Microsoft SC-100 Practice Test

SC-100 practice test: what's covered

• Cybersecurity Architect Expert

Free SC-100 sample questions

1. Contoso, a global manufacturer with 40,000 employees in 22 countries, has acquired three smaller companies in the last 18 months. The CISO has tasked the architect to design a Zero Trust security strategy that aligns the merged estate. Several executives push back, arguing that the existing perimeter firewall investments are "good enough." The architect must justify the strategic shift. Which set of THREE core principles BEST defines Zero Trust as per Microsoft's reference architecture, and should be cited?

   • A. Defense in depth, least privilege, network segmentation
   • B. Verify explicitly, use least privilege access, assume breach
   • C. Encrypt everywhere, log everything, patch fast
   • D. Identity is the new perimeter, MFA everywhere, disable legacy auth
   Show answer

   Correct: B. Microsoft's Zero Trust doctrine has exactly three foundational tenets: "verify explicitly" (always authenticate AND authorize against all signals), "use least privilege access" (JIT/JEA, risk-based adaptive access), and "assume breach" (minimize blast radius, segment, encrypt end-to-end, use analytics for visibility). The B-distractor sounds correct but conflates older defense-in-depth doctrine with Zero Trust; while related, they are not the SAME principles Microsoft codifies in MCRA.

2. The architect must map the customer's security strategy to a Microsoft framework. The CTO is confused between three Microsoft frameworks the architect has cited. Which TWO statements correctly distinguish them? (Choose 2)

   • A. CAF (Cloud Adoption Framework) provides a full-lifecycle business + cloud-adoption approach including Strategy, Plan, Ready, Adopt, Govern, Manage, Secure
   • B. ZTAF (Zero Trust Adoption Framework) is a CAF subset focused on operationalizing Zero Trust principles in stages across identity, endpoints, apps, data, infra and network
   • C. WAF (Well-Architected Framework) is the strategic Zero Trust governance framework that defines breach-assumption pillars
   • D. CAF and WAF are interchangeable names for the same governance framework
   • E. ZTAF replaces CAF entirely for any Zero Trust customer
   Show answer

   Correct: A and B. CAF is the strategic ADOPTION lifecycle (Strategy → Plan → Ready → Adopt → Govern/Manage/Secure). ZTAF complements CAF and focuses ONLY on operationalising Zero Trust across the six pillars (identity, endpoints, apps, data, infra, network). WAF (Well-Architected Framework) is a workload-level design framework with five pillars (Reliability, Security, Cost, OpEx, Performance) — NOT a Zero Trust governance framework. Confusing WAF with ZTAF is the most common SC-100 trap.

3. During a strategy workshop the architect sketches a high-level Microsoft Cybersecurity Reference Architecture (MCRA) layer view: <pre>┌─────────────────────────────────────────────────────────┐ │ Security Operations (XDR + SIEM): │ │ Microsoft 365 Defender ←→ Defender for Cloud ←→ Sentinel │ ├─────────────────────────────────────────────────────────┤ │ Identity & Access (Entra ID, PIM, CA, Verified ID) │ ├─────────────────────────────────────────────────────────┤ │ Endpoints | Apps | Data | Infrastructure | Network │ │ Defender Defender Purview Defender Defender for │ │ for for Cloud for Servers / Cloud-Net │ │ Endpoint Apps IaaS-PaaS │ └─────────────────────────────────────────────────────────┘</pre> A director asks where "business-risk alignment" lives in this picture. Which is the architect's BEST answer?

   • A. It is implicit in the Defender for Endpoint layer
   • B. Business risk is NOT shown in MCRA — MCRA is a technical reference; business-risk alignment is delivered through the Microsoft Cybersecurity Risk Management Framework (CRMF / NIST CSF mapped) layered ABOVE MCRA
   • C. Business risk maps directly to Sentinel analytic rules
   • D. It belongs to the WAF Reliability pillar
   Show answer

   Correct: B. MCRA is a TECHNICAL reference of how Microsoft security products inter-relate. Business-risk alignment lives one layer above, via Microsoft's Cybersecurity Risk Management Framework — itself mapped to NIST CSF (Govern, Identify, Protect, Detect, Respond, Recover). Architects must explicitly connect business risks to MCRA capabilities; MCRA itself does not do that mapping for you. Saying it is "implicit in Defender" is a common SC-100 trap.

4. A bank with 12,000 employees runs on-prem Active Directory plus Entra ID hybrid. The architect must propose a Zero Trust starting point. Senior leadership wants ONE pillar to attack FIRST for maximum risk reduction with minimal disruption. Which Zero Trust pillar should the architect prioritise FIRST and WHY?

   • A. Network — segment everything with micro-perimeters
   • B. Identity — because identity is the primary control plane in cloud-first Zero Trust; MFA + Conditional Access + risk-based sign-in eliminate >99% of identity-based attacks per Microsoft telemetry, with minimal user disruption
   • C. Endpoints — deploy Defender for Endpoint to every device
   • D. Data — classify and label all sensitive data
   Show answer

   Correct: B. In Microsoft's Zero Trust model identity is the primary control plane — every access decision starts with "who are you and what is your context". Enforcing MFA + Conditional Access + risk-based policies on Entra ID gives the largest risk reduction with the smallest user-impact footprint. Network and endpoint controls follow, but identity is the most prescribed FIRST step. Network-first is the legacy mindset and the typical exam trap.

5. Following a workshop the architect produces a Zero Trust maturity scoring table: <pre>Pillar Traditional Advanced Optimal Score Identity Pwd+MFA CA risk Passwordless+CA Advanced Endpoints AV only MDE EDR MDE+ASR+TVM Advanced Apps SSO some SAML+CA CASB+CA risk Traditional Data File shares Labels Auto-label+DLP Traditional Infra VPN PIM JIT PIM+PAW+JEA Traditional Network Flat Segments ZT segmentation Traditional</pre> Given this scoring, which is the SINGLE BEST next investment recommendation?

   • A. Roll out Defender for Cloud Apps (MDA / former MCAS) to mature the Apps pillar from Traditional to Advanced
   • B. Deploy yet more EDR sensors on already-covered endpoints
   • C. Switch to passwordless on identity which is already Advanced
   • D. Replace MDE with a third-party EDR
   Show answer

   Correct: A. In ZT maturity scoring you invest in the WEAKEST pillar with the highest business value. Apps, Data, Infra and Network are all "Traditional", but Apps is the most reachable quick win with MDA (formerly MCAS) — provides SaaS app discovery, session control, file scanning, OAuth app governance. Tackling apps unlocks data-classification visibility for the next iteration on Data. Doubling down on already-Advanced pillars is the textbook anti-pattern.

Last updated: 2026-10-19

SC-100 practice test FAQ

Related practice tests

• Microsoft AI-102 practice test
• Microsoft AI-900 practice test
• Azure AZ-104 practice test
• Azure AZ-140 practice test
• Azure AZ-204 practice test
• Azure AZ-305 practice test