Microsoft Cybersecurity Architect

SC-100 Practice Test

Start today’s free 10-question SC-100 set with source-backed explanations, local progress, and a fresh rotation every morning.

10 Free Daily Questions Source-backed Explanations 210 Verified Questions

Questions updated at Aug 12, 2026, 3:38 PM CDT

Start Daily Practice Open Dashboard

Go Pro - One Time Unlock

Unlock the full SC-100 bank

210 verified questions Exam Mode Practice Mode Detailed explanations Weak-area review No subscription - one-time unlock

Get the complete source-backed bank with Interview Questions, the full Study Guide, full Course Notes, detailed explanations, weak-area review, and exam-style practice.

Interview Questions Full Study Guide Full Course Notes Exam Mode Practice Mode Guided Course Detailed explanations Weak-area review No subscription

$4.99 One-time payment

See bundle and PDF options

We will confirm your site email in one quick checkout step.

Why DotCreds?

Practice with explanations that teach.

Source links for every answer Every wrong answer explained Guided Course included Practice and Exam Mode Weak-area tracking Same verified bank across web practice

What you get with free practice

10 Free Questions Daily Fresh set every day from the live bank

Detailed Explanations Learn with clear source-backed answers

Track Your Progress Daily history and performance insights

Upgrade Anytime Unlock the full bank when you are ready

Today's 10 SC-100 questions

Use this SC-100 practice test to review Microsoft Cybersecurity Architect. Questions rotate daily and each answer links back to the source used to write it.

Today’s Set

10 questions

Rotates at 10:00 AM local time

Progress

0/10

Answered on this page

Accuracy

Loading countdown…

210 verified questions are in the live bank. Free daily questions are selected from a rotating sample set. Unlock Pro to access the full question bank.

Preparing today’s free questions... Ordering the final locked-bank set before showing the practice cards.

Question 1 of 10

Objective Evaluate application threats with threat modeling Design security solutions for applications and data

A threat model lists twenty low-impact threats and one plausible path across a new trust boundary to payment data. What should be prioritized?

Concept tested:

Source:Threat modeling for drivers

Question 2 of 10

Objective Discover external attack surface with Defender EASM Design security solutions for infrastructure

EASM discovers an exposed system missing from the CMDB. The security team expects EASM to patch it automatically. What should the architect explain?

Concept tested:

Question 3 of 10

Objective Design access for agent and workload identities Design security operations, identity, and compliance capabilities

Security cannot identify who owns an AI agent, why it exists, which tools it can use, or when its access changed. What should the identity program implement?

Concept tested:

Question 4 of 10

Objective Align security and governance with CAF, WAF, landing zones, and DevSecOps Design solutions that align with security best practices and priorities

A governance report celebrates thousands of assigned policies but cannot show whether controls work or protect critical business outcomes. What should change?

Concept tested:

Question 5 of 10

Objective Design solutions that align with the Microsoft Cloud Adoption Framework for Azure (CAF) and the Azure Well-Architected Framework Design solutions that align with security best practices and priorities (20–25%)

A company plans to deploy a generative AI assistant over sensitive internal data. Which security architecture decision should occur before pilot access is granted?

Concept tested:

Question 6 of 10

Objective Prioritize exposure with attack paths and Security Exposure Management Design security solutions for infrastructure

A team has 500 recommendations but one identity-to-database attack path reaches a critical asset. What should Exposure Management drive first?

Concept tested:

Question 7 of 10

Objective Design access reviews and lifecycle governance Design security operations, identity, and compliance capabilities

Managers must recertify application access, but the review shows only usernames and gives no job, owner, or last-use context. What should be improved?

Concept tested:

Question 8 of 10

Objective Design a resiliency strategy for ransomware and other attacks Design solutions that align with security best practices and priorities

A critical service spans Azure, a SaaS identity provider, and an on-premises database, but the resiliency plan protects only Azure resources. What should the architect do?

Concept tested:

Question 9 of 10

Objective Design encryption, Key Vault, and AI data protections Design security solutions for applications and data

A team requests customer-managed keys only because they sound more secure, but it has no rotation, recovery, audit, or separation-of-duties process. What should the architect decide?

Concept tested:

Question 10 of 10

An enterprise AI assistant is being connected to SharePoint. Some sites have overbroad permissions. Which risk should the security architect prioritize?

Concept tested:

Locked preview

You are viewing today’s free 10. Unlock 190 more questions.

Unlock full bank

Daily sample Rotating practice Free daily questions are selected from a rotating sample set.

Pro bank Full access Unlock Pro to access the full question bank, Exam Mode, Practice Mode, and random tests.

SC-100 Pro $4.99 one-time

Best if you only need this one certification.

50 Exam Practice Test $1.99 one-time

A 50-question SC-100 PDF for short review sessions. Questions come first, then the answer review and explanations later in the file.

Microsoft Security Bundle $9.99 one-time

Unlock all 6 active Microsoft Security Bundle practice banks in one permanent purchase.

What’s includedSC-900, SC-200, SC-300, SC-401, SC-500, SC-100

All Access $6.99/month

Unlock every active practice exam, bundle and path experience, Pro course and study content, and included downloads.

What’s includedEvery current and future active practice exam, All active bundle and career-path practice content, Pro course lessons, study content, and supported paid downloads

Choose an unlock option to continue. We will confirm your site email in one quick checkout step.

Secure checkout powered by Stripe. Source-backed questions. Not brain dumps. Checkout stays on this page and unlocks the same Pro builder on this practice page.

Already Pro? Open dashboard

SC-100 SC-100

Build your practice session

Choose how you want to study today. DotCreds will build the session from your unlocked full bank.

210verified questions Source-backedexplanations UpdatedAug 12, 2026, 3:38 PM CDT iPhonesame bank

Pass plan

Set your target once.

We will keep the next study action visible before every Pro session.

Exam date Target confidence score Daily minutes

Do this next: start Practice Mode with 20 questions to build your baseline.

Customize your session

Pick the size, question pool, mode, and timer before you start.

Question count How many questions do you want?

Question count

Question set What questions should we include?

Question set

Session mode How would you like to practice?

Session mode Practice mode Instant feedback after each answer. Exam mode No explanations until you submit.

Timer Set a time limit per question.

Timer: 1 minute per question

Extra features Choose which coaching cards appear after answers.

Why Users Miss On Interview Questions On Why This Matters On

Course Mode Course Notes Study Guide My Dashboard 10 questions · Practice mode · Untimed

Purchase options

Unlock the full SC-100 bank.

Get the full bank, Exam Mode, Practice Mode, question sets, random tests, readiness tracking, saved box scores, and review tools for this exam.

The PDF versions keep questions first and move the answer review, explanations, and distractor notes to the back of the file.

210 verified exam-style questions Every choice explained Exam Mode and Practice Mode Question sets and random tests Readiness score and trends Previous test box scores

You've answered 0/10 questions in today's set.

Locked: 190 more questions in the full bank.

Locked: exam simulation mode, practice mode, readiness tracking, and saved review history.

Checkout stays on this page, so you can keep practicing, unlock the full bank, and start Exam Mode or Practice Mode when you are ready.

Cheat Sheets

7-day score keeper

Answer questions today and this will become a rolling 7-day scorecard.

Local history

Optional progress sync

Keep today’s practice moving

Guest progress saves automatically on this device. Add an email later when you want a magic link that keeps your daily SC-100 practice in sync across browsers.

Guest progress saves on this device automatically

Source-backed answer review

The free daily SC-100 set includes crawlable question text, answer choices, correct answer labels, objective mapping, and source links. Only the first SEO card includes answer explanations and any extra learning features. Pro-only bank questions stay locked; this section mirrors only the 10 free daily questions already shown on this page.

Question 1 A threat model lists twenty low-impact threats and one plausible path across a new trust boundary to payment data. What should be prioritized?

Answer choices

A. Prioritize the high-impact payment path from data-flow analysis.
B. The team with the fewest findings without owner or exception governance
C. All threats equally regardless of exploitability without scope controls
D. Threat categories alphabetically without scope controls

Correct answer

Prioritize the high-impact payment path from data-flow analysis.

Data-flow diagrams expose trust transitions, and threat priority should follow plausible exploitability and impact rather than category or finding count.

Wrong-answer review

B. The team with the fewest findings without owner or exception governance: Team metrics do not determine application threat severity.
C. All threats equally regardless of exploitability without scope controls: Equal weighting can delay the one threat most likely to cause material harm.
D. Threat categories alphabetically without scope controls: Alphabetical order provides no risk or attack-path information.

Extra learning features

Interview question

Q: A threat model lists twenty low-impact threats and one plausible path across a new trust boundary to payment data. Describe how you would prioritize these findings and why. Strong answer: The plausible high-impact payment path revealed by the data-flow and trust-boundary analysis should be prioritized. This focuses mitigation efforts on the most credible path with the greatest potential business consequence. It's crucial to understand that threat prioritization isn't about volume or category, but about exploitability and impact.

threat prioritization
data-flow diagrams
trust boundaries
impact assessment
understanding of exploitability

Caution: Avoid simply restating the question or suggesting a specific product as the solution.

Objective/domain: Design security solutions for applications and data

Source: Threat modeling for drivers

Question 2 EASM discovers an exposed system missing from the CMDB. The security team expects EASM to patch it automatically. What should the architect explain?

Answer choices

A. EASM replaces every internal inventory and patch tool without scope controls
B. Discovery alone proves patch completion without owner or exception governance
C. Use EASM to contextualize exposure, validate ownership and route remediation.
D. Unregistered assets can be ignored without replacement protection

Correct answer

Use EASM to contextualize exposure, validate ownership and route remediation.

Objective/domain: Design security solutions for infrastructure

Source: Microsoft Defender External Attack Surface Management overview

Question 3 Security cannot identify who owns an AI agent, why it exists, which tools it can use, or when its access changed. What should the identity program implement?

Answer choices

A. Inventory agents by owner, purpose, permissions, activity and lifecycle.
B. A shared anonymous agent account with broad access
C. Permanent access with no sponsor review without owner or exception governance
D. A spreadsheet listing only agent names without scope controls

Correct answer

Inventory agents by owner, purpose, permissions, activity and lifecycle.

Objective/domain: Design security operations, identity, and compliance capabilities

Source: Microsoft Entra Agent ID overview

Question 4 A governance report celebrates thousands of assigned policies but cannot show whether controls work or protect critical business outcomes. What should change?

Answer choices

A. Remove business leaders from cloud governance without replacement protection
B. Measure only technical deployment speed without scope controls
C. Use CAF-aligned ownership and assess control effectiveness and business outcomes.
D. Assign more policies to improve the metric without owner or exception governance

Correct answer

Use CAF-aligned ownership and assess control effectiveness and business outcomes.

Objective/domain: Design solutions that align with security best practices and priorities

Source: Security in the Cloud Adoption Framework

Question 5 A company plans to deploy a generative AI assistant over sensitive internal data. Which security architecture decision should occur before pilot access is granted?

Answer choices

A. Enable prompt filtering, then defer data-classification decisions until after the pilot
B. Grant one agent service identity broad dataset access and restrict only the user interface
C. Classify data, define identity/access boundaries, and establish logging and risk controls
D. Use the model's default safety training in place of workload-specific access audits

Correct answer

Classify data, define identity/access boundaries, and establish logging and risk controls

Objective/domain: Design solutions that align with security best practices and priorities (20–25%)

Source: Secure AI - Guidance to set up your organization's AI security process - Cloud Adoption Framework

Question 6 A team has 500 recommendations but one identity-to-database attack path reaches a critical asset. What should Exposure Management drive first?

Answer choices

A. Break the path at a high-value control point using attack-path context.
B. Treat all findings as equal because they share a product without scope controls
C. Close recommendations in numerical order without owner or exception governance
D. Prioritize the business unit with the fewest assets without owner or exception governance

Correct answer

Break the path at a high-value control point using attack-path context.

Objective/domain: Design security solutions for infrastructure

Source: Microsoft Security Exposure Management overview

Question 7 Managers must recertify application access, but the review shows only usernames and gives no job, owner, or last-use context. What should be improved?

Answer choices

A. Replace the review with a password reset without owner or exception governance
B. Approve every user to finish quickly without scope controls
C. Ask reviewers to guess from email addresses without owner or exception governance
D. Provide business and access context for entitlement review.

Correct answer

Provide business and access context for entitlement review.

Objective/domain: Design security operations, identity, and compliance capabilities

Source: Microsoft Entra access reviews overview

Question 8 A critical service spans Azure, a SaaS identity provider, and an on-premises database, but the resiliency plan protects only Azure resources. What should the architect do?

Answer choices

A. Map and protect the hybrid dependency chain by criticality and threat impact.
B. Prioritize whichever platform has the most resources without owner or exception governance
C. Assume cloud-provider availability covers every dependency without scope controls
D. Remove the on-premises database from business impact analysis without replacement protection

Correct answer

Map and protect the hybrid dependency chain by criticality and threat impact.

Objective/domain: Design solutions that align with security best practices and priorities

Source: Ransomware protection in Azure

Question 9 A team requests customer-managed keys only because they sound more secure, but it has no rotation, recovery, audit, or separation-of-duties process. What should the architect decide?

Answer choices

A. Remove all recovery capability without replacement protection
B. Define the control need and key administration, rotation, recovery and audit.
C. Store the key beside the encrypted data without owner or exception governance
D. Approve immediately because customer-managed keys are universally superior

Correct answer

Define the control need and key administration, rotation, recovery and audit.

Objective/domain: Design security solutions for applications and data

Source: Azure data encryption best practices

Question 10 An enterprise AI assistant is being connected to SharePoint. Some sites have overbroad permissions. Which risk should the security architect prioritize?

Answer choices

A. Copilot automatically escalates permissions to read every SharePoint site regardless of ACLs
B. Overshared content remains accessible to users with overly broad permissions
C. SharePoint default permission groups always match the company's intended least-privilege access
D. Sensitivity labels automatically remove all unintended SharePoint group memberships

Correct answer

Overshared content remains accessible to users with overly broad permissions

Objective/domain: Design solutions that align with security best practices and priorities (20–25%)

Source: What is Microsoft Copilot?

Where to go after the daily web set

How are SC-100 questions generated?

dotCreds builds SC-100 practice questions from public exam objectives and Microsoft Learn and exam-objective references. The questions are written for realistic study practice, not copied from exam dumps.

How are explanations sourced?

Each question includes an explanation and, when available, a source link back to the provider documentation or reference used to validate the answer. That keeps the practice tied to study material you can actually review.

What score do I get?

The page tracks today's answered count and accuracy for the 10-question daily set, then saves a 7-day score history on this device so you can see your recent practice trend.

Why use this site?

The site is the fastest way to start SC-100 practice without installing anything. It is built for daily recall, quick weak-topic discovery, and source-backed explanations you can review immediately.