SC-100 study guide
SC-100 · Work through your exam, one topic at a time.
SC-100, Microsoft Cybersecurity Architect, is the single exam required for the Microsoft Certified: Cybersecurity Architect Expert credential - but it is not the only requirement. Candidates must first hold at least one associate-level certification from the security, compliance, and identity portfolio: Identity and Access Administrator Associate, Security Operations Analyst Associate, or Cloud and AI Security Engineer Associate. The exam targets experienced practitioners who already implement or administer identity and access, platform protection, security operations, data and AI security, application security, and hybrid or multicloud infrastructure, with expert depth in at least one of those areas. It measures four skill areas: aligning solutions with security best practices and priorities (20–25%), designing security operations, identity, and compliance capabilities (25–30%), designing infrastructure security (25–30%), and designing application and data security (20–25%). The SC-100 study guide has 4 sections and about 1,353 words.
01Design solutions that align with security best practices and priorities
Zero Trust rests on three principles: verify explicitly, use least privilege access, and assume breach. Every design decision on this exam can be defended by mapping it to one of the three.
333 words, about 2 min02Design security operations, identity, and compliance capabilities
Microsoft Sentinel is the cloud-native SIEM and SOAR layer: it ingests logs via data connectors, detects with analytics rules, groups alerts into incidents, and responds. Microsoft Defender XDR is the native correlation layer across Defender for Endpoint, Identity, Office 365, Cloud Apps, and Vulnerability Management - it produces high-fidelity incidents from first-party signals and can auto-remediate.
330 words, about 2 min03Design security solutions for infrastructure
Design around a hub-and-spoke (or Virtual WAN) topology: shared services, centralized egress through Azure Firewall, spokes peered to the hub. Inside a spoke, use network security groups and application security groups for micro-segmentation between tiers rather than relying on subnets alone.
337 words, about 2 min04Design security solutions for applications and data
Application security here splits into build-time, run-time, and identity-for-apps. At build time, Defender for Cloud DevSecOps capabilities connect to repositories and pipelines to surface code, secret, and dependency findings alongside infrastructure-as-code misconfiguration.
353 words, about 2 min