Skip to content
Azure Mastery Exam SC-100 Download
Azure Mastery

Microsoft Certification SC-100

SC-100: Predict your score. Know what to study next.

See your predicted score, follow a study plan based on your answers, and revisit topics you're starting to forget. It all runs on your device.

472 practice questions AI score prediction 100% offline
Try a practice question →

50+ free questions per exam · No account needed.
Full banks: one-time purchase. Pro adds every bank and advanced study tools. Compare access options.

Original questions with written explanations. How we review them · About readiness estimates

Download free iPhone & iPad · Free to start QR code — scan with your iPhone to open Azure Mastery on the App Store On your Mac?
Scan to install

Inside the app

Nine interactive practice formats, on iPhone

Azure Mastery has nine interactive formats for exam practice. The examples below show original SC-100 practice questions in Azure Mastery on iPhone and iPad. The exam simulator uses timed sessions with the published domain weights. Microsoft's live interface and question mix may differ.

Which Microsoft pillar is the PRIMARY security perimeter in a Zero Trust architecture?

  • Network
  • Data
  • Endpoint
  • Identity

Multiple choice

An original SC-100 practice question with one correct answer. Choose an option to read its written rationale.

Exam-specific sample
Explore more question formats

Which TWO pillars are part of the Azure Well-Architected Framework? (Choose 2)

  • Reliability
  • Marketing
  • Security
  • Procurement

Multi-select

An original SC-100 multi-select question. Select all the correct options to earn the mark.

All-or-nothing

Drag-and-drop

An original SC-100 ordering question you can answer by touch on iPhone and iPad.

Interactive item

Hotspot

An original SC-100 question with a visual prompt, designed for touch on iPhone and iPad.

Tap target

Case studies

An original SC-100 case study with several questions about the same requirements and environment.

Multi-question

Answer Coach

Answer Coach explains why the answer is correct and, where available, why each option is right or wrong. It helps you understand a mistake and remember the distinction. Read explanations after each question or at the end of a practice test. On supported devices, optional AI can reword a note on your device after checking it against the written guidance.

App exclusive

SC-100 Practice Questions & Exam Prep — Microsoft Cybersecurity Architect

Get exam-ready for SC-100 (Microsoft Cybersecurity Architect Expert) on iPhone or iPad. Azure Mastery uses on-device AI to predict your readiness score across all four SC-100 domains, build a personalised study plan from your weak spots, and surface topics you're forgetting. Core study stays on-device and works offline; optional sync uses your private iCloud account.

The exam

What is the SC-100 exam?

SC-100 is the exam for the Microsoft Certified: Cybersecurity Architect Expert credential — the most senior security cert in Microsoft's track. It's the credential hiring managers expect for "Cybersecurity Architect", "Lead Security Engineer", or "Cloud Security Architect" roles.

Passing SC-100 alone doesn't award the certification: Microsoft also requires one of three active Associate-level credentials — Identity and Access Administrator Associate (SC-300), Security Operations Analyst Associate (SC-200), or Cloud and AI Security Engineer Associate (SC-500).

Microsoft replaced the retired AZ-500 route with SC-500 in the current prerequisite list. You can take SC-100 before earning the Associate credential, but the expert certification is awarded only after both requirements are active on your profile. The prerequisite is the active Associate credential, not merely a pass on its exam.

SC-100 is design-oriented and trade-off-heavy. Unlike Associate exams that test individual-service knowledge, it tests architectural reasoning: picking the right strategy under real-world constraints. It validates that you can:

Expect scenario questions where multiple answers could work; the right one is whichever best satisfies the stated constraints.

Architectural questions often turn on where a control operates: tenant, management plane, workload edge, or external attack surface. Sketch the trust boundary and ownership model before comparing products; a technically capable service can still be wrong when it leaves the required control plane or evidence source untouched.

SC-100: English revision effective 21 October 2026. Architecture candidates should revisit security-operations design and evaluation of Microsoft 365 protection. Both groups have minor revisions in the published change log. Earlier sittings use the preceding outline. See the official version and change log for your exam language. Its document update is 21 September 2026; that is not the effective date.

Published domains · English revision 21 October 2026

SC-100 exam objectives

Cybersecurity architecture begins with business security priorities and connects operations, identity, infrastructure, applications, and data. Compare control coverage, ownership boundaries, and the evidence needed to support a design choice. These four groups frame the Expert-level architecture work. See the published outline; the revision notice above explains which date applies.

Aura presents a visual map of identity, protection, detection, and governance skills.
Security skill map

Design solutions that align with security best practices and prioritiesPublished weight 20–25%

98 exam-scoped practice questions in the app

Explore Best Practices topics
  • Design a resiliency strategy for ransomware and other attacks based on Microsoft Security Best Practices
  • Design solutions that align with the Microsoft Cybersecurity Reference Architectures (MCRA) and Microsoft Cloud Security Benchmark (MCSB)
  • Design solutions that align with the Microsoft Cloud Adoption Framework for Azure (CAF) and the Azure Well-Architected Framework
  • This domain tests setting direction: ransomware resilience, MCRA and MCSB alignment, and CAF or WAF governance recommendations.
  • Candidates who only studied Associate-level configuration struggle here, since the exam wants a recommended strategy, not a setting.
  • Practise stating which framework, MCRA, MCSB, or CAF, a described requirement calls for before naming any product.

Design security operations, identity, and compliance capabilitiesPublished weight 25–30%

141 exam-scoped practice questions in the app

Explore SecOps topics
  • Design solutions for security operations
  • Design solutions for identity and access management
  • Design solutions for securing privileged access
  • Design solutions for regulatory compliance
  • This domain spans the most products: SecOps design with Sentinel and Defender XDR, identity strategy, privileged access, and compliance.
  • Legacy admin-tiering language often replaces the enterprise access model the exam now expects.
  • Learn the enterprise access model's three planes before practising any privileged-access scenario in this domain.

Design security solutions for infrastructurePublished weight 25–30%

126 exam-scoped practice questions in the app

Explore Infrastructure topics
  • Design solutions for security posture management in hybrid and multicloud environments
  • Specify requirements for securing server and client endpoints
  • Specify requirements for securing SaaS, PaaS, and IaaS services
  • Evaluate solutions for network security and Security Service Edge (SSE)
  • This domain tests specifying requirements across posture management, endpoints, SaaS/PaaS/IaaS, and Security Service Edge.
  • Candidates confuse Defender for Cloud's posture management with Sentinel's active threat response, though the exam treats them separately.
  • Keep posture management and active response as two separate domains in your head; scenarios rarely mix them.

Design security solutions for applications and dataPublished weight 20–25%

107 exam-scoped practice questions in the app

Explore Apps & Data topics
  • Evaluate solutions for securing Microsoft 365
  • Design solutions for securing applications
  • Design solutions for securing an organization's data
  • Securing Microsoft 365 workloads, application threat modelling, and data protection including AI workloads all sit in this domain.
  • The newer requirement to evaluate data-security controls in Microsoft Copilot for Microsoft 365 gets under-revised most often.
  • Add Copilot data-security evaluation to your revision list; it's a recent addition many candidates miss.

Common traps

Where SC-100 candidates slip

Five recurring misconceptions that trip up otherwise well-prepared SC-100 candidates, grounded in the current skills outline.

Zero Trust is an architecture, not a single control

Candidates who deployed MFA or network segmentation sometimes treat either one alone as doing Zero Trust.

  • A single strong control, deployed harder, still reads as incomplete if the other pillars stay silent.
  • Build a Zero Trust answer that touches at least two pillars before you commit to a single-control fix.

MCRA, MCSB, and CAF or WAF answer different questions

Candidates reach for whichever framework name they remember best rather than the one the scenario actually calls for.

  • MCRA is a reference architecture; MCSB provides prescriptive security recommendations; CAF and WAF guide adoption and workload design.
  • A posture-management tool can assess an environment against MCSB, but the benchmark itself does not perform the measurement.

The enterprise access model has replaced legacy admin tiering

Candidates who studied older AD-centric tiering default to Tier 0, 1, 2 language on a privileged-access scenario.

  • Reasoning in terms of the control, management, and data-or-workload planes now replaces tier numbers entirely.
  • Retire Tier 0/1/2 language from your answers and reason in terms of the three enterprise access model planes.

Posture management and active response are different domains

Defender for Cloud appearing in a scenario doesn't automatically make the question about security operations.

  • A SOAR or incident-response design belongs in security operations, whatever product name the scenario mentions.
  • Ask whether the scenario wants a measurement of risk or a response to an active threat before choosing a domain.

The prerequisite gates the certification, not the exam booking

Candidates researching "can I take SC-100 first" often assume the prerequisite blocks registration itself.

  • Content readiness is what SC-100 grades; the prerequisite sits outside the exam, as a separate certification-award policy.
  • Book SC-100 whenever you're ready on content, and separately earn an active SC-200, SC-300, or SC-500 prerequisite certification.

Designed for SC-100

How Azure Mastery helps you pass SC-100

Exam-specific practice

  • 472 SC-100 practice questions, each tagged to one of the four official domains.
  • Coverage weights SecOps/identity/compliance and infrastructure security joint-heaviest at 25–30% each.
  • Practise picking the strategy that best satisfies stated constraints, the exam's actual reasoning style.

Predicted score

  • Exam IQ forecasts your SC-100 score on-device after about 30 questions, with a confidence range.
  • It names the specific framework or control-plane topic actually holding your score back.
  • Watch which of the four domains lags behind the others in the days before you book.

Adaptive study plan

  • Your plan leans hardest on whichever of SecOps or infrastructure security is currently your weakest.
  • Miss a Zero Trust strategy question and the next session surfaces another identity-strategy scenario.
  • Master a topic across three sessions and the plan moves toward your next weak spot.

Knowledge decay

  • Expert-level architecture spans dozens of products; a strategy mastered weeks ago fades fastest if unrevised.
  • A padlock cue appears on the Today screen once a topic starts approaching decay.
  • Weak Spots sessions pull decayed framework or control-plane topics back into rotation.

Exam rehearsal

  • Practise pacing. Microsoft allows marking and review; breaks and some section transitions restrict returning to earlier questions.
  • The four-domain split matches the published weighting, drawn entirely from Azure Mastery's own bank.
  • Microsoft alone sets the live SC-100 interface and its exact question order.

Answer Coach

  • Untangles SC-100's near-identical framework calls: MCRA vs MCSB, enterprise access model vs legacy admin tiering.
  • Get one wrong and Answer Coach names the specific distinction the scenario was testing.
  • Authored guidance covers every question; eligible devices can optionally reword a note once grounding checks pass.

Aura guidance

  • Aura tracks your first week of SC-100 sessions and updates its suggestions as patterns emerge.
  • Each session ends with a compact recap: what shifted, what to revisit, where to head next.

Private by design

  • Your SC-100 answer history, readiness gauge, and coaching notes stay put unless you opt into sync.
  • No Azure Mastery account and no external server ever sees your study data.
  • iCloud sync, if you switch it on, runs through your own private account only.

6-week study plan

Suggested SC-100 study plan

Practise security architecture decisions across strategy, infrastructure, applications and data. Use these six weeks of study blocks to build your trade-off reasoning, then rehearse.

  1. Security architecture frameworks

    • Review the Microsoft Cybersecurity Reference Architecture.
    • Explore the Microsoft Cloud Security Benchmark.
    • Review the Cloud Adoption Framework security baseline.

  2. Zero Trust and resilience

    • Design Zero Trust across identities, endpoints and networks.
    • Extend the strategy to applications and data.
    • Review ransomware resilience and recovery.

  3. Compliance and risk

    • Review compliance requirements and their design implications.
    • Consider sovereign-cloud constraints.
    • Compare risk-assessment approaches.

  4. Security operations strategy

    • Design SecOps with Sentinel and Defender XDR.
    • Plan Entra access controls and identity governance.
    • Review Purview compliance strategy.

  5. Endpoint and server strategy

    • Compare Defender for Endpoint and Defender for Servers.
    • Review secure baselines.
    • Plan hybrid and multi-cloud coverage with Azure Arc.

  6. Network security strategy

    • Design segmentation and perimeter protection.
    • Plan private connectivity.
    • Review Defender for Cloud network maps.

  7. Keys and secure access

    • Compare Key Vault, customer-managed keys and HSMs.
    • Plan secret management.
    • Review Bastion and just-in-time VM access.

  8. Container security

    • Review Defender for Containers and AKS hardening.
    • Plan image scanning.
    • Consider software supply-chain protection.

  9. Application security strategy

    • Review secure development lifecycle choices.
    • Plan DevSecOps and supply-chain security.
    • Practise threat modelling.

  10. Data security strategy

    • Review Purview Information Protection and labels.
    • Compare encryption choices for SQL, Cosmos DB and Storage.
    • Consider data residency.

  11. Practise trade-off reasoning

    • Use Focus Weak Spots to revisit gaps.
    • Re-read scenarios you missed.
    • Explain why each alternative is unsuitable.

  12. Timed rehearsal

    • Complete two 120-minute Exam Simulator sessions.
    • Review the reasoning behind missed answers.
    • Plan further practice where needed.

Frequently asked

SC-100 FAQs

MCRA vs MCSB — which framework does a given SC-100 scenario want?

MCRA shows how security capabilities fit together, while MCSB provides prescriptive security recommendations. A posture-management tool can assess an environment against MCSB, but the benchmark itself is guidance rather than a measurement service.

What's the SC-100 prerequisite?

An active Associate credential is required to earn Cybersecurity Architect Expert, alongside the SC-100 exam pass. Microsoft currently accepts Cloud and AI Security Engineer Associate, Security Operations Analyst Associate, or Identity and Access Administrator Associate. Choose one of those routes; they are alternatives. AZ-500 is absent from the current list. You can take SC-100 before finishing the qualifying credential, but an earlier Associate exam pass by itself is insufficient.

What format does the SC-100 exam use?

40–60 questions, with formats that vary by sitting. Azure Mastery's bank runs a similar spread: mostly single-answer, a meaningful share of scenario questions, yes/no and multi-select in roughly equal measure, plus a smaller mix of drag-to-match, dropdown, hotspot, ordering, and case-study items.

What's the SC-100 exam fee, and does renewal add to the cost?

The voucher costs USD $165 in the United States, around £128 in the UK. Microsoft occasionally runs free-voucher promotions around events like Build or Ignite. Renewal itself is free, a short annual online assessment, so factor only the original voucher into long-term cost.

Is SC-100 a lifetime certification, or does it need renewing?

The Cybersecurity Architect Expert credential is valid for one year. In the final six months, renew it at no charge through Microsoft's current online assessment; its length can change as the skills outline evolves. Fundamentals credentials such as AZ-900 do not expire.

SC-100 vs AZ-305 — which next for an architect?

Different lenses. SC-100 is the security architect cert: Zero Trust, ransomware resilience, SecOps strategy, identity governance. AZ-305 is the solutions architect cert: data, infrastructure, business continuity, identity and monitoring. They overlap on identity and governance; many senior architects hold both.

How soon can I resit SC-100 after a fail?

A first retake is available after 24 hours.

  • First retake: 24-hour wait.
  • All subsequent retakes: 14-day wait each.
  • Five total attempts maximum within 12 months of the first attempt, a fresh voucher required each sitting.
How is SC-100 different from an Associate-level security exam?

Associate exams like SC-200 and SC-300 test configuring a named product correctly. SC-100 tests designing the strategy those products serve, choosing between Sentinel automation and Defender XDR-native response for stated constraints. Multiple options can be valid; only one best satisfies the scenario.

Can I try Azure Mastery's SC-100 bank before paying?

Yes. The app is free to download with 50+ free SC-100 questions and written explanations. The full 472-question bank unlocks with a one-time exam-pack purchase, or a subscription unlocks every exam in the catalogue. Advanced study tools require Pro.

Can I rehearse SC-100 scenarios with no internet connection?

Yes. Practice, scoring, and the readiness prediction all run on-device, working with no connection at all. No account is required, and iCloud sync stays optional and private if you want it.

Free study guides

Free guides that pair with SC-100

Where SC-100 fits

Certification paths that include SC-100

SC-100 is the exam for Microsoft Cybersecurity Architect Expert — the senior credential in the security track. The current qualifying Associate credentials are SC-500, SC-200, or SC-300. AZ-500 is a retired reference route and is not in Microsoft's current prerequisite list. Tap any linked exam below to see its dedicated study app page.

Ready to pass SC-100?

Download Azure Mastery free. 472 SC-100 practice questions across all four domains, AI score prediction, full-length exam simulator, adaptive study plan. iPhone & iPad.

Download Azure Mastery — free iPhone & iPad · Free to start · No account required
SC-100 practice — free on the App Store Download

Search Azure Mastery