SC-100 · CHEAT SHEET

Microsoft Certified: Cybersecurity Architect Expert

Key concepts grouped by official exam weight.

Download as PDF (free, no sign-up)

1. Design solutions that align with security best practices and priorities

20–25%

Design a resiliency strategy for ransomware and other attacks based on Microsoft Security Best Practices

Resiliency starts by identifying the assets whose compromise would hurt the business most and mapping them to IT assets, without delaying backup and privileged access work. Microsoft prioritizes recovery by category, with identity systems first, and the Zero Trust guidance bases breach preparation on a documented risk appetite and the breach scenarios you choose to address.
A BCDR design combines Azure Site Recovery, which replicates Azure, on-premises and AWS machines with orchestrated failover, and Azure Backup, whose data is isolated from production. To withstand attacks on backups, use soft delete, a locked immutable vault and multi-user authorization with a Resource Guard, ideally placed in another tenant.
Microsoft orders ransomware mitigation into three steps: prepare a recovery plan with protected, immutable backups, limit the scope by protecting privileged access and, last, make entry harder. The privileged access phase includes sessions validated with Conditional Access, protecting identity systems, stopping lateral traversal with unique local passwords and rapid threat response.
When evaluating update solutions, separate the roles: Azure Update Manager assesses and patches Windows and Linux servers in Azure, on-premises and other clouds through Azure Arc; Windows Autopatch automates client device updates in rings; and Defender Vulnerability Management and Defender for Cloud prioritize and flag what still needs remediation.

Design solutions that align with the Microsoft Cybersecurity Reference Architectures (MCRA) and Microsoft Cloud Security Benchmark (MCSB)

MCRA serves as a template to define the target state of cybersecurity capabilities across hybrid, multicloud and OT estates and to compare it with what is already owned. MCSB organizes controls by domain, with principle, risk, MITRE ATT&CK, criticality and mappings to NIST, CIS, PCI-DSS or ISO, which show full or partial coverage, not guaranteed compliance.
For insider threats, Microsoft Purview Insider Risk Management correlates signals, pseudonymizes users and escalates cases; for external threats, Defender External Attack Surface Management discovers unknown exposed assets. For the supply chain, MCSB calls for an SBOM, gating that blocks vulnerable components, Dependabot, CodeQL and no standing privileged access to pipelines.
The MCSB AI security domain is organized into three pillars: platform (approved models enforced with Azure Policy), application (multi-layered content filtering, safety meta-prompts, least privilege for agents and human-in-the-loop for critical actions) and monitor and respond, with jailbreak detection in Defender for Cloud and continuous red teaming with tools such as PYRIT.
The Zero Trust adoption framework uses the Cloud Adoption Framework phases (define strategy, plan, ready, adopt, govern and manage) and five business scenarios with four implementation stages each. It scales in two dimensions, extending one piece across the estate and repeating with the next, and tracks progress with tools such as the Zero Trust initiative in Exposure Management.

Design solutions that align with the Microsoft Cloud Adoption Framework for Azure (CAF) and the Azure Well-Architected Framework

The Cloud Adoption Framework recommends discovering AI risks from the existing threat modeling framework, supplemented with MITRE ATLAS and OWASP, and repeating assessments periodically. Then inventory AI workloads, for example with AI security posture management in Defender for Cloud, protect them with managed identities, private networking and Purview DLP, and detect threats automatically.
The Cloud Adoption Framework Secure methodology applies security across every phase and maps controls to the CIA triad; governance relies on an empowered team, a RACI matrix and policies with an ID, statement, scope and remediation. The Well-Architected Framework adds Zero Trust driven design principles, such as replacing standing permissions with just-in-time access.
To recommend solutions, the Cloud Adoption Framework turns each governance policy into a control with its tool, such as Azure Policy for encryption or Entra ID Governance for access reviews. The Azure landing zone brings Defender for Cloud, Sentinel, Azure Firewall, PIM and policies such as blocking inbound RDP, and posture is sustained with secure score and automated drift detection.
An Azure landing zone separates a platform landing zone (usually one per tenant) from workload landing zones, which inherit the Azure Policy assignments made on the management group hierarchy. Team permissions are assigned at subscription or resource group scope, not on management groups, and the reference architecture includes Defender for Cloud, Microsoft Sentinel, Azure Firewall and PIM.
CAF calls for CI/CD pipelines with static analysis, vulnerability scanning and compliance checks, deploying all infrastructure as code, and protecting resources with deployment stacks and deny settings. DevOps security in Defender for Cloud centralizes findings from Azure DevOps, GitHub and GitLab, and OIDC federation avoids storing Azure credentials as secrets.

2. Design security operations, identity, and compliance capabilities

25–30%

Design solutions for security operations

Microsoft Defender XDR correlates signals from endpoints, identities, email and apps and applies automated response, while Microsoft Sentinel is the SIEM and SOAR that collects multicloud and third-party data. Onboarding Sentinel to the Defender portal gives a unified incident queue, cross-domain correlation and joint advanced hunting.
Microsoft Purview Audit records user and admin operations from Microsoft services in the unified audit log, with retention policies by service, activity or user and API access for a SIEM. In Azure, diagnostic settings send logs to Log Analytics, to immutable storage or to Event Hubs.
Azure Arc represents on-premises and other-cloud servers as Azure resources, and the Azure Monitor Agent sends their data to Microsoft Sentinel according to data collection rules. Sentinel ingests AWS logs from S3 using OIDC and GCP logs through Pub/Sub, and Defender for Cloud connects AWS and GCP agentlessly for CSPM and protects servers in any environment.
Microsoft Sentinel provides SOAR through automation rules, which tag, assign or close incidents and launch playbooks, and through playbooks built on Azure Logic Apps that integrate with external systems. Defender XDR adds automated investigation and response with a verdict per piece of evidence, plus automatic attack disruption that contains in-progress attacks.
Microsoft's guidance calls for a response plan with defined roles (technical leader, communications liaison, recorder) and a choice between cleaning as you go and a single coordinated remediation when the adversary is entrenched. In Microsoft Sentinel, hunts start from a hypothesis, keep bookmarks and create rules and incidents from findings.

Design solutions for identity and access management

Microsoft Entra Agent ID gives each AI agent its own identity, separate from user and workload identities, with blueprints, technical owners and business sponsors. Conditional Access targets the token subject: the user in the on-behalf-of flow, the agent identity or its blueprint for app-only access, and the agent's user account when it acts as a user.
Global Secure Access combines Microsoft Entra Internet Access, a secure web gateway for internet and SaaS, and Private Access, which replaces the VPN with per-app access to hybrid and multicloud resources. Defender for Cloud Apps controls SaaS browser sessions, private endpoints and Azure Bastion avoid exposing PaaS and IaaS, and workload identity federation removes secrets.
For hybrid identity, password hash synchronization is the simplest method and should always be enabled as a backup and to detect leaked credentials; pass-through authentication enforces on-premises account states and AD FS covers requirements Entra ID doesn't support natively. Cloud Sync syncs disconnected forests with lightweight agents. In multicloud, Microsoft Entra ID centralizes AWS sign-in with Conditional Access and PIM.
Microsoft Entra External ID covers two scenarios: B2B collaboration with guests in the workforce tenant and consumer CIAM in a separate external tenant. Cross-tenant access settings control inbound and outbound access and can trust a partner's MFA and device claims; B2B direct connect serves Teams shared channels. Verified ID issues verifiable credentials signed with DIDs that verifiers check without contacting the issuer.
Conditional Access is the Zero Trust policy engine. Continuous access evaluation lets Exchange, SharePoint and Teams reject unexpired tokens after critical events or network location changes. ID Protection scores user and sign-in risk, which feeds Conditional Access policies with self-remediation. Protected actions require Conditional Access when sensitive permissions are used, whatever role grants them.

Design solutions for securing privileged access

The enterprise access model extends the AD tier model into control, management and data/workload planes plus user and app access pathways, and prevents lower planes from controlling higher ones. Privileged access is secured end to end with trusted accounts, devices and intermediaries such as Azure Bastion; administrative units delegate roles to specific scopes.
PIM provides just-in-time access to Microsoft Entra roles, Azure roles and groups, with approval, justification, MFA and auditing; groups used to elevate into roles should be role-assignable and require approval. Entitlement management bundles resources into access packages with approval and expiration, including for external users, and access reviews periodically recertify groups, apps and roles.
The AD DS tier model separates Tier 0 (domain controllers, AD FS, AD CS, Entra Connect and what manages them), Tier 1 (servers and apps) and Tier 2 (user devices), with a PAW per tier and no credential reuse across tiers. Defender for Identity detects reconnaissance, lateral movement and domain dominance, and forest recovery relies on trusted backups of several writable domain controllers.
Cloud tenant administration is secured with cloud-only privileged accounts, PIM, phishing-resistant MFA and at least two emergency access accounts with FIDO2 and a permanent active Global Administrator role. Azure Lighthouse delegates subscriptions to providers under customer control, Defender for Cloud Apps assesses SaaS app posture, and CIEM in Defender CSPM right-sizes permissions across Azure, AWS and GCP.
Microsoft Defender for Cloud includes CIEM in Defender CSPM to discover overprovisioned or inactive human and workload identities across Azure, AWS and Google Cloud. Each cloud must be connected and Permissions Management (CIEM) turned on; cloud security explorer and attack paths show who can reach critical resources and how lateral movement could happen.

Design solutions for regulatory compliance

Each risk or regulatory requirement becomes a governance policy with an ID, a linked risk, an outcome-based statement and the tool that enforces it. MCSB provides controls already mapped to CIS, NIST and PCI DSS, and enforcement is automated with Azure Policy, Defender for Cloud, Purview and Entra ID Governance, starting with monitoring.
Microsoft Purview addresses regulatory requirements with Compliance Manager (assessments, improvement actions and multicloud testing through Defender for Cloud), sensitivity labels and DLP to protect data, and retention to keep or delete content. Retention labels work per item and travel with it; in conflicts, retention wins over deletion and the longest period wins.
Azure Policy evaluates resource properties against JSON rules; definitions are grouped into initiatives and assigned at management groups so subscriptions inherit them. The deny, modify, deployIfNotExists and audit effects block, fix or report; remediation tasks fix existing resources with a managed identity, and exemptions record exceptions.
The Defender for Cloud regulatory compliance dashboard continuously assesses Azure, AWS and GCP resources against standards such as MCSB, ISO 27001 or PCI DSS, grouped into controls. Controls that cannot be automated are attested with evidence, reports serve auditors, and data can be exported, automated with Logic Apps and surfaced in Compliance Manager.

3. Design security solutions for infrastructure

25–30%

Design solutions for security posture management in hybrid and multicloud environments

Turning on Defender for Cloud applies the Microsoft cloud security benchmark, whose built-in recommendations feed the secure score grouped into controls. A control earns points only when its resources meet all its recommendations; preview recommendations do not count, and the Cloud Secure Score in the Defender portal adds risk and criticality.
Microsoft Secure Score, in the Microsoft Defender portal, measures the posture of Microsoft 365 identities, devices, apps and data and ranks recommended actions by points, difficulty and impact. Actions resolved through a third party or alternate mitigation earn points while risk-accepted ones do not; access is delegated with Defender Unified RBAC custom roles.
Defender for Cloud provides posture management across Azure, AWS and Google Cloud through native connectors with federated credentials, and for on-premises servers through Azure Arc. Defender CSPM adds attack path analysis, security explorer, EASM and governance rules, and alerts are integrated into the Microsoft Defender portal.
The cloud workload protection platform (CWPP) in Microsoft Defender for Cloud is enabled per plan: Defender for Servers protects machines in Azure, AWS, GCP and on-premises; Defender for Storage scans for malware and detects SAS token misuse without diagnostic logs; Defender for Containers adds vulnerability assessment, runtime protection and gated deployment; Defender for APIs protects APIs published in Azure API Management.
Azure Arc projects servers, Kubernetes clusters and databases outside Azure into Azure Resource Manager, so they are governed with Azure Policy, RBAC and Defender for Cloud like any Azure resource. The Defender for Cloud AWS and GCP connectors deploy Arc automatically. For Tier 0 assets, use a dedicated subscription and lock down the agent locally with extension allowlists.

Specify requirements for securing server and client endpoints

Microsoft Defender for Endpoint protects Windows Server and Linux servers; Defender for Servers integrates it into Defender for Cloud and automatically onboards the extension to Azure and Arc-enabled machines. With another antimalware product, Defender Antivirus must run in passive mode. The data location is fixed at first setup, and the Linux sensor uses eBPF without kernel modules.
Mobile protection combines Intune compliance policies with Conditional Access for enrolled devices, app protection policies (which don't require enrollment) and Defender for Endpoint on Android and iOS for web protection, jailbreak detection and risk signals. The data protection framework has three levels, and Level 3 adds Mobile Threat Defense for high-risk data.
IoT devices need minimal, tamper-resistant hardware, secrets stored in HSMs, unique credentials (X.509 in production), secure updates and TLS. Legacy devices are protected behind a field gateway such as IoT Edge, and the cloud side uses Private Link, Microsoft Entra ID and RBAC. Enterprise IoT devices such as printers and cameras are monitored with Defender for Endpoint and Defender for IoT.
Microsoft Defender for IoT monitors OT/ICS networks without agents through network sensors connected to SPAN ports or TAPs, which analyze traffic on the sensor itself with protocol violation, policy violation, industrial malware, anomaly and operational incident engines. Sensors can be cloud-connected or locally managed in air-gapped environments, and they integrate with Microsoft Sentinel.
For Windows clients, Intune security baselines apply preconfigured, customizable settings; conflicts between baselines must be resolved and preview versions avoided in production. For servers, Defender for Cloud assesses OS configuration against the Microsoft Cloud Security Benchmark baselines, whose controls are mapped to CIS, NIST and PCI-DSS.

Specify requirements for securing SaaS, PaaS, and IaaS services

The Microsoft cloud security benchmark (MCSB) is the prescriptive baseline for Azure and multicloud, with controls mapped to CIS, NIST and PCI-DSS, and Defender for Cloud applies it by default to Azure, AWS and GCP. Per-service baselines state whether each feature is enabled and who configures it; Defender for Cloud Apps SSPM assesses SaaS and Azure Policy machine configuration enforces OS settings in IaaS.
IoT security splits into device, connection, edge and cloud. Recommended controls are unique X.509 certificates, HSMs for keys, TLS 1.2, Private Link and Microsoft Entra ID with RBAC; legacy devices are protected through a field gateway such as IoT Edge. Microsoft Defender for IoT discovers OT devices without agents and can keep data on-premises at air-gapped sites.
For App Service web workloads, the guidance is WAF on Azure Front Door (global, at the edge) or on Application Gateway (regional), private endpoints, HTTPS with TLS 1.2 or later, managed identities and Key Vault references for secrets. Defender for App Service integrates without agents and detects threats and dangling DNS; Defender for APIs protects APIs published in API Management.
Defender for Containers covers posture, agentless vulnerability assessment across Azure, AWS and Google registries, runtime protection integrated with Defender XDR, and supply chain protection with gated deployment rules. Binary drift blocking stops external processes inside running containers. Guidance adds private registries, CI scanning, Key Vault for secrets, least privilege and network segmentation.
For AKS, integrate Microsoft Entra ID and disable local accounts, use private clusters or authorized IP ranges for the API server, Microsoft Entra Workload ID so pods reach Azure without secrets, and Azure Policy for Kubernetes (Gatekeeper) on AKS and Arc-enabled clusters. Network policies restrict traffic between pods, and hostile multitenant workloads need isolated clusters.

Evaluate solutions for network security and Security Service Edge (SSE)

A Zero Trust network design uses macro and micro-segmentation with per-segment ingress and egress controls, prefers identity-based segmentation, and uses hub-spoke with Azure Firewall in the hub (Premium adds IDPS and TLS inspection). The internet boundary combines DDoS Network Protection (layers 3 and 4) with a WAF (layer 7), and PaaS services are protected with Private Link or a network security perimeter.
Microsoft Entra Internet Access is the identity-centric secure web gateway of Global Secure Access. It filters by web category, FQDN and URL through policies grouped in security profiles linked to Conditional Access; the baseline profile applies to all traffic, including remote networks. Without TLS inspection it evaluates HTTPS by SNI; with it, traffic is decrypted for malware detection and DLP.
Internet Access for Microsoft services uses the Microsoft traffic profile to provide the compliant network check in Conditional Access (stopping token replay without IP lists), source IP restoration for Entra ID and Graph, and Universal Tenant Restrictions, which enforce tenant restrictions v2 on any OS and browser without a proxy to block access to unauthorized external tenants.
Microsoft Entra Private Access is the Zero Trust network access part of Global Secure Access and replaces the VPN. Quick Access groups private FQDNs and IPs as a transition step, and Global Secure Access apps provide per-app segmentation with their own Conditional Access. Private network connectors run on Windows Server, make outbound-only connections and are grouped for high availability.

4. Design security solutions for applications and data

20–25%

Evaluate solutions for securing Microsoft 365

Microsoft Secure Score measures Microsoft 365 security posture across four groups (identity, devices, apps and data) and lets you benchmark against similar organizations and set KPIs. Actions earn full or partial points; risk accepted earns none, while resolved through third party does. The current license, achievable and planned views, the custom score zone and the regression trend help prioritize and report.
Microsoft Defender for Office 365 protects email and collaboration with Safe Attachments, Safe Links and impersonation protection, and adds investigation, automated response and attack simulation. Microsoft Defender for Cloud Apps is a CASB that discovers and risk-ranks SaaS apps, feeds SSPM into Secure Score, controls browser sessions and governs OAuth apps. Both integrate into Microsoft Defender XDR.
Microsoft Intune manages devices (MDM) and apps (MAM) from the cloud and relies on Microsoft Entra ID for identity. Compliance policies report device state to Conditional Access, which grants or blocks access; devices with no policy should be marked not compliant. App protection policies protect data on personal devices without enrollment.
Microsoft Purview protects Microsoft 365 data with sensitive information types, classifiers, sensitivity labels and encryption (Double Key Encryption when only the organization must be able to decrypt). DLP monitors and protects data in Exchange, SharePoint, OneDrive, Teams, devices and on-premises repositories, starting in simulation mode. Insider Risk Management detects internal risks and escalates cases to eDiscovery.
Microsoft 365 Copilot only returns data the user can already view, so oversharing is amplified; DSPM for AI finds it with data risk assessments. Encrypted labels require VIEW and EXTRACT for AI to use content, DLP blocks prompts with sensitive data and Insider Risk Management detects risky AI usage. Audit, eDiscovery and retention cover compliance.

Design solutions for securing applications

To evaluate an application portfolio, Microsoft Defender for Cloud (a CNAPP) provides CSPM with secure score, recommendations and multicloud regulatory compliance, attack path analysis to prioritize by exposure, and code-to-cloud DevOps security. Defender for Cloud Apps covers SaaS apps. Classify applications by data sensitivity, exposure and business criticality.
Threat modeling identifies threats in the design phase, when mitigation is cheapest. You build a data flow diagram with entities, processes, stores and trust boundaries, apply STRIDE to each element, prioritize mitigations and validate the result. The Microsoft Threat Modeling Tool automates part of the process, and the model is updated whenever the architecture changes.
A full lifecycle strategy embeds security from requirements, documenting trade-offs and risk acceptance, to design with threat modeling and managed Azure services. It continues with SAST and DAST in CI/CD, clean build agents, segmented secrets, separate environments and progressive exposure, and in production with versioned catalogs, patching and decommissioning unused assets.
Secure development standards build on the 10 Microsoft SDL practices (governance, threat modeling, cryptography, supply chain, engineering environment, testing, training) and the MCSB DevOps Security controls: SAST with several scanners, secret scanning with push protection, SBOMs and Dependabot, secrets in Key Vault and workload identity federation.
Mapping technologies to requirements avoids gaps: Microsoft Entra ID and External ID for users, managed identities and federation for workloads, Azure WAF on Front Door or Application Gateway against the OWASP Top 10, API Management in internal mode to isolate APIs, DDoS Protection for volumetric attacks, Key Vault for secrets and Defender for Cloud plans for threat detection.

Design solutions for securing an organization's data

Microsoft Purview classifies with sensitive information types (patterns), exact data match, trainable classifiers, document fingerprinting and OCR for images. Purview DSPM answers what data exists, where it is, who can access it and how it is protected. Azure SQL includes Data Discovery & Classification, which recommends columns, applies labels and lets you audit access to labeled data.
Microsoft recommends starting with a classification framework and a label taxonomy; then classify and label, encrypt and control access, and later add DLP, insider risk and data minimization. Against ransomware, backups are prioritized starting with identity systems, protected with immutable or offline storage and MFA, and the backup list becomes the restore list.
Azure encrypts data at rest by default with platform-managed keys; customer-managed keys live in Key Vault or in Managed HSM (single-tenant, with its own security domain). Azure Storage infrastructure encryption adds a second layer with a separate key and can only be enabled when the account is created. In transit, Azure uses TLS, MACsec between datacenters and IPsec VPNs.
For data used by AI, Microsoft Purview DSPM for AI finds oversharing, applies DLP policies that stop Copilot from summarizing content with selected labels and monitors third-party AI sites. Microsoft Defender for Cloud adds AI security posture management in Defender CSPM (inventory, recommendations, multicloud attack paths) and real-time alerts for jailbreak and data leakage.
Azure SQL combines Microsoft Entra authentication, TDE at rest, Always Encrypted against administrators, dynamic data masking, row-level security and ledger to prove integrity. Synapse adds object-, row- and column-level security in dedicated SQL pools. For Cosmos DB, Microsoft recommends private access, data plane RBAC, separate identities per plane and continuous backup.

Practice this certification