How are SC-100 questions generated?

dotCreds builds SC-100 practice questions from public exam objectives and Microsoft Learn and exam-objective references. The questions are written for realistic study practice, not copied from exam dumps.

How are explanations sourced?

Each question includes an explanation and, when available, a source link back to the provider documentation or reference used to validate the answer. That keeps the practice tied to study material you can actually review.

The page tracks today's answered count and accuracy for the 10-question daily set, then saves a 7-day score history on this device so you can see your recent practice trend.

The site is the fastest way to start SC-100 practice without installing anything. It is built for daily recall, quick weak-topic discovery, and source-backed explanations you can review immediately.

Free SC-100 Practice Test

SC-100 Practice Test

Start today’s free 10-question SC-100 set with source-backed explanations, local progress, and a fresh rotation every morning.

10 Free Daily Questions Source-backed Explanations 200 Verified Questions

Questions updated at Aug 12, 2026, 3:38 PM CDT

Unlock the full SC-100 bank

200 verified questions Exam Mode Practice Mode Detailed explanations Weak-area review No subscription - one-time unlock

Get the complete source-backed bank with Interview Questions, the full Study Guide, full Course Notes, detailed explanations, weak-area review, and exam-style practice.

Interview Questions Full Study Guide Full Course Notes Exam Mode Practice Mode Guided Course Detailed explanations Weak-area review No subscription

What you get with free practice

10 Free Questions Daily Fresh set every day from the live bank

Detailed Explanations Learn with clear source-backed answers

Track Your Progress Daily history and performance insights

Upgrade Anytime Unlock the full bank when you are ready

Question 1 of 10

Objective Design modern identity, authentication, authorization, and external access Design security operations, identity, and compliance capabilities

A report-only Conditional Access pilot shows that a policy would block the emergency access account. How should the architect proceed?

Concept tested:

Source:Microsoft Entra Conditional Access overview

Question 2 of 10

Objective Align security and governance with CAF, WAF, landing zones, and DevSecOps Design solutions that align with security best practices and priorities

A platform team must apply identity, connectivity, management, policy, and security foundations consistently before workload subscriptions are created. What should it implement?

Concept tested:

Question 3 of 10

Objective Design secure backup and restore for business continuity and disaster recovery Design solutions that align with security best practices and priorities

Backup monitoring reports mass deletion attempts, and the restore runbook starts applications before identity, DNS, networking, and keys. What should the response and recovery design require?

Concept tested:

Question 4 of 10

Objective Secure local administrator passwords with Windows LAPS Design security solutions for infrastructure

LAPS generates unique passwords, but they are backed up to an unapproved location, many help-desk users can retrieve them, and rotation is not audited. What should be redesigned?

Concept tested:

Question 5 of 10

Objective Design centralized logging, auditing, and activity investigation Design security operations, identity, and compliance capabilities

Help-desk staff need no investigative role but can search all Microsoft 365 user and administrator activity. What should the architect change?

Concept tested:

Question 6 of 10

Objective Evaluate Microsoft 365 security posture and protection Design security solutions for applications and data

Copilot reveals overshared data, and management responds by chasing Secure Score points with no assigned remediation owners. What should the architect do?

Concept tested:

Question 7 of 10

Objective Align solutions with the Microsoft Cloud Security Benchmark Design solutions that align with security best practices and priorities

A team marks an MCSB recommendation complete because a policy is assigned, but no evidence shows the control operates effectively. What should governance require?

Concept tested:

Question 8 of 10

Objective Specify security requirements for cloud workloads and containers Design security solutions for infrastructure

A team moves from VMs to containers and plans to patch production containers manually while leaving identity and network controls unchanged. What should the architect require?

Concept tested:

Question 9 of 10

Objective Design data discovery, classification, and threat priorities Design security solutions for applications and data

A data catalog locates files but assigns no sensitivity or business meaning, so every file receives the same access and retention. What should the architect add?

Concept tested:

Question 10 of 10

Objective Specify endpoint baselines and Windows LAPS requirements Design security solutions for infrastructure

A piloted Windows baseline deployed successfully, but six months later many endpoints have drifted from its settings. What should the program add?

Concept tested:

Unlock the full SC-100 bank.

Get the full bank, Exam Mode, Practice Mode, question sets, random tests, readiness tracking, saved box scores, and review tools for this exam.

The PDF versions keep questions first and move the answer review, explanations, and distractor notes to the back of the file.

200 verified exam-style questions Every choice explained Exam Mode and Practice Mode Question sets and random tests Readiness score and trends Previous test box scores

You've answered 0/10 questions in today's set.

Locked: 190 more questions in the full bank.

Locked: exam simulation mode, practice mode, readiness tracking, and saved review history.

Checkout stays on this page, so you can keep practicing, unlock the full bank, and start Exam Mode or Practice Mode when you are ready.

Cheat Sheets

Question 1 A report-only Conditional Access pilot shows that a policy would block the emergency access account. How should the architect proceed?

Answer choices

A. Remove all monitoring from the emergency identity without replacement protection
B. Narrowly exclude, protect and monitor emergency access; validate policy scope.
C. Exclude every administrator permanently without scope controls
D. Enable the policy and hope the account is unnecessary without owner or exception governance

Correct answer

Narrowly exclude, protect and monitor emergency access; validate policy scope.

Safe rollout uses report-only evidence, while emergency access needs a deliberate governed exclusion, protected credentials, and monitoring rather than accidental blockage.

Wrong-answer review

A. Remove all monitoring from the emergency identity without replacement protection: Emergency use is highly sensitive and should receive stronger, not weaker, monitoring.
C. Exclude every administrator permanently without scope controls: A universal administrator exclusion defeats the policy’s privileged-access protection.
D. Enable the policy and hope the account is unnecessary without owner or exception governance: Blocking the recovery identity can make the tenant inaccessible during control failure.

Extra learning features

Why this matters

Failure to exclude the emergency account from Conditional Access could render the tenant inaccessible during a control failure, severely disrupting business operations and potentially leading to prolonged downtime. This highlights the critical need for careful governance of emergency access policies.

Objective/domain: Design security operations, identity, and compliance capabilities

Question 2 A platform team must apply identity, connectivity, management, policy, and security foundations consistently before workload subscriptions are created. What should it implement?

A. A separate manually configured platform for every workload
B. An application threat model only without scope controls
C. A Secure Score improvement plan without owner or exception governance
D. Use an Azure landing-zone foundation with shared platform controls.

Use an Azure landing-zone foundation with shared platform controls.

Objective/domain: Design solutions that align with security best practices and priorities

Source: Security in the Cloud Adoption Framework

Question 3 Backup monitoring reports mass deletion attempts, and the restore runbook starts applications before identity, DNS, networking, and keys. What should the response and recovery design require?

A. Investigate the alert and restore dependencies in a tested sequence.
B. Use the same sequence for every service without dependency analysis
C. Ignore backup alerts during incidents without replacement protection
D. Restore applications first because they are customer-facing

Investigate the alert and restore dependencies in a tested sequence.

Source: Azure Backup security features

Question 4 LAPS generates unique passwords, but they are backed up to an unapproved location, many help-desk users can retrieve them, and rotation is not audited. What should be redesigned?

A. Disable rotation to simplify access without replacement protection
B. Publish the passwords in device inventory without owner or exception governance
C. Return to one shared local password with broad access
D. Define backup location, least-privileged retrieval, rotation and auditing.

Define backup location, least-privileged retrieval, rotation and auditing.

Objective/domain: Design security solutions for infrastructure

Source: Windows Local Administrator Password Solution overview

Question 5 Help-desk staff need no investigative role but can search all Microsoft 365 user and administrator activity. What should the architect change?

A. Restrict audit access to authorized least-privileged roles and monitor use.
B. Export all audit records to a public share without scope controls
C. Disable Purview Audit entirely without replacement protection
D. Give every employee the same access without scope controls

Restrict audit access to authorized least-privileged roles and monitor use.

Source: Search the Microsoft Purview audit log

Question 6 Copilot reveals overshared data, and management responds by chasing Secure Score points with no assigned remediation owners. What should the architect do?

A. Increase the score through unrelated low-impact actions without owner or exception governance
B. Remediate permissions, sensitivity, retention, audit and DLP by risk.
C. Assume Copilot caused the underlying permissions without owner or exception governance
D. Disable all posture reporting without replacement protection

Remediate permissions, sensitivity, retention, audit and DLP by risk.

Objective/domain: Design security solutions for applications and data

Source: Microsoft Secure Score

Question 7 A team marks an MCSB recommendation complete because a policy is assigned, but no evidence shows the control operates effectively. What should governance require?

A. Count the recommendation twice to improve reporting without owner or exception governance
B. Validate evidence, monitoring, ownership and exceptions against risk.
C. Remove the benchmark from governance without replacement protection
D. Accept the assignment as conclusive implementation proof without owner or exception governance

Validate evidence, monitoring, ownership and exceptions against risk.

Source: Microsoft Cloud Security Benchmark overview

Question 8 A team moves from VMs to containers and plans to patch production containers manually while leaving identity and network controls unchanged. What should the architect require?

A. Use trusted rebuilt images; retain customer identity, network, data and app controls.
B. Patch each running container and keep it indefinitely without owner or exception governance
C. Assume the orchestrator owns every customer security decision without scope controls
D. Disable image scanning because the platform is managed without replacement protection

Use trusted rebuilt images; retain customer identity, network, data and app controls.

Source: Azure security best practices and patterns

Question 9 A data catalog locates files but assigns no sensitivity or business meaning, so every file receives the same access and retention. What should the architect add?

A. Delete the catalog because location is insufficient without replacement protection
B. Use file size as the only security label without scope controls
C. Apply one maximum restriction to all data permanently without scope controls
D. Classify by content/context; apply proportional access, protection, retention and monitoring.

Classify by content/context; apply proportional access, protection, retention and monitoring.

Source: Data discovery and classification

Question 10 A piloted Windows baseline deployed successfully, but six months later many endpoints have drifted from its settings. What should the program add?

A. Reimage every endpoint without investigating drift without scope controls
B. Assume the initial deployment remains effective without owner or exception governance
C. Monitor baseline compliance and remediate or govern exceptions.
D. Stop versioning the baseline to avoid future changes without owner or exception governance

Monitor baseline compliance and remediate or govern exceptions.

Source: Windows security baselines

SC-100 Practice Test

Unlock the full SC-100 bank

Practice with explanations that teach.

What you get with free practice

A report-only Conditional Access pilot shows that a policy would block the emergency access account. How should the architect proceed?

A platform team must apply identity, connectivity, management, policy, and security foundations consistently before workload subscriptions are created. What should it implement?

Backup monitoring reports mass deletion attempts, and the restore runbook starts applications before identity, DNS, networking, and keys. What should the response and recovery design require?

LAPS generates unique passwords, but they are backed up to an unapproved location, many help-desk users can retrieve them, and rotation is not audited. What should be redesigned?

Help-desk staff need no investigative role but can search all Microsoft 365 user and administrator activity. What should the architect change?

Copilot reveals overshared data, and management responds by chasing Secure Score points with no assigned remediation owners. What should the architect do?

A team marks an MCSB recommendation complete because a policy is assigned, but no evidence shows the control operates effectively. What should governance require?

A team moves from VMs to containers and plans to patch production containers manually while leaving identity and network controls unchanged. What should the architect require?

A data catalog locates files but assigns no sensitivity or business meaning, so every file receives the same access and retention. What should the architect add?

A piloted Windows baseline deployed successfully, but six months later many endpoints have drifted from its settings. What should the program add?

You are viewing today’s free 10. Unlock 190 more questions.

Build your practice session

Set your target once.

Customize your session

Unlock the full SC-100 bank.

7-day score keeper

Keep today’s practice moving

Answer choices

Correct answer

Wrong-answer review

Extra learning features

Why this matters

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

How are SC-100 questions generated?

How are explanations sourced?

What score do I get?

Why use this site?