SC-100 study plan

Your step-by-step plan

1. Map the blueprint and book a date

   Day 1

   Read the official Microsoft exam guide and the four domains with their weights. Book a provisional date now, because a fixed date turns open-ended study into a plan and is the strongest predictor of actually sitting. Note that Security Operations, Identity, and Compliance and Infrastructure Security carry the most marks between them, so plan the heaviest study there, and confirm you have the assumed associate-level depth before committing.

2. Internalise the Zero Trust assume-breach lens

   Week 1

   Before drilling any domain, fix the decision rule the whole exam rests on: assume breach, verify explicitly, least privilege. Practise choosing the control that holds after a privileged identity is compromised, with the canonical cases of immutable backups, a dedicated directory recovery path, continuous access evaluation, and preventive separation of duties. Learn the framework map too: MCRA, MCSB, CAF, and WAF, and the Rapid Modernization Plan ordering that leads with privileged access and identity.

3. Go deep on operations, identity, and compliance (Domain 2)

   Weeks 1 to 2

   This is the largest domain, so it gets the most time. Drill the three distinctions until they are automatic: near-real-time enforcement versus fixed timers, preventive grant-time governance versus detective review, and the right home for control management in Microsoft Purview Compliance Manager. Add the enterprise access model, Privileged Identity Management, entitlement management, and group managed service accounts. Read the worked explanation on every practice question, including the ones you got right.

4. Lock infrastructure protection by surface (Domain 3)

   Weeks 2 to 3

   Infrastructure security is reliable marks if you drill it as posture-versus-runtime and surface-to-Defender-plan mappings. Fix Defender for Cloud posture management against the Defender for Servers, Endpoint, and IoT workload plans, the device builder micro-agent for shipped embedded hardware, Windows LAPS for local administrator passwords, and Global Secure Access remote networks for agentless whole-site onboarding. Do each surface-to-plan call by hand until the constraint alone decides it.

5. Cover application and data design (Domains 1 and 4)

   Weeks 3 to 4

   Tie the best-practices resilience and framework questions together with the application and data layer decisions. Drill threat modelling as the design-phase practice, least-privilege scoping of workload identities for blast radius, the data control layers from dynamic data masking to encryption at rest, and Intune app protection policies for unmanaged mobile. Keep checking that the control sits at the layer and lifecycle stage the scenario names, not just one that is technically capable.

6. Drill weak domains and rehearse case studies

   Weeks 4 to 5

   Use your per-domain accuracy to attack the two domains dragging you down, not to re-read what you already know. Then rehearse the case-study format, where one organisation stacks several design decisions, so you practise reading a long scenario, holding multiple constraints, and answering each linked question on its own merits. Space the review: revisit each domain's recall prompts after a few days and again a week later.

7. Sit a timed mock and calibrate

   Weeks 5 to 6

   Take at least one full timed mock under exam conditions to rehearse pacing, the flag-and-return habit, and the case-study sections that consume time fast. Treat the score as a per-domain readiness signal, not a single number, and review every missed question, naming the constraint you misread and why the Microsoft-preferred design wins, before you book or sit.

Frequently asked questions