SC-100 Cheat Sheet 2026: Quick Reference for the Cybersecurity Architect Exam
All 4 domains as scannable tables, the MCRA/MCSB/CAF/WAF framework guide people mix up most, and the AZ-500/SC-200/SC-300 prerequisite reference.
Quick Facts
The domain weights, terminology, and reference links here come straight from Microsoft's official SC-100 exam page. We re-check them against our audited 500-question SC-100 practice bank so nothing drifts out of date.
Domain 1: Security Best Practices and Priorities (20-25%)
| Concept | Sub-area | Quick note |
|---|---|---|
| Ransomware/BCDR resiliency | Best practices | Microsoft prioritizes secure backup + privileged-access reduction over detection tooling |
| Business continuity & disaster recovery (BCDR) | Best practices | Secure backup/restore design for hybrid and multicloud environments |
| Microsoft Cybersecurity Reference Architecture (MCRA) | Frameworks | Conceptual map of how security capabilities relate — not a scored checklist |
| Microsoft Cloud Security Benchmark (MCSB) | Frameworks | The scored control baseline Defender for Cloud evaluates configurations against |
| Cloud Adoption Framework (CAF) | Frameworks | Governs the broader cloud adoption/migration lifecycle, including landing zones |
| Well-Architected Framework (WAF) | Frameworks | Evaluates workload design quality; security is one of five pillars |
| Azure landing zones | Governance | CAF's mechanism for baking governance into every new subscription by default |
| DevSecOps process design | Governance | Security integrated into the CI/CD pipeline, not bolted on after deployment |
| Secure AI adoption strategy | Emerging | Newer skills-measured item — governance for AI workload rollout specifically |
Domain 2: Security Operations, Identity, and Compliance (25-30%)
| Concept | Sub-area | Quick note |
|---|---|---|
| SIEM/XDR design (Sentinel + Defender XDR) | SecOps | Centralizes detection across identity, endpoint, and cloud signal |
| SOAR — automation rules & playbooks | SecOps | Automates response to high-confidence incidents without manual triage |
| MITRE ATT&CK coverage mapping | SecOps | Evaluates detection coverage against Enterprise, Mobile, and ICS matrices |
| Microsoft Entra Agent ID & Conditional Access for agents | Identity | Newer skills-measured item — identity for autonomous AI agents specifically |
| Microsoft Entra B2B & decentralized identity | Identity | External-identity federation without creating local accounts for partners |
| Continuous access evaluation & risk-based Conditional Access | Identity | Modern authentication strategy beyond static sign-in rules |
| Enterprise access model + Privileged Identity Management (PIM) | Privileged access | Just-in-time, time-bound, approval-gated role activation — never standing access |
| AD DS hardening requirements | Privileged access | On-premises Active Directory resilience to common attack patterns |
| Compliance via Microsoft Purview & Azure Policy | Compliance | Translating regulatory requirements into enforceable technical controls |
Cross-referencing while you study?
Drill each domain above with MSCertQuiz's 500-question SC-100 bank — 40 questions free to start.
Start Free SC-100 PracticeDomain 3: Security Solutions for Infrastructure (25-30%)
| Concept | Sub-area | Quick note |
|---|---|---|
| Defender for Cloud posture across hybrid/multicloud | Posture mgmt | Extends to AWS/on-prem once onboarded via Azure Arc |
| Microsoft Secure Score | Posture mgmt | A different scored signal than MCSB — tenant-wide, not just cloud config |
| Defender External Attack Surface Management (EASM) | Posture mgmt | Discovers internet-facing assets the org may not know it owns |
| Microsoft Security Exposure Management | Posture mgmt | Attack-path analysis and attack-surface reduction, newer emphasis |
| Server & client endpoint baselines | Endpoints | Covers multiple OS platforms, not just Windows |
| Defender for IoT (OT/ICS) | Endpoints | Passive, agentless monitoring for legacy industrial devices that can't run agents |
| Windows LAPS evaluation | Endpoints | Randomized local admin passwords as a specific endpoint control |
| SaaS/PaaS/IaaS security baselines, containers | Cloud services | Requirements differ meaningfully by service model |
| Security Service Edge: Entra Internet Access vs. Entra Private Access | Network/SSE | Outbound internet filtering (Internet Access) vs. inbound private-app access (Private Access) — commonly confused |
Domain 4: Security Solutions for Applications and Data (20-25%)
| Concept | Sub-area | Quick note |
|---|---|---|
| Microsoft 365 posture (Secure Score for collaboration) | M365 security | A distinct Secure Score view scoped to productivity workloads |
| Defender for Office 365 & Defender for Cloud Apps | M365 security | Email/collaboration threats vs. broader SaaS visibility — different tools |
| Copilot for M365 data security controls | M365 security | Newer skills-measured item — evaluating Purview controls specific to Copilot |
| Threat modeling & full-lifecycle app security | App security | Identifies attack vectors during design, before code is scanned |
| Workload identities for Azure resource access | App security | Non-human identities authenticating to Azure — a distinct identity category |
| API management & security, Azure WAF | App security | Two different control layers: API gateway policy vs. web traffic filtering |
| Data discovery & classification (Purview) | Data security | Prerequisite step before you can prioritize which data to protect first |
| Encryption at rest/in transit, Azure Key Vault | Data security | Key management is a distinct design decision from the encryption itself |
| Security for data used in AI workloads | Data security | A specifically called-out skills-measured item, not folded into general data security |
Framework Quick Reference: MCRA vs. MCSB vs. CAF vs. WAF
These four get tested both directly and indirectly, and their names are easy to blur together under time pressure:
| Acronym | Full name | What it actually is |
|---|---|---|
| MCRA | Microsoft Cybersecurity Reference Architecture | Conceptual guidance for how security capabilities fit together across an org |
| MCSB | Microsoft Cloud Security Benchmark | Scored control baseline you evaluate a cloud configuration against |
| CAF | Cloud Adoption Framework | Governs the strategy, planning, and adoption lifecycle for moving to Azure |
| WAF | Well-Architected Framework | Evaluates workload design quality across 5 pillars; security is one of them |
SC-100 Prerequisite Path Reference
Per Microsoft's certification page (checked August 4, 2026), earning the Cybersecurity Architect Expert credential requires SC-100 plus one of these three, held either before or within one year after passing SC-100:
| Exam | Certification | Status |
|---|---|---|
| AZ-500 | Azure Security Engineer Associate | Retires August 31, 2026 — still valid as an SC-100 prerequisite for 1 year if passed before then |
| SC-200 | Security Operations Analyst Associate | No scheduled retirement as of this check |
| SC-300 | Identity and Access Administrator Associate | No scheduled retirement as of this check |
SC-100 Acronym Glossary
| Acronym | Stands for | What it means on the exam |
|---|---|---|
| BCDR | Business Continuity and Disaster Recovery | Secure backup/restore design, prioritized ahead of detection tooling for ransomware |
| GRC | Governance, Risk, and Compliance | The umbrella category covering Domain 2's compliance-design skills |
| XDR | Extended Detection and Response | Cross-signal threat detection — Defender XDR is Microsoft's implementation |
| SIEM | Security Information and Event Management | Centralized log analysis and correlation — Microsoft Sentinel |
| SOAR | Security Orchestration and Automated Response | Automation rules/playbooks that act on incidents without manual triage |
| PIM | Privileged Identity Management | Just-in-time, approval-gated role activation inside Microsoft Entra ID |
| EASM | External Attack Surface Management | Discovers internet-facing assets an org may not know it owns |
| SSE | Security Service Edge | Umbrella term covering Entra Internet Access and Entra Private Access |
| ICS | Industrial Control Systems | Factory-floor/OT systems monitored via Defender for IoT, not standard agents |
| WAF (control) | Web Application Firewall | Not to be confused with the Well-Architected Framework acronym above |
SC-100 FAQ
What's the fastest way to tell MCRA, MCSB, CAF, and WAF apart on exam day?
MCRA is conceptual (how capabilities relate). MCSB is a scored checklist (evaluate a configuration against it). CAF governs the adoption lifecycle. WAF evaluates workload design quality, security being one pillar. If a question gives you a configuration to score, think MCSB — if it gives you an adoption/migration scenario, think CAF.
Which SC-100 prerequisite certification should I pick if I don't have any of the three yet?
Since AZ-500 retires August 31, 2026, starting it fresh now leaves little runway. SC-200 or SC-300 are the safer picks if you're choosing from scratch, unless your actual job role is specifically Azure security engineering and you can finish AZ-500 before the retirement date.
Is this cheat sheet different from the SC-100 study guide?
Yes. The study guide walks through an 8-week plan with narrative explanation and exam-day tactics. This page strips the narrative for tables and reference lists you can scan in the last hour before the exam.
Can I print this SC-100 cheat sheet?
Yes — every table here is plain HTML, so a browser print or "print to PDF" renders cleanly.
MSCertQuiz sells practice-exam access for SC-100 and other Microsoft certifications; this cheat sheet is written by the same team that builds those questions.
Continue Your Prep
The 8-week plan behind this quick reference.
Design-judgment scenarios with full rationale, grouped by domain.
Full exam details and the complete 500-question practice bank.
Including AZ-500, SC-200, and SC-300 — the three SC-100 prerequisite options.
Reviewed the cheat sheet? Now drill it.
Start with 40 free SC-100 questions covering every domain above.
Start Free SC-100 Practice