EnglishDeutschFrançaisEspañolPortuguês

Microsoft · SC-100 · Expert

Microsoft Cybersecurity Architect (SC-100) — Practice Questions and Mock Exam

The SC-100 certification validates expert-level skills in designing and evolving an organization's overall cybersecurity strategy.

Practice for freeTry a practice question first
Try a practice question firstPractice for free
Start practicing SC-100 freeBuy SC-100 access for $29.99
50Questions per Pass-IT mock exam
120minPass-IT mock exam time limit

Official SC-100 exam: 700 out of 1000 points to pass.

Checked against Microsoft · August 2026 · Current exam version

Try Pass-IT

See what learning with Pass-IT is like.

Answer a SC-100 sample question and read the explanation with its source. Right here, with no sign-up.

Design security solutions for applications and data5 / 5

A cybersecurity architect is designing the key management architecture for an organization with strict regulatory requirements. The organization needs a Key Vault-integrated Azure key management service for encryption-at-rest scenarios that provides FIPS 140-3 Level 3 validated HSMs, single-tenant isolation, and customer-controlled root of trust so Microsoft doesn't have access to key material. Which Azure key management service meets these requirements?

AlexFull explanation from Alex

Managed HSM is the Key Vault-integrated option for high-assurance customer-managed keys when the requirements include FIPS 140-3 Level 3 HSMs, single tenancy, and customer-controlled root of trust. Distinguish it from Key Vault Premium, which offers HSM-backed keys in a multitenant service, and Azure Cloud HSM, which gives direct HSM administration through industry HSM APIs but not the Key Vault managed key service model.

Sourcelearn.microsoft.com

How to prepare for SC-100 with Pass-IT.

Currently 321 practice questions for SC-100, with new ones added regularly. Focus on what you still need to learn.

Get past difficult questions.

Understand why an answer is correct. Alex explains the concepts and answers your follow-up questions so you can apply what you learn to the next task.

Meet Alex →

Conversation preview · SC-100

Azure Policy Audit

  1. You

    Does an Audit effect prevent a request that violates policy?

  2. Alex · AI tutor

    No. Audit reports noncompliance; it does not stop the request.

    Read the Microsoft documentation ↗
  3. You

    Does adding developer training change that effect?

  4. Alex · AI tutor

    No. Training does not turn Audit into an enforcing control. The proposed audit does not meet a prevention requirement.

    Read the Microsoft documentation ↗

Make your study time count.

Practice at your level.
For new practice sessions, Pass-IT adjusts the difficulty based on your previous answers.

Learn from mistakes.
Incorrect answers automatically become flashcards. When you review them, you rate how confidently you remember; Pass-IT schedules the next review.

See how focused practice works →

Animated feature preview

Turn your mistakes into knowledge you can rely on.

How Pass-IT works

Your review

Answered a question incorrectly?

Pass-IT saves it for your review.

SC-100 · Question excerpt

Azure Policy Audit

View the full question

A cybersecurity architect is designing the security for Azure App Configuration used to store feature flags and application settings for microservices. Problem Statement: Development teams are storing sensitive connection strings directly in App Configuration instead of using Key Vault references. Proposed Solution: Implement Azure Policy that audits App Configuration entries for patterns matching connection strings and secrets, combined with developer training on Key Vault reference patterns. Does this solution prevent sensitive data from being stored directly in App Configuration?

Understand the correct answer.

No

An Audit effect records noncompliance without stopping the request, so the proposed audit is not a preventive control.

Read the Microsoft documentation ↗

How confidently do you remember?

During review, you assess how well you still know the answer.

Correct after hesitating

Pass-IT schedules your next review.

The date depends on your self-assessment and previous reviews.

Simplified demonstration. No learning progress is saved.

Practice for the moment that counts.

Take a full mock exam with a time limit and find out whether you can finish in time.

Your SC-100 mock exam

Questions
50
Minutes
120

Illustration of an exam session

  1. Start
  2. Answer questions
  3. Finish

Length and time limit of the Pass-IT mock exam.

Go into your exam with more confidence.

Your Readiness Score helps you assess whether you are ready for the exam. Results by exam domain show you where you should keep practicing.

Your money back if you fail despite 80% Readiness.
If your Readiness Score is at least 80% when you take the exam and you still fail, we refund the Pass-IT purchase price for this certification.

For active, paid access. Submit proof of failing within 14 days.

Further guarantee conditions

You need at least 80% Readiness and active, paid access to the certification when you take the exam. Take the exam within your access period and submit official proof of failing within 14 days after the exam.

For purchases through Apple or Google, refunds are handled by the respective store. See the full terms for further details.

Read the guarantee terms →

The Readiness Score describes your practice progress, not a probability of passing.

Guarantee requirement

80%

At least 80% Readiness
when you take the exam

Money back if you fail

Question counts and mock exam settings from the current Pass-IT catalog.

Exam domains

What you practice for SC-100.

Exam topics, relevant practice and sources you can check.

Security strategy and architecture20–25% of the exam52 QuestionsPass-IT questions

You turn business priorities and security frameworks into a practical design.

  • Prioritize threats to critical business processes and design ransomware resilience with backups, recovery, privileged-access controls and security updates.
  • Apply Microsoft reference architectures, the cloud security benchmark and Zero Trust to internal, external and supply-chain threats, including AI security.
  • Evaluate security governance with the Cloud Adoption Framework and Well-Architected Framework, then recommend secure AI adoption, landing zones and development practices.
Official Microsoft objectives
Operations, identity and compliance25–30% of the exam83 QuestionsPass-IT questions

You design how teams detect threats, control access and demonstrate compliance.

  • Design centralized logging, monitoring, automated response and threat hunting across hybrid and multicloud systems with Defender XDR, Sentinel, Purview Audit and MITRE ATT&CK. Evaluate security workflows and threat-detection coverage.
  • Design identity and access controls for users, external partners and agents, including modern authentication, Conditional Access, hardened Active Directory and protected secrets, keys and certificates.
  • Design delegated and privileged access, entitlement governance and access reviews, including secure administrator accounts, workstations and remote access.
  • Translate compliance requirements into controls and design their assessment with Microsoft Purview, Azure Policy and Defender for Cloud benchmarks.
Official Microsoft objectives
Infrastructure protection25–30% of the exam83 QuestionsPass-IT questions

You design protection for devices, cloud services and the networks connecting them.

  • Assess and improve cloud security posture with Defender for Cloud, Secure Score and Azure Arc, using exposure analysis and attack paths to prioritize workload protection.
  • Design endpoint hardening and security baselines for servers, clients, mobile and embedded devices, including industrial systems and local administrator passwords.
  • Design security baselines and controls for cloud services, web applications, IoT workloads, containers, orchestration platforms and Azure AI.
  • Design network security and access to internet, Microsoft and private services with Microsoft Entra Internet Access and Private Access, including cross-tenant protection.
Official Microsoft objectives
Application and data security20–25% of the exam103 QuestionsPass-IT questions

You choose controls that protect collaboration, application development and stored data.

  • Evaluate and design Microsoft 365 security with Secure Score, Defender, Intune and Purview, including collaboration and Copilot data protection and compliance.
  • Assess application risks and threat models, define and implement secure development standards, and design and implement controls for the application lifecycle, workload identities, APIs and web application firewalls.
  • Design data discovery, classification and threat priorities, then choose encryption and protection for AI data, Azure databases and storage, including Key Vault and Defender controls.
Official Microsoft objectives
Question formats you can practice
Multiple Choice
Select one answer.
Multiple Response
Select multiple applicable answers.
True / False
Decide whether statements are true or false.
Drag & Drop
Match items to the appropriate targets.
Ordering
Put steps in the correct order.
Dropdown
Choose the appropriate entry from a dropdown list.

These are Pass-IT practice formats. Check the Microsoft certification page for the official exam information.

The ranges describe the weighting of exam topics. See Official Microsoft objectives for the current exam objectives.

Frequently asked questions

Your preparation

How much study time should I plan for SC-100?

For planning, Pass-IT estimates roughly 35–85 hours. Relevant experience may put you toward the lower end; starting from scratch may put you toward the higher end. Your needs may fall outside this range. This is not a time requirement from Microsoft or a promise that you will be exam-ready within that time.

Using Pass-IT

What language are Pass-IT questions in?

Questions in the app are currently in English. Translations of the sample questions on this page apply only to this preview. Check with Microsoft for the languages available for the official exam.

How long does my SC-100 access last?

Access covers this certification for 12 months. You pay once, with no automatic renewal.

When does the money-back guarantee apply?

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days. Guarantee terms

About the SC-100 exam

Where can I take the SC-100 exam?

Pearson VUE online proctored or at authorized testing centers worldwide.

How long is the Microsoft Cybersecurity Architect exam?

The SC-100 exam has 50 questions and a 120-minute time limit.

Who is SC-100 aimed at?

It is Microsoft's expert-level security exam, written for people who design security strategy rather than operate it. Every domain is a design domain, so the questions ask what you would recommend across identity, infrastructure, applications and data, not which blade to click. Roles it maps to are security architect, senior security engineer and CISO-adjacent advisory work.

How often do you renew SC-100?

Every year, through the free renewal assessment on Microsoft Learn. It opens six months before your expiry date and has to be completed before that date, not after.

What happens if you fail SC-100?

You can retake after 24 hours, then after 14 days for later attempts, up to five attempts in 12 months. At 120 minutes it is the longest of Microsoft's security exams, so pacing is worth rehearsing.

Your preparation for SC-100

$29.99one-time

12 months of access for SC-100 · No automatic renewal

Buy SC-100 access

Questions in the app are currently in English.

Try 20 questions for freeFree account required. No credit card.

Already have an account? Log in

Prefer a subscription? View subscriptions →

Money back if you fail with at least 80% Readiness, for eligible purchases under the guarantee terms.

Guarantee terms

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days.

Full guarantee terms →

Related certifications

Administering Information Security in Microsoft 365Administering Microsoft Azure SQL SolutionsAdministering Windows ServerCollaboration Communications Systems EngineerAll Microsoft certifications →