Reinforce SC-100 concepts with active-recall study cards covering all 4 blueprint domains. Each card shows the question on the front and the correct answer with a full explanation on the back.
Flashcards work through active recall — the process of retrieving information from memory rather than passively re-reading it. Research consistently shows that active recall produces stronger, longer-lasting memory than re-reading study guides. For SC-100 preparation, this means flashcards are one of the highest-return study tools available.
Attempt recall first
Read the SC-100 question on each card, pause, and attempt to formulate the answer in your own words before revealing. This retrieval attempt — even if wrong — dramatically strengthens memory compared to immediately reading the answer.
Review wrong cards again
When you get a card wrong, note it and add it back to your review pile. Spaced repetition — seeing difficult cards more frequently — is the mechanism that makes flashcard study far more efficient than linear reading.
Study by domain
Group your SC-100 flashcard sessions by domain for the first 3–4 weeks. Master one domain before moving to the next. In the final week, shuffle all cards together to test cross-domain recall — which is what the real SC-100 exam requires.
Short sessions beat marathon reviews
20–30 flashcard cards per session, done daily, produces better retention than a single 200-card marathon session. Five short daily sessions per week over 4 weeks gives you over 400 total card reviews — enough to reliably pass SC-100.
Sample cards from the SC-100 flashcard bank. Read the question, think of the answer, then read the explanation below.
Your organization wants to implement a zero-trust security model for on-premises and cloud resources. As part of this strategy, you need to ensure that all access requests are authenticated and authorized based on dynamic risk signals. Which Microsoft security solution should you use to enforce conditional access policies based on real-time risk?
Microsoft Entra ID Conditional Access
Microsoft Entra ID Conditional Access is the correct solution because it enables you to enforce access policies based on real-time risk signals, such as user risk, sign-in risk, and device compliance. It integrates with Identity Protection to evaluate dynamic risk levels and can block or require multi-factor authentication (MFA) accordingly, directly supporting the zero-trust principle of 'never trust, always verify'.
Refer to the exhibit. You are an Azure security engineer reviewing a custom Azure Policy definition. The policy is intended to audit virtual machines to ensure they have the Azure Security extension installed. However, the policy is not triggering on any resources. What is the most likely reason?
The policy condition requires a managed disk, but the VMs might have unmanaged disks.
The policy condition uses `field` to check for `Microsoft.Compute/virtualMachines/storageProfile.osDisk.managedDisk.id`, which requires the VM to have a managed disk. If the VMs use unmanaged disks (i.e., the `managedDisk` property is absent), the condition evaluates to false, and the `auditIfNotExists` effect never triggers the existence check for the Azure Security extension.
You are designing a security solution for Azure resources. You need to ensure that any changes to network security groups (NSGs) are automatically logged and sent to a central Log Analytics workspace. Which Azure feature should you use?
Diagnostic settings on the Azure Activity Log
Diagnostic settings on the Azure Activity Log capture all control-plane operations, including changes to NSGs (e.g., rule additions or deletions). By configuring a diagnostic setting to stream the Activity Log to a Log Analytics workspace, you ensure that every NSG modification is automatically logged and centralized for monitoring and alerting.
Your organization uses Microsoft Sentinel and wants to automatically respond to high-severity incidents. Which feature should you configure?
Configure an automation rule to run a playbook automatically
Automation rules in Microsoft Sentinel allow you to define automated responses that trigger when an incident is created or updated, including running playbooks (Azure Logic Apps workflows) automatically. This is the correct approach for automatically responding to high-severity incidents because it eliminates manual intervention and ensures consistent, immediate action based on incident properties like severity.
A company plans to implement Microsoft Purview to enforce data loss prevention (DLP) policies. They need to prevent users from sharing credit card numbers via email. What should they configure?
Create a DLP policy that detects and blocks credit card numbers in Exchange Online
Microsoft Purview Data Loss Prevention (DLP) policies can be configured to detect sensitive data types, such as credit card numbers, in Exchange Online emails. When a DLP policy is created with a rule that identifies credit card numbers and blocks the email from being sent, it directly prevents users from sharing that data via email. This is the native mechanism for enforcing DLP on email traffic in Microsoft 365.
Your organization uses Microsoft Defender for Cloud to secure multi-cloud workloads. You need to ensure that Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP) resources are assessed against the same security baseline. What should you do?
Connect AWS and GCP accounts to Defender for Cloud and use Azure Policy to enforce the Microsoft Cloud Security Benchmark
Microsoft Defender for Cloud's multi-cloud CSPM capabilities allow you to connect AWS and GCP accounts directly, and then apply Azure Policy to enforce the Microsoft Cloud Security Benchmark (MCSB) across all connected clouds. This ensures a unified security baseline assessment for Azure, AWS, and GCP resources, as MCSB is the default policy initiative in Defender for Cloud.
Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. What should you configure?
Create a Conditional Access policy that requires compliant device
A Conditional Access policy in Microsoft Entra ID (formerly Azure AD) can enforce the requirement that only devices marked as compliant by Intune can access corporate email. This policy evaluates the device compliance status at authentication time and blocks or grants access based on that signal, ensuring that only managed and compliant devices can connect to services like Exchange Online.
Your organization uses Microsoft Entra ID and wants to implement a passwordless authentication strategy. Users have smartphones. Which method should you recommend as the primary authentication method?
Microsoft Authenticator app with passwordless sign-in
The Microsoft Authenticator app with passwordless sign-in is the correct primary method because it leverages the user's smartphone to provide a seamless, phishing-resistant authentication experience using public/private key cryptography (FIDO2/WebAuthn). This method aligns with the organization's goal of eliminating passwords while utilizing existing smartphone hardware, and it supports a simple user experience by requiring only a biometric or PIN verification on the phone.
Your company uses Azure Firewall to filter outbound traffic from a virtual network. You need to allow only HTTP and HTTPS traffic to specific FQDNs, while blocking all other outbound traffic. Which Azure Firewall rule type should you use?
Application rule
Application rules in Azure Firewall allow filtering outbound traffic based on fully qualified domain names (FQDNs) for HTTP and HTTPS protocols. Option A is wrong because NAT rules only perform destination network address translation, not FQDN filtering. Option C is wrong because threat intelligence rules are used to block traffic from known malicious IP addresses, not for allowing FQDNs. Option D is wrong because network rules filter traffic based on IP addresses, ports, and protocols, not FQDNs.
Your company is designing a Zero Trust network for a hybrid workforce. Remote users connect via VPN to on-premises resources, while cloud apps use Microsoft Entra ID. You need to enforce conditional access based on device compliance and user risk. Which Microsoft security solution should you integrate with Entra ID to provide real-time device posture signals?
Microsoft Intune
Microsoft Intune provides device compliance policies and can send device posture signals to Entra ID Conditional Access. With Intune, you can enforce device health and compliance requirements before granting access. Option A is wrong because Microsoft Purview focuses on data governance and compliance, not device management. Option C is wrong because Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) and does not directly manage device compliance. Option D is wrong because Microsoft Sentinel is a security information and event management (SIEM) solution and does not provide device posture signals.
Your organization is designing a hybrid identity infrastructure with Microsoft Entra ID. You need to ensure that users can access on-premises applications using passwordless authentication and that the solution minimizes latency for authentication requests. What should you implement?
Use Microsoft Entra application proxy to publish the on-premises applications and enable passwordless authentication.
Microsoft Entra application proxy provides secure remote access to on-premises web applications by publishing them through the Microsoft Entra ID service. It allows users to authenticate using passwordless methods (e.g., Windows Hello, FIDO2, Microsoft Authenticator) and minimizes latency by proxying requests through Microsoft's infrastructure without requiring a VPN. Option A is incorrect because Microsoft Entra Domain Services is for domain-joined VMs, not for publishing applications. Option C is incorrect because Web Application Proxy is a legacy on-premises component that does not integrate with passwordless authentication and lacks the software-defined perimeter capabilities of Entra application proxy. Option D is incorrect because VPNs introduce latency and do not inherently support passwordless authentication.
You are designing a network security architecture for an Azure application that uses Azure Front Door and Azure Application Gateway. The application must be protected from DDoS attacks and common web exploits. Application traffic should be inspected by a web application firewall (WAF) before reaching the backend. What is the recommended deployment order?
Azure Front Door with WAF in front of Azure Application Gateway with WAF.
The recommended deployment order is to place Azure Front Door with WAF at the edge, followed by Azure Application Gateway with WAF before the backend. This provides DDoS protection at the global level via Azure Front Door and regional web application firewall inspection via Application Gateway. Option A is incorrect because it lacks the regional WAF inspection. Option B is incorrect because Azure Front Door without WAF provides no web application firewall protection. Option C is incorrect because Application Gateway with WAF should be behind Front Door for layered defense. Therefore, Option D is correct.
Refer to the exhibit. The NSG is applied to a subnet containing Azure SQL databases. You notice that traffic from the internet to the databases is not being denied. What is the most likely reason?
The destinationAddressPrefix should be '*' instead of 'VirtualNetwork'
The Deny rule has destinationAddressPrefix set to 'VirtualNetwork', which only matches traffic destined to IPs within the virtual network. Azure SQL databases are PaaS services with public endpoints; internet traffic does not have a destination in the VNet, so the rule never applies. Changing destinationAddressPrefix to '*' would deny all inbound internet traffic. Option A is incorrect because Allow rules cannot deny traffic. Option C is incorrect because priority 100 is high (lower number = higher priority), so the Deny rule would be evaluated before any lower priority Allow rules. Option D is incorrect because the direction must be Inbound to block incoming traffic.
Your organization is deploying a new line-of-business application on Azure App Service. The app must authenticate users from Microsoft Entra ID and also access a downstream API that requires a client secret. You need to recommend the most secure method for managing the client secret. What should you use?
Store the secret in Azure Key Vault and use a Key Vault reference in App Service.
Azure Key Vault provides secure storage for secrets and certificates, and App Service can reference them via managed identity or Key Vault references. Option A is wrong because the Azure AD app registration manifest is for application configuration and should not be used to store secrets; instead, use the 'Certificates & secrets' section. Option B is wrong because App Service application settings are less secure and can be accessed through the portal, lacking the fine-grained access control and auditing of Key Vault. Option D is wrong because storing the secret in code exposes it to source control and accidental disclosure.
You are designing an API management solution using Azure API Management. The security team requires that all API calls must be authenticated using OAuth 2.0 and that only specific Azure AD applications can access the APIs. Additionally, the solution must support rate limiting and IP filtering. What should you configure?
Configure OAuth 2.0 in Azure API Management, use validate-jwt policy to restrict to specific Azure AD apps, and add rate-limit and ip-filter policies
It fully addresses all requirements: it uses OAuth 2.0 with Azure AD for authentication, the 'validate-jwt' policy restricts access to specific Azure AD applications, and the 'rate-limit' and 'ip-filter' policies satisfy the rate limiting and IP filtering requirements. Option A is incorrect because client certificate authentication is not OAuth 2.0. Option B is incorrect because API key authentication is less secure and does not allow restricting to specific Azure AD apps. Option C is incorrect because while it uses OAuth 2.0 and validate-jwt, it does not include the required rate limiting and IP filtering policies.
A company is designing a secure API for a customer-facing application that will handle sensitive personal data. They need to ensure that only authorized client applications can call the API and that the identity of the end-user is verified. Which of the following should they implement?
OAuth 2.0 with client credentials and OpenID Connect
OAuth 2.0 with client credentials grant authenticates the client application, while OpenID Connect extends OAuth 2.0 to verify the end-user's identity. Together, they satisfy both requirements: only authorized clients can call the API and the end-user's identity is confirmed. Option A (HTTP Basic Authentication) transmits credentials in plaintext and does not support user identity verification beyond the client. Option C (JWT bearer tokens) is a token format, not a full authentication protocol; it lacks client authentication and user verification on its own. Option D (API keys) only authenticate the client, not the user, and are typically used for simple access control.
The SC-100 flashcard bank covers all 4 official blueprint domains published by Microsoft. Cards are distributed proportionally, so domains with higher exam weight have more cards.
Domain Coverage
Design solutions that align with security best practices and priorities
Design security operations, identity, and compliance capabilities
Design security solutions for infrastructure
Design security solutions for applications and data
Both flashcards and practice questions are evidence-based study tools. The difference is in what they train:
Flashcards — concept retention
Best for memorising definitions, acronyms, protocol behaviours, command syntax, and conceptual distinctions. Use flashcards to build the foundational vocabulary that SC-100 questions assume you know.
Best in: weeks 1–3
Practice tests — application
Best for applying concepts to realistic scenarios, eliminating distractors, and building exam stamina.SC-100 questions test scenario reasoning — not just recall — so practice tests are essential.
Best in: weeks 3–6
The most effective SC-100 study plan combines both: use flashcards for the first 2–3 weeks to build conceptual foundations, then shift to practice tests and mock exams in the final 2–3 weeks to apply and benchmark that knowledge. Most candidates who pass on their first attempt use both tools.
Yes. Courseiva provides free SC-100 flashcards across all official exam domains. Every card includes the correct answer and a full explanation of why it is right and why the distractors are wrong. The platform also includes topic-based practice, mock exams, and readiness tracking — no account required.
Courseiva has 208+ original SC-100 flashcards across all 4 exam blueprint domains. New cards are added regularly as the question bank grows. All cards are written by certified engineers against the official Microsoft exam objectives.
Courseiva flashcards are purpose-built for IT certification exams. Unlike generic flashcard platforms where content quality varies, every Courseiva card is mapped to the official SC-100 exam blueprint, written by engineers who hold the certification, and includes a full explanation of the correct answer and why the distractors are wrong. This explanation quality is what separates genuine learning from rote memorisation.
Courseiva is a web platform — an internet connection is required. For offline study, we recommend creating free Courseiva account, using the platform in your browser, and using your device's offline capabilities if your browser supports offline web apps.
Save your results, see which domains need more work, and get spaced repetition recommendations — all free.
Sign Up FreeFree forever · Every certification included