Microsoft Cybersecurity Architect (SC-100) Exam Practice Questions & Study Guide 2026

Question 1

You have a Microsoft 365 tenant that contains 5,000 users and 5,000 Windows 11 devices. All users are assigned Microsoft 365 £5 licenses and the Microsoft Defender Vulnerability Management add-on. The Windows 11 devices are managed by using Microsoft Intune and Microsoft Defender for Endpoint. The Windows 11 devices are configured during deployment to comply with Center for Internet Security (CIS) benchmarks for Windows 11. You need to recommend a compliance solution for the Windows 11 devices. The solution must identify devices that were modified and no longer comply with the CIS benchmarks. What should you include in the recommendation?  

A. Authenticated scan for Windows in Microsoft Defender Vulnerability Management 
B. Microsoft Secure Score for Devices in Defender for Endpoint 
C. attack surface reduction (ASR) rules in Defender for Endpoint 
D. security baselines assessments in Microsoft Defender Vulnerability Management

Show Answer

Question 2

You have an Azure subscription that has Microsoft Defender for Cloud enabled. You need to enforce ISO 27001:2013 standards for new resources deployed to the subscription. The solution must ensure that noncompliant resources are automatically detected. What should you use? 

A. Azure Blueprints 
B. the regulatory compliance dashboard in Defender for Cloud 
C. Azure role-based access control (Azure RBAC) 
D. Azure Policy 

Show Answer

Question 3

You design cloud-based software as a service (SaaS) solutions. You need to recommend ransomware attacks. The solution must follow Microsoft Security Best Practices. What should you recommend doing first?

A. Implement data protection. 
B. Develop a privileged access strategy. 
C. Prepare a recovery plan. 
D. Develop a privileged identity strategy. 

Show Answer

Question 4

You have an on-premises server that runs Windows Server and contains a Microsoft SQL Server database named DB1. You plan to migrate DB1 to Azure. You need to recommend an encrypted Azure database solution that meets the following requirements: • Minimizes the risks of malware that uses elevated privileges to access sensitive data • Prevents database administrators from accessing sensitive data • Enables pattern matching for server-side database operations • Supports Microsoft Azure Attestation • Uses hardware-based encryption What should you include in the recommendation?

A. SQL Server on Azure Virtual Machines with virtualization-based security (VBS) enclaves 
B. Azure SQL Database with virtualization-based security (VBS) enclaves 
C. Azure SQL Managed Instance that has Always Encrypted configured 
D. Azure SQL Database with Intel Software Guard Extensions (Intel SGX) enclaves 

Show Answer

Question 5

You are designing the encryption standards for data at rest for an Azure resource You need to provide recommendations to ensure that the data at rest is encrypted by using AES-256 keys. The solution must support rotating the encryption keys monthly. Solution: For blob containers in Azure Storage, you recommend encryption that uses customer-managed keys (CMKs). Does this meet the goal?

A. Yes
 B. No 

Show Answer

Question 6

Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains 500 Windows 11 devices. You have a Microsoft 365 subscription and an Azure subscription. You have a Microsoft Entra tenant that syncs with the domain and is linked to the subscriptions. The devices are Microsoft Entra hybrid joined. You plan to deploy a solution to mitigate attacks against privileged accounts. The solution will include Microsoft Sentinel rules that will detect attempts to use fake cached credentials. You need to recommend a solution to create the fake cached credentials on client computers. What should you recommend? 

A. User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel 
B. a deception rule in Microsoft Defender for Endpoint 
C. a Honeytoken tag in Microsoft Defender for Identity 
D. a user risk policy in Microsoft Entra ID Protection 

Show Answer

Question 7

You have an Azure subscription. You have a DNS domain named contoso.com that is hosted by a third-party DNS registrar. Developers use Azure DevOps to deploy web apps to App Service Environments- When a new app is deployed, a CNAME record for the app is registered in contoso.com. You need to recommend a solution to secure the DNS record tor each web app. The solution must meet the following requirements: • Ensure that when an app is deleted, the CNAME record for the app is removed also • Minimize administrative effort. What should you include in the recommendation? 

A. Microsoft Defender for DevOps 
B. Microsoft Defender foe App Service 
C. Microsoft Defender for Cloud Apps 
D. Microsoft Defender for DNS 

Show Answer

Question 8

You have an Azure subscription. You have a subscription to a third-party cloud provider. The subscription contains 100 virtual machines. You manage cloud security for both subscriptions from the Azure subscription. You need to recommend a solution to validate the security posture of the virtual machines. Which two services should you include in the recommendation? Each correct answer presents part of the solution.

A. Microsoft Defender for Cloud 
B. Microsoft Defender for Endpoint 
C. Azure Lighthouse 
D. Microsoft Sentinel 
E. Azure Arc 

Show Answer

Question 9

Your on-premises network contains an Active Directory Domain Services (AD DS) domain named corpxontoso.com and an AD DS-integrated application named App1. Your perimeter network contains a server named Server1 that runs Windows Server. You have a Microsoft Entra tenant named contoso.com that syncs with corp.contoso.com. You plan to implement a security solution that will include the following configurations: • Manage access to App1 by using Microsoft Entra Private Access. • Deploy a Microsoft Entra application proxy connector to Server1. • Implement single sign-on (SSO) for App1 by using Kerberos constrained delegation. • For Server1, configure the following rules in Windows Defender Firewall with Advanced Security: o Rule1: Allow TCP 443 inbound from a designated set of Azure URLs. o Rule2: Allow TCP 443 outbound to a designated set of Azure URLs. o Rule3: Allow TCP 80 outbound to a designated set of Azure URLs. o Rule4: Allow TCP 389 outbound to the domain controllers on corp.contoso.com. You need to maximize security for the planned implementation. The solution must minimize the impact on the connector. Which rule should you remove?

A. Rule1 
B. Rule2 
C. Rule3 
D. Rule4 

Show Answer

Question 10

You have an Azure AD tenant that syncs with an Active Directory Domain Services {AD DS) domain. Client computers run Windows and are hybrid-joined to Azure AD. You are designing a strategy to protect endpoints against ransomware. The strategy follows Microsoft Security Best Practices. You plan to remove all the domain accounts from the Administrators group on the Windows computers. You need to recommend a solution that will provide users with administrative access to the Windows computers only when access is required. The solution must minimize the lateral movement of ransomware attacks if an administrator account on a computer is compromised. What should you include in the recommendation?

A. Local Administrator Password Solution (LAPS) 
B. Privileged Access Workstations (PAWs) 
C. Azure AD Privileged Identity Management (PIM) 
D. Azure AD identity Protection 

Show Answer