SC-100 Sample Questions With Full Explanations
Welcome to this focused set of practice questions designed to mirror the rigor and complexity of the Microsoft SC-100 (Cybersecurity Architect Expert) exam. These questions test your ability to think like an architect, balancing security requirements with business needs, and applying the Zero Trust model across identity, data, applications, network, and infrastructure. Each question includes a detailed rationale to reinforce key concepts.
Q1. Your organization is migrating a legacy on-premises application to Azure. The application uses Integrated Windows Authentication and does not support modern protocols. You need to recommend an identity strategy that minimizes disruption while improving the security posture. What should you include in the recommendation? This topic pairs well with CISA Sample Questions With Full Explanations.
A. Implement Azure AD Application Proxy and configure pre-authentication using OAuth 2.0.
B. Configure Azure AD Seamless Single Sign-On and enable Legacy Authentication blocking.
C. Deploy Azure AD Domain Services and join the application VMs to the managed domain.
D. Implement Azure AD Kerberos authentication for on-premises resources using a cloud trust.
Answer: A
Explanation: Azure AD Application Proxy allows legacy on-premises apps to be published securely with modern pre-authentication (Azure AD), eliminating the need for inbound connectivity and supporting MFA. Option B blocks legacy auth, which would break the app. Option C changes the domain architecture significantly. Option D is for on-premises resources, not publishing apps.
Q2. You are designing a Zero Trust network strategy for a hybrid environment. The CISO mandates that all traffic between VNets and on-premises must be inspected, logged, and restricted based on identity and workload attributes. Which solution should you prioritize?
A. Azure Firewall with Threat Intelligence-based filtering.
B. Network Security Groups (NSGs) applied to all subnets.
C. Azure Virtual WAN with integrated routing and Azure Firewall.
D. Azure DDoS Protection Standard on all public IPs.
Answer: C
Explanation: Azure Virtual WAN provides centralized networking with built-in routing and integrates Azure Firewall for traffic inspection, aligning with Zero Trust segmentation. NSGs (B) are stateful but lack centralized logging and advanced inspection. Azure Firewall alone (A) doesn't solve the hybrid routing. DDoS (D) is a resilience control, not a segmentation one.
Q3. Your company is using Microsoft 365 E5 and wants to protect sensitive data in SharePoint Online. You need to recommend a strategy to automatically detect and protect documents containing credit card numbers, even if users rename or re-upload them. What should you include in the recommendation?
A. Create a retention policy for all SharePoint sites.
B. Configure a DLP policy using document fingerprinting.
C. Deploy Microsoft Information Protection (MIP) with a custom sensitive info type.
D. Enable SharePoint Advanced Management (SAM) with restricted access control.
Answer: C
Explanation: Custom sensitive info types in MIP allow you to define patterns (e.g., credit card regex) and apply labels/encryption automatically, independent of file names. Document fingerprinting (B) is a separate method but less flexible for regex patterns. Retention (A) doesn't classify. SAM (D) is for access control, not content classification.
Q4. A multinational enterprise is designing a security strategy for Azure DevOps pipelines. They require that code changes to production cannot be deployed without at least two independent approvals and that no single user can approve their own change. Which security control should you recommend?
A. Enable branch policies with "Number of required reviewers" set to 2.
B. Implement a service connection with "Approval gates" and "Exclude self-approval" enabled. Looking for more detail? See CKS Sample Questions With Full Explanations.
C. Use Azure AD Privileged Identity Management (PIM) for pipeline administrators.
D. Configure a release pipeline with a "Pre-deployment condition" requiring a manual validation.
Answer: B
Explanation: In Azure DevOps, service connection approval gates allow you to require approvals from multiple users and explicitly exclude the requester from approving. Branch policies (A) manage code merging, not deployment. PIM (C) governs admin roles, not pipeline approvals. Manual validation (D) is a single-step gate without multi-user enforcement.
Q5. Your security team needs to detect and respond to attacks on Azure SQL databases, including SQL injection attempts and anomalous access patterns. You have Azure Sentinel deployed. Which data source should you connect first to maximize detection coverage?
A. Azure SQL Auditing logs.
B. Azure SQL Database diagnostic settings for "SQLInsights" and "QueryStoreRuntimeStatistics".
C. Azure Activity logs for SQL write operations.
D. Microsoft Defender for Cloud alerts for SQL.
Answer: D
Explanation: Defender for Cloud for SQL provides built-in threat detection (SQL injection, brute force) and integrates natively with Sentinel via the "Continuous Export" connector. SQL Auditing logs (A) are raw and require custom rules. Diagnostic settings (B) are for performance metrics. Activity logs (C) only cover control plane operations.
Q6. You are designing a secure access solution for a new SaaS application that will be used by contractors. The contractors will use their personal Microsoft accounts (MSA) or Google accounts. You need to enforce MFA and conditional access for these users. What should you implement?
A. Configure a B2B collaboration with "Identity providers" for Google and Microsoft accounts, and apply a Conditional Access policy targeting guest users.
B. Create a B2C tenant and configure custom policies for each identity provider.
C. Use Azure AD entitlement management to grant access via access packages.
D. Enable SAML-based federation with each contractor's home organization.
Answer: A
Explanation: Azure AD B2B collaboration supports external identities (Google, MSA) and allows Conditional Access policies to target "Guest users" specifically for MFA and compliance. B2C (B) is for customer-facing apps, not employee/contractor access. Entitlement management (C) manages access lifecycle but doesn't enforce MFA. SAML federation (D) requires each contractor org to have Azure AD or AD FS.
Q7. Your organization is deploying Azure Kubernetes Service (AKS) for a critical workload. You need to ensure that secrets are not stored in plain text in etcd and that they are encrypted at rest and in transit. What is the most secure and architecturally correct approach?
A. Use Kubernetes Secrets and enable Azure Disk Encryption on the nodes.
B. Use Azure Key Vault with the Secrets Store CSI driver, and enable AKS-managed Azure Active Directory integration.
C. Store secrets in ConfigMaps and use network policies to restrict access.
D. Use Helm charts with secrets in the chart values, and use a private AKS cluster.
Answer: B You might also find Cisco CyberOps Associate Sample Questions With Full Explanations helpful.
Explanation: The Secrets Store CSI driver mounts Azure Key Vault secrets as volumes, ensuring secrets never persist in etcd. AKS-managed Azure AD integration (B) provides identity-based access for the driver. Disk encryption (A) protects at rest but secrets still exist in etcd. ConfigMaps (C) are not encrypted. Helm values (D) are plain text.
Q8. Your company has a complex Microsoft 365 environment and needs to implement a least-privilege model for administrators. You need to ensure that only users who are actively performing admin tasks have privileged roles, and they must elevate for a limited time with approval. Which approach meets these requirements?
A. Assign permanent Global Administrator role to the security team.
B. Use Azure AD Privileged Identity Management (PIM) with "Active assignment" for the security team.
C. Use PIM with "Eligible assignment" and require Azure MFA and justification for activation.
D. Create a custom role with only "Directory Readers" permission.
Answer: C
Explanation: PIM with eligible assignments requires users to activate the role on-demand, with MFA, justification, and optional approval, enforcing just-in-time access. Active assignments (B) are permanent. Permanent Global Admin (A) violates least privilege. Custom read-only role (D) doesn't allow admin tasks.
Q9. You are designing a data security strategy for a large data lake in Azure Data Lake Storage (ADLS) Gen2. The data includes PII and financial records. You need to recommend a solution to automatically classify and label files as they are uploaded, and enforce access policies based on these labels. What should you use?
A. Azure Purview with automatic sensitivity labeling and Azure Storage Blob inventory.
B. Microsoft Information Protection (MIP) with a scanner for on-premises data.
C. Azure SQL Database's Dynamic Data Masking.
D. Azure Policy with "Audit" effect for storage accounts.
Answer: A
Explanation: Azure Purview integrates with MIP to automatically classify and label data in ADLS Gen2, and those labels can be used in access policies (e.g., via Azure AD conditional access or attribute-based access control). Blob inventory (A) helps track files. MIP scanner (B) is for on-premises. SQL DDM (C) is for relational data. Azure Policy (D) audits config, not content.
Q10. Your organization is using Azure Sentinel for security operations. You need to design a solution to automatically respond to a specific type of incident (e.g., malware detected on a server) by isolating the VM from the network, without manual intervention. What is the most reliable and secure method?
A. Create a playbook based on Azure Logic Apps and trigger it from an analytics rule.
B. Use a workbook with a "Run" button to trigger a manual response.
C. Configure a PowerShell script in Azure Automation to run every 5 minutes.
D. Use Azure Security Center's "Just-in-time" access feature.
Answer: A
Explanation: Sentinel analytics rules can trigger automated responses via Logic Apps playbooks, which can call Azure APIs to isolate a VM (e.g., add an NSG rule). Workbooks (B) are for visualization, not automation. A periodic script (C) is not event-driven and has latency. JIT (D) manages access, not isolation.
This set reflects the depth and breadth of the SC-100 exam, emphasizing the architect's role in choosing between similar-sounding but distinct solutions. Remember to always map your answer to the core pillars: Zero Trust, governance, risk, and threat resilience.
Before you start full-length practice, use the free SC-100 readiness check for a quick look at which topics need more review.
Lock in your knowledge — full-length Microsoft Cybersecurity Architect (SC-100) mock tests reinforce what you have studied and expose what you have not.
To organize your remaining review, the free SC-100 study plan gives you a week-by-week schedule weighted by the official exam topics.