A. Assume breach, which means designing as if an attacker is already inside B. Segment everything, which means splitting the network into small zones C. Verify explicitly, which means authorizing on every available signal, such as device state D. Use least privilege access, giving each identity only the access it needs
Answer
**Correct: C** **Why:** Verify explicitly means authenticating and authorizing on all available signals, including device state. Least privilege concerns the scope of granted access, addressed by PIM and RBAC. Assume breach drives segmentation, encryption, and detection. "Segment everything" is not one of the three principles.Question 11¶
Scenario: A regulated customer requires that Microsoft cannot access the keys protecting their data, and that the key store is single-tenant and FIPS 140-2 Level 3 validated. What should the design specify?
A. Platform-managed keys, which Microsoft rotates and protects B. Double encryption with platform-managed keys C. Azure Key Vault Managed HSM, a single-tenant FIPS 140-2 Level 3 module D. Customer-managed keys in the standard Key Vault tier, which gives key control but uses a multi-tenant service
Answer
**Correct: C** **Why:** Managed HSM provides a single-tenant, FIPS 140-2 Level 3 validated HSM under customer control. Standard Key Vault is multi-tenant and validated at a lower level. Platform-managed keys give the customer no key control at all. Double encryption adds layers but does not satisfy the single-tenancy and validation requirements.Question 12¶
Scenario: A design must give a central SOC visibility into on-premises Windows servers, including vulnerability assessment and file integrity monitoring, with the least agent management.
A. Defender for Servers Plan 2 through Azure Arc B. Forward Windows event logs to Sentinel only, using the Azure Monitor agent and the security events connector C. Defender for Servers Plan 2 enabled on the Azure subscription only, with the on-premises servers left unconnected D. Install Defender for Endpoint manually on each server and run vulnerability scans from the Defender portal
Answer
**Correct: A** **Why:** Vulnerability assessment, file integrity monitoring, just-in-time VM access, and agentless scanning are Plan 2 capabilities. Plan 1 covers Defender for Endpoint integration but not those, and enabling a plan on a subscription (C) does nothing for on-premises servers that are not connected through Arc. Arc is the mechanism that brings non-Azure servers into scope and carries the agent, minimizing separate agent management. Log forwarding alone gives no endpoint protection.Question 13¶
Scenario: Which control should a design use to ensure that no resource in a management group can be created with a public IP address?
A. A Conditional Access policy that blocks the creation of any resource by an identity that is not on a compliant device B. An Azure Policy assignment with a deny effect at the management group scope C. An NSG rule on each subnet that denies inbound traffic from the internet to any address in the range D. A Defender for Cloud recommendation to remove public IP addresses, with an owner and a due date assigned
Answer
**Correct: B** **Why:** "Ensure" and "prevent" call for prevention rather than detection. Azure Policy deny stops the resource being created. A Defender for Cloud recommendation reports non-compliance after the fact. NSGs filter traffic, they do not prevent resource creation. Conditional Access governs sign-in conditions.Question 14¶
Scenario: An organization has Microsoft-only workloads, standard detection needs, no third-party log sources, and a strict cost constraint. What should the security operations design recommend?
A. Microsoft Defender XDR alone, deferring Sentinel until a third-party source or long retention is needed B. Microsoft Sentinel with every connector enabled, so that each Microsoft signal is ingested and kept in the workspace C. A third-party SIEM, deployed on virtual machines in the tenant, with connectors for each of the Microsoft services D. Sentinel with Basic logs for every table, to cut the ingestion charge
Answer
**Correct: A** **Why:** Defender XDR provides correlated detection and response across the Microsoft estate with per-user or per-workload licensing rather than per-GB ingestion. Sentinel earns its cost when you need third-party sources, custom analytics, or long retention. Enabling all connectors is the classic cost mistake. Basic logs reduce cost but also reduce query capability and do not change the underlying question of whether a SIEM is needed.Question 15¶
Scenario: A design must let a single SOC team investigate incidents across two Entra tenants after an acquisition, without migrating identities. What should it use?
A. Merging the tenants immediately, with a cross-tenant migration B. A second SOC team in its own workspace, handing off by ticket C. B2B guest accounts for every analyst in the other tenant, with roles assigned to each guest on the workspaces D. Azure Lighthouse delegated resource management across the two tenants
Answer
**Correct: D** **Why:** Lighthouse provides cross-tenant delegated management so one team operates across both without identity migration or duplicated accounts. Guest accounts scale poorly and complicate privileged access. A second team duplicates cost. Tenant merger is a long project that does not answer the immediate operational need.Scoring guide¶
- 13-15 correct (85%+): Ready. Focus remaining time on case study technique and reading for the constraint.
- 10-12 correct (65-80%): Re-read the domain notes for your weak areas, especially Domain 2, which is 30-35% of the exam.
- Below 10: Work the scenarios and the Microsoft Cybersecurity Reference Architectures before retesting.
Remember that on SC-100 more than one option is usually technically valid. The qualifier in the question, such as "least administrative effort" or "without additional licensing", is what selects the answer.