Examworthyexamworthy.comMicrosoft Cybersecurity Architect (SC-100) cheat sheet
Microsoft
Free to share. Examworthy is not affiliated with or endorsed by Microsoft; SC-100 and related marks belong to their respective owners.
At a glance
Format: Multiple choice, multiple response, and case studies, at a Pearson VUE testing center or online proctored
Domain weight map
Heaviest first - spend your time hereHow this exam thinks
SC-100 is a design-the-strategy exam: almost every question is a scenario with resilience, identity, compliance, infrastructure, or data constraints, and the right answer is the Microsoft capability or reference-architecture pattern that satisfies all of them at the architectural level with the least standing risk.
Spot the trap
Tempting wrong answers, and why they failCommon misconception
That multi-factor authentication and long admin passwords stop a compromised laptop exposing credentials. A cached or stolen session still hands over control.
Design Security Operations, Identity, and Compliance Capabilities
Common misconception
That being on an allow-listed network proves a device is trustworthy. Zero Trust requires verifying the device itself, not its network location.
Design Security Solutions for Infrastructure
Common misconception
That the recovery point objective governs how fast a system comes back online. It bounds tolerable data loss, not downtime; that measure belongs to the recovery time objective.
Design Solutions that Align with Security Best Practices and Priorities
Common misconception
That an Azure Policy deny effect counts as shifting security left. It blocks a bad deployment at the platform, after the flaw has already left the pull request.
Design Security Solutions for Applications and Data
Common misconception
That requiring any multi-factor method satisfies a phishing-resistant requirement. Methods such as SMS and push remain phishable.
Design Security Operations, Identity, and Compliance Capabilities
Common misconception
That scaling up an on-premises VPN concentrator modernises access control. It still ties policy to network location, not verified identity.
Design Security Solutions for Infrastructure
Common misconception
That multifactor authentication plus a compliant-device policy fully isolates the recovery vault. A compromised workstation can still ride an already authenticated session.
Design Solutions that Align with Security Best Practices and Priorities
Common misconception
That having platform-managed encryption on by default satisfies a customer-key-control requirement. Only customer-managed keys in Key Vault give that control.
Design Security Solutions for Applications and Data
Key terms
Exam-day rules
- Read the scenario for its constraint first. The resilience, identity, compliance, infrastructure, or data requirement named in the question is what picks the design, so find it before you judge the options.
- Apply assume-breach to every resilience and identity question. When the scenario names a compromised admin or privileged identity, choose the control the attacker cannot defeat with the access they hold, such as immutable backups or continuous access evaluation, not one that relies on the access they already have.
- Prefer preventive enforcement over detection. A grant-time separation-of-duties rule, a scoped role assignment, or platform-enforced immutability beats an option that only notices, reviews, or limits the problem after it has formed.
- Match the framework to the requirement. MCRA for reference patterns, MCSB for control baselines, CAF for the operating model and DevSecOps, WAF for the security pillar and trade-offs, and the Rapid Modernization Plan when the scenario asks where to start.
- Separate posture from runtime and match protection to the surface. Configuration posture management does not detect active threats; pick the Defender workload plan built for the exact surface, from endpoints and servers to passive IoT sensors and the device builder micro-agent for shipped hardware.
Revision schedule
- Day 1Map the blueprint and book a date
- Week 1Internalise the Zero Trust assume-breach lens
- Weeks 1 to 2Go deep on operations, identity, and compliance (Domain 2)
- Weeks 2 to 3Lock infrastructure protection by surface (Domain 3)
- Weeks 3 to 4Cover application and data design (Domains 1 and 4)