SC-100 Practice Test
Microsoft Certified: Cybersecurity Architect Expert
SC-100 tests whether you can design the strategy, not just operate the controls. So do we.
Our 500 scenario-based questions mirror the SC-100 format: multi-constraint architecture decisions across Zero Trust strategy, SIEM/XDR and SOAR design, identity and access architecture, infrastructure security posture, and application/data security — the same reasoning-under-tradeoffs style Microsoft uses on the real Expert-level exam.
Start Free Practice — 40 QuestionsNo credit card required. Upgrade to full 500 questions for $19.99 when ready.
Is this for you?
This is NOT for you if:
SC-100 Exam Details
What to expect on exam day
Questions
50
Duration
120 minutes
Passing Score
700
Exam Cost
$165
Exam Domains Covered
Master all topics tested on the SC-100 exam
Design solutions that align with security best practices and priorities
Design security operations, identity, and compliance capabilities
Design security solutions for infrastructure
Design security solutions for applications and data
SC-100 Case Study Practice
Expert-level Microsoft exams test judgment on realistic business scenarios. Our SC-100 bank includes 15+ full case studies: one shared scenario covering the company background, requirements and existing environment, followed by 5 to 7 linked questions.
- ✓ Case Study Practice mode: one scenario at a time with instant feedback and detailed explanations.
- ✓ Exam mode: one or two case studies are mixed into your timed exam alongside standalone questions.
- ✓ Included with paid SC-100 access, and counted in your score and review.
Test Yourself Right Now
Try 5 real practice questions — no signup needed
5 Free SC-100 Questions
See how ready you are for the SC-100 exam. Each question includes a detailed explanation so you learn as you go.
Sample SC-100 Practice Questions
10 real questions from the free SC-100bank. Pick an answer in your head, then open “Show answer” for the explanation.
1. A publicly traded energy company must classify criticality across 8,000 assets spanning on-premises AD DS, Azure, and AWS, satisfy an auditor requirement that classification be traceable to documented criteria rather than ad hoc judgment, stay within a budget covering only already-owned Microsoft 365 E5 and Defender for Cloud licenses, and deliver results within one quarter. Which approach should the architect recommend?
- A. Manually document asset criticality in a shared spreadsheet, reviewed on a quarterly basis by the IT team
- B. License and deploy a new third-party CMDB-based risk-scoring platform across the environment
- C. Apply Security Exposure Management's unified inventory with predefined and custom classifiers across on-prem, Azure, and AWS, documenting logic for audit traceability
- D. Wait until the AWS assets are migrated to Azure before classifying anything further
Show answer
Correct answer: C
Security Exposure Management's unified inventory already spans on-premises, Azure, and AWS under existing licensing, and documented classifier logic satisfies the auditor's traceability requirement within a one-quarter timeline (C). A spreadsheet (A) doesn't scale to 8,000 assets or meet the timeline, a new CMDB platform (B) breaches the budget constraint, and waiting for AWS migration (D) unnecessarily delays classification.
2. A 100-person architecture firm wants a low-effort first step toward Microsoft's ransomware guidance, wants the change to cost close to zero, and cannot afford disruption during an in-flight ERP migration. Which action should they prioritize?
- A. Migrate the ERP system to a new subscription immediately
- B. Deploy a full zero trust network redesign this month
- C. Enable and validate soft delete on their Recovery Services vaults and test a sample restore
- D. Purchase cyber-insurance as a substitute for backup validation
Show answer
Correct answer: C
Soft delete is enabled by default at no additional cost and validating a sample restore confirms recoverability, making it the lowest-cost, lowest-disruption step-1 action available. Migrating the ERP system (A) and a full network redesign (B) are disruptive, large-scope projects unrelated to the immediate goal, and insurance (C is actually D here) doesn't substitute for verifying backups actually restore.
3. During active ransomware remediation, a company must decide which system to restore first among a low-impact marketing website, a high-impact ERP order-processing system with a verified, tested backup, and a file server whose backup exists but has never been test-restored. Which system should be restored first?
- A. The marketing website, because it is simplest to restore
- B. The file server, because a backup exists
- C. The ERP order-processing system, because it is business-critical and its backup has already been validated before restoring
- D. Whichever system the affected department requests first, regardless of validation status
Show answer
Correct answer: C
Microsoft's guidance states that your prioritized backup list becomes your prioritized restore list, and backups should be validated again before restoring; the ERP system is both business-critical and already validated. The marketing website (A) is lower business impact, the file server (B) has an unvalidated backup, and restoring based purely on department requests (D) ignores both business-criticality and validation.
4. A global media company replicates 200 on-premises VMware VMs to Azure for disaster recovery. Requirements: recovery point retention of at least 15 days, application-consistent recovery points at least every four hours for database-tier VMs, no site-to-site VPN due to an existing ExpressRoute Microsoft peering investment, and no per-VM manual policy creation across all 200 VMs. Which Azure Site Recovery configuration should the architect specify?
- A. Configure a unique replication policy manually for each of the 200 VMs individually, using a dedicated site-to-site VPN
- B. Create a shared VMware replication policy with 15 days of retention and app-consistent snapshot frequency set between one and 12 hours, using the existing ExpressRoute connection
- C. Use the default Azure-to-Azure replication policy of one-day retention with app-consistent snapshots left disabled
- D. Rely on crash-consistent recovery points generated automatically at five-minute intervals, with no app-consistent snapshots configured
Show answer
Correct answer: B
A single shared replication policy with 15-day retention and configurable app-consistent frequency meets both the retention and consistency requirements while scaling to 200 VMs without per-VM policies, and traffic can flow over the existing ExpressRoute Microsoft peering connection (B). Manual per-VM policies with a dedicated VPN (A) fail the scale and network constraints, the Azure-to-Azure default policy (C) doesn't apply to on-premises VMware replication and has the wrong retention/consistency settings, and crash-consistent-only recovery points (D) don't meet the database-tier app-consistency requirement.
5. A pharmaceutical company must prioritize resiliency spend for its clinical-trial data pipeline, which spans Azure Data Lake and an on-premises analytics cluster. A regulator requires evidence that incident-response prioritization considers regulatory scope, the SOC can staff only three dedicated analysts, and there is no additional budget this fiscal year. Which design best supports prioritizing incidents affecting this pipeline over lower-value systems?
- A. Hire 10 additional analysts so each incident can be manually triaged in detail
- B. Disable alerting on lower-value systems entirely so attention shifts to the pipeline
- C. Move the on-premises analytics cluster fully into the scope of a brand-new SIEM platform purchase
- D. Tag the pipeline's Azure and on-premises components as Critical/regulated and configure automated severity scoring so tagged alerts escalate first, within the existing three-analyst SOC
Show answer
Correct answer: D
Tagging the pipeline as Critical/regulated and using automated severity scoring lets the existing three-analyst SOC prioritize correctly without added headcount or spend (D). Hiring 10 analysts (A) breaches the budget constraint, disabling alerting elsewhere (B) loses visibility into other business impact rather than prioritizing, and a new SIEM purchase (C) also breaches the zero-budget constraint.
Show 5 more questions
6. During an active ransomware incident, an IT team wants the one action that most directly limits further lateral movement while the full incident-response plan is being executed. Which should they do first?
- A. Begin restoring file servers from backup immediately, before containment
- B. Send a company-wide email asking employees to voluntarily change their passwords
- C. Wait for a fully signed incident-response retainer before taking any containment action
- D. Disable all privileged and administrative accounts except a small set needed for recovery, per Microsoft's containment guidance
Show answer
Correct answer: D
Disabling privileged accounts except a small recovery set directly cuts off the attacker's most valuable escalation path and matches Microsoft's documented containment guidance (D). Restoring before containment (A) risks reinfecting freshly restored systems, a voluntary password-change email (B) is too slow and uncontrolled, and waiting for a signed retainer (C) delays critical containment that can start immediately.
7. A global insurance company is redesigning its ransomware resiliency program. It must reduce dwell time before privileged escalation across 4,000 endpoints in three regions, comply with a regulator mandate for documented emergency-access procedures, stay within a "no new license SKU" budget cap this fiscal year, and avoid increasing help-desk password-reset volume by more than 10%. The company already holds Microsoft 365 E5 and Microsoft Entra ID P2. Which control should the architect recommend?
- A. Purchase Microsoft Entra ID Governance add-on licenses for entitlement management across the endpoint fleet
- B. Deploy Microsoft Entra Privileged Identity Management for just-in-time role activation using the existing P2 licenses
- C. Require administrators to reset their password on a 24-hour cycle as an added control
- D. Deploy a third-party privileged access management appliance across the three regions
Show answer
Correct answer: B
PIM just-in-time activation is included in the already-owned Microsoft Entra ID P2 license, satisfies the emergency-access documentation requirement through activation approvals and audit logs, and doesn't force additional password resets (B). Entra ID Governance add-on licensing (A) and a third-party PAM appliance (D) both violate the no-new-SKU constraint, and forcing frequent password resets (C) directly breaches the help-desk volume constraint.
8. A regional retailer with no mature security program wants the single action that most reduces an attacker's financial incentive to target them. Which action should they implement first?
- A. Increase cyber-insurance coverage limits
- B. Build tested, offline or immutable backups covering business-critical systems
- C. Purchase additional antivirus licenses
- D. Require yearly security-awareness training, with no other controls in place
Show answer
Correct answer: B
Reducing the monetary incentive for ransomware attackers means making it easy to recover without paying, which requires tested, offline/immutable backups (B). Insurance (A) pays after the fact rather than preventing loss, extra AV licenses (C) address malware detection rather than recovery, and training alone (D) does nothing for recoverability.
9. A telecom operator's business resiliency plan must identify which network operations centers (NOCs) are crown jewels. Classification must reconcile automatically detected criticality with human judgment, since some NOCs have low technical footprint but very high business impact, the review process must be repeatable quarterly without redoing manual work each time, the scope spans 15,000 devices, and no new licensing is approved this year. Which capability addresses the ongoing reconciliation requirement?
- A. Review and override automatically classified assets with lower confidence in Security Exposure Management, adding custom rules for under-scored NOCs
- B. Accept the automatic classifications as final with no human review process, to save analyst time
- C. Re-run a full manual asset inventory from scratch each calendar quarter without reusing prior work
- D. Rank NOC criticality solely by raw device count recorded per site
Show answer
Correct answer: A
Reviewing and overriding lower-confidence automatic classifications, combined with custom rules for the nuanced NOC cases, is repeatable quarterly without re-doing the full inventory and needs no new licensing (A). Accepting automatic results blindly (B) ignores the stated business-impact nuance, a full manual re-inventory each quarter (C) doesn't scale to 15,000 devices, and ranking by device count (D) ignores actual business impact.
10. An airline's resiliency strategy must prioritize threats to its crew-scheduling system, which has a maximum tolerable downtime of four hours, depends on both an Azure-hosted API and a mainframe reachable via an Azure Arc-enabled server, requires documented elevated protection for flight-safety-adjacent systems, and must use only currently owned Defender for Cloud and Exposure Management licenses. Which design best supports prioritizing this system's protection?
- A. Track the mainframe informally outside any inventory since Arc doesn't extend to mainframe-class hosts
- B. Classify the crew-scheduling system and its Arc-enabled mainframe dependency as Very High criticality, with documented justification tied to the downtime tolerance and flight-safety scope
- C. Apply the same default criticality level to the crew-scheduling system as to non-safety-adjacent systems
- D. Purchase a dedicated flight-ops security appliance that falls outside the existing licensing agreement
Show answer
Correct answer: B
Classifying the system and its Arc-connected mainframe dependency as Very High, with justification tied to the four-hour tolerance and flight-safety scope, satisfies the documented elevated-protection requirement using existing licensing (B). Excluding the mainframe from inventory (A) ignores that Arc-enabled servers extend visibility to hybrid, non-Azure hosts, applying default criticality (C) fails the documentation requirement, and a new appliance purchase (D) breaches the licensing constraint.
SC-100 study resources
Why Practice with MSCertQuiz?
Microsoft Learn teaches concepts. We prepare you for the actual exam.
Scenario-based questions covering the Microsoft Cybersecurity Reference Architectures (MCRA) and Microsoft Cloud Security Benchmark (MCSB) at Expert-level depth
Deep coverage of Zero Trust strategy design, including the Rapid Modernization Plan (RaMP), ransomware resiliency, and privileged access strategy
Architecture-tradeoff explanations that teach the reasoning behind each design decision — critical for an exam that tests strategy, not configuration steps
Updated for the latest 2026 exam objectives spanning security operations, identity, infrastructure, and application/data security design
Not sure if you're ready for the SC-100 exam?
Take the free SC-100 Readiness Check →What Our Users Say
“The MCRA and Zero Trust RaMP questions were exactly the kind of architectural reasoning the real exam demands. I had SC-300 and AZ-500 already but SC-100 still required real strategy thinking — this practice bank got me there. Passed with 745.”
Daniel K.
SC-100 Certified
“The privileged access and identity governance scenarios closed gaps I didn't know I had, even after years running an identity team. The explanations teach the tradeoffs, not just the letter.”
Priya V.
Cybersecurity Architect Expert
“Infrastructure and application security domains were the hardest for me. The Defender for Cloud posture management and Azure WAF questions here matched the depth of what showed up on exam day. Scored 780 on my second attempt.”
Thomas H.
Passed SC-100
Choose Your Plan
Start free, upgrade when you're ready to get serious
Free
Good for exploring the platform
- 40 practice questions
- Practice mode only
- Progress tracking
- No exam simulation mode
SC-100 Full Access
Best if your exam is in the next 2-4 weeks
- 500 practice questions
- Practice & Exam modes
- Detailed explanations
- Lifetime access
7-day money-back guarantee
Pro — All Certs
Best if you're planning multiple Microsoft exams
- ALL certifications included
- Unlimited questions
- New certs added free
- Cancel anytime
Save 30% vs buying individually
Your SC-100Exam Won't Wait
Candidates who complete at least 2 full mock exams pass at significantly higher rates than those who only study passively.
Don't risk $165 on the real exam without testing yourself first.
Start Free Practice NowNo credit card required • 40 free questions • Upgrade for $19.99 when ready
Official Microsoft Resources
Our practice questions are aligned with official Microsoft exam objectives. We recommend studying with Microsoft Learn first, then using MSCertQuiz to test your readiness.
View Official SC-100 Exam DetailsSC-100 Frequently Asked Questions
Everything you need to know about the SC-100 Cybersecurity Architect certification
What is the SC-100 certification?
What are the prerequisites for SC-100?
How hard is the SC-100 exam?
Is SC-100 worth it in 2026?
What topics does the SC-100 exam cover?
What is the difference between SC-100 and SC-200/SC-300/AZ-500?
What is the passing score for SC-100?
How is MSCertQuiz different from free SC-100 practice tests?
Does SC-100 practice include case study questions?
Also Preparing For
Candidates studying SC-100 often prepare for these certifications next.