SC-100 · Domain 3 of 4

SC-100 Domain 3: Design security solutions for infrastructure

Joint-heaviest SC-100 area: hybrid and multicloud posture with Defender for Cloud, Azure Arc and Exposure Management, endpoint and IoT requirements, baselines for SaaS, PaaS, IaaS and containers, Azure AI services security, and network and Security Service Edge evaluation.

Exam weight
25–30%
Official functional groups
4
Estimated questions estimate
~14
Suggested study time estimate
16–22 hrs

About 13 min read Reviewed October 2026

Overview

Domain 3 moves from strategy and identity to the infrastructure that workloads run on. Its first functional group covers posture management across hybrid and multicloud estates: Defender for Cloud with MCSB, Microsoft Secure Score, cloud workload protection plans, Azure Arc onboarding, Defender External Attack Surface Management, and Microsoft Security Exposure Management attack paths and initiatives. The second group sets security requirements for servers, mobile devices, IoT and embedded systems, OT environments through Defender for IoT, endpoint baselines and Windows LAPS.

The third group specifies baselines for SaaS, PaaS and IaaS, and requirements for IoT workloads, web workloads, containers, container orchestration and Azure AI services. The final group evaluates network designs and the Security Service Edge capabilities in Microsoft Entra Internet Access and Microsoft Entra Private Access. This domain carries 25–30% of the exam.

How it's tested

Domain 3 items describe a mixed estate: Azure subscriptions, AWS or GCP accounts, on-premises servers, factories with OT devices, and container platforms. You are asked which Microsoft capability gives visibility, which baseline or requirement applies, or which access design replaces a legacy approach while meeting Zero Trust goals.

  • Match plan to workload

    A resource type is described, and you choose the Defender for Cloud plan or connector that protects it, such as Defender for Servers or Defender for Containers.

  • Prioritize exposure

    Many posture findings exist, and you select the tool or attack path view that shows which issues lead to critical assets.

  • Replace legacy access

    Users reach private apps or the internet through VPNs or proxies, and you evaluate Entra Private Access or Internet Access as the replacement.

Reasoning it through

A firm runs workloads in Azure, AWS and an on-premises datacenter, and wants a single posture score with consistent server protection. Separate tools per cloud would fragment the view. Connecting AWS through the Defender for Cloud multicloud connector, onboarding on-premises servers with Azure Arc and enabling Defender for Servers brings all three into one Secure Score and recommendation set, which satisfies the single-view requirement.

Functional groups 4

Official functional groups from the Microsoft outline, in outline order.

3.1 Design solutions for security posture management in hybrid and multicloud environmentsDefender for Cloud with MCSB, Secure Score, workload protection, Azure Arc, Defender EASM and Exposure Management.
What it means
This group covers evaluating posture with Defender for Cloud and MCSB, evaluating Microsoft Secure Score, designing integrated posture management across hybrid and multicloud estates, selecting cloud workload protection plans, integrating environments through Azure Arc, designing Defender EASM, and specifying requirements for an Exposure Management process using attack paths, attack surface reduction, security insights and initiatives.
What to understand
Defender for Cloud has two halves: posture management, including the paid Defender CSPM plan with attack path analysis, and workload protection plans such as Defender for Servers, Storage, Databases and Containers. AWS and GCP connect through native connectors, while on-premises and other servers use Azure Arc. Defender EASM discovers internet-facing assets the organization may not know it owns. Exposure Management aggregates posture data into initiatives and attack paths toward critical assets.
How it shows up
Questions present a fragmented estate and ask which onboarding method, plan or exposure tool provides the required visibility.
Common confusion
Assuming foundational CSPM includes attack path analysis; that capability requires the Defender CSPM plan.
3.2 Specify requirements for securing server and client endpointsServer, mobile and client requirements, IoT and embedded systems, OT and ICS, baselines and Windows LAPS.
What it means
This group covers specifying security requirements for servers across platforms and operating systems, for mobile devices and clients including endpoint protection, hardening and configuration, for IoT devices and embedded systems, evaluating OT and ICS protection with Microsoft Defender for IoT, specifying endpoint security baselines, and evaluating Windows LAPS.
What to understand
Servers typically need Defender for Endpoint through Defender for Servers, vulnerability assessment, hardening and update management. Clients and mobile devices rely on Intune compliance policies, security baselines and Defender for Endpoint, with Conditional Access consuming compliance status. OT networks often cannot run agents, so Defender for IoT uses passive network monitoring. Windows LAPS rotates unique local administrator passwords and can back them up to Microsoft Entra ID or AD DS.
How it shows up
Expect a device category with constraints, such as no agent support or bring-your-own device, and a question on the right requirement.
Common confusion
Recommending agent-based EDR for legacy OT controllers that cannot host agents; passive monitoring with Defender for IoT fits better.
3.3 Specify requirements for securing SaaS, PaaS, and IaaS servicesService baselines, IoT and web workloads, containers, container orchestration and Azure AI services security.
What it means
This group covers specifying security baselines for SaaS, PaaS and IaaS, and security requirements for IoT workloads, web workloads, containers and container orchestration, and evaluating solutions that include security for Azure AI services.
What to understand
The shared responsibility model shifts more duties to Microsoft as you move from IaaS to PaaS to SaaS, but identity, data and configuration stay with the customer. Container requirements include trusted registries, image scanning, runtime protection and least-privilege pod identities. Orchestration requirements for AKS cover private clusters, Azure Policy for Kubernetes and Microsoft Entra integration. Azure AI services need private endpoints, managed identity instead of keys, content filtering and logging.
How it shows up
Questions give a service model or workload and ask which requirement or baseline belongs to the customer.
Common confusion
Believing PaaS removes the customer's responsibility for access control and data protection.
3.4 Evaluate solutions for network security and Security Service Edge (SSE)Network design evaluation, Entra Internet Access, Internet Access for Microsoft services and Entra Private Access.
What it means
This group covers evaluating network designs against security requirements and best practices, and evaluating Microsoft Entra Internet Access as a secure web gateway, Entra Internet Access for Microsoft services including cross-tenant configurations, and Microsoft Entra Private Access.
What to understand
Global Secure Access is Microsoft's SSE solution. Internet Access applies web content filtering and Conditional Access to internet traffic. The Microsoft traffic profile secures access to Microsoft 365 and supports universal tenant restrictions to block unapproved tenants. Private Access gives per-application, identity-aware access to private apps without exposing the full network as a VPN does. Network design evaluation still covers segmentation, Azure Firewall, NSGs and private endpoints.
How it shows up
Expect a remote access or data exfiltration scenario where you compare a VPN, a proxy and Global Secure Access options.
Common confusion
Treating Private Access as a full-tunnel VPN; it grants access per application based on identity and policy.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Defender CSPM

    Paid posture plan with attack path analysis, cloud security explorer and governance features.

    Remember
    Foundational CSPM is free but lacks attack paths.
    Tested as
    Chosen when prioritized exposure insight is required.
    Trap
    Assuming free posture covers attack path analysis.

  • Microsoft Secure Score

    Measure of security posture based on implemented recommendations.

    Remember
    Defender for Cloud and Defender XDR each present a score for their scope.
    Tested as
    Used to evaluate and track posture over time.
    Trap
    Treating a high score as proof of compliance.

  • Azure Arc

    Projects non-Azure servers and Kubernetes clusters into Azure Resource Manager.

    Remember
    Enables Defender for Cloud, Azure Policy and update management outside Azure.
    Tested as
    The answer for on-premises and other-cloud server onboarding.
    Trap
    Expecting Arc to migrate workloads into Azure.

  • Multicloud connectors

    Native Defender for Cloud connectors for AWS and GCP accounts.

    Remember
    Bring other clouds' resources into MCSB assessments.
    Tested as
    Used for integrated multicloud posture.
    Trap
    Installing Arc for every AWS resource instead of using the connector.

  • Defender EASM

    External Attack Surface Management that discovers internet-facing assets.

    Remember
    Finds unknown domains, IP addresses and services.
    Tested as
    Appears when shadow IT or unknown exposure is the problem.
    Trap
    Confusing it with internal vulnerability scanning.

  • Microsoft Security Exposure Management

    Unified exposure view with attack paths, initiatives and critical asset tagging.

    Remember
    Prioritizes fixes by reachability of critical assets.
    Tested as
    Named in the posture management objective.
    Trap
    Treating every finding as equal priority.

  • Defender for IoT

    Agentless OT and IoT monitoring through network traffic analysis.

    Remember
    Suited to devices that cannot host agents.
    Tested as
    OT and ICS evaluation questions.
    Trap
    Proposing endpoint agents on PLCs.

  • Windows LAPS

    Automatic rotation and backup of local administrator passwords.

    Remember
    Backs up to Entra ID or AD DS and prevents shared local passwords.
    Tested as
    Explicitly listed for evaluation.
    Trap
    Assuming legacy LAPS and Windows LAPS are identical.

  • Defender for Containers

    Protection for registries, Kubernetes clusters and container runtime.

    Remember
    Covers vulnerability assessment and runtime threat detection.
    Tested as
    Container and orchestration requirement questions.
    Trap
    Expecting Defender for Servers to protect AKS workloads fully.

  • Shared responsibility model

    Division of security duties between cloud provider and customer by service model.

    Remember
    Identity, data and accounts always remain customer duties.
    Tested as
    Baseline and requirement questions depend on it.
    Trap
    Believing SaaS shifts data governance to Microsoft.

  • Microsoft Entra Private Access

    Identity-centric access to private applications through Global Secure Access.

    Remember
    Replaces broad VPN access with per-app access.
    Tested as
    SSE evaluation scenarios.
    Trap
    Assuming it needs inbound firewall openings.

  • Universal tenant restrictions

    Global Secure Access feature that limits sign-ins to approved tenants.

    Remember
    Helps prevent data exfiltration to personal or foreign tenants.
    Tested as
    Cross-tenant Microsoft traffic scenarios.
    Trap
    Relying on proxy header injection as the only option.

  • Azure AI services security

    Controls for AI service endpoints, keys, data and content.

    Remember
    Use private endpoints, managed identity and content safety.
    Tested as
    New AI-related requirement in this domain.
    Trap
    Leaving API keys embedded in application code.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Posture and exposure tools

ConceptMeaningKey differenceCommon trap
Defender for Cloud (CSPM) Cloud posture recommendations, MCSB assessments and Secure Score. Focuses on cloud resource configuration. Expecting it to find unknown internet assets.
Defender EASM Outside-in discovery of internet-facing assets. Shows what attackers see from the internet. Using it for internal configuration checks.
Exposure Management Unified exposure view with attack paths across products. Prioritizes by paths to critical assets. Treating it as a replacement for workload protection.

Remote and web access options

ConceptMeaningKey differenceCommon trap
Traditional VPN Network-level tunnel into the corporate network. Grants broad network reach once connected. Choosing it when per-app least privilege is required.
Entra Private Access Per-application access to private apps via Global Secure Access. Identity and Conditional Access decide each app connection. Assuming it exposes the whole subnet.
Entra Internet Access Secure web gateway for internet and SaaS traffic. Applies web filtering and identity-aware policy. Using it to reach on-premises apps.

Service model responsibilities

ConceptMeaningKey differenceCommon trap
IaaS Customer manages OS, network controls, apps and data. Largest customer responsibility. Forgetting OS patching and hardening.
PaaS Microsoft manages OS and runtime; customer configures service, identity and data. Configuration and access remain customer tasks. Assuming network exposure is handled by default.
SaaS Microsoft runs the application; customer manages accounts, data and settings. Data governance and access stay with the customer. Treating tenant settings as Microsoft's job.

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Free tier with paid features

    What candidates pick
    Foundational CSPM for attack path analysis
    Why it looks right
    It is enabled by default and sounds sufficient.
    Why it's wrong
    Attack path analysis and cloud security explorer need the Defender CSPM plan.

    Clue to watch for Requirements to prioritize risks by attack path.

  2. Agent everywhere

    What candidates pick
    Install Defender for Endpoint on factory controllers
    Why it looks right
    EDR is the standard endpoint answer.
    Why it's wrong
    Many OT devices cannot run agents; Defender for IoT monitors them passively from network traffic.

    Clue to watch for Mentions of PLCs, SCADA or ICS networks.

  3. Arc for cloud accounts

    What candidates pick
    Onboard every AWS resource with Azure Arc
    Why it looks right
    Arc is the hybrid onboarding tool.
    Why it's wrong
    AWS accounts connect through the Defender for Cloud AWS connector; Arc adds server-level capabilities where needed.

    Clue to watch for Phrases such as connect AWS account or GCP project.

  4. VPN for least privilege

    What candidates pick
    Upgrade VPN gateways for remote staff
    Why it looks right
    VPNs are proven and familiar.
    Why it's wrong
    A VPN exposes network segments; Private Access grants per-app access governed by Conditional Access.

    Clue to watch for Requirements for app-level access or Zero Trust network access.

  5. Keys for AI services

    What candidates pick
    Store Azure AI services keys in app settings
    Why it looks right
    Keys are the quick-start method.
    Why it's wrong
    Managed identities with Microsoft Entra authentication remove secrets, and private endpoints limit exposure.

    Clue to watch for Requirements for keyless or least-privilege access to AI endpoints.

  6. Score equals compliance

    What candidates pick
    Report Secure Score as regulatory evidence
    Why it looks right
    A single number is easy to share.
    Why it's wrong
    Secure Score measures recommendation adoption; regulatory alignment is shown through compliance standards and assessments.

    Clue to watch for Words like auditor, regulator or standard.

Answer framework

Work through these steps when a Domain 3 scenario asks how to protect or assess infrastructure.

  1. List every environment in the scenario, including Azure, AWS, GCP, on-premises, OT networks and container platforms.
  2. Choose the onboarding route for each: native multicloud connectors for cloud accounts, Azure Arc for servers and clusters outside Azure.
  3. Select the posture tier and workload protection plans that match each resource type and the stated need for attack path insight.
  4. Apply baselines and requirements by service model and device type, including AI services, containers and devices that cannot host agents.
  5. Evaluate network access last, preferring identity-aware Global Secure Access when the scenario asks for per-app least privilege, and keep segmentation, Azure Firewall and private endpoints for traffic inside Azure.

Practice question

A manufacturer has hundreds of programmable logic controllers on an isolated plant network. The devices cannot run agents and must not be actively scanned. Security wants asset inventory, vulnerability insight and threat detection for this network. What should the architect recommend?

Want more like this? The SC-100 practice test has questions for every domain.

Checklist

0 of 13

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Begin with Defender for Cloud because it anchors half of this domain. Draw a table of the Defender plans, what each protects, and which features need Defender CSPM. Add a column for onboarding method: native connector, Azure Arc, or built-in for Azure resources. Then read about Exposure Management and Defender EASM so you can describe how they differ from cloud posture recommendations.

Move to endpoints and OT next. Compare Intune baselines, Defender for Endpoint and Defender for IoT by device type and agent support, and read how Windows LAPS stores and rotates passwords. For services, work through the shared responsibility model, then list container, AKS and Azure AI services requirements in your own words.

Finish with Global Secure Access. Study Private Access, Internet Access and the Microsoft traffic profile, including universal tenant restrictions, and contrast each with a VPN or proxy. Plan roughly 16 to 22 hours, and rehearse with scenarios that mix several environments, since the exam rarely presents a single-cloud estate.

FAQ

How much of SC-100 is Domain 3, Design security solutions for infrastructure?

Microsoft weights it at 25–30%, which ties it with Domain 2 as the largest SC-100 area. It contains four functional groups covering posture, endpoints, services and network access.

Do I need to know Defender for Cloud pricing tiers?

You need to know which features belong to foundational CSPM, Defender CSPM and each workload protection plan. Exact prices are not tested.

Is Microsoft Security Exposure Management on the exam?

Yes. The posture management group asks you to specify requirements for an Exposure Management process using attack paths, attack surface reduction, security insights and initiatives.

What AI content appears in Domain 3?

The service requirements group includes evaluating solutions that include Azure AI services security, such as private networking, managed identity and content safety controls.

Why is Global Secure Access part of SC-100?

Microsoft positions its Security Service Edge as the Zero Trust replacement for broad VPN and proxy access, so architects must evaluate Internet Access and Private Access designs.

How deep does the OT and IoT coverage go?

Expect requirement and evaluation questions, such as choosing passive monitoring with Defender for IoT, rather than sensor installation details.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 3 knowledge

Check that you can match every resource type to its Defender plan and onboarding method, and evaluate Global Secure Access against a VPN.

Take the SC-100 practice test Check your SC-100 readiness

Keep going