Microsoft · Exam reference
About the Microsoft SC-100 exam
SC-100 is Microsoft's expert-level cybersecurity architect exam, and it tests design judgement rather than portal skills. It asks you to choose the architecture that meets a stated business requirement, then defend that choice against Zero Trust, the Microsoft Cloud Security Benchmark and the Cloud Adoption Framework. This course follows the blueprint Microsoft published on 28 July 2026, including the AI security objectives added in that update.
10
Sample questions
120 min
Exam time limit
70%
Practice pass mark
$165
Exam voucher
SC-100 sits at the top of Microsoft's security certification track, and it is a design exam. Every other exam in the portfolio asks whether you can configure something. This one asks whether you should, and what you would put in its place when the answer is no. Candidates arriving straight from SC-200 or AZ-500 usually struggle with that shift rather than with product knowledge. The blueprint Microsoft published on 28 July 2026 measures four areas: designing solutions that align with security best practices and priorities, designing security operations, identity and compliance capabilities, designing security solutions for infrastructure, and designing security solutions for applications and data. The middle two carry 25 to 30 percent each, so more than half the exam sits in identity, compliance, posture management and infrastructure. Frameworks do real work in these questions. The Microsoft Cybersecurity Reference Architectures, the Microsoft Cloud Security Benchmark, the Zero Trust adoption framework, the Cloud Adoption Framework for Azure and the Azure Well-Architected Framework are not background reading. Questions ask which one governs a given decision and what it actually recommends. The July 2026 update also pushed AI security across the blueprint, adding Microsoft Entra Agent ID for agent identities, security for data used in AI workloads, and designing AI solutions against the Microsoft Cloud Security Benchmark. SC-100 is an expert certification with a prerequisite. Microsoft awards it only once you hold Azure Security Engineer Associate, Identity and Access Administrator Associate, or Security Operations Analyst Associate, and the exam assumes you have implemented or administered solutions in at least one of those areas.
Exam Domains Covered
Exam Format & Details
Microsoft publishes a range of 40 to 60 questions for its certification exams rather than an exact count for SC-100. Questions mix multiple choice, multiple response, drag and drop, build list, active screen and multi-part case studies. Expert role-based exams are allotted 100 minutes where no labs appear and 120 minutes where labs may appear, with roughly 20 minutes of seat time on top for instructions and the candidate agreement. Microsoft does not publish which exams carry labs, so plan for 120 minutes. The pass mark is 700 on a scale of 1 to 1000, which this app tracks as 70 percent. Microsoft states that this is a scaled score, so it does not equal 70 percent of questions answered correctly. The United States voucher price is 165 USD and varies by the country or region where the exam is proctored. Booking goes through Pearson VUE, at a test centre or online proctored. Passing SC-100 on its own does not earn the certification: Microsoft also requires Azure Security Engineer Associate, Identity and Access Administrator Associate, or Security Operations Analyst Associate.
Why Practice Questions Matter
SC-100 questions rarely carry an obviously wrong answer. Three of the four options usually work in some form, and the exam wants the one that satisfies the stated requirement without adding cost, blast radius or an unmanaged dependency. Reading why the near-miss fails is worth more here than memorising another product name. Practice also builds the case study habit: read the requirements first, then the scenario, then decide. Candidates who read a case study end to end before knowing what they are looking for tend to run short of time in the second half of the exam.
Sample Practice Questions
The following questions are a preview of the type of syllabus-aligned questions you will practise in CertCrush. They reflect the format and reasoning style of the Microsoft SC-100 exam — not actual exam content.
Q1.A retail bank's review finds an application secret committed to source control, and a production code signing key held in the same Azure Key Vault the development team uses daily. Which design change should the architect recommend?
- A.Keep both in one vault and restrict access with role assignments
- B.Replace the stored secret with a managed identity where supported, and separate vaults by environment and blast radius
- C.Move the secret into the same vault and rotate both it and the key monthly
- D.Encrypt the secret in source control using a key held in the vault
Domain: Design security operations, identity, and compliance capabilities
Q2.An attack path shows an internet-exposed virtual machine with an unpatched remote code execution flaw, a system-assigned managed identity holding Contributor at subscription scope, and a storage account holding nightly database exports. The same identity assignment appears in several other paths. Which remediation closes the most exposure?
- A.Enable Microsoft Defender for Storage on the account holding the exports
- B.Patch the remote code execution vulnerability on the virtual machine
- C.Remove the public exposure from the virtual machine
- D.Replace the Contributor assignment on the managed identity with a scoped role
Domain: Design security solutions for infrastructure
Q3.A credit union wants a device that has fallen out of its configuration standard to lose access to corporate applications until it is fixed, rather than merely appearing on a report. Which design closes that loop?
- A.Mark the device non-compliant in Microsoft Intune and require device compliance in Conditional Access
- B.Disable the user's account until the device is remediated
- C.Increase the reporting frequency of the configuration profiles
- D.Publish a non-compliance dashboard and assign an owner to chase remediation
Domain: Design security solutions for infrastructure
Q4.Four hundred applications sit on a port authority's estate and only a fraction can receive threat modelling and penetration testing. On what basis should the architect prioritise?
- A.The number of users each application serves
- B.Business criticality and data sensitivity together, with internet exposure and privilege blast radius as tie-breakers
- C.A uniform assessment of all four hundred so no application is treated as less important
- D.The age of each application, oldest first
Domain: Design security solutions for applications and data
Q5.A charity lets its 600 staff read corporate mail and use the corporate chat application on their own phones. The trustees have made clear that the charity will not manage personal handsets or risk wiping personal photographs. What should the design specify?
- A.Block all access to mail and chat from mobile devices
- B.Publish an acceptable use policy asking staff to secure their own devices
- C.Enrol every personal handset in Microsoft Intune and apply a device compliance policy
- D.Apply app protection policies so corporate data inside managed applications is controlled without enrolling the device
Domain: Design security solutions for infrastructure
Frequently Asked Questions
What is included in the free Microsoft SC-100 sample?
The free sample includes 10 syllabus-aligned practice questions, sample flashcards, and a preview chapter from the study guide. No account or payment is required to try the sample.
How many questions are in the full Microsoft SC-100 course?
The full course includes a comprehensive question bank covering all exam domains. You can see the total question count on the Microsoft SC-100 course page.
Are these official Microsoft exam questions?
No. CertCrush questions are independently written and syllabus-aligned — they mirror the format, difficulty, and reasoning style of the official exam. We are not affiliated with or endorsed by Microsoft.
Which domains does the Microsoft SC-100 course cover?
The course covers 4 exam domains: Design solutions that align with security best practices and priorities, Design security operations, identity, and compliance capabilities, Design security solutions for infrastructure, Design security solutions for applications and data.
Can I study on mobile?
Yes. CertCrush is fully responsive and works on phones, tablets, and desktops. The timed exam, flashcards, and study guide all work on mobile without installing an app.
What happens when I create an account?
Creating a free account lets you access full courses, track your weak areas by domain, and resume practice sessions across devices. No credit card is required to register.