SC-100 · Domain 1 of 4

SC-100 Domain 1: Design solutions that align with security best practices and priorities

The strategy layer of SC-100: ransomware and business resiliency, alignment with the Microsoft Cybersecurity Reference Architectures and the Microsoft Cloud Security Benchmark, Zero Trust adoption, secure AI adoption, and governance through CAF, Well-Architected and Azure landing zones.

Exam weight
20–25%
Official functional groups
3
Estimated questions estimate
~11
Suggested study time estimate
12–16 hrs

About 14 min read Reviewed October 2026

Overview

Domain 1 asks you to think like the architect who sets direction before any product is configured. Microsoft groups it into three functional areas. The first is resiliency: identifying the assets the business cannot lose, planning BCDR with backups that attackers cannot encrypt or delete, prioritizing privileged access during ransomware response, and judging how security updates are delivered. The second is alignment with the Microsoft Cybersecurity Reference Architectures (MCRA) and the Microsoft Cloud Security Benchmark (MCSB), including insider and supply chain threats, AI solutions mapped to MCSB, and the Zero Trust adoption framework.

The third area uses the Cloud Adoption Framework (CAF) and the Azure Well-Architected Framework (WAF) to shape governance, Azure landing zones, DevSecOps and a strategy for adopting AI securely. SC-100 is an active expert exam with no retirement date on Microsoft Learn as of October 2026, and its skills measured were last revised on October 21, 2026.

How it's tested

Domain 1 questions rarely ask how to click through a portal. They describe an organization, its risks and its constraints, then ask which framework, priority or strategy an architect should recommend first. Many items sit inside long case studies where the correct choice must satisfy business goals, compliance needs and least administrative effort together.

  • Order the ransomware priorities

    A recovery or prevention scenario is described, and you decide which action comes first, typically protected backups or privileged access before broader hardening.

  • Name the right framework

    A goal such as governance at scale, control mapping or workload review is given, and you pick CAF, WAF, MCSB, MCRA or Zero Trust.

  • Govern AI adoption

    An organization plans generative AI use, and you choose the strategy elements and MCSB-aligned controls that let teams adopt it safely.

Reasoning it through

A manufacturer wants its new Azure subscriptions to inherit policy, logging and network controls automatically as teams create them. Writing a per-subscription checklist does not scale. Azure landing zones, built from CAF guidance, place subscriptions under management groups where Azure Policy and role assignments are inherited. The requirement is consistent governance at scale, so the landing zone design is the answer, not a workload review under the Well-Architected Framework.

Functional groups 3

Official functional groups from the Microsoft outline, in outline order.

1.1 Design a resiliency strategy for ransomware and other attacks based on Microsoft Security Best PracticesBusiness resiliency goals, BCDR with secure backup, ransomware mitigation priorities and security updates.
What it means
This group covers building a security strategy around business resiliency by identifying and ranking threats to business-critical assets, designing BCDR that includes secure backup and restore across hybrid and multicloud estates, designing ransomware mitigation that puts BCDR and privileged access first, and evaluating how security updates are delivered and tracked.
What to understand
Microsoft's ransomware guidance treats recovery and privileged access as the top priorities because attackers target backups and admin accounts first. Secure backup means immutable or soft-deleted copies, separate credentials, multi-user authorization for destructive operations and tested restores. Azure Backup features such as immutable vaults and soft delete support this. Update evaluation covers tools like Azure Update Manager and Windows Autopatch, judged by coverage and speed of deployment rather than by product preference.
How it shows up
Expect a breached or at-risk organization and a question about which resiliency step to prioritize or which backup protection prevents attacker deletion.
Common confusion
Assuming any backup equals resilience. A backup reachable with the same compromised admin credentials offers little protection against ransomware.
1.2 Design solutions that align with the Microsoft Cybersecurity Reference Architectures (MCRA) and Microsoft Cloud Security Benchmark (MCSB)Capability and control best practices, insider, external and supply chain threats, AI alignment with MCSB and Zero Trust adoption.
What it means
This group covers designing solutions that follow best practices for cybersecurity capabilities and controls, protecting against insider, external and supply chain attacks, designing AI solutions that align with the Microsoft Cloud Security Benchmark, and aligning designs with the Zero Trust adoption framework.
What to understand
MCRA is a set of diagrams showing how Microsoft security capabilities fit together across identity, devices, data, operations and multicloud. MCSB is a prescriptive control set, organized into domains such as network security, identity management and data protection, that Defender for Cloud uses as its default assessment. The Zero Trust adoption framework breaks work into business scenarios such as modernizing secure access and securing AI. Supply chain protection spans code dependencies, third-party access and software integrity.
How it shows up
Questions give a security goal and ask which benchmark control, reference architecture view or Zero Trust scenario the design should map to.
Common confusion
Treating MCRA and MCSB as the same thing. MCRA shows architecture and capabilities, while MCSB lists the controls you assess against.
1.3 Design solutions that align with the Microsoft Cloud Adoption Framework for Azure (CAF) and the Azure Well-Architected FrameworkSecure AI adoption, CAF and WAF security strategy, Azure landing zones and DevSecOps.
What it means
This group covers designing a strategy for secure AI adoption, designing or evaluating a security and governance strategy based on CAF and WAF, recommending security and governance solutions from those frameworks, implementing and governing security with Azure landing zones, and designing a DevSecOps process aligned with CAF.
What to understand
CAF guides the organization-wide journey, including the Secure and Govern methodologies, while WAF reviews individual workloads against pillars such as security and reliability. Azure landing zones apply CAF at scale using management groups, Azure Policy, centralized connectivity and logging. Secure AI adoption covers governance of approved AI services, data boundaries and responsible use. DevSecOps builds security checks into pipelines, such as code scanning and infrastructure-as-code validation, instead of testing only before release.
How it shows up
Expect a choice between CAF, WAF and landing zones, or a question on where security checks belong in a DevSecOps pipeline.
Common confusion
Using the Well-Architected Framework for organization-wide governance. WAF evaluates a workload; CAF and landing zones govern the estate.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Zero Trust principles

    Three design rules: verify every request explicitly, grant least privilege, and assume a breach has occurred.

    Remember
    Every SC-100 design should be defensible against all three principles.
    Tested as
    Many answer options are judged by whether they weaken one of these principles.
    Trap
    Equating Zero Trust with a single product such as Conditional Access.

  • Microsoft Cybersecurity Reference Architectures (MCRA)

    Diagrams that map Microsoft security capabilities to each other and to third-party and multicloud environments.

    Remember
    MCRA shows how capabilities connect; it is not a compliance checklist.
    Tested as
    Used when a question asks for an end-to-end capability view or reference design.
    Trap
    Choosing MCRA when the scenario needs specific control assessments.

  • Microsoft Cloud Security Benchmark (MCSB)

    Microsoft's prescriptive cloud security control set mapped to frameworks such as CIS and NIST.

    Remember
    Defender for Cloud assesses subscriptions against MCSB by default.
    Tested as
    Appears whenever a design must align to best-practice controls across Azure and other clouds.
    Trap
    Thinking MCSB covers only Azure; it includes AWS and GCP guidance.

  • Ransomware priority order

    Microsoft ranks preparing recovery and protecting privileged access ahead of wider hardening.

    Remember
    Backups attackers cannot reach and secured admin accounts come first.
    Tested as
    Questions often ask for the first or most important step.
    Trap
    Starting with endpoint tuning while backups remain deletable.

  • Immutable and soft-deleted backups

    Azure Backup protections that keep recovery points from being altered or permanently removed for a period.

    Remember
    Combine immutability, soft delete and multi-user authorization for strong protection.
    Tested as
    The answer when a scenario fears attackers deleting backups.
    Trap
    Relying on geo-redundant storage alone, which replicates deletions too.

  • Zero Trust adoption framework

    Microsoft guidance that organizes Zero Trust work into business scenarios with stakeholders and milestones.

    Remember
    Scenarios include modernizing secure access, protecting data and securing AI.
    Tested as
    Used for strategy and roadmap questions rather than single controls.
    Trap
    Treating it as a technical configuration baseline.

  • Cloud Adoption Framework (CAF)

    Microsoft's methodology for adopting cloud across strategy, plan, ready, adopt, govern, secure and manage.

    Remember
    CAF works at organization level and feeds landing zone design.
    Tested as
    Questions on governance strategy and security operating models point here.
    Trap
    Confusing CAF with the workload-level Well-Architected Framework.

  • Azure Well-Architected Framework (WAF)

    Workload guidance across reliability, security, cost optimization, operational excellence and performance efficiency.

    Remember
    WAF reviews one workload at a time.
    Tested as
    Chosen when a team must assess a specific application's design.
    Trap
    Mixing it up with Azure Web Application Firewall, which shares the acronym.

  • Azure landing zones

    A pre-designed environment of management groups, policies, identity, networking and logging for subscriptions.

    Remember
    Policy and RBAC inherit downward through management groups.
    Tested as
    The answer for governing many subscriptions consistently.
    Trap
    Assuming a landing zone is one resource group or one VNet.

  • Secure AI adoption

    A strategy for approving, governing and monitoring AI use while protecting data and identities.

    Remember
    Covers approved services, data boundaries, oversight and responsible AI.
    Tested as
    Newer SC-100 objectives tie AI to CAF and MCSB alignment.
    Trap
    Blocking all AI use, which drives unmanaged shadow AI instead.

  • Supply chain attacks

    Compromise through third-party code, vendors, build systems or managed service providers.

    Remember
    Defenses include dependency scanning, signed artifacts and limited partner access.
    Tested as
    Grouped with insider and external threats in MCRA alignment questions.
    Trap
    Focusing only on network perimeter controls.

  • DevSecOps

    Integrating security tasks into each stage of development and deployment pipelines.

    Remember
    Shift security left with code, secret and infrastructure-as-code scanning.
    Tested as
    Tested as a CAF-aligned process design.
    Trap
    Adding a single penetration test before release and calling it DevSecOps.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Microsoft security frameworks

ConceptMeaningKey differenceCommon trap
MCRA Capability and architecture diagrams. Shows how products and capabilities fit together. Picking it for control-by-control compliance checks.
MCSB Prescriptive security controls with Azure, AWS and GCP guidance. Used for assessment and baseline alignment in Defender for Cloud. Assuming it is an architecture diagram set.
Zero Trust adoption framework Business-scenario roadmap for Zero Trust. Organizes programs and stakeholders, not settings. Using it as a technical baseline.
CAF Organization-wide cloud adoption methodology. Covers strategy, governance and security operating model. Applying it to review a single workload.
WAF Workload design guidance across five pillars. Scoped to a workload such as one application. Confusing it with Web Application Firewall.

Backup protections against ransomware

ConceptMeaningKey differenceCommon trap
Soft delete Deleted backup data is retained for a recovery window. Lets you undo malicious deletion. Assuming it stops an attacker from changing retention policies.
Immutable vault Prevents operations that would reduce or delete recovery points. Locked immutability cannot be turned off. Forgetting it must be locked to be irreversible.
Multi-user authorization Requires approval from a separate security admin for critical backup operations. Stops a single compromised admin from disabling protection. Assigning both roles to the same person.

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Geo-redundancy as ransomware defense

    What candidates pick
    Geo-redundant storage for backups
    Why it looks right
    Two regions sound safer than one.
    Why it's wrong
    Replication copies encryption and deletion events, so recovery points still need immutability, soft delete and separate authorization.

    Clue to watch for Look for wording about attackers deleting or modifying backups.

  2. Workload framework for estate governance

    What candidates pick
    The Azure Well-Architected Framework
    Why it looks right
    It contains a security pillar and sounds comprehensive.
    Why it's wrong
    WAF assesses individual workloads; consistent subscription governance comes from CAF and Azure landing zones.

    Clue to watch for Phrases like all subscriptions, at scale or enterprise-wide.

  3. Reference architecture for compliance

    What candidates pick
    Microsoft Cybersecurity Reference Architectures
    Why it looks right
    MCRA covers every Microsoft security capability.
    Why it's wrong
    MCRA describes capabilities and integration; measurable control alignment comes from MCSB in Defender for Cloud.

    Clue to watch for Words such as assess, controls, benchmark or compliance score.

  4. Hardening before recovery

    What candidates pick
    Deploy new endpoint protection first
    Why it looks right
    Stopping the next infection feels urgent.
    Why it's wrong
    Microsoft's guidance places recoverability and privileged access protection first, because a lost recovery path ends the business.

    Clue to watch for Questions asking for the first or highest-priority action.

  5. Banning AI tools

    What candidates pick
    Block all generative AI services
    Why it looks right
    It appears to remove the risk entirely.
    Why it's wrong
    Blanket bans push users to unmanaged tools; a secure AI adoption strategy approves, governs and monitors sanctioned services instead.

    Clue to watch for Requirements to enable productivity while protecting data.

  6. DevSecOps as a final gate

    What candidates pick
    A penetration test before each release
    Why it looks right
    It is a familiar, visible security activity.
    Why it's wrong
    DevSecOps integrates automated checks throughout the pipeline, so issues are caught early and cheaply rather than at the end.

    Clue to watch for Mentions of pipelines, pull requests or infrastructure as code.

Answer framework

Use this sequence when a Domain 1 scenario asks which strategy, framework or priority an architect should recommend.

  1. Identify the business outcome under threat, such as continuity of a critical process, regulatory standing, customer trust or safe AI use.
  2. Decide whether the question is about recovery, controls, architecture, roadmap or governance, because each maps to a different framework.
  3. For ransomware, protect recovery and privileged access first, then reduce the attack surface and improve detection.
  4. Match scope: organization-wide needs point to CAF and landing zones, while single-application reviews point to the Well-Architected Framework.
  5. Check the option against verify explicitly, least privilege and assume breach, then prefer the choice that meets every requirement with the least administrative effort and ongoing cost.

Practice question

A retailer recovered from a ransomware attack in which the attacker used a compromised global administrator account to delete Azure Backup recovery points. Leadership wants to prevent a repeat with minimal operational overhead. Which recommendation best addresses the root weakness?

Want more like this? The SC-100 practice test has questions for every domain.

Checklist

0 of 12

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Start by building a one-page map of the frameworks: MCRA, MCSB, the Zero Trust adoption framework, CAF and WAF. For each, write its scope, its main audience and one example question it would answer. Then read Microsoft's ransomware protection guidance and practise putting recovery, privileged access and hardening steps in order until the sequence is automatic.

Next, spend time in Defender for Cloud with the regulatory compliance dashboard to see how MCSB controls appear as assessments. Review the Azure landing zone reference architecture and trace how a policy assigned at a management group reaches a new subscription. Add the AI objectives deliberately: read CAF guidance on AI adoption and note which MCSB controls apply to AI services.

Finish with case-style practice. For each scenario, name the framework or priority before looking at the options, then check whether the answer you chose respects all three Zero Trust principles. Plan roughly 12 to 16 hours, weighted toward ransomware resiliency and framework scope because those two themes drive most item logic in this domain.

FAQ

How much of the SC-100 exam is Domain 1, Design solutions that align with security best practices and priorities?

Microsoft weights this domain at 20–25% of the exam. It is tied with Domain 4 as one of the two smaller areas, but its frameworks are referenced in questions across all four domains.

Do I need to memorize every MCSB control?

No. Know the control domains, such as network security, identity management, privileged access, data protection and logging, and how Defender for Cloud uses MCSB as its default initiative.

What is the difference between CAF and WAF on SC-100?

CAF guides how an organization adopts and governs cloud overall. WAF reviews the design of a single workload against five pillars, one of which is security.

Is AI covered in this domain?

Yes. The October 2026 outline includes designing AI solutions aligned to MCSB and designing a strategy for secure AI adoption under the CAF and WAF group.

Which certifications do I need before SC-100 counts toward the Expert credential?

Microsoft lists Identity and Access Administrator Associate, Security Operations Analyst Associate, or Cloud and AI Security Engineer Associate. The Azure Security Engineer exam, AZ-500, retired on August 31, 2026.

How long is the SC-100 exam?

The SC-100 page does not list a duration. Microsoft's general guidance gives 100 minutes of exam time and 120 minutes of seat time for role-based exams without labs.

Why does ransomware appear in an architecture exam?

Ransomware tests whether a design keeps the business recoverable. Architects must plan backups, privileged access and response priorities rather than only individual product settings.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 1 knowledge

Check whether you can match each scenario to the right framework and ransomware priority before moving on to the identity and operations domain.

Take the SC-100 practice test Check your SC-100 readiness

Keep going