SC-100 Practice Questions & Exam Prep — Microsoft Cybersecurity Architect
Get exam-ready for SC-100 (Microsoft Cybersecurity Architect Expert) on iPhone or iPad. Azure Mastery uses on-device AI to predict your readiness score across all four SC-100 domains, build a personalised study plan from your weak spots, and surface topics you're forgetting. Core study stays on-device and works offline; optional sync uses your private iCloud account.
The exam
What is the SC-100 exam?
SC-100 is the exam for the Microsoft Certified: Cybersecurity Architect Expert credential — the most senior security cert in Microsoft's track. It's the credential hiring managers expect for "Cybersecurity Architect", "Lead Security Engineer", or "Cloud Security Architect" roles. To earn it, Microsoft currently accepts Azure Security Engineer Associate, Security Operations Analyst Associate, or Identity and Access Administrator Associate as the prerequisite credential. AZ-500 is the retiring exam for Azure Security Engineer Associate; MS-500 is no longer an accepted route.
SC-100 is design-oriented and trade-off-heavy. Unlike Associate exams that test individual-service knowledge, SC-100 tests architectural reasoning: pick the right strategy under real-world constraints. It validates that you can apply the Microsoft Cybersecurity Reference Architecture (MCRA), design a Zero Trust strategy and a ransomware-resilience stance, build SecOps strategies around Microsoft Sentinel and Defender XDR, design identity strategies in Microsoft Entra (Conditional Access, PIM, Identity Governance), design infrastructure security spanning endpoints / servers / containers / networks / keys, and design application and data security including DevSecOps. Expect scenario questions where multiple answers could work — the right answer is the one that best satisfies the constraints.
Microsoft updated the SC-100 skills outline on 27 April 2026. Every question in Azure Mastery's SC-100 bank is mapped to the current outline — no leftover questions on retired services. Read the official outline at learn.microsoft.com.
Questions40–60 multiple choice
Duration120 minutes (140 min seat)
Pass score700 / 1000
CostUSD $165 (≈ £128 UK)
ValidityRenew annually (Expert)
FormatOnline or test centre
Skills measured · April 2026
SC-100 exam objectives
Four domains, with weights set by Microsoft's April 2026 update. Every domain summary below is paraphrased from the official skills outline; bullet-level objectives in Azure Mastery are tagged so you always know which domain you're being tested on and where your weak spots cluster.
Security skill mapIdentityProtectDetectGovern
Design solutions that align with security best practices and priorities20–25%
Explore key topics
The strategy layer. Apply the Microsoft Cybersecurity Reference Architecture (MCRA), the Microsoft Cloud Security Benchmark, and the Cloud Adoption Framework (CAF) Secure baseline. Design a Zero Trust strategy across identities, endpoints, networks, applications, and data. Design ransomware-resilience patterns and a recovery strategy. Map architectural choices to regulatory compliance requirements (HIPAA, PCI-DSS, GDPR). Around 8–15 questions per sitting.
Design security operations, identity, and compliance capabilities25–30%
Explore key topics
Tied for the largest domain. Design a SecOps strategy with Microsoft Sentinel (analytics rules, automation, hunting) and Microsoft Defender XDR. Design an identity strategy for hybrid and multi-cloud — Microsoft Entra ID, Conditional Access, Privileged Identity Management, Identity Governance, federation. Design a compliance strategy with Microsoft Purview (Information Protection, DLP, Insider Risk, Communication Compliance, Compliance Manager). Around 10–18 questions.
Design security solutions for infrastructure25–30%
Explore key topics
Tied for the largest domain. Design endpoint and server security (Defender for Endpoint, Defender for Servers, secure baselines), Azure / multi-cloud / hybrid postures (Defender for Cloud, Azure Arc, Defender CSPM). Design network security (segmentation, perimeter, private connectivity), key and secret management strategy (Azure Key Vault, customer-managed keys, HSMs), secure remote access (Bastion, JIT VM access). Container and Kubernetes security (Defender for Containers, AKS hardening). Around 10–18 questions.
Design security solutions for applications and data20–25%
Explore key topics
Application security strategy — secure-by-design SDL, DevSecOps and supply-chain security (Defender for DevOps), threat modelling, secrets management. Data security strategy — Microsoft Purview Information Protection, sensitivity labels, encryption choices for SQL / Cosmos / Storage, data residency considerations. Around 8–15 questions.
Designed for SC-100
How Azure Mastery helps you pass SC-100
Azure Mastery ships with 442 SC-100 practice questions, every one written specifically against the current (April 2026) skills outline. Each question carries a domain tag mapped to the official four domains (best practices and priorities, security operations / identity / compliance capabilities, infrastructure security, applications and data security), so you always know which area you're being tested on and where your weak spots are clustered. SC-100 questions favour multi-constraint scenarios over single-service recall — you'll see a customer requirement, a regulatory constraint, and a technical limitation, and pick the best architectural answer.
The on-device Exam IQ engine predicts your SC-100 score before you sit the exam. After roughly 30 questions it has enough signal to give a confidence-scored prediction (e.g. "786 ±37, 68% confidence") — and tells you the specific topics that are dragging your readiness down. No vague "study more" advice; just a ranked list of objectives where improvement would move your score the furthest.
The adaptive study plan rebuilds itself from your answer history. Miss a Zero-Trust strategy scenario? You'll see another Zero-Trust question in the next session. Master "Defender for Cloud vs Defender XDR strategy" three sessions running and the engine backs off, surfacing fresh DevSecOps or Purview design scenarios. The plan optimises for the gap between where you are and the 700 pass score, not for blind volume.
Knowledge decay tracking matters more for SC-100 than for foundational exams — Expert-level architecture spans four broad domains and dozens of Microsoft security products, and the strategy you mastered three weeks ago is the strategy you'll forget by exam day if you stop revising. Azure Mastery tracks every topic's decay curve and flags topics approaching expiry. The padlock icon on the Today screen is your "revisit before you forget" cue, and weak-spot drills automatically pull from decayed topics first.
Real exam simulation mode runs at SC-100's actual length and time pressure: a randomised 40–60-question set drawn from the full 442-question bank, weighted by domain percentages from the April 2026 outline, with the 120-minute timer running and no jumping back to flag-and-review. It's the closest you can get to the live Pearson VUE / online-proctored experience without sitting the exam.
Answer Coach turns each missed answer into a private, grounded lesson: the misconception, key distinction, and rule to remember. It always uses authored certification guidance; on supported devices, an optional on-device model may rewrite the note only when it passes grounding checks.
During your first week, Aura adapts the next step as you go. Every session ends with a concise recap of what changed, what to focus on, and the best follow-up.
Everything essential runs on-device. Your answer history, readiness gauge, and coaching stay private. Optional sync uses your private iCloud account; there is no Azure Mastery account, tracking, or external processing server.
6-week study plan
Suggested SC-100 study plan
Most candidates pass SC-100 after six to ten weeks of focused study, assuming a passed Associate prereq. The six-week plan below maps onto the four SC-100 domains, Azure Mastery's adaptive sessions, and the in-app exam simulator. Adjust pace to taste — the readiness gauge tells you when you're done, not the calendar.
Strategy and capabilities
Days 1–3: Microsoft Cybersecurity Reference Architecture (MCRA), Microsoft Cloud Security Benchmark, Cloud Adoption Framework Secure baseline.
Days 4–6: Zero Trust strategy across identities, endpoints, networks, applications, data. Ransomware-resilience patterns and recovery strategy.
Days 7–9: Regulatory compliance design (HIPAA, PCI-DSS, GDPR, sovereign cloud constraints), risk assessment frameworks.
Days 10–14: SecOps strategy with Microsoft Sentinel and Defender XDR, identity strategy with Microsoft Entra (Conditional Access, PIM, Identity Governance), compliance strategy with Microsoft Purview.
Infrastructure and workload security
Days 15–17: Endpoint and server security strategy — Defender for Endpoint, Defender for Servers, secure baselines, multi-cloud and hybrid via Azure Arc.
Days 18–20: Network security strategy — segmentation, perimeter, private connectivity, Defender for Cloud network maps.
Days 21–23: Key and secret management strategy (Key Vault, customer-managed keys, HSMs), secure remote access (Bastion, JIT VM access).
Days 24–28: Container and Kubernetes security (Defender for Containers, AKS hardening, image scanning, supply chain).
Apps, data, sharpen, simulate
Days 29–32: Application security strategy — secure-by-design SDL, DevSecOps and supply-chain security (Defender for DevOps), threat modelling.
Days 33–36: Data security strategy — Microsoft Purview Information Protection, sensitivity labels, encryption choices for SQL/Cosmos/Storage, data residency.
Days 37–40: Run Focus Weak Spots every morning. SC-100 emphasises trade-off reasoning — re-read scenarios you missed and articulate why each distractor is wrong.
Days 41–42: Two end-to-end Exam Simulator runs at full 120-minute length. Review carefully. If readiness gauge is 750+ with reasonable confidence, schedule the exam.
Inside the app
Every Microsoft question type, on iPhone
SC-100's question bank uses the same formats Microsoft puts on the live exam — not just multiple choice. Each visualisation below is a faithful mock of how the type renders inside Azure Mastery on iPhone and iPad. Exam-simulator mode runs all of them at full 100-minute length with no flag-and-review jumps, mirroring Pearson VUE.
Which Microsoft pillar is the PRIMARY security perimeter in a Zero Trust architecture?
Identity
Network
Endpoint
Data
Multiple choice
A real SC-100 question-bank example with one correct answer. The app explains every option after you answer.
Exam-specific sample
Which TWO pillars are part of the Azure Well-Architected Framework? (Choose 2)
Security
Reliability
Marketing
Procurement
Multi-select
A real SC-100 multi-select item. Every required selection must be correct to earn the mark.
All-or-nothing
Order Microsoft's three prioritized objectives for a ransomware program, from the first thing to put in place to the last.
⋮⋮1Prepare a recovery plan with secure, isolated, immutable backups and…
⋮⋮2Limit the scope of damage by protecting privileged roles and identities
⋮⋮3Make it harder to get in by incrementally removing risks across entry…
Drag-and-drop
A real SC-100 interactive-format prompt, rendered for touch on iPhone and iPad.
Interactive item
In the Microsoft Defender for Cloud environment settings for a subscription that hosts virtual machines, a storage account, and an Azure SQL database, which single plan…
Hotspot
A real SC-100 prompt that tests recognition inside a visual or contextual interface.
Tap target
Contoso — Securing a multicloud estate Contoso runs production workloads in Azure, AWS, and Google Cloud after several acquisitions. Each cloud has its own native security tooling and its own team, and…
1How should Contoso obtain one consolidated posture view across Azure, AWS, and…
2How can Contoso apply consistent policy and Defender protections to servers in…
3Which single standard should every subscription be measured against for a…
4How should remediation be prioritized so the team fixes the most exploitable…
Case studies
A real SC-100 case-study scenario with linked questions that share the same requirements and environment.
Multi-question
✕Your answer: Network
✨ Answer Coach:Network controls such as segmentation and micro-segmentation remain a defense-in-depth layer in Zero Trust, but the model explicitly assumes breach and stops treating network location as the basis for trust,…
— grounded in authored certification guidance
Answer Coach
Answer Coach uses the bank's authored rationale to explain the misconception, key distinction, and rule to remember. On supported devices, an optional on-device model may rewrite the note only when it passes grounding checks.
App exclusive
Frequently asked
SC-100 FAQs
How much does the SC-100 exam cost?
The SC-100 voucher is USD $165 in the United States. Pricing varies by region — in the UK it's typically around £128. Microsoft sometimes runs free-voucher promotions during events such as Microsoft Build or Microsoft Ignite, so check your Microsoft Learn profile for any active offers before booking. SC-100 also requires annual renewal (free, online), so factor that into long-term cost planning.
Does the SC-100 certification expire?
Yes. Microsoft Associate certifications including SC-100 expire annually. Renewal is free — a 25–30 question online assessment on Microsoft Learn within the six-month window before your expiration date. The renewal targets recent skills outline updates, so staying current is straightforward if you remain broadly active in the role. (Fundamentals certifications such as AZ-900 are different — those don't expire.)
What is the SC-100 retake policy if I fail?
The first retake is allowed after 24 hours. Second and third retakes each require a 14-day wait. Microsoft caps retakes at five attempts per 12-month rolling period. Each attempt requires a new voucher purchase.
How long should I study for SC-100?
Most candidates pass SC-100 after six to ten weeks of focused study, assuming an Associate-level prerequisite is already passed. SC-100 is design-oriented, so much of the prep is reading and pattern recognition rather than command memorisation — practice scenario reasoning until you can articulate why each distractor is wrong. Azure Mastery's readiness gauge tells you when you're at exam-ready; don't book until it shows roughly 720 or higher with reasonable confidence.
What's the SC-100 prerequisite?
To earn the Cybersecurity Architect Expert credential, Microsoft currently accepts Azure Security Engineer Associate, Security Operations Analyst Associate, or Identity and Access Administrator Associate. You can sit SC-100 without one, but the credential is awarded only after both requirements are met. AZ-500 is the retiring exam tied to Azure Security Engineer Associate; Microsoft has not yet listed SC-500 as an accepted replacement prerequisite.
SC-100 vs AZ-305 — which next for an architect?
Different architectural lenses. SC-100 is the security architect cert — design Zero Trust, ransomware resilience, SecOps strategy, identity governance. AZ-305 is the solutions architect cert — design data, infrastructure, business continuity, and identity/governance/monitoring. The two overlap on identity and governance design, but SC-100 goes much deeper on security and AZ-305 covers a broader Azure surface. Many senior architects hold both.
Where SC-100 fits
Certification paths that include SC-100
SC-100 is the exam for Microsoft Cybersecurity Architect Expert — the senior credential in the security track. The clearest current routes use SC-200 or SC-300 as the accepted Associate prerequisite; Azure Security Engineer Associate is also accepted, but its AZ-500 exam retires on 31 August 2026. Tap any linked exam below to see its dedicated study app page.
SC-100 is the senior security exam. SC-200 and SC-300 are current prerequisite routes; Azure Security Engineer Associate also qualifies, although its AZ-500 exam retires on 31 August 2026. SC-900 builds the cross-cutting Microsoft security vocabulary if security is new to you.
Ready to pass SC-100?
Download Azure Mastery free. 442 SC-100 practice questions across all four domains, AI score prediction, full-length exam simulator, adaptive study plan. iPhone & iPad.
