In the full course
What you get
- 400 exam-style questions, each with a full explanation
- 20 performance-based tasks, marked with partial credit
- 200 flashcards, filtered by domain
- The full study guide, 27 chapters
- Timed mock exams matched to the real exam length
- A readiness score weighted by the official exam blueprint
Get full access to Microsoft SC-100
All questions, timed exams, flashcards, PDF study guide download & progress tracking.
Lifetime · all courses
$29.99
One payment · future courses included
30 seconds, then straight to checkout.
Pass, or your money back
Reach 85% readiness on this course, sit the real exam, and if you don't pass we refund it in full. Applies to this single-course purchase. Terms.
More free samples
Marked, and passed
Real feedback from people who passed
“I failed my CISSP on the first attempt with another platform. Switched to CertCrush, focused on my weak domains using the tracking feature, and passed three months later. The explanations for wrong answers are genuinely useful, not just 'A is correct because A is correct'.”
“Honestly wasn't expecting much but this is probably the best ten bucks I've spent on exam prep. Did 20–30 questions every morning before work for 6 weeks. Passed with a comfortable margin. The timed exam mode is what really got me comfortable with the pressure.”
“The flashcards are underrated. I used them during my commute and it made a huge difference for the theory-heavy ITIL questions. Passed first try. Already using it again for CISM.”
SC-100 is Microsoft's expert-level cybersecurity architect exam, and it tests design judgement rather than portal skills. It asks you to choose the architecture that meets a stated business requirement, then defend that choice against Zero Trust, the Microsoft Cloud Security Benchmark and the Cloud Adoption Framework. This course follows the blueprint Microsoft published on 28 July 2026, including the AI security objectives added in that update.
Practice content last updated · Independently written and aligned to Microsoft’s published exam objectives.
About the Microsoft SC-100 Exam
SC-100 sits at the top of Microsoft's security certification track, and it is a design exam. Every other exam in the portfolio asks whether you can configure something. This one asks whether you should, and what you would put in its place when the answer is no. Candidates arriving straight from SC-200 or AZ-500 usually struggle with that shift rather than with product knowledge. The blueprint Microsoft published on 28 July 2026 measures four areas: designing solutions that align with security best practices and priorities, designing security operations, identity and compliance capabilities, designing security solutions for infrastructure, and designing security solutions for applications and data. The middle two carry 25 to 30 percent each, so more than half the exam sits in identity, compliance, posture management and infrastructure. Frameworks do real work in these questions. The Microsoft Cybersecurity Reference Architectures, the Microsoft Cloud Security Benchmark, the Zero Trust adoption framework, the Cloud Adoption Framework for Azure and the Azure Well-Architected Framework are not background reading. Questions ask which one governs a given decision and what it actually recommends. The July 2026 update also pushed AI security across the blueprint, adding Microsoft Entra Agent ID for agent identities, security for data used in AI workloads, and designing AI solutions against the Microsoft Cloud Security Benchmark. SC-100 is an expert certification with a prerequisite. Microsoft awards it only once you hold Azure Security Engineer Associate, Identity and Access Administrator Associate, or Security Operations Analyst Associate, and the exam assumes you have implemented or administered solutions in at least one of those areas.
Exam Domains Covered
- Design solutions that align with security best practices and priorities23%
- Design security operations, identity, and compliance capabilities27%
- Design security solutions for infrastructure27%
- Design security solutions for applications and data23%
Exam Format & Details
Microsoft publishes a range of 40 to 60 questions for its certification exams rather than an exact count for SC-100. Questions mix multiple choice, multiple response, drag and drop, build list, active screen and multi-part case studies. Expert role-based exams are allotted 100 minutes where no labs appear and 120 minutes where labs may appear, with roughly 20 minutes of seat time on top for instructions and the candidate agreement. Microsoft does not publish which exams carry labs, so plan for 120 minutes. The pass mark is 700 on a scale of 1 to 1000, which this app tracks as 70 percent. Microsoft states that this is a scaled score, so it does not equal 70 percent of questions answered correctly. The United States voucher price is 165 USD and varies by the country or region where the exam is proctored. Booking goes through Pearson VUE, at a test centre or online proctored. Passing SC-100 on its own does not earn the certification: Microsoft also requires Azure Security Engineer Associate, Identity and Access Administrator Associate, or Security Operations Analyst Associate.
Why Practice Questions Matter
SC-100 questions rarely carry an obviously wrong answer. Three of the four options usually work in some form, and the exam wants the one that satisfies the stated requirement without adding cost, blast radius or an unmanaged dependency. Reading why the near-miss fails is worth more here than memorising another product name. Practice also builds the case study habit: read the requirements first, then the scenario, then decide. Candidates who read a case study end to end before knowing what they are looking for tend to run short of time in the second half of the exam.
Try 2 performance tasks free
Drag-and-drop, sequencing and configuration tasks that mirror the interactive questions on the real Microsoft SC-100 exam, marked with partial credit.
Sample Practice Questions
The following questions are a preview of the type of syllabus-aligned questions you will practise in CertCrush. They reflect the format and reasoning style of the Microsoft SC-100 exam, not actual exam content.
Q1.A retail bank's review finds an application secret committed to source control, and a production code signing key held in the same Azure Key Vault the development team uses daily. Which design change should the architect recommend?
- A.Keep both in one vault and restrict access with role assignments
- B.Replace the stored secret with a managed identity where supported, and separate vaults by environment and blast radius
- C.Move the secret into the same vault and rotate both it and the key monthly
- D.Encrypt the secret in source control using a key held in the vault
Domain: Design security operations, identity, and compliance capabilities
Q2.An attack path shows an internet-exposed virtual machine with an unpatched remote code execution flaw, a system-assigned managed identity holding Contributor at subscription scope, and a storage account holding nightly database exports. The same identity assignment appears in several other paths. Which remediation closes the most exposure?
- A.Enable Microsoft Defender for Storage on the account holding the exports
- B.Patch the remote code execution vulnerability on the virtual machine
- C.Remove the public exposure from the virtual machine
- D.Replace the Contributor assignment on the managed identity with a scoped role
Domain: Design security solutions for infrastructure
Q3.A credit union wants a device that has fallen out of its configuration standard to lose access to corporate applications until it is fixed, rather than merely appearing on a report. Which design closes that loop?
- A.Mark the device non-compliant in Microsoft Intune and require device compliance in Conditional Access
- B.Disable the user's account until the device is remediated
- C.Increase the reporting frequency of the configuration profiles
- D.Publish a non-compliance dashboard and assign an owner to chase remediation
Domain: Design security solutions for infrastructure
Q4.Four hundred applications sit on a port authority's estate and only a fraction can receive threat modelling and penetration testing. On what basis should the architect prioritise?
- A.The number of users each application serves
- B.Business criticality and data sensitivity together, with internet exposure and privilege blast radius as tie-breakers
- C.A uniform assessment of all four hundred so no application is treated as less important
- D.The age of each application, oldest first
Domain: Design security solutions for applications and data
Q5.A charity lets its 600 staff read corporate mail and use the corporate chat application on their own phones. The trustees have made clear that the charity will not manage personal handsets or risk wiping personal photographs. What should the design specify?
- A.Block all access to mail and chat from mobile devices
- B.Publish an acceptable use policy asking staff to secure their own devices
- C.Enrol every personal handset in Microsoft Intune and apply a device compliance policy
- D.Apply app protection policies so corporate data inside managed applications is controlled without enrolling the device
Domain: Design security solutions for infrastructure
Q6.A sovereign wealth fund states that its records must remain in one country and that no foreign authority should be able to compel access to the readable data. An architect proposes an allowed-locations policy restricting deployment to that country's regions. Is that sufficient?
- A.No, the policy should list additional regions in the same country for resilience
- B.Yes, provided platform-managed encryption at rest is confirmed for every service
- C.No, the design also needs customer-managed key custody and restricted operator access
- D.Yes, because the allowed-locations policy prevents deployment outside the country
Domain: Design security operations, identity, and compliance capabilities
Q7.A university plans a new policy that will require a compliant device for access to the student records system. The registrar is worried about locking out staff on the first day of term. What is the correct validation approach before enforcement?
- A.Enable the policy and monitor the sign-in logs during the first week of term
- B.Leave the policy disabled and review device compliance reports instead
- C.Enable the policy for a pilot group and read the sign-in logs afterwards
- D.Enable the policy in Report-only mode and model named users with the what-if tool
Domain: Design security operations, identity, and compliance capabilities
Q8.After a games studio deploys private endpoints for its databases and disables public access, application servers still resolve the public names and connections fail. What is missing from the design?
- A.Private zone integration for name resolution, so clients resolve the endpoint to its private address
- B.Firewall rules on the database resources permitting the application subnet address ranges
- C.Service endpoints on the application subnets, so traffic is recognised as originating from the virtual network
- D.Peering between the application virtual network and the network hosting the databases
Domain: Design security solutions for infrastructure
Q9.A logistics operator requires that every storage account in all current and future subscriptions blocks public blob access. Subscriptions are created weekly by three separate business units. Where should the initiative be assigned?
- A.At the management group above those subscriptions
- B.At each subscription, with a monthly process that adds newly created subscriptions
- C.In the shared deployment template used by the three business units
- D.At each resource group that contains storage accounts
Domain: Design solutions that align with security best practices and priorities
Q10.Key material must never leave a single-tenant hardware boundary, and a national payments scheme insists Microsoft have no access path to it. Which key store meets the requirement?
- A.A standard Azure Key Vault with soft delete and purge protection enabled
- B.Azure Key Vault Managed HSM
- C.A standard vault with the key access policy limited to one service identity
- D.Keys generated on-premises and imported into a standard vault
Domain: Design security solutions for applications and data
Microsoft SC-100 guides & exam news
How to Pass the Microsoft SC-100 Exam in 2026: An 8-Week Study Plan for the Updated Objectives
A week-by-week plan to pass the Microsoft SC-100 Cybersecurity Architect exam in 2026, built around the refreshed objectives, the four design domains and the scenario questions that catch most candidates out.
SC-500 vs SC-200 in 2026: Which Microsoft Security Exam Should You Take?
SC-500 is for engineers who build and harden Azure, hybrid and AI workloads. SC-200 is for analysts who detect, investigate and respond. How the two 2026 exams differ, where their objectives overlap, and which to take first.
Microsoft AB-650 Exam Topics and Domain Weightings in 2026: The MS-102 Replacement, Now in Beta
AB-650 replaces MS-102 as Microsoft's tenant administration exam, and the weightings tell a different story. Security and governance take 40 to 45 percent, AI services take 35 to 40 percent, and classic tenant admin is down to a fifth of the exam.
Frequently Asked Questions
Does the Microsoft SC-100 course include performance-based questions?
Yes. The Microsoft SC-100 course includes 20 performance-based questions (PBQs): hands-on tasks that mirror the interactive questions on the real exam, including drag-and-drop matching, sequencing and configuration screens. Each one is marked with partial credit, so you can see exactly which placements were wrong, and every task includes a full explanation. The first two are free to try.
What is included in the free Microsoft SC-100 sample?
The free sample includes 10 syllabus-aligned practice questions, sample flashcards, and a preview chapter from the study guide. No account or payment is required to try the sample.
How many questions are in the full Microsoft SC-100 course?
The full Microsoft SC-100 course includes 400 practice questions and 20 performance-based tasks, covering all 4 exam domains. Every question carries a full explanation for the right answer and the wrong ones.
Are these official Microsoft exam questions?
No. CertCrush questions are independently written and syllabus-aligned. They mirror the format, difficulty, and reasoning style of the official exam. We are not affiliated with or endorsed by Microsoft.
Which domains does the Microsoft SC-100 course cover?
The course covers 4 exam domains: Design solutions that align with security best practices and priorities, Design security operations, identity, and compliance capabilities, Design security solutions for infrastructure, Design security solutions for applications and data.
Can I study on mobile?
Yes. CertCrush is fully responsive and works on phones, tablets, and desktops. The timed exam, flashcards, and study guide all work on mobile without installing an app.
What happens when I create an account?
Creating a free account lets you access full courses, track your weak areas by domain, and resume practice sessions across devices. No credit card is required to register.
Start with 10 free questions
No account, no card. The full Microsoft SC-100 course is $9.99, once.