SC-100 · topic practice

Design a Zero Trust strategy and architecture practice questions

Q: How should I use these Design a Zero Trust strategy and architecture practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Q: Can I practise just Design a Zero Trust strategy and architecture questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Design a Zero Trust strategy and architecture domain.

Practise Microsoft Cybersecurity Architect Design a Zero Trust strategy and architecture practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

12 questionsDomain: Design a Zero Trust strategy and architecture

Practice 10 questions Browse domain →

What the exam tests

What to know about Design a Zero Trust strategy and architecture

Design a Zero Trust strategy and architecture questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Design a Zero Trust strategy and architecture exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Design a Zero Trust strategy and architecture questions

12 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full NAT/PAT explanation →

A company is designing a Zero Trust network strategy. They want to ensure that all network traffic between on-premises and Azure is inspected and logged, regardless of source or destination. Which Azure service should they use to achieve this?

Trap 1: Azure Front Door

Azure Front Door is for global load balancing and web application firewall, not for inspecting all network traffic.

Trap 2: Azure Bastion

Azure Bastion provides secure remote access to VMs, not network traffic inspection.

Trap 3: Azure DDoS Protection

Azure DDoS Protection is focused on mitigating distributed denial-of-service attacks, not general traffic inspection.

Study all Design a Zero Trust strategy and architecture common traps →

A
Azure Front Door
Why wrong: Azure Front Door is for global load balancing and web application firewall, not for inspecting all network traffic.
B
Azure Bastion
Why wrong: Azure Bastion provides secure remote access to VMs, not network traffic inspection.
C
Azure Firewall
Azure Firewall can inspect and log all traffic between on-premises and Azure.
D
Azure DDoS Protection
Why wrong: Azure DDoS Protection is focused on mitigating distributed denial-of-service attacks, not general traffic inspection.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full Design a Zero Trust strategy and architecture explanation →

An organization is implementing a Zero Trust identity strategy. They have a mix of on-premises Active Directory and Azure AD. They want to enforce conditional access policies that require device compliance for accessing sensitive apps. However, some users report that their devices are not being evaluated for compliance even though they are enrolled in Microsoft Intune. What should the organization check first?

Trap 1: Ensure Intune compliance policies are assigned to the correct user…

Compliance policies are needed but the device must be registered first.

Trap 2: Confirm that devices are Azure AD Joined

Azure AD Registered devices can also be evaluated for compliance; Azure AD Join is not mandatory.

Trap 3: Check if users have enabled multi-factor authentication

MFA is a separate control and does not affect device compliance evaluation.

Study all Design a Zero Trust strategy and architecture common traps →

A
Ensure Intune compliance policies are assigned to the correct user groups
Why wrong: Compliance policies are needed but the device must be registered first.
B
Confirm that devices are Azure AD Joined
Why wrong: Azure AD Registered devices can also be evaluated for compliance; Azure AD Join is not mandatory.
C
Check if users have enabled multi-factor authentication
Why wrong: MFA is a separate control and does not affect device compliance evaluation.
D
Verify that devices are registered in Azure AD
Device registration in Azure AD is required for conditional access to evaluate device compliance.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full Design a Zero Trust strategy and architecture explanation →

A company is planning their Zero Trust data protection strategy. They want to classify and protect sensitive data stored in SharePoint Online. Which Microsoft tool should they use?

Trap 1: Microsoft Intune

Intune manages devices and mobile application management, not data classification.

Trap 2: Microsoft Defender for Cloud Apps

Defender for Cloud Apps provides cloud app security but does not perform data classification.

Trap 3: Azure Policy

Azure Policy enforces compliance rules on Azure resources, not data classification.

Study all Design a Zero Trust strategy and architecture common traps →

A
Microsoft Intune
Why wrong: Intune manages devices and mobile application management, not data classification.
B
Microsoft Defender for Cloud Apps
Why wrong: Defender for Cloud Apps provides cloud app security but does not perform data classification.
C
Microsoft Purview Information Protection
Purview Information Protection provides data classification and labeling.
D
Azure Policy
Why wrong: Azure Policy enforces compliance rules on Azure resources, not data classification.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Design a Zero Trust strategy and architecture explanation →

A company is implementing a Zero Trust network strategy using Azure Virtual Network Manager (AVNM). They need to ensure that all traffic between virtual networks is encrypted and inspected by a firewall. Which configuration should they use?

Trap 1: Enable VNet peering between all VNets and use network security…

VNet peering does not encrypt traffic and NSGs do not provide inspection.

Trap 2: Use a mesh topology with direct connectivity between VNets

Mesh topology does not force traffic through a firewall.

Trap 3: Configure service endpoints for each VNet

Service endpoints are for accessing Azure PaaS services, not for inter-VNet traffic inspection.

Study all Design a Zero Trust strategy and architecture common traps →

A
Enable VNet peering between all VNets and use network security groups
Why wrong: VNet peering does not encrypt traffic and NSGs do not provide inspection.
B
Use a mesh topology with direct connectivity between VNets
Why wrong: Mesh topology does not force traffic through a firewall.
C
Use a hub-and-spoke topology with a firewall appliance in the hub
Hub-and-spoke with firewall ensures traffic is routed through the firewall for inspection.
D
Configure service endpoints for each VNet
Why wrong: Service endpoints are for accessing Azure PaaS services, not for inter-VNet traffic inspection.

Full breakdown with real-world context →

Question 5hardmulti select

Read the full Design a Zero Trust strategy and architecture explanation →

A company is designing a Zero Trust security posture for their Azure environment. They need to assess and improve their security posture. Which TWO actions should they take? (Choose two.)

Trap 1: Enable Azure Update Management for all VMs

Update Management is for patching, not a comprehensive posture assessment.

Trap 2: Deploy Microsoft Entra Permissions Management

Permissions Management focuses on identity permissions, not overall security posture.

Trap 3: Use Microsoft Security Copilot to generate security policies

Security Copilot assists with investigations, not posture assessment.

Study all Design a Zero Trust strategy and architecture common traps →

A
Enable Azure Update Management for all VMs
Why wrong: Update Management is for patching, not a comprehensive posture assessment.
B
Use Azure Policy to enforce security configurations
Azure Policy can enforce compliance and security baselines.
C
Deploy Microsoft Entra Permissions Management
Why wrong: Permissions Management focuses on identity permissions, not overall security posture.
D
Review and implement recommendations from Microsoft Defender for Cloud Secure Score
Secure Score provides recommendations to improve security posture.
E
Use Microsoft Security Copilot to generate security policies
Why wrong: Security Copilot assists with investigations, not posture assessment.

Full breakdown with real-world context →

Question 6mediummulti select

Read the full Design a Zero Trust strategy and architecture explanation →

A company is implementing a Zero Trust identity strategy. They want to ensure that only compliant and managed devices can access corporate resources. Which THREE components should they include in their solution? (Choose three.)

Trap 1: Azure AD Application Proxy

Application Proxy is for publishing on-premises apps, not device compliance.

Trap 2: Azure AD B2B collaboration

B2B is for external user identities, not device management.

Study all Design a Zero Trust strategy and architecture common traps →

A
Microsoft Intune for device management and compliance policies
Intune manages device compliance and enforces policies.
B
Azure AD device registration
Device registration in Azure AD is needed for device identity.
C
Azure AD Conditional Access policies
Conditional Access can require compliant devices for access.
D
Azure AD Application Proxy
Why wrong: Application Proxy is for publishing on-premises apps, not device compliance.
E
Azure AD B2B collaboration
Why wrong: B2B is for external user identities, not device management.

Full breakdown with real-world context →

Question 7hardmultiple choice

Read the full Design a Zero Trust strategy and architecture explanation →

Refer to the exhibit. You are reviewing a Conditional Access policy in Azure AD. The policy requires MFA and a compliant device for all users and all cloud apps. Some users report that they are able to access apps without being prompted for MFA even though their devices are compliant. What is the most likely reason?

Exhibit

{
  "policy": {
    "tenantId": "contoso.onmicrosoft.com",
    "displayName": "Require MFA for all users",
    "state": "enabled",
    "conditions": {
      "applications": {
        "includeApplications": ["All"]
      },
      "users": {
        "includeUsers": ["All"]
      }
    },
    "grantControls": {
      "builtInControls": ["mfa", "compliantDevice"]
    }
  }
}

Trap 1: The policy does not include all cloud apps

The policy includes 'All' applications.

Trap 2: The policy excludes specific locations

No location exclusion is shown in the policy.

Trap 3: The policy does not include session controls to enforce MFA…

Session controls are not required for MFA; the grant control itself triggers MFA.

Study all Design a Zero Trust strategy and architecture common traps →

A
The policy does not include all cloud apps
Why wrong: The policy includes 'All' applications.
B
The policy is set to 'Report-only' mode
In report-only mode, policies are not enforced, so users are not prompted for MFA.
C
The policy excludes specific locations
Why wrong: No location exclusion is shown in the policy.
D
The policy does not include session controls to enforce MFA re-prompt
Why wrong: Session controls are not required for MFA; the grant control itself triggers MFA.

Full breakdown with real-world context →

Question 8mediummultiple choice

Read the full Design a Zero Trust strategy and architecture explanation →

A company, Fabrikam, has a hybrid identity environment with on-premises Active Directory synchronized to Azure AD using Azure AD Connect. They have implemented a Zero Trust strategy that includes requiring multi-factor authentication (MFA) for all users accessing cloud applications. They use Conditional Access policies to enforce MFA. Recently, they noticed that users who authenticate from the on-premises network are not being prompted for MFA when accessing cloud apps, even though the Conditional Access policy is configured to require MFA for all users. The network location is not excluded in the policy. The Conditional Access policy is enabled and in 'Enforce' mode. The users' devices are not domain-joined. What is the most likely reason for this behavior?

Trap 1: Azure AD Connect is not configured for Pass-through Authentication

Pass-through Authentication is not required for MFA; password hash sync works and MFA is still enforced.

Trap 2: The Conditional Access policy does not include session controls

Session controls are not required for MFA; grant controls are sufficient.

Trap 3: The Conditional Access policy is not targeting the correct user…

The policy targets all users, so this is not the issue.

Study all Design a Zero Trust strategy and architecture common traps →

A
Azure AD Connect is not configured for Pass-through Authentication
Why wrong: Pass-through Authentication is not required for MFA; password hash sync works and MFA is still enforced.
B
The Conditional Access policy does not include session controls
Why wrong: Session controls are not required for MFA; grant controls are sufficient.
C
The Conditional Access policy is not targeting the correct user group
Why wrong: The policy targets all users, so this is not the issue.
D
Users are using legacy authentication protocols that do not support MFA
Legacy authentication protocols like POP, IMAP, SMTP do not support MFA and can bypass Conditional Access policies if not blocked.

Full breakdown with real-world context →

Question 9mediumdrag order

Read the full Design a Zero Trust strategy and architecture explanation →

Order the steps to implement a Microsoft Sentinel data connector for Azure Active Directory logs.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 10mediumdrag order

Study the full multicast explanation →

Order the steps to implement Azure AD Privileged Identity Management (PIM) for a role.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 11mediummatching

Read the full Design a Zero Trust strategy and architecture explanation →

Match each Azure security capability to its primary purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

SIEM and SOAR

Cloud security posture management

Risk-based conditional access

Manage secrets, keys, and certificates

Mitigate distributed denial-of-service attacks

Question 12mediummatching

Read the full Design a Zero Trust strategy and architecture explanation →

Match each Azure security benchmark control to its category.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Control category for authentication and authorization

Control category for network segmentation and filtering

Control category for encryption and data classification

Control category for audit logs and alerts

Control category for detection and response processes

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Design a Zero Trust strategy and architecture sessions

Start a Design a Zero Trust strategy and architecture only practice session

Every question in these sessions is drawn from the Design a Zero Trust strategy and architecture domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Design a Zero Trust strategy and architecture questions →Mixed SC-100 session

Frequently asked questions

What does the SC-100 exam test about Design a Zero Trust strategy and architecture?: Design a Zero Trust strategy and architecture questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Design a Zero Trust strategy and architecture questions in a focused session?: Yes — the session launcher on this page draws every question from the Design a Zero Trust strategy and architecture domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other SC-100 topics?: Use the topic links above to move to related areas, or go back to the SC-100 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the SC-100 exam covers. They are not copied from any real exam or dump site.

Design a Zero Trust strategy and architecture only

10 questions 20 questions 30 questions 50 questions

Mixed SC-100 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All SC-100 questions Design a Zero Trust strategy and architecture domain overview SC-100 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Design a Zero Trust strategy and architecture practice questions

What to know about Design a Zero Trust strategy and architecture

Common Design a Zero Trust strategy and architecture exam traps

Design a Zero Trust strategy and architecture questions

A company is designing a Zero Trust network strategy. They want to ensure that all network traffic between on-premises and Azure is inspected and logged, regardless of source or destination. Which Azure service should they use to achieve this?

A company is planning their Zero Trust data protection strategy. They want to classify and protect sensitive data stored in SharePoint Online. Which Microsoft tool should they use?

A company is implementing a Zero Trust network strategy using Azure Virtual Network Manager (AVNM). They need to ensure that all traffic between virtual networks is encrypted and inspected by a firewall. Which configuration should they use?

A company is designing a Zero Trust security posture for their Azure environment. They need to assess and improve their security posture. Which TWO actions should they take? (Choose two.)

A company is implementing a Zero Trust identity strategy. They want to ensure that only compliant and managed devices can access corporate resources. Which THREE components should they include in their solution? (Choose three.)

Exhibit

Order the steps to implement a Microsoft Sentinel data connector for Azure Active Directory logs.

Order the steps to implement Azure AD Privileged Identity Management (PIM) for a role.

Match each Azure security capability to its primary purpose.

Match each Azure security benchmark control to its category.

Track your progress over time

Start a Design a Zero Trust strategy and architecture only practice session

Related SC-100 topic practice pages

Design solutions that align with security best practices and priorities practice questions

Design security operations, identity, and compliance capabilities practice questions

Design security solutions for infrastructure practice questions