Microsoft SC-100: Microsoft Cybersecurity Architect

Last checked October 22, 2026 against the official Microsoft exam page.

1. Question 1Design security operations

   A security operations team wants to correlate signals from endpoints, identities, email, and cloud workloads in one place. Which architecture supports this?

   1. ADisabling logs from every source except one endpoint agent to reduce storage costs and ingestion noise
   2. BA cloud SIEM and extended detection and response platform collecting signals from all sources
   3. CSeparate spreadsheets maintained by each team for each source, reviewed manually by analysts once per quarter
   4. DRelying on each team to report suspicious alerts by phone to the on-call manager
   Show answer and explanationHide answer

   Correct answer: B

   A cloud SIEM and XDR collect and correlate signals across sources for detection and response. Spreadsheets, phone reporting, and single-source logs cannot provide cross-domain correlation.

2. Question 2Design identity and access

   A company wants to prevent credential theft through phishing for its administrator accounts. Which authentication method is most appropriate?

   1. APhishing-resistant MFA such as passkeys or FIDO2 security keys
   2. BSecurity questions about childhood pets and birthplaces
   3. CSMS one-time codes sent to a registered mobile phone
   4. DA longer password alone, rotated every 30 days by IT
   Show answer and explanationHide answer

   Correct answer: A

   Phishing-resistant MFA binds authentication to the legitimate site, which defeats credential-harvesting attacks. SMS codes can be intercepted or phished, longer passwords alone are insufficient, and security questions are weak.

3. Question 3Design infrastructure security

   An architect must protect a web application from distributed denial-of-service attacks and common web exploits at the edge. Which combination is most appropriate?

   1. AA larger monitor for reviewing the dashboards and open alert queues
   2. BDisabling inbound web traffic on port 443 at the regional load balancer
   3. CA printed sign warning attackers that the site is actively monitored
   4. DWeb application firewall with DDoS protection at the edge
   Show answer and explanationHide answer

   Correct answer: D

   A web application firewall and edge DDoS protection filter attacks before they reach the application. Signs, monitors, and disabling traffic do not provide technical protection.

4. Question 4Design governance and risk

   A board wants a clear view of cyber risk over time, expressed in business terms. Which approach supports this?

   1. AA risk register with quantified impact and trend reporting
   2. BNo reporting of cyber risk to the board until a breach actually occurs
   3. CA monthly story about the weather in the office
   4. DA list of technical jargon for the board members
   Show answer and explanationHide answer

   Correct answer: A

   A risk register with quantified impacts and trend reporting translates technical risk into business terms. Jargon, weather stories, and waiting for a breach do not inform decisions.

5. Question 5Design a zero trust strategy and architecture

   A company wants to adopt zero trust across its hybrid estate. Which principle should guide the architecture first?

   1. ARely on one perimeter firewall to separate the trusted internal network from external traffic
   2. BGive administrators permanent broad access across subscriptions and on-premises systems for speed and convenience
   3. CVerify explicitly and enforce least privilege for every access request, regardless of network location
   4. DTrust traffic originating inside the corporate network after it passes the perimeter firewall, needing no checks
   Show answer and explanationHide answer

   Correct answer: C

   Zero trust starts with explicit verification and least privilege, independent of network location. Trusting internal traffic, a single perimeter, and permanent broad access contradict the model.