SC-100 key terms

A security strategy that assumes breach and verifies every request explicitly, granting least-privilege access based on identity, device health, and context rather than on network location alone.

A framework that divides security duties between the cloud provider and the customer, where the provider secures the platform and the customer secures data, identities, and configurations.

A layered approach that applies independent controls across identity, network, compute, application, and data so that a failure in one layer does not expose the whole environment.

A structured exercise that maps assets, trust boundaries, and data flows, then enumerates plausible attacks so architects can design mitigations before code or infrastructure is deployed.

Microsoft's published set of diagrams and control mappings showing how security capabilities combine across identity, endpoints, data, and cloud to implement Zero Trust.

A numeric measurement of an organization's security configuration compared with Microsoft-recommended baselines, listing improvement actions ranked by potential risk reduction.

A pre-provisioned Azure environment where identity, networking, logging, and policy guardrails are already configured so workloads deploy with approved controls from the start.

Designing consistent identity, policy, and monitoring across on-premises, Azure, and other clouds so visibility and control do not fragment at platform boundaries.

A policy engine in Microsoft Entra that evaluates signals such as user, device, location, and risk to grant, block, or require step-up controls like multifactor authentication before access.

A service that detects risky sign-ins and compromised credentials, assigns risk levels to users and sessions, and feeds those signals into access and governance decisions.

A capability that grants privileged roles only when needed, for a limited time, typically with approval and strong authentication, and records every activation for audit.

Recurring attestations in which managers or resource owners confirm that users and guests still require their group, application, or role assignments.

A correlated detection and response suite spanning identities, email, endpoints, cloud apps, and SaaS that combines signals into single incidents with automated investigation and remediation.

A cloud-native SIEM that ingests logs from Microsoft and third-party sources, applies analytics and threat intelligence to raise incidents, and supports hunting and workbooks.

Security orchestration, automation, and response: playbooks that trigger on incidents, enrich alerts with external data, and perform actions such as isolating a device or disabling an account.

The combined portal experience where Microsoft Defender XDR and Microsoft Sentinel share incidents, advanced hunting, and automation so analysts investigate from one place.

A generative AI assistant that summarizes incidents, answers analyst questions using Microsoft and customer data, and drafts investigation and response guidance.

A Microsoft Purview capability that detects potentially harmful user behavior such as data exfiltration or leaks, using policy signals while preserving privacy through pseudonymization.

A compliance service that records user and administrator activity across Microsoft 365 and connected sources, supporting investigations, eDiscovery, and long-term retention of audit records.

A cloud security posture management and workload protection platform that scores configurations against benchmarks and detects threats across servers, containers, databases, storage, and APIs.

A governance service that evaluates resources against rules and can deny, audit, or auto-remediate noncompliant configurations, including deploying required settings through remediation tasks.

Managed services for storing secrets, certificates, and cryptographic keys inside hardware security modules, with access controlled through Microsoft Entra and optional customer-controlled key lifecycles.

A mechanism that exposes Azure platform services through a private IP address inside a virtual network, removing the need to reach those services over the public internet.

A service that monitors public Azure endpoints and mitigates volumetric and protocol-based attacks, applying automatic tuning and rapid response during an active flood.

A managed jump-host service that provides RDP and SSH access to virtual machines through the portal over TLS, so the machines need no public IP addresses.

A Defender for Cloud control that keeps management ports closed by default and opens them briefly for an approved user, time window, and source address.

A Defender for Cloud feature that learns which executables run on a server and then permits only those applications, blocking unknown or malicious binaries.

Dividing a network into isolated zones, often using a hub-and-spoke topology that centralizes firewalls and shared services so traffic between workloads is inspected and restricted.

A service that projects on-premises and other-cloud servers and Kubernetes clusters into Azure so they can be inventoried, governed by policy, and protected by Defender for Cloud.

A solution combining agentless network monitoring and lightweight agents to discover operational technology and enterprise IoT devices, map their behavior, and alert on anomalies.

A cloud access security broker that provides visibility into SaaS usage, surfaces shadow IT, and enforces session and data policies across sanctioned and unsanctioned applications.

A protection suite for email and collaboration that blocks phishing, malware, and malicious links while adding investigation, hunting, and attack simulation for those workloads.

A labeling framework that classifies documents and emails by sensitivity and can apply encryption, watermarking, and usage restrictions that travel with the content.

Policies in Microsoft Purview that detect sensitive information in email, files, and chats and then block, warn, or encrypt based on location and user context.

Automatically managed identities in Microsoft Entra that let Azure workloads authenticate to supported services without storing or rotating credentials in code or configuration.

A control that requires explicit customer approval before a Microsoft engineer can access customer data during a support case, producing an audited request record.

Integrating security checks such as code scanning, secret detection, dependency review, and infrastructure-as-code validation into build and release pipelines so flaws are gated before deployment.

A workload protection capability that discovers APIs published through Azure API Management, assesses their exposure, and detects suspicious calls and data access patterns.