Free Exam SC-100: Microsoft Cybersecurity Architect Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Exam SC-100: Microsoft Cybersecurity Architect practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An organization urgently needs to reduce ransomware business risk. Its recovery capability is untested, and administrators have broad standing access. Which sequence follows Microsoft's prioritized ransomware mitigation strategy?

   1. A. Harden entry points, restrict privileged access, then prepare recovery.
   2. B. Prepare recovery, restrict privileged access, then harden entry points.
   3. C. Restrict privileged access, harden entry points, then prepare recovery.
   4. D. Harden entry points, prepare recovery, then restrict privileged access.

   Answer: B

   Explanation: Microsoft orders the work as "Step 1. Prepare your ransomware recovery plan", "Step 2. Limit the scope of ransomware damage", and "Step 3. Make it hard for cybercriminals to get in". Recovery comes first; limiting privileged access reduces damage before the broader entry-point program.

   Reference: Protect your organization against ransomware — Set up your system to prevent ransomware right now, Steps 1–3

2. 2A SOC needs centralized security analysis of Azure, on-premises, and non-Microsoft cloud events. Which architecture fits Microsoft Sentinel's documented collection model?

   1. A. Ingest only Azure Activity logs and discard other platforms.
   2. B. Use Sentinel connectors and supported event formats across the estate.
   3. C. Move every workload to Azure before collecting any events.
   4. D. Replace event collection with the Microsoft Secure Score total.

   Answer: B

   Explanation: Sentinel can "Collect data across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds." Its collection scope is not restricted to Azure.

   Reference: What is Microsoft Sentinel SIEM? — Collect data at scale

3. 3A Defender for Cloud design requires attack path analysis and risk prioritization beyond free posture features. Which plan fits?

   1. A. Foundational CSPM alone.
   2. B. Defender CSPM.
   3. C. Defender for Servers alone.
   4. D. Defender for Containers alone.

   Answer: B

   Explanation: The paid plan offers "AI security posture, attack path analysis, and risk prioritization." Foundational CSPM alone does not supply these advanced features.

   Reference: What is Cloud Security Posture Management (CSPM) — CSPM plans / Defender CSPM

4. 4A malicious site becomes dangerous after an email is delivered. Which Defender for Office 365 capability checks the URL when a user clicks it?

   1. A. Safe Attachments file detonation.
   2. B. Anti-spam filtering during message delivery.
   3. C. Safe Links time-of-click verification.
   4. D. Anti-malware attachment scanning during delivery.

   Answer: C

   Explanation: Safe Links provides "time-of-click verification of URLs and links". This addresses changes after mail delivery, unlike attachment detonation or retention.

   Reference: Safe Links in Microsoft Defender for Office 365 — Overview / Safe Links scanning

5. 5A ransomware program treats Microsoft's implementation checklists as a mandatory technical dependency graph. Backup and identity teams therefore wait for each other before starting independent work. What should the architect change?

   1. A. Use the listed priorities while permitting independent tasks to run in parallel.
   2. B. Reverse the listed priorities so that entry-point controls finish before backups.
   3. C. Require each checklist item to finish before any team starts the next item.
   4. D. Replace the listed priorities with whichever controls have the lowest cost.

   Answer: A

   Explanation: The guidance states, "The items in the implementation checklists are in the recommended order of prioritization, not a technical dependency order." Independent teams can work concurrently while protecting the priority of recovery and privileged access.

   Reference: Protect your organization against ransomware — Important information about this article / Do some items in parallel

6. 6Security logs use different schemas, making cross-source detections difficult. Which Sentinel capability provides a uniform view for analysis?

   1. A. Maintain separate source schemas and query each as if its field names were identical.
   2. B. Use a watchlist of source names without translating their event fields.
   3. C. Rename workbook display labels while leaving queried event schemas unchanged.
   4. D. Use ASIM normalization at query time or ingestion time.

   Answer: D

   Explanation: Sentinel uses "both query time and ingestion time normalization to translate various sources into a uniform, normalized view." This addresses schema differences.

   Reference: What is Microsoft Sentinel SIEM? — Collect data at scale / Data normalization

7. 7An architect needs continuous assessment of cloud misconfigurations across Azure, AWS, and GCP. Which Defender for Cloud capability is appropriate?

   1. A. Cloud workload runtime threat detection alone.
   2. B. Endpoint detection and response alone.
   3. C. External attack surface discovery alone.
   4. D. Cloud Security Posture Management.

   Answer: D

   Explanation: CSPM provides "actionable guidance to improve your security posture in Azure, AWS, and GCP." It continuously assesses infrastructure and issues security recommendations.

   Reference: What is Cloud Security Posture Management (CSPM) — Overview / opening paragraph

8. 8SharePoint and OneDrive URLs are no longer visibly rewritten by Safe Links. What is the documented security interpretation?

   1. A. They are still processed by Safe Links; lack of wrapping does not degrade protection.
   2. B. They are always excluded from Safe Links processing.
   3. C. They require users to manually copy links into a scanner.
   4. D. They are checked only during mail delivery, never at time of click.

   Answer: A

   Explanation: Microsoft states, "Safe Links no longer wraps URLs pointing to SharePoint or OneDrive sites, but the URLs are still processed by the Safe Links service." Visible wrapping is not the protection boundary.

   Reference: Safe Links in Microsoft Defender for Office 365 — Safe Links protection for email messages / Note

9. 9An architect must prevent a compromised backup administrator from disabling vault immutability after the design has been tested. Which immutable vault state meets this requirement?

   1. A. Disabled, with a longer backup retention policy.
   2. B. Enabled, with immutability left reversible.
   3. C. Enabled and locked, after validating its impact.
   4. D. Disabled, with more frequent backup schedules.

   Answer: C

   Explanation: For the locked state, Microsoft states, "The immutable vault setting is now locked and can't be disabled." Enabled alone remains reversible; retention and scheduling do not lock the immutability setting.

   Reference: Immutable vault for Azure Backup — Making immutability irreversible / Enabled and locked

10. 10A SOC wants related low-fidelity alerts combined into a more meaningful investigation unit. Which Sentinel mechanism addresses that need?

    1. A. Use analytics to group related alerts into incidents.
    2. B. Display alerts together in a workbook without incident correlation.
    3. C. Maintain a watchlist of alert identifiers without grouping logic.
    4. D. Ingest more alerts through connectors without configuring correlation.

    Answer: A

    Explanation: Microsoft states, "Microsoft Sentinel uses analytics to group alerts into incidents." Correlation improves the investigation unit; visualizations and reference lists do not perform that role.

    Reference: What is Microsoft Sentinel SIEM? — Detect threats / Analytics