CertifyDeckCargando contenido…
SC-100 · Sample questions
10 real questions from the CertifyDeck SC-100 bank, spread across the domains of the official Microsoft Certified: Cybersecurity Architect Expert skills outline, with the correct answer and a full explanation of why the other options are wrong. They are original questions written from the public syllabus, not exam dumps, and they are the same style you will find in the practice tests and mock exams.
Correct answer: C. Azure Arc-enabled servers running the Azure Monitor Agent with data collection rules
Azure Arc gives each non-Azure machine an Azure resource representation, and the Azure Monitor Agent collects guest operating system data for Microsoft Sentinel according to data collection rules, which centralize configuration across machines and environments. The legacy Log Analytics agent is being replaced by the Azure Monitor Agent and does not use DCR-based central configuration. Diagnostic settings route platform logs of Azure resources, not guest events of servers outside Azure, and the Defender for Cloud Apps collector handles traffic logs for cloud discovery.
Correct answer: D. Create an administrative unit per school and scope the role assignments to it.
Administrative units restrict the permissions of a role to a portion of the organization, so each school's team can hold a role scoped only to the users in its school's administrative unit. A tenant-scoped role assignment, eligible in PIM or not, still grants tenant-wide scope once active; PIM limits when access is held, not where it applies. Group ownership lets the team manage the group's membership but doesn't delegate administration of the user accounts themselves.
Correct answer: C. The Allowed locations definition assigned at the management group scope
The built-in Allowed locations definition uses the deny effect to restrict where new resources can be created, and assigning it at the management group makes every child subscription inherit it. Assigning it with audit only reports noncompliant resources and does not block them. Azure RBAC manages what users can do at a scope, while Azure Policy evaluates resource properties such as location regardless of who makes the change; governance rules only drive remediation of recommendations.
Correct answer: D. Use workload identity federation for the Azure connection
Workload identity federation lets pipelines authenticate to Azure without stored secrets, which the guidance recommends to eliminate hardcoded and long-lived credentials. Moving the secret to Key Vault is tempting because centralizing secrets is also recommended, but the secret still exists and is long-lived, so it fails the requirement. A secret pipeline variable and a certificate on the agents are also stored long-lived credentials.
Correct answer: B. Create a data classification framework and a sensitivity label taxonomy
The Zero Trust deployment guide for data says that, as a precursor to any data security implementation, you should create a data classification framework and sensitivity label taxonomy, which then simplifies inventory, policy management and investigation prioritization. DLP, insider risk management and data minimization are later deployment objectives that depend on knowing which data is sensitive. Deploying DLP first would mean writing policies without an agreed definition of the data they protect.
Correct answer: A. Keep STRIDE and supplement it with MITRE ATLAS and OWASP AI risk guidance
The Cloud Adoption Framework says to begin with your established threat modeling framework, such as STRIDE, and reference AI-specific knowledge bases like MITRE ATLAS and OWASP generative AI risk to supplement, not replace, it. Replacing STRIDE contradicts that guidance. Content filtering is a runtime control, not a risk identification method, and the framework calls for periodic risk assessments because models, usage and threat actors evolve.
Correct answer: B. Microsoft Purview Insider Risk Management with the departing users template
Insider Risk Management correlates signals to identify malicious or inadvertent insider risks such as IP theft, offers a data theft by departing users policy template, pseudonymizes users by default and can escalate cases to eDiscovery (Premium). Defender for Identity detects attacks against the on-premises identity infrastructure, and Entra ID Protection evaluates risky users and sign-ins, so neither identifies data theft by a legitimately signed-in employee. Defender External Attack Surface Management maps internet-facing assets, an external threat.
Correct answer: C. Prepare a recovery plan that lets the business recover without paying
Microsoft orders the steps so that preparing the recovery plan comes first: being able to restore without paying removes the attacker's monetary incentive. Protecting privileged roles is the second step, and making entry harder is the third step, which must not slow down the first two. Identifying sensitive assets is important but is a longer process that should not hold up backups and privileged access work.
Correct answer: D. Deploy Microsoft Defender for Endpoint on Linux to the servers.
Defender for Endpoint on Linux uses a lightweight eBPF-based sensor without kernel modules and provides real-time protection, EDR features such as device isolation and live response, and vulnerability management. Agentless scanning in Defender for Cloud can assess vulnerabilities and malware without an agent, but it does not deliver real-time prevention or EDR response actions. Syslog collection into Sentinel only gathers logs, and the Defender for Containers sensor protects Kubernetes workloads rather than standalone servers.
Correct answer: C. Universal Tenant Restrictions in Global Secure Access
Universal Tenant Restrictions use Global Secure Access to tag traffic with the tenant restrictions v2 signal regardless of operating system, browser, or device form factor, through the client or remote networks, so the policy is enforced without a corporate proxy. Tenant restrictions v1 depends on an allow list configured on a corporate proxy, which the requirement rules out, and Windows Group Policy only covers corporate Windows devices. Inbound cross-tenant access settings control how external users access your tenant, not where your own users can sign in.
Answer each question before opening the explanation, and write down why you discarded the other options. On SC-100, most mistakes come from choosing an option that is technically possible but does not meet every requirement in the scenario.
These 10 questions are a taste of the format, not a diagnostic. To know which domains you fail, practice by domain for free and take a timed mock exam that mirrors the official weights and duration.
Start for free, no sign-up or card. Every question includes an explanation like the ones above, and the mock exam reproduces the official SC-100 format.