SC-100 Course Notes

This objective covers designing security solutions that align with the Cloud Adoption Framework (CAF), Azure landing zones, and DevSecOps practices. It emphasizes a holistic approach, considering people, process, and technology to address business risks and cloud adoption plans, while recognizing distinct responsibilities between platform and workload teams. Design a resiliency strategy for ransomware and other attacks by prioritizing business-critical assets and implementing controls to limit an attacker's movement and impact. Aligning solutions with MCRA and Zero Trust priorities requires a holistic approach that considers all assets – identities, endpoints, applications, infrastructure, networks, data, and operations – as a single system. Align solutions with the Microsoft Cloud Security Benchmark by mapping controls to organizational risks and compliance obligations. The MCSB provides prescriptive recommendations and controls for Azure and multicloud environments; however, their effective implementation requires governance, validation, and should not be adopted as an unexamined checklist. MCSB spans control domains such as network, identity, privileged access, data protection, asset management, logging, incident response, posture, and endpoint security. AI workload design should apply relevant identity, network, data protection, logging, and governance controls. A benchmark recommendation can guide a target control but does not by itself prove that the control is implemented effectively. Security recommendations must be prioritized by exposure and business criticality. Compensating controls require documented risk reasoning and validation. Design secure backup and restore solutions by implementing controls that protect recovery data and processes from compromise and ensure successful application restoration.

• Platform controls, established at the landing zone level, provide consistent enterprise guardrails, while workload teams retain responsibility for workload-specific security.

• Focus on the interconnectedness of CAF, landing zones, and DevSecOps. Understand the distinct roles of platform and workload teams.

Design security solutions for infrastructure leveraging Microsoft Entra Internet Access to secure supported internet and SaaS traffic through identity-aware Security Service Edge controls. this objective covers building a secure environment that complements existing controls and prioritizes tenant boundaries and resilient access. Design hybrid and multicloud posture management with Defender for Cloud by understanding how to prioritize recommendations, integrate with threat response, and manage regulatory views. Specifying endpoint baselines requires tailoring configurations to platform capabilities and business needs. Continuous monitoring and controlled exceptions are critical for maintaining compliance and operational effectiveness. This objective covers specifying security requirements for cloud workloads and containers, emphasizing that customer responsibility for identity, access, data, and configuration remains regardless of the service model. Secure architecture requires deliberate protection across container orchestration, application layers, and workload-specific needs (IoT, AI). Prioritize security efforts by understanding how attackers move within your environment and the potential impact of their actions. Exposure Management focuses on actionable risk reduction through a holistic view of assets, attack paths, and business context. This objective covers integrating non-Azure machines into Azure Arc, emphasizing that Arc provides management and governance, but requires proactive configuration of security, monitoring, and policies. Secure IoT and OT environments by leveraging passive discovery, Defender for IoT, and robust network segmentation strategies. Prioritize asset inventory with contextual data for effective risk management. This objective covers how Defender EASM identifies external attack surfaces from an attacker's perspective. It emphasizes the critical process of validating discovered assets and assigning ownership before initiating remediation actions. Secure local administrator passwords across joined devices using Windows LAPS.

• Broad Network Reachability vs. Scoped Access: Avoid granting access to the entire network when only specific applications or resources are needed. Scoped access minimizes implicit trust.

• Focus on the 'why' behind each design choice. assess whether the design the underlying principles.

Design security operations leveraging XDR, SIEM, and SOAR within a combined architecture. Design modern identity, authentication, and external access capabilities aligned with a Zero Trust approach. Design privileged access capabilities to minimize risk and ensure compliance. Design a centralized logging and auditing system for Microsoft 365, ensuring comprehensive activity tracking and efficient investigation capabilities. Design access for agent and workload identities by establishing separate governance and applying least privilege principles throughout the agent lifecycle. Design access reviews to recertify group memberships, application access, and role assignments. This objective covers leveraging the MITRE ATT&CK framework to evaluate detection coverage within a security operations environment. It emphasizes that mapping techniques does not guarantee prevention or complete visibility, and requires validation through telemetry and testing. Design secure storage for secrets, keys, and certificates using Key Vault. Translate compliance requirements into Purview, Azure Policy, and Defender for Cloud controls. Understand that compliance dashboards are assessment views, not legal proof, and require testing, exception governance, and broader enforcement strategies.

• XDR vs. SIEM: XDR correlates domain-specific signals, while SIEM provides broader log analytics and operational visibility.

• Focus on the combined architecture – the exam prioritizes solutions that integrate XDR and SIEM.

This objective covers designing Microsoft 365 security solutions by evaluating the existing posture and protection mechanisms. Effective design prioritizes risk reduction, considers the applicability and impact of controls, and integrates diverse security layers. Microsoft Secure Score measures progress against recommended actions but is not a guarantee that the tenant is secure. Score improvement should be prioritized by risk reduction, applicability, user impact, and compensating controls. Design a full-lifecycle application security strategy by integrating security practices throughout the development process. This objective covers designing security solutions for applications and data by implementing encryption, managing keys effectively, and securing AI data pipelines. This objective covers designing security solutions for applications and data by leveraging workload identities. This includes understanding the benefits of managed identities, scoping permissions correctly, and implementing robust governance processes for workload identity activity and credentials. Implement robust security for Azure databases and storage by minimizing public exposure, leveraging identity-based access, and integrating threat detection services. Design security solutions for applications and data by leveraging API Management and Web Application Firewall controls. This involves centralizing policy enforcement, managing API versions, and ensuring secure credential handling while maintaining backend service integrity. Evaluate application threats with threat modeling by identifying assets, entry points, trust boundaries, data flows, threats, and mitigations before implementation decisions are fixed. Design security solutions for applications and data by leveraging data discovery and classification to drive proportional access, protection, retention, and monitoring controls.

• Device Compliance vs. Session Safety: Intune compliance provides a signal of device posture, but does not guarantee a safe session. Focus on broader protection strategies.

• Consider the 'why' behind each Secure Score recommendation. Don't just implement controls for the sake of a higher score.