--- title: "SC-100 Study Guide — Cybersecurity Architect Expert" description: "An interactive study guide built on 7 memory techniques to help you master SC-100 -Microsoft's flagship expert-level cybersecurity architecture certification." url: "https://lucidlabs.com.au/insights/sc-100" --- # Master the SC-100 An interactive study guide built on 7 memory techniques to help you master SC-100 -Microsoft's flagship expert-level cybersecurity architecture certification. Best Practices & Priorities 20-25%SecOps, Identity & Compliance 25-30%Infrastructure Security 25-30%Application & Data Security 20-25% What it covers Zero Trust architecture (verify explicitly, least privilege, assume breach), the Microsoft Cybersecurity Reference Architecture (MCRA) and Cloud Adoption Framework Secure methodology, Microsoft Sentinel (SIEM/SOAR), Microsoft Defender XDR (Defender for Cloud, Defender for Identity, Defender for Cloud Apps, Defender for Endpoint, Defender for Office 365), Entra ID architecture (Conditional Access, PIM, Identity Governance, workload identities), data security (Purview DLP, sensitivity labels, insider risk), AI security (Copilot and agent workload protection, prompt injection defence), application security (DevSecOps, API security), and governance, risk and compliance (Secure Score, Compliance Manager, regulatory frameworks). Ideal for Security architects, senior security engineers, and consultants who design end-to-end Zero Trust strategy rather than operate a single security tool. Aspire to this if You already hold an associate-level security certification -AZ-500, SC-200, or SC-300 -and you're ready to move from implementing individual controls to architecting the strategy that ties identity, data, apps, and infrastructure together under Zero Trust. Section 1 / Spatial Memory ## The Map Tap any component to see what you need to know for the exam. **🎯 Zero Trust** Verify · Least Privilege · Assume Breach **🗺️ MCRA & CAF Secure** Reference Architecture & Adoption **📐 Security Strategy** Risk, Roadmap & Reporting **🛰️ Security Operations** Sentinel SIEM/SOAR **🪪 Identity & Access** Conditional Access · PIM · Governance **📋 GRC** Governance, Risk & Compliance **☁️ Hybrid & Multicloud** Defender for Cloud CSPM/CWPP **🌐 Network Security** Segmentation & Perimeter **🖥️ Endpoint & XDR** Defender for Endpoint & Cloud Apps **🧩 Application Security** DevSecOps & API Security **🗄️ Data Security** Purview DLP & Sensitivity Labels **🤖 AI Security** Copilot & Agent Protection Section 2 / Narrative Memory ## The Story Follow the narrative to build a mental model of how everything connects. 🎯 ### The Zero Trust Mandate Every architecture decision at the expert level begins with the same compass: verify explicitly, use least privilege, assume breach. There is no walled garden anymore -users, devices, and workloads live outside any single network boundary. The cybersecurity architect's job is to translate this mandate into concrete policy across identity, data, apps, network, infrastructure, and endpoints, and to defend that translation to leadership. **Exam Intel**Three Zero Trust principles: verify explicitly, least privilege access, assume breach. Six pillars: identity, endpoints, applications, network, infrastructure, data. SC-100 tests principle-to-control mapping, not tool trivia -expect scenario questions asking which principle a recommendation satisfies. 🗺️ ### Reading the Reference Map Before recommending a single product, the architect opens the Microsoft Cybersecurity Reference Architecture -a living map of every Microsoft security capability plotted against Zero Trust functions. Paired with the Cloud Adoption Framework's Secure methodology, it sequences the journey: set strategy, plan the roadmap, get environments ready, adopt controls, then govern continuously. **Exam Intel**MCRA = capability-to-architecture mapping, used to spot gaps and avoid duplicate tooling. CAF Secure phases: Strategy → Plan → Ready → Adopt → Govern. Secure Future Initiative pillars: secure by design, secure by default, secure operations -expect these in strategy-framing questions. 🛰️ ### The Security Operations Command Deck On the command deck, Microsoft Sentinel ingests every signal the organisation can produce -firewall logs, identity events, endpoint telemetry, custom application data- and correlates it into actionable incidents. Automation rules trigger playbooks the moment a known pattern is detected, while analysts focus their attention on the genuinely novel threats that automation cannot yet resolve. **Exam Intel**Sentinel = cloud-native SIEM + SOAR. Automation rules trigger Logic Apps playbooks for triage, enrichment, containment. Defender Threat Intelligence enriches alerts with attacker TTPs. Design questions test detection engineering maturity and incident response runbook design, not KQL syntax. 🪪 ### The Identity Perimeter and the Compliance Ledger Identity has replaced the network as the true perimeter. Conditional Access evaluates every sign-in against risk signals in real time, while PIM ensures privileged roles are never standing targets -elevation is just-in-time, approved, and time-bound. Behind the scenes, the GRC function keeps its own ledger: Compliance Manager scores controls against regulatory templates, converting technical configuration into audit-ready evidence. **Exam Intel**Conditional Access = policy engine, evaluated per sign-in. PIM = just-in-time privileged elevation. Identity Governance = access reviews + entitlement management. GRC is proactive (design and assure controls); SecOps is reactive (detect and respond). Compliance Manager scores against ISO 27001, NIST, GDPR templates. ☁️ ### Hardening the Hybrid and Multicloud Estate The estate rarely lives in one place. Defender for Cloud extends posture management and workload protection across Azure, AWS, and GCP alike, surfacing attack paths that chain together small misconfigurations into a critical breach route. Landing zones bake in guardrails from the moment a subscription is created, so security is a starting condition, not an afterthought bolted on later. **Exam Intel**Defender for Cloud = CSPM (posture) + CWPP (workload protection), multicloud. Attack path analysis prioritises remediation by exploitability and blast radius. Landing zone design embeds policy, network segmentation, and identity boundaries at provisioning time. IaC scanning shifts misconfiguration detection left. 🖥️ ### The Network Perimeter and the XDR Web At the network layer, microsegmentation and just-in-time access shrink the attack surface to a whisper. But the real power emerges when Defender for Endpoint, Defender for Identity, and Defender for Cloud Apps feed their signals into one place -Defender XDR- reconstructing an attacker's full path from initial phishing email to lateral movement to data exfiltration as a single, correlated incident. **Exam Intel**Defender for Endpoint = EDR + attack surface reduction. Defender for Cloud Apps = CASB, discovers shadow IT, enforces session policies. Defender for Identity = on-prem AD + Entra identity attack detection. Defender XDR correlates all of these into one incident -know which product answers which scenario. 🧩 ### Building Security Into the Pipeline Application security cannot be a gate at the end of the pipeline -it has to be woven through it. Static analysis and dependency scanning run before code merges. Threat modelling during design catches the architectural flaws no amount of code review will ever find. And when applications ship as containers, Defender for Cloud follows them into runtime, watching for drift from the secure baseline. **Exam Intel**DevSecOps = SAST, dependency scanning, secrets detection in CI/CD. STRIDE threat modelling happens at design time, not code review time. API security = auth, authorisation, rate limiting, schema validation at the gateway. Defender for Cloud covers container and Kubernetes posture plus runtime protection. 🗄️ ### Guarding Data and the New AI Frontier At the centre of it all sits the data -labelled by sensitivity, watched by DLP policies, and monitored for the subtle behavioural signals of insider risk. Now a new frontier joins the vault: AI agents and Copilot experiences that read and generate content on the organisation's behalf. The architect must extend classification and least-privilege identity to these agents, and defend against prompt injection just as rigorously as SQL injection. **Exam Intel**Purview sensitivity labels + DLP + Insider Risk Management form the data protection chain. AI security risks: prompt injection, output data leakage, unauthorised plugin/tool access. Purview extends DLP to Copilot prompts and grounding data. AI agents need least-privilege, scoped identity -not broad service accounts. Section 3 / Acronym Memory ## Mnemonic Wall Memorable acronyms and phrases to anchor key exam concepts in your memory. 🎯 VLA **V**erify explicitly, **L**east privilege, **A**ssume breach The three Zero Trust guiding principles behind every SC-100 design recommendation. If an answer violates one of these, it is wrong. 🗺️ SPRAG **S**trategy, **P**lan, **R**eady, **A**dopt, **G**overn The five phases of the Cloud Adoption Framework Secure methodology for sequencing security modernisation. 🛰️ CDIR **C**ollect, **D**etect, **I**nvestigate, **R**espond Microsoft Sentinel's four core SIEM/SOAR functions -the lifecycle of every security incident. 🪪 CPI **C**onditional Access, **P**IM, **I**dentity Governance Three Entra ID capabilities an architect layers together for adaptive, least-privilege identity control. 🖥️ ICEO **I**dentity, **C**loud Apps, **E**ndpoint, **O**ffice 365 The four Defender signal sources correlated by Defender XDR into a single, unified incident. 🗄️ CDI **C**lassify, **D**LP, **I**nsider risk Purview's three-step data protection chain: label sensitivity, prevent leakage, watch for risky behaviour. Section 4 / Contrast Memory ## Versus Arena Side-by-side comparisons to sharpen your understanding of similar concepts. vs Zero TrustvsPerimeter Security Click to compare #### Zero Trust vs Perimeter Security | Aspect | Zero Trust | Perimeter Security | | --- | --- | --- | | Trust model | Never trust, always verify | Trust everything inside the perimeter | | Boundary | Identity, device, and session are the boundary | Network firewall is the boundary | | Breach assumption | Assume breach -design for containment | Assume the perimeter holds | | Access control | Continuous, contextual policy evaluation | One-time authentication at the gate | | Remote work | Native support -no implicit trust by location | Requires VPN to simulate being inside | | Blast radius | Segmented -lateral movement is limited | Flat network -lateral movement is easy | Click to flip back vs Microsoft SentinelvsDefender for Cloud Click to compare #### SIEM/SOAR vs CSPM/CWPP | Aspect | Microsoft Sentinel | Defender for Cloud | | --- | --- | --- | | Category | SIEM + SOAR | CSPM + CWPP | | Scope | Cross-domain signal correlation, any log source | Cloud resource posture and workload protection | | Primary question | "What is happening right now across my estate?" | "Is my cloud configuration and workload secure?" | | Data source | Microsoft 365, Defender XDR, on-prem, multicloud, custom connectors | Azure, AWS, GCP resource telemetry and agents | | Response | Automation rules, playbooks (Logic Apps) | Secure Score recommendations, attack path remediation | | Best for | Detection, investigation, incident response | Posture management, misconfiguration prevention | Click to flip back vs GRCvsSecOps Click to compare #### Proactive Assurance vs Reactive Response | Aspect | GRC | SecOps | | --- | --- | --- | | Focus | Proactive -design and assure controls | Reactive -detect and respond to threats | | Timescale | Ongoing audit cycles, quarterly reviews | Real-time, minutes to hours | | Output | Compliance score, risk register, control evidence | Incidents, alerts, remediation actions | | Owner | Risk, compliance, and legal stakeholders | SOC analysts and incident responders | | Tooling | Compliance Manager, regulatory compliance dashboard | Microsoft Sentinel, Defender XDR | | Failure mode | Control gap discovered in audit | Active breach discovered in production | Click to flip back vs Defender for Cloud AppsvsDefender for Identity Click to compare #### CASB vs Identity Threat Detection | Aspect | Defender for Cloud Apps | Defender for Identity | | --- | --- | --- | | Category | CASB -Cloud Access Security Broker | Identity threat detection and response (ITDR) | | Protects | SaaS app usage and shadow IT | On-premises AD and Entra ID identities | | Signal source | Cloud app API logs, proxy sessions | Domain controller traffic, Entra Connect signals | | Detects | Risky OAuth apps, anomalous SaaS activity, data exfiltration | Pass-the-Hash, DCSync, Kerberoasting, lateral movement | | Control type | Session policies -block, monitor, encrypt downloads | Alerting and investigation -no session control | | Deploys via | API connectors + reverse proxy for conditional access | Sensors on domain controllers and AD FS servers | Click to flip back vs Conditional AccessvsPrivileged Identity Management Click to compare #### Every Sign-In vs Privileged Elevation | Aspect | Conditional Access | Privileged Identity Management | | --- | --- | --- | | Purpose | Evaluate every sign-in against risk-based policy | Time-bound elevation of privileged role access | | Applies to | All users and workload identities | Users assigned eligible privileged roles | | Trigger | Every access attempt | On-demand activation request | | Controls | Require MFA, compliant device, block/allow by location | Approval workflow, justification, time limit, MFA on activation | | Standing access | N/A -policy, not a role state | Removes standing access -just-in-time only | | Together | Blocks risky sign-ins before role activation | Prevents privileged roles being always-on targets | Click to flip back Section 5 / Grouping Memory ## Cheat Sheet Organised reference grouped by exam domain — everything you need on one page. ### Design Solutions Aligned with Best Practices & Priorities 20-25% #### Zero Trust Principles - Verify explicitly: authenticate and authorise based on all available signals - Least privilege: just-in-time and just-enough-access (JIT/JEA), risk-based adaptive policy - Assume breach: minimise blast radius, segment access, verify end-to-end encryption - Six pillars: identity, endpoints, applications, network, infrastructure, data #### Reference Architectures - MCRA maps Microsoft security capabilities to Zero Trust functions - CAF Secure methodology: Strategy -> Plan -> Ready -> Adopt -> Govern - Secure Future Initiative: secure by design, secure by default, secure operations - Reference architectures are reviewed continuously, not set once #### Strategy & Governance - Microsoft Secure Score benchmarks configuration posture across workloads - Risk appetite drives prioritisation of the security roadmap - Executive reporting: likelihood, impact, residual risk after mitigation - Security strategy requires continuous cross-functional collaboration ### Design Security Operations, Identity & Compliance 25-30% #### Security Operations (SecOps) - Microsoft Sentinel: cloud-native SIEM + SOAR, ingests any log source - Automation rules + Logic Apps playbooks drive triage and containment - Defender Threat Intelligence enriches alerts with attacker TTP context - Detection engineering and post-incident review drive continuous SOC improvement #### Identity & Access - Conditional Access: real-time, risk-based policy engine for every sign-in - PIM: just-in-time, time-bound, approved privileged role elevation - Identity Governance: access reviews, entitlement management, lifecycle workflows - Workload identities need the same governance rigour as human identities #### Governance, Risk & Compliance (GRC) - Compliance Manager scores posture against ISO 27001, NIST, GDPR templates - Regulatory compliance dashboard maps controls to PCI DSS, CIS benchmarks - GRC is proactive assurance; SecOps is reactive detection and response - Risk registers, control owners, and remediation timelines are architecture artefacts ### Design Security Solutions for Infrastructure 25-30% #### Hybrid & Multicloud Posture - Defender for Cloud: CSPM + CWPP across Azure, AWS, and GCP - Attack path analysis prioritises remediation by exploitability and impact - Landing zones embed guardrails -policy, segmentation, identity- at provisioning - Infrastructure-as-Code scanning shifts misconfiguration detection left #### Network Security - Microsegmentation replaces implicit trust by network subnet - Azure Firewall, WAF, and DDoS Protection defend the perimeter and app layer - Private endpoints remove public exposure for PaaS resources - Just-in-time network access reduces standing exposure for RDP/SSH #### Endpoint & Extended Detection - Defender for Endpoint: EDR, attack surface reduction, automated investigation - Defender for Cloud Apps: CASB, shadow IT discovery, session policies - Defender for Identity: on-prem AD + Entra identity attack detection - Defender XDR correlates all signal sources into one incident ### Design Security Solutions for Applications & Data 20-25% #### Application & DevSecOps - SAST, dependency scanning, and secrets detection run before merge - STRIDE threat modelling at design time catches architectural flaws - API security: auth, authorisation, rate limiting, schema validation at the gateway - Defender for Cloud extends posture and runtime protection to containers/Kubernetes #### Data Security - Purview sensitivity labels classify and protect data consistently everywhere - DLP policies block or warn on sensitive data leaving approved channels - Insider Risk Management uses behavioural signals, not full content inspection - Information barriers and records management support regulated industries #### AI & Copilot Security - Key risks: prompt injection, output data leakage, unauthorised tool access - Purview extends DLP and labelling to Copilot prompts and grounding data - AI agents need least-privilege, scoped identity -not broad service accounts - Defender for Cloud AI security posture management assesses AI workload risk Section 6 / Method of Loci ## The Memory Palace Walk through themed rooms — each object anchors a concept in spatial memory. ### The Strategy War Room Best Practices & Priorities -Where the architecture compass is set 🎯 Zero Trust Compass Verify explicitly, least privilege, assume breach. Points every design decision in the same direction. 🗺️ MCRA Blueprint Maps every Microsoft security capability against Zero Trust functions -reveals gaps and overlaps. 🧭 CAF Secure Roadmap Strategy -> Plan -> Ready -> Adopt -> Govern. The sequencing for security modernisation. 📊 Secure Score Dial Benchmarks configuration posture across Microsoft 365, Entra, and Defender workloads. 📜 Executive Risk Ledger Translates likelihood and impact into board-level language for investment decisions. ### The Security Operations Bridge SecOps, Identity & Compliance -Where threats are hunted and access is governed 🛰️ Sentinel Console Cloud-native SIEM + SOAR. Ingests every signal, correlates, automates response via playbooks. 🕸️ Defender XDR Correlator Unifies Endpoint, Identity, Cloud Apps, and Office 365 signals into one reconstructed attack chain. 🚦 Conditional Access Gatekeeper Evaluates every sign-in against identity, device, location, and session risk in real time. ⏱️ PIM Timer Just-in-time, approved, time-bound elevation. No privileged role stands always-on. 📋 Compliance Manager Scorecard Scores posture against ISO 27001, NIST, and GDPR templates -audit evidence on demand. ### The Infrastructure Perimeter Infrastructure -Where cloud, network, and endpoints are hardened ☁️ Defender for Cloud Posture Map CSPM + CWPP across Azure, AWS, GCP. Attack path analysis prioritises the riskiest chains. 🏗️ Landing Zone Blueprint Guardrails baked in at subscription creation -policy, segmentation, identity boundaries. 🔥 Azure Firewall Sentry Perimeter and application-layer defence, paired with WAF and DDoS Protection. 🖥️ Defender for Endpoint Sensor EDR, attack surface reduction rules, automated investigation and remediation. 🪤 Defender for Identity Trip-Wire Watches domain controller traffic for Pass-the-Hash, DCSync, and lateral movement. ### The Application & Data Vault Applications & Data -Where code, data, and AI agents are secured 🧩 DevSecOps Pipeline Gate SAST, dependency scanning, and secrets detection run before code ever merges. 🏷️ Purview Sensitivity Label Classifies and protects data consistently across Microsoft 365, Azure, and on-premises. 🧱 DLP Policy Wall Blocks or warns on sensitive data leaving approved channels -email, chat, USB, cloud apps. 📡 Insider Risk Radar Behavioural signals flag risky activity -like mass downloads before departure- without full content inspection. 🛡️ Copilot Guardrail Least-privilege agent identity, prompt-injection defence, and DLP applied to prompts and outputs. Section 7 / Pattern Recognition ## Pattern Spotter Decision trees and trigger-answer pairs — see the pattern, know the answer. Which Defender Product? Which Defender Product?   ├── Need SaaS visibility and shadow IT control? → Microsoft Defender for Cloud Apps (CASB)  ├── Need on-prem AD / Entra identity attack detection? → Microsoft Defender for Identity  ├── Need endpoint EDR and attack surface reduction? → Microsoft Defender for Endpoint  ├── Need multicloud posture and workload protection? → Microsoft Defender for Cloud  └── Need email and collaboration threat protection? → Microsoft Defender for Office 365 SIEM/SOAR or Posture Management? SIEM/SOAR or Posture Management?   ├── Question is "what happened / is happening right now"? → Microsoft Sentinel (SIEM/SOAR)  ├── Question is "is this resource configured securely"? → Microsoft Defender for Cloud (CSPM/CWPP)  ├── Need automated containment across products? → Sentinel automation rules + Defender XDR  └── Need compliance evidence for an auditor? → Compliance Manager + regulatory compliance dashboard Which Identity Control? Which Identity Control?   ├── Every sign-in needs risk-based evaluation? → Conditional Access policy  ├── Privileged role should not be always-on? → Privileged Identity Management (PIM)  ├── Access needs periodic recertification? → Identity Governance access reviews  └── Non-human identity needs scoped permissions? → Workload identity + least-privilege app registration Protecting Data & AI Workloads Protecting Data & AI Workloads   ├── Sensitive content needs consistent labelling? → Microsoft Purview sensitivity labels  ├── Sensitive data leaving an approved channel? → Purview Data Loss Prevention policy  ├── User behaviour signals risk before departure? → Insider Risk Management  └── Copilot or agent could leak or be manipulated? → Purview for AI + least-privilege agent identity + prompt-injection controls ## Decision Cards Design must minimise standing privileged access→Use PIM for just-in-time, time-bound, approved role elevation. Design must detect lateral movement across on-prem AD→Deploy Microsoft Defender for Identity sensors on domain controllers. Design must correlate signals across endpoint, identity, cloud apps, and email→Adopt Microsoft Defender XDR as the unified incident engine. Design must automate SOC triage and response at scale→Build Microsoft Sentinel automation rules and Logic Apps playbooks. Design must prove regulatory compliance to an auditor→Use Purview Compliance Manager scored against the relevant regulatory template. Design must prevent sensitive data leaving via email or USB→Apply Purview DLP policies scoped to sensitivity labels. Design must secure a multicloud estate spanning Azure, AWS, and GCP→Onboard all clouds to Microsoft Defender for Cloud for unified CSPM/CWPP. Design must reduce prompt injection risk in a Copilot or agent workload→Scope agent identity to least privilege, apply Purview DLP to prompts and outputs, and validate grounding data sources. Ready to certify? ## Train with practitioners, not presenters Lucid Labs delivers Microsoft certification training led by Microsoft Certified Trainers (MCTs) and grounded in real-world project experience. We adapt every session to your team's environment, data stack, and business objectives — because the best exam prep comes from engineers who build these solutions every day. 🎯 Zero Trust Architecture Design Translate Zero Trust principles into a phased roadmap across identity, endpoints, network, data, and AI workloads. 🛰️ SecOps & XDR Deployment Design and tune Microsoft Sentinel and Defender XDR for real-world detection engineering and incident response. 🪪 Identity & Governance Hardening Implement Conditional Access, PIM, and Identity Governance to close standing-access and privilege escalation risks. 📋 GRC & Executive Reporting Build compliance programs and board-level risk reporting that satisfy auditors without slowing the business down. [Talk to us about Cybersecurity Architect Expert (SC-100) training](https://lucidlabs.com.au/?service=training-consulting&message=I%27m%20interested%20in%20Cybersecurity%20Architect%20\(SC-100\)%20training%20and%20consulting%20for%20my%20team%20-%20covering%20Zero%20Trust%2C%20Microsoft%20Sentinel%2C%20Defender%20XDR%2C%20and%20security%20governance.#contact) Custom training for teams & individuals — remote or on-site across Australia ![Keith Oak](https://lucidlabs.com.au/team/koak-400.jpg) Keith Oak Chief Technology Officer — Lucid Labs Microsoft Solutions Partner architect specialising in Fabric, Azure Data & AI, and GitHub Enterprise. 18+ years delivering data platforms for Australian businesses — building the systems these exams test every day. [LinkedIn ↗](https://www.linkedin.com/in/keithoak/)[lucidlabs.com.au ↗](https://lucidlabs.com.au/)Published 29-03-2026