Certifications
SC-100 study guide: Cybersecurity Architect
An expert-level design exam that punishes product knowledge without architectural judgement. What it actually tests, and why people who know the tools still fail it.
Why strong engineers fail this one
SC-100 does not ask which blade a setting lives in. It presents a business situation with constraints and asks what you would design. The answers are frequently all technically possible, and the correct one is the one that fits the stated constraint.
That is a different skill from operating the products, and it is why people who could pass SC-200 and SC-300 comfortably can still fail SC-100 without preparation aimed at judgement rather than recall.
The skill areas
Microsoft publishes these as weighted ranges. Midpoints shown.
- Security strategy and architecture28%
- GRC and risk strategy25%
- Infrastructure security design25%
- Data and application security design22%
Ranges rather than fixed weights. Planning guidance only.
How to prepare for a judgement exam
Learn the Zero Trust pillars as a design language
Identity, endpoints, applications, network, infrastructure, data. Many questions are answerable by identifying which pillar the constraint sits in.
Practise reading the constraint, not the scenario
Scenarios are long and mostly decoration. The deciding sentence is usually one line about budget, timescale, regulation or an existing investment.
Know when the answer is not a Microsoft product
Sometimes the correct design is a process change or an existing capability. Candidates who reach for a product every time lose marks.
Be fluent in the Cloud Adoption Framework and Well-Architected pillars
The exam leans on this vocabulary, and it shapes what a correct answer looks like.
Study resources
Microsoft Learn, plus the Cloud Adoption Framework
- Best for
- Everyone. The framework documentation is as important as the exam outline for this one
- Watch out for
- Free but enormous. Work from the skills outline rather than reading it front to back
MeasureUp practice tests
- Best for
- Scenario-style questions, which is what this exam is made of
- Watch out for
- Expensive, and no practice set fully replicates expert-level case questions
Links above go to the vendor. Where a link is marked as an affiliate link, a purchase may earn this site a commission at no cost to you, and it played no part in the ranking.
The verdict
Take it after an associate exam and real design experience
It is the credential that signals architect rather than operator, and it is respected because it is difficult to bluff.
Skip it if you have never designed anything end to end. Passing it without that experience produces a title you cannot defend in the first interview.
Disclosure. Some links on this site are affiliate links. Scoring weights are published before any programme is joined, and commission is never a ranking input. Full policy, and the method behind this guide.