CertArea
All Microsoft exams

Free SC-100 practice test: 30 questions with answers

30 original questions for Microsoft Cybersecurity Architect, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
100 questions

SC-100 exam guide: topics, cost and format

All 30 SC-100 questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Design security operations (4 questions)

  1. Question 1

    A security operations team wants to correlate signals from endpoints, identities, email, and cloud workloads in one place. Which architecture supports this?

    1. ADisabling logs from every source except one endpoint agent to reduce storage costs and ingestion noise
    2. BA cloud SIEM and extended detection and response platform collecting signals from all sources
    3. CSeparate spreadsheets maintained by each team for each source, reviewed manually by analysts once per quarter
    4. DRelying on each team to report suspicious alerts by phone to the on-call manager
    Show answer and explanation
    Correct answer: B

    A cloud SIEM and XDR collect and correlate signals across sources for detection and response. Spreadsheets, phone reporting, and single-source logs cannot provide cross-domain correlation.

  2. Question 2

    An incident response plan must define who makes decisions during an incident and how evidence is preserved. Which element is required?

    1. AA list of favourite websites and personal streaming services that staff visit during working hours
    2. BRoles, escalation paths, and evidence-handling procedures in the incident response plan
    3. CA holiday schedule listing staff leave dates, public closures, and the annual office party calendar
    4. DA menu of office coffee and tea blends with weekly rotating pastry options from the cafeteria
    Show answer and explanation
    Correct answer: B

    Clear roles, escalation paths, and evidence procedures make response effective and legally defensible. Favourite websites, holiday schedules, and coffee menus are not incident response elements.

  3. Question 3

    A security team wants automated responses to certain alerts, such as isolating a device when malware is confirmed. Which capability supports this?

    1. ASecurity orchestration, automation, and response playbooks
    2. BA manual checklist printed weekly and filed by the shift supervisor
    3. CIgnoring alerts in the queue until the next compliance audit
    4. DDisabling automated response workflows for endpoints
    Show answer and explanation
    Correct answer: A

    SOAR playbooks automate defined responses such as isolation, which speeds containment. Weekly checklists, ignoring alerts, and disabling automation slow or prevent response.

  4. Question 4

    Which metric best reflects how quickly a security team detects a threat once it begins?

    1. AMean time to detect
    2. BNumber of desk plants
    3. CAverage coffee break length
    4. DNumber of printers
    Show answer and explanation
    Correct answer: A

    Mean time to detect measures detection speed, which is central to security operations. Printers, breaks, and plants are unrelated.

Design identity and access (4 questions)

  1. Question 5

    A company wants to prevent credential theft through phishing for its administrator accounts. Which authentication method is most appropriate?

    1. APhishing-resistant MFA such as passkeys or FIDO2 security keys
    2. BSecurity questions about childhood pets and birthplaces
    3. CSMS one-time codes sent to a registered mobile phone
    4. DA longer password alone, rotated every 30 days by IT
    Show answer and explanation
    Correct answer: A

    Phishing-resistant MFA binds authentication to the legitimate site, which defeats credential-harvesting attacks. SMS codes can be intercepted or phished, longer passwords alone are insufficient, and security questions are weak.

  2. Question 6

    A business wants privileged roles to be granted only when needed and removed automatically afterwards. Which approach fits?

    1. AJust-in-time privileged access with approval and time limits
    2. BPermanent global administrator roles for convenience
    3. CNo privileged roles assigned to staff in the directory
    4. DShared admin accounts used daily by the operations team
    Show answer and explanation
    Correct answer: A

    Just-in-time access grants elevated rights only when needed, with approval and automatic expiry. Permanent roles, shared accounts, and no roles either increase risk or block operations.

  3. Question 7

    A multi-cloud organization wants one identity system to govern access across cloud platforms. Which architecture element provides this?

    1. AShared passwords stored in a spreadsheet on a shared drive
    2. BSeparate local accounts on every platform with no central control or audit trail
    3. CA central identity provider with federation to each cloud platform
    4. DAnonymous access to cloud resources through public endpoints
    Show answer and explanation
    Correct answer: C

    A central identity provider with federation gives consistent governance across platforms. Separate local accounts, shared spreadsheets of passwords, and anonymous access each weaken control.

  4. Question 8

    A third-party application needs access to company data on behalf of users. Which standard should be used for delegated authorization?

    1. AA permanent administrator account for the third party
    2. BOAuth 2.0 with scoped, time-limited tokens
    3. CSharing each user's password with the third party
    4. DEmailing data exports
    Show answer and explanation
    Correct answer: B

    OAuth 2.0 delegates scoped, time-limited access without sharing passwords. Sharing passwords, email exports, and permanent admin accounts are unsafe.

Design infrastructure security (4 questions)

  1. Question 9

    An architect must protect a web application from distributed denial-of-service attacks and common web exploits at the edge. Which combination is most appropriate?

    1. AA larger monitor for reviewing the dashboards and open alert queues
    2. BDisabling inbound web traffic on port 443 at the regional load balancer
    3. CA printed sign warning attackers that the site is actively monitored
    4. DWeb application firewall with DDoS protection at the edge
    Show answer and explanation
    Correct answer: D

    A web application firewall and edge DDoS protection filter attacks before they reach the application. Signs, monitors, and disabling traffic do not provide technical protection.

  2. Question 10

    A cloud workload must be administered without exposing management ports to the internet. Which design is recommended?

    1. AOpen RDP and SSH ports to the internet on every public IP address range
    2. BUse a public IP and default ports for administration
    3. CUse a secure bastion or just-in-time access for administration
    4. DShare a single administrator password across every server in the environment
    Show answer and explanation
    Correct answer: C

    A bastion or just-in-time access keeps management ports private and controlled. Open ports, shared passwords, and public administration expose the workloads.

  3. Question 11

    Which control helps enforce a consistent security baseline for cloud resources, such as requiring encryption and blocking public storage access?

    1. AManual review of cloud configurations once per year by the security team
    2. BCloud policy with deny effects for non-compliant configurations
    3. CTrusting each team's judgement on encryption settings
    4. DA laminated printed guideline posted on the wall of the office kitchen
    Show answer and explanation
    Correct answer: B

    Deny-effect policies stop non-compliant resources from being created, which enforces the baseline. Annual reviews, wall guidelines, and trusting judgement do not enforce it consistently.

  4. Question 12

    An organization runs workloads in several clouds and on-premises datacentres. Which practice helps keep security policies consistent across all of them?

    1. ANo security policies defined for on-premises systems or the datacentre servers hosting legacy apps today
    2. BRelying on each cloud provider's default settings to define every security policy in use across the estate
    3. CA central security posture management solution with consistent policies across environments
    4. DSeparate policies written independently by each team for its own workloads and tooling
    Show answer and explanation
    Correct answer: C

    A central posture management solution applies consistent policies and measures compliance across environments. Independent policies, missing on-premises policies, and relying only on providers leave gaps.

Design governance and risk (4 questions)

  1. Question 13

    A board wants a clear view of cyber risk over time, expressed in business terms. Which approach supports this?

    1. AA risk register with quantified impact and trend reporting
    2. BNo reporting of cyber risk to the board until a breach actually occurs
    3. CA monthly story about the weather in the office
    4. DA list of technical jargon for the board members
    Show answer and explanation
    Correct answer: A

    A risk register with quantified impacts and trend reporting translates technical risk into business terms. Jargon, weather stories, and waiting for a breach do not inform decisions.

  2. Question 14

    A security architect must decide whether to accept a residual risk identified in an audit. Which process should be followed?

    1. AFormal risk acceptance by an accountable owner with documented rationale and review date
    2. BIgnore the risk in the register until it causes a material incident in production
    3. CThe architect decides alone without documentation and informs the team afterward
    4. DDelete the finding from the report before the audit committee sees it
    Show answer and explanation
    Correct answer: A

    Formal acceptance by an accountable owner with documented rationale and review date keeps governance intact. Silent decisions, ignoring risk, and deleting findings remove accountability.

  3. Question 15

    A company must assess the security of a third-party software provider before onboarding it. Which practice is most appropriate?

    1. AAccepting the vendor's marketing claims and product datasheets as sufficient evidence of its security posture
    2. BOnboarding the vendor immediately under a standard contract and scheduling the security review for later
    3. CSkipping the assessment for vendors from well-known brands that are widely trusted in the industry
    4. DA vendor security assessment that reviews controls, certifications, and contractual obligations
    Show answer and explanation
    Correct answer: D

    A vendor assessment checks controls, certifications, and contract terms before onboarding. Marketing claims, late reviews, and brand-based trust do not verify security.

  4. Question 16

    Which three elements should a security strategy include to be effective for executives? (Choose three.)

    1. AClear objectives tied to business outcomes
    2. BMeasurable metrics with targets
    3. CRoles and responsibilities for each control
    4. DTechnical details of every firewall rule
    5. EThe name of the office coffee supplier
    Show answer and explanation
    Correct answer: A, B, C

    Business-linked objectives, measurable metrics, and clear roles make a strategy actionable and accountable. Firewall rule details and coffee suppliers do not belong in an executive strategy.

Design a zero trust strategy and architecture (4 questions)

  1. Question 17

    A company wants to adopt zero trust across its hybrid estate. Which principle should guide the architecture first?

    1. ARely on one perimeter firewall to separate the trusted internal network from external traffic
    2. BGive administrators permanent broad access across subscriptions and on-premises systems for speed and convenience
    3. CVerify explicitly and enforce least privilege for every access request, regardless of network location
    4. DTrust traffic originating inside the corporate network after it passes the perimeter firewall, needing no checks
    Show answer and explanation
    Correct answer: C

    Zero trust starts with explicit verification and least privilege, independent of network location. Trusting internal traffic, a single perimeter, and permanent broad access contradict the model.

  2. Question 18

    A security architect is asked to choose the first zero trust area to implement in an organization with mostly cloud workloads. Which area offers the strongest early return?

    1. ATurning off security monitoring and audit log collection for cloud workloads to reduce alert noise and cost
    2. BReplacing every network cable in the office building with new Cat6 hardware
    3. CIdentity as the primary control plane, with strong authentication and conditional access
    4. DPrinting security policies on paper and distributing binders to every employee's desk for annual audit
    Show answer and explanation
    Correct answer: C

    Identity is the primary control plane in zero trust, and strong authentication with conditional access gives broad early benefit. Cabling, printing policies, and disabling monitoring do not advance zero trust.

  3. Question 19

    Which framework is commonly used to organise security controls into identity, devices, data, network, infrastructure, applications, and visibility for zero trust planning?

    1. AA spreadsheet with no categories or labels
    2. BA printer maintenance schedule for the office fleet
    3. CThe Microsoft Zero Trust framework pillars
    4. DA marketing plan for new launches
    Show answer and explanation
    Correct answer: C

    The Microsoft Zero Trust framework organizes controls into pillars such as identity, devices, data, and infrastructure. A spreadsheet without categories, printer schedules, and marketing plans are not security frameworks.

  4. Question 20

    An architect must decide how to protect a legacy on-premises application that cannot support modern authentication. Which design is most appropriate?

    1. AReplace the application immediately without a migration plan, moving users to a new platform overnight
    2. BExpose it directly to the internet on a public IP address with its original login page enabled
    3. CRemove authentication on the legacy endpoint to avoid compatibility issues with newer browsers and clients
    4. DPublish it through a secure access proxy that enforces modern authentication and conditional access in front of it
    Show answer and explanation
    Correct answer: D

    A secure access proxy adds modern authentication and conditional access without changing the legacy app. Direct exposure, removing authentication, and unplanned replacement increase risk or disruption.

Design application security (4 questions)

  1. Question 21

    A web application stores user passwords in a database as plain text. Which architectural change addresses this most directly?

    1. AEmail each user's current password to them every month as a reminder for safekeeping
    2. BShow the stored password on the login page for users to verify their entry
    3. CStore only salted, slow password hashes and never store plain-text passwords
    4. DEncrypt the site with one shared key embedded in the page source code
    Show answer and explanation
    Correct answer: C

    Salted, slow hashes protect passwords even if the database is stolen, and plain text should never be stored. Shared page keys, emailed passwords, and visible passwords expose credentials.

  2. Question 22

    Which approach helps protect an API that is called by many client applications from abuse and excessive requests?

    1. ARemoving request logging at the gateway to save storage
    2. BPublishing the API key in a public web page's HTML
    3. CAllowing unlimited anonymous requests from each client with no quotas
    4. DAPI management with authentication, rate limits, and quotas
    Show answer and explanation
    Correct answer: D

    API management enforces authentication, rate limits, and quotas to prevent abuse. Public keys, unlimited anonymous access, and no logging make abuse easier and harder to detect.

  3. Question 23

    A development team wants to find security flaws in its application code before deployment. Which practice is most appropriate?

    1. AStatic application security testing integrated into the build pipeline
    2. BSkipping peer code review to save time before merging changes
    3. CRelying on the hosting provider's platform controls alone to secure the code
    4. DRunning security tests after customers report problems in production releases
    Show answer and explanation
    Correct answer: A

    Static analysis in the pipeline finds flaws early and consistently. Waiting for reports, skipping review, and relying on the host do not find application-level vulnerabilities before release.

  4. Question 24

    An application must not trust input from users, which could contain malicious commands. Which practice is most important?

    1. AConcatenate user input directly into database query strings
    2. BTrust input without checks because users are internal staff members
    3. CValidate and encode input and use parameterized queries
    4. DDisable input fields on every form that accepts user data entry
    Show answer and explanation
    Correct answer: C

    Input validation, encoding, and parameterized queries prevent injection attacks. Trusting input, concatenating it into commands, and disabling fields do not address injection.

Design data security (3 questions)

  1. Question 25

    A company stores sensitive customer records in a database. Which control protects the data even if an attacker obtains the database files?

    1. AAnonymous public read access on the database
    2. BEncryption at rest with keys managed separately
    3. CStoring keys in the same file as the data
    4. DStoring the database on a shared USB drive
    Show answer and explanation
    Correct answer: B

    Encryption at rest with separately managed keys protects stolen files because the keys are not available to the attacker. Keys stored with the data and public or shared storage offer no protection.

  2. Question 26

    A data governance requirement says that sensitive columns should be visible only to a small group of analysts. Which design implements this in a database?

    1. ADeleting the sensitive columns from the production database and keeping a copy
    2. BPrinting the sensitive columns for analysts on paper and filing them in a cabinet
    3. CGiving everyone full access and asking them to be careful with sensitive customer values
    4. DColumn-level access controls or dynamic masking for non-authorized users
    Show answer and explanation
    Correct answer: D

    Column-level access controls or masking restrict visibility to authorized users technically. Trusting people, deleting needed data, and printing data do not meet the requirement.

  3. Question 27

    A company must prevent data exfiltration through unsanctioned cloud storage services. Which control is most appropriate?

    1. AAllowing unrestricted cloud services with no logging
    2. BAsking users not to upload data to personal storage drives
    3. CDisabling the entire corporate network for every user
    4. DCloud app control that blocks or monitors unsanctioned services
    Show answer and explanation
    Correct answer: D

    Cloud app control identifies and restricts unsanctioned services, which limits exfiltration. Unrestricted access, disabling networks, and unenforced requests do not provide technical control.

Design regulatory compliance (3 questions)

  1. Question 28

    An organization must demonstrate compliance with a regulation across its cloud estate. Which capability helps track control status against that regulation?

    1. ACompliance assessment that maps controls to the regulation with improvement actions
    2. BA marketing brochure describing the cloud provider's compliance commitments
    3. CA printed copy of the full regulation text filed in a binder on a shelf in the compliance office
    4. DA recurring calendar reminder sent to the compliance team every quarter to review the regulation
    Show answer and explanation
    Correct answer: A

    A compliance assessment maps controls to regulations and tracks improvement, which supports evidence and reporting. A shelf copy, calendar reminder, and brochure do not measure control status.

  2. Question 29

    A regulation requires that personal data be deleted when it is no longer needed. Which design element supports this requirement?

    1. AHiding the records from the data protection team
    2. BRetention and deletion policies applied to the data stores
    3. CKeeping every record indefinitely in case it is useful
    4. DCopying personal data into additional analytics and reporting systems
    Show answer and explanation
    Correct answer: B

    Retention and deletion policies enforce the requirement across data stores. Keeping everything, copying data, and hiding it from the policy team fail the requirement.

  3. Question 30

    A regulation requires that a company be able to show evidence that its security controls operated over a period. Which practice provides this evidence?

    1. AA marketing summary of the platform's strong controls
    2. BA verbal statement from the security lead confirming the controls operated as designed
    3. CContinuous control monitoring and retained compliance reports over time
    4. DA single screenshot taken on the final day of the audit period
    Show answer and explanation
    Correct answer: C

    Continuous monitoring with retained reports demonstrates control operation over the period. A single screenshot, verbal statements, and marketing summaries are not sufficient evidence.

Want more SC-100 questions?

The full bank has 100 questions with answers and explanations, as a PDF, an online practice exam, or both.

Full question bank · 100 questions
$89$124

Both formats together. The best value.

Instant access after payment, with 90 days of updates. Checkout is on our store, AIExamCerts.