SC-100: Predict your score.
Know what to study next.
See your predicted score, follow a study plan based on your answers, and revisit topics you're starting to forget. It all runs on your device.
472 practice questions
AI score prediction
100% offline
Download free
iPhone & iPad · Free to startOn your Mac? Scan to install
SC-100Microsoft Cybersecurity Architect
SC-100 · 30 days left ›
PREDICTED786 ±37✓ Exam Ready · 87% confidence
SC-100 Practice Questions & Exam Prep — Microsoft Cybersecurity Architect
Get exam-ready for SC-100 (Microsoft Cybersecurity Architect Expert) on iPhone or iPad. Azure Mastery uses on-device AI to predict your readiness score across all four SC-100 domains, build a personalised study plan from your weak spots, and surface topics you're forgetting. Core study stays on-device and works offline; optional sync uses your private iCloud account.
The exam
What is the SC-100 exam?
SC-100 is the exam for the Microsoft Certified: Cybersecurity Architect Expert credential — the most senior security cert in Microsoft's track. It's the credential hiring managers expect for "Cybersecurity Architect", "Lead Security Engineer", or "Cloud Security Architect" roles.
Microsoft replaced the retired AZ-500 route with SC-500 in the current prerequisite list. You can take SC-100 before earning the Associate credential, but the expert certification is awarded only after both requirements are active on your profile. The prerequisite is the active Associate credential, not merely a pass on its exam.
SC-100 is design-oriented and trade-off-heavy. Unlike Associate exams that test individual-service knowledge, it tests architectural reasoning: picking the right strategy under real-world constraints. It validates that you can:
Apply the Microsoft Cybersecurity Reference Architecture (MCRA)
Design a Zero Trust strategy and a ransomware-resilience stance
Build SecOps strategies around Microsoft Sentinel and Defender XDR
Design identity strategies in Microsoft Entra — Conditional Access, PIM, Identity Governance
Design infrastructure security spanning endpoints, servers, containers, networks, and keys
Design application and data security, including DevSecOps
Expect scenario questions where multiple answers could work; the right one is whichever best satisfies the stated constraints.
Architectural questions often turn on where a control operates: tenant, management plane, workload edge, or external attack surface. Sketch the trust boundary and ownership model before comparing products; a technically capable service can still be wrong when it leaves the required control plane or evidence source untouched.
Microsoft updated the SC-100 skills outline on 28 July 2026. Every question in Azure Mastery's SC-100 bank is mapped to the current outline — no leftover questions on retired services. Read the official outline at learn.microsoft.com.
Questions40–60 multiple choice
Duration120 minutes (140 min seat)
Pass score700 / 1000
CostUSD $165 (≈ £128 UK)
ValidityRenew annually (Expert)
FormatOnline or test centre
Skills measured · 28 July 2026
SC-100 exam objectives
SC-100 has four domains, and Microsoft's 28 July 2026 refresh set the weights. Each summary below follows the official skills outline; the counts are the questions in the app tagged to that domain.
Security skill mapIdentityProtectDetectGovern
Design solutions that align with security best practices and prioritiesPublished weight 20–25%
98 exam-scoped practice questions in the app
Explore Best Practices topics
Design a resiliency strategy for ransomware and other attacks based on Microsoft Security Best Practices
Design solutions that align with the Microsoft Cybersecurity Reference Architectures (MCRA) and Microsoft Cloud Security Benchmark (MCSB)
Design solutions that align with the Microsoft Cloud Adoption Framework for Azure (CAF) and the Azure Well-Architected Framework
This domain tests setting direction: ransomware resilience, MCRA and MCSB alignment, and CAF or WAF governance recommendations.
Candidates who only studied Associate-level configuration struggle here, since the exam wants a recommended strategy, not a setting.
Practise stating which framework, MCRA, MCSB, or CAF, a described requirement calls for before naming any product.
Design security operations, identity, and compliance capabilitiesPublished weight 25–30%
139 exam-scoped practice questions in the app
Explore SecOps topics
Design solutions for security operations
Design solutions for identity and access management
Design solutions for securing privileged access
Design solutions for regulatory compliance
This domain spans the most products: SecOps design with Sentinel and Defender XDR, identity strategy, privileged access, and compliance.
Legacy admin-tiering language often replaces the enterprise access model the exam now expects.
Learn the enterprise access model's three planes before practising any privileged-access scenario in this domain.
Design security solutions for infrastructurePublished weight 25–30%
127 exam-scoped practice questions in the app
Explore Infrastructure topics
Design solutions for security posture management in hybrid and multicloud environments
Specify requirements for securing server and client endpoints
Specify requirements for securing SaaS, PaaS, and IaaS services
Evaluate solutions for network security and Security Service Edge (SSE)
This domain tests specifying requirements across posture management, endpoints, SaaS/PaaS/IaaS, and Security Service Edge.
Candidates confuse Defender for Cloud's posture management with Sentinel's active threat response, though the exam treats them separately.
Keep posture management and active response as two separate domains in your head; scenarios rarely mix them.
Design security solutions for applications and dataPublished weight 20–25%
108 exam-scoped practice questions in the app
Explore Apps & Data topics
Evaluate solutions for securing Microsoft 365
Design solutions for securing applications
Design solutions for securing an organization's data
Securing Microsoft 365 workloads, application threat modelling, and data protection including AI workloads all sit in this domain.
The newer requirement to evaluate data-security controls in Microsoft Copilot for Microsoft 365 gets under-revised most often.
Add Copilot data-security evaluation to your revision list; it's a recent addition many candidates miss.
Common traps
Where SC-100 candidates slip
Five recurring misconceptions that trip up otherwise well-prepared SC-100 candidates, grounded in the current skills outline.
Zero Trust is an architecture, not a single control
Candidates who deployed MFA or network segmentation sometimes treat either one alone as doing Zero Trust.
A single strong control, deployed harder, still reads as incomplete if the other pillars stay silent.
Build a Zero Trust answer that touches at least two pillars before you commit to a single-control fix.
MCRA, MCSB, and CAF or WAF answer different questions
Candidates reach for whichever framework name they remember best rather than the one the scenario actually calls for.
MCRA is a reference architecture; MCSB provides prescriptive security recommendations; CAF and WAF guide adoption and workload design.
A posture-management tool can assess an environment against MCSB, but the benchmark itself does not perform the measurement.
The enterprise access model has replaced legacy admin tiering
Candidates who studied older AD-centric tiering default to Tier 0, 1, 2 language on a privileged-access scenario.
Reasoning in terms of the control, management, and data-or-workload planes now replaces tier numbers entirely.
Retire Tier 0/1/2 language from your answers and reason in terms of the three enterprise access model planes.
Posture management and active response are different domains
Defender for Cloud appearing in a scenario doesn't automatically make the question about security operations.
A SOAR or incident-response design belongs in security operations, whatever product name the scenario mentions.
Ask whether the scenario wants a measurement of risk or a response to an active threat before choosing a domain.
The prerequisite gates the certification, not the exam booking
Candidates researching "can I take SC-100 first" often assume the prerequisite blocks registration itself.
Content readiness is what SC-100 grades; the prerequisite sits outside the exam, as a separate certification-award policy.
Book SC-100 whenever you're ready on content, and separately earn an active SC-200, SC-300, or SC-500 prerequisite certification.
Designed for SC-100
How Azure Mastery helps you pass SC-100
Exam-specific practice
472 SC-100 practice questions, each tagged to one of the four official domains.
Coverage weights SecOps/identity/compliance and infrastructure security joint-heaviest at 25–30% each.
Practise picking the strategy that best satisfies stated constraints, the exam's actual reasoning style.
Predicted score
Exam IQ forecasts your SC-100 score on-device after about 30 questions, with a confidence range.
It names the specific framework or control-plane topic actually holding your score back.
Watch which of the four domains lags behind the others in the days before you book.
Adaptive study plan
Your plan leans hardest on whichever of SecOps or infrastructure security is currently your weakest.
Miss a Zero Trust strategy question and the next session surfaces another identity-strategy scenario.
Master a topic across three sessions and the plan moves toward your next weak spot.
Knowledge decay
Expert-level architecture spans dozens of products; a strategy mastered weeks ago fades fastest if unrevised.
A padlock cue appears on the Today screen once a topic starts approaching decay.
Weak Spots sessions pull decayed framework or control-plane topics back into rotation.
Exam rehearsal
Rehearse a full 120-minute session with no jumping back to flag-and-review, like the real booking.
The four-domain split matches the published weighting, drawn entirely from Azure Mastery's own bank.
Microsoft alone sets the live SC-100 interface and its exact question order.
Answer Coach
Untangles SC-100's near-identical framework calls: MCRA vs MCSB, enterprise access model vs legacy admin tiering.
Get one wrong and Answer Coach names the specific distinction the scenario was testing.
Authored guidance covers every question; eligible devices can optionally reword a note once grounding checks pass.
Aura guidance
Aura tracks your first week of SC-100 sessions and updates its suggestions as patterns emerge.
Each session ends with a compact recap: what shifted, what to revisit, where to head next.
Private by design
Your SC-100 answer history, readiness gauge, and coaching notes stay put unless you opt into sync.
No Azure Mastery account and no external server ever sees your study data.
iCloud sync, if you switch it on, runs through your own private account only.
6-week study plan
Suggested SC-100 study plan
Practise security architecture decisions across strategy, infrastructure, applications and data. Use these six weeks of study blocks to build your trade-off reasoning, then rehearse.
Security architecture frameworks
Review the Microsoft Cybersecurity Reference Architecture.
Explore the Microsoft Cloud Security Benchmark.
Review the Cloud Adoption Framework security baseline.
Zero Trust and resilience
Design Zero Trust across identities, endpoints and networks.
Extend the strategy to applications and data.
Review ransomware resilience and recovery.
Compliance and risk
Review compliance requirements and their design implications.
Consider sovereign-cloud constraints.
Compare risk-assessment approaches.
Security operations strategy
Design SecOps with Sentinel and Defender XDR.
Plan Entra access controls and identity governance.
Review Purview compliance strategy.
Endpoint and server strategy
Compare Defender for Endpoint and Defender for Servers.
Review secure baselines.
Plan hybrid and multi-cloud coverage with Azure Arc.
Network security strategy
Design segmentation and perimeter protection.
Plan private connectivity.
Review Defender for Cloud network maps.
Keys and secure access
Compare Key Vault, customer-managed keys and HSMs.
Plan secret management.
Review Bastion and just-in-time VM access.
Container security
Review Defender for Containers and AKS hardening.
Plan image scanning.
Consider software supply-chain protection.
Application security strategy
Review secure development lifecycle choices.
Plan DevSecOps and supply-chain security.
Practise threat modelling.
Data security strategy
Review Purview Information Protection and labels.
Compare encryption choices for SQL, Cosmos DB and Storage.
Consider data residency.
Practise trade-off reasoning
Use Focus Weak Spots to revisit gaps.
Re-read scenarios you missed.
Explain why each alternative is unsuitable.
Timed rehearsal
Complete two 120-minute Exam Simulator sessions.
Review the reasoning behind missed answers.
Plan further practice where needed.
Inside the app
Nine interactive practice formats, on iPhone
Azure Mastery has nine interactive formats for exam practice. The examples below show original SC-100 practice questions in Azure Mastery on iPhone and iPad. The exam simulator uses timed sessions with the published domain weights. Microsoft's live interface and question mix may differ.
Which Microsoft pillar is the PRIMARY security perimeter in a Zero Trust architecture?
Network
Data
Endpoint
Identity
Multiple choice
An original SC-100 practice question with one correct answer. The app explains every option after you answer.
Exam-specific sample
Which TWO pillars are part of the Azure Well-Architected Framework? (Choose 2)
Reliability
Marketing
Security
Procurement
Multi-select
An original SC-100 multi-select question. Select all the correct options to earn the mark.
All-or-nothing
Order Microsoft's three prioritized objectives for a ransomware program, from the first thing to put in place to the last.
⋮⋮1Prepare a recovery plan with secure, isolated, immutable backups and…
⋮⋮2Limit the scope of damage by protecting privileged roles and identities
⋮⋮3Make it harder to get in by incrementally removing risks across entry…
Drag-and-drop
An original SC-100 ordering question you can answer by touch on iPhone and iPad.
Interactive item
In the Microsoft Defender for Cloud environment settings for a subscription that hosts virtual machines, a storage account, and an Azure SQL database, which single plan…
Hotspot
An original SC-100 question with a visual prompt, designed for touch on iPhone and iPad.
Tap target
Contoso — Securing a multicloud estate Contoso runs production workloads in Azure, AWS, and Google Cloud after several acquisitions. Each cloud has its own native security tooling and its own team, and…
1How should Contoso obtain one consolidated posture view across Azure, AWS, and…
2How can Contoso apply consistent policy and Defender protections to servers in…
3Which single standard should every subscription be measured against for a…
4How should remediation be prioritized so the team fixes the most exploitable…
Case studies
An original SC-100 case study with several questions about the same requirements and environment.
Multi-question
✕Your answer: Network
✨ Answer Coach:Network controls such as segmentation and micro-segmentation remain a defense-in-depth layer in Zero Trust, but the model explicitly assumes breach and stops treating network location as the basis for trust,…
— grounded in authored certification guidance
Answer Coach
Answer Coach explains why the answer is correct and, where available, why each option is right or wrong. It helps you understand a mistake and remember the distinction. Read explanations after each question or at the end of a practice test. On supported devices, optional AI can reword a note on your device after checking it against the written guidance.
App exclusive
Frequently asked
SC-100 FAQs
MCRA vs MCSB — which framework does a given SC-100 scenario want?
MCRA shows how security capabilities fit together, while MCSB provides prescriptive security recommendations. A posture-management tool can assess an environment against MCSB, but the benchmark itself is guidance rather than a measurement service.
What's the SC-100 prerequisite?
You can sit SC-100 with no prior certification. To earn the Cybersecurity Architect Expert credential, you must also hold an active SC-200, SC-300, or SC-500 Associate certification. Microsoft replaced the retired AZ-500 route with SC-500 in the current prerequisite list. An exam pass alone is not the prerequisite; the Associate credential must be active on your profile.
What format does the SC-100 exam use?
40–60 questions, with formats that vary by sitting. Azure Mastery's bank runs a similar spread: mostly single-answer, a meaningful share of scenario questions, yes/no and multi-select in roughly equal measure, plus a smaller mix of drag-to-match, dropdown, hotspot, ordering, and case-study items.
What's the SC-100 exam fee, and does renewal add to the cost?
The voucher costs USD $165 in the United States, around £128 in the UK. Microsoft occasionally runs free-voucher promotions around events like Build or Ignite. Renewal itself is free, a short annual online assessment, so factor only the original voucher into long-term cost.
Is SC-100 a lifetime certification, or does it need renewing?
The Cybersecurity Architect Expert credential is valid for one year. In the final six months, renew it at no charge through Microsoft's current online assessment; its length can change as the skills outline evolves. Fundamentals credentials such as AZ-900 do not expire.
Different lenses. SC-100 is the security architect cert: Zero Trust, ransomware resilience, SecOps strategy, identity governance. AZ-305 is the solutions architect cert: data, infrastructure, business continuity, identity and monitoring. They overlap on identity and governance; many senior architects hold both.
How soon can I resit SC-100 after a fail?
A first retake is available after 24 hours.
First retake: 24-hour wait.
Second and third retakes: 14-day wait each.
Five attempts maximum per rolling 12 months, a fresh voucher required each sitting.
How is SC-100 different from an Associate-level security exam?
Associate exams like SC-200 and SC-300 test configuring a named product correctly. SC-100 tests designing the strategy those products serve, choosing between Sentinel automation and Defender XDR-native response for stated constraints. Multiple options can be valid; only one best satisfies the scenario.
Can I try Azure Mastery's SC-100 bank before paying?
Yes. The app is free to download with a free allowance of SC-100 questions so you can try every feature. The full 472-question bank unlocks with a one-time exam-pack purchase, or a subscription unlocks every exam in the catalogue.
Can I rehearse SC-100 scenarios with no internet connection?
Yes. Practice, scoring, and the readiness prediction all run on-device, working with no connection at all. No account is required, and iCloud sync stays optional and private if you want it.
Free study guides
Free guides that pair with SC-100
Where SC-100 fits
Certification paths that include SC-100
SC-100 is the exam for Microsoft Cybersecurity Architect Expert — the senior credential in the security track. The clearest current routes use SC-200 or SC-300 as the accepted Associate prerequisite; an already-earned Azure Security Engineer Associate credential is also accepted, though its AZ-500 exam was retired by Microsoft on 31 August 2026 and is no longer bookable. Tap any linked exam below to see its dedicated study app page.
SC-100 is the senior security exam. SC-200 and SC-300 are current prerequisite routes; an already-earned Azure Security Engineer Associate credential also qualifies, though its AZ-500 exam was retired by Microsoft on 31 August 2026. SC-900 builds the cross-cutting Microsoft security vocabulary if security is new to you.
Ready to pass SC-100?
Download Azure Mastery free. 472 SC-100 practice questions across all four domains, AI score prediction, full-length exam simulator, adaptive study plan. iPhone & iPad.
