How to prepare for the Azure Cybersecurity Architect SC-100 exam

2023-01-20 2 min read General Bas Van De Sande

Frustration! If one word should describe the learning experience using Microsoft Learn (other words could have been: indigestable, wut?!, uncohesive etcetera). I have never encountered a Microsoft Learning path that was so hard to digest. Then you could ask yourself: “Is the subject that hard?”. It is not the subject, it is the way the self-study was written. In this blog post, I will share the way I prepared for this exam.

A big shout-out goes to Saskia de Gilder for helping me to prepare for the exam.

If you go by the book and just follow the MS Learn SC-100 learning path then you are up for an utterly frustrating experience, as the text is very hard to read because of all the abbreviations and acronyms (which have different meanings among other Microsoft areas). What I missed the most in the official learning path was a cohesive description on how the various components together build the desired zero trust architecture.

Therefor my advise would be is to scan/browse the content of the learning path. Forget all of the exhaustive lists that Microsoft describes. Just make sure that you have a basic understanding of:

Security rapid modernization plan (RAMP)
Microsoft Cybersecurity Reference Architecture (MCRA)
Microsoft cloud security benchmark (MCSB)
Security Incident Event Manager / Security Orchestration, Automation, Response (SIEM / SOAR)

Understand the following (what does):

Azure Defender for…. provides active protection and creates signals
Azure Sentinel consumes signals and is used as a SIEM/SOAR solution

With that knowledge digested, watch the video by John Savill. A very comprehensive exam cram that gives you all the information that you need to do the exam. If you understand the picture he sketched, then you will be almost good to do the exam.

Drawings

I took the liberty to redraw the drawings he made and I shared them below:

Zero trust / Identity

Endpoints

Network

Infrastructure / Policies

Encryption at rest / Managed Identities

Bastion

ARC / Policies / Multi cloud

Signals

Data / Azure backup

SIEM / SOAR

For a final touch of confidence, you can do some practice at ExamTopics or any other exam practice web site. What is important to know is that the exam is very conceptual; you need to have knowledge on a wide range of topics, such as:

DevOps (Github and/or Azure DevOps): AZ-400
Azure infrastructure: e.g. AZ-104 or AZ-700
Azure fundamentals: AZ-900

With all these insights on how to prepare as efficient as possible, go ahead and do the exam.

It’s a fun one!