Cybersecurity Architect study guide

Learn it in this order

Start with the frameworks, because they give you the vocabulary the exam uses and a structure to hang everything else on. Then work outwards through the four areas.

• Weeks 1 to 2. Zero Trust, the Microsoft reference architectures and the cloud security benchmark. Read them properly once; they are the exam's frame of reference.
• Weeks 3 to 4. Security operations, identity and compliance design: detection and response, logging, privileged access, and turning regulation into controls.
• Weeks 5 to 6. Infrastructure: posture management across hybrid and multicloud, endpoints, platform services and network security.
• Weeks 7 to 8. Applications and data: securing Microsoft 365, application lifecycle, and protecting data at rest, in transit and in AI workloads.
• Weeks 9 to 10. Practice tests and the resiliency material, which sits across everything and is easiest to absorb last.

How to answer a design question

This is the skill the exam actually measures, and it is learnable. When several options look reasonable, the best answer is usually the one that changes the outcome rather than the paperwork, and that works without anybody remembering to do something.

• Prefer the control that prevents over the one that reports, unless the question is explicitly about visibility.
• Prefer the answer that removes a category of problem over the one that fixes this instance.
• Distrust options that depend on people being careful, remembering a step, or reviewing something quarterly.
• Watch for constraints in the scenario. A stated budget, a deadline or a refusal is there to eliminate an otherwise correct answer.
• When two options differ only in scope, the narrower one is usually right.

Where people lose marks

Most losses here are not knowledge gaps. They are reading errors, or a preference for the technically interesting answer over the one that fits the situation described.

• Answering the question you know rather than the one asked. The last line of the scenario usually names the actual requirement.
• Choosing a product when the question is about a decision, an owner or a process.
• Ignoring that the organisation in the scenario has already decided something, and recommending they undo it.
• Reaching for the most thorough control regardless of what the workload holds.
• Forgetting that some answers are the architect saying no, or recording who accepted a risk.

What the exam weights, and what that means for your time

The four areas are close together, with the two middle blocks slightly larger. Design experience transfers between them more than it does on the other exams, so time spent understanding one area properly pays off across the paper.

• Security best practices and priorities, 20 to 25%. Resiliency against ransomware, the Microsoft reference architectures and security benchmark, Zero Trust adoption, and the cloud adoption and well-architected frameworks.
• Security operations, identity and compliance, 25 to 30%. Detection and response, centralised logging, identity and access design, privileged access, and translating regulation into controls.
• Infrastructure security, 25 to 30%. Posture management across hybrid and multicloud, server and client endpoints, SaaS, PaaS and IaaS requirements, and network security.
• Application and data security, 20 to 25%. Securing Microsoft 365, application security through the lifecycle, and protecting data at rest, in transit and in AI workloads.

What to do instead of a lab

Labs help less here than on the other three, because the exam is not asking whether you can configure something. What builds the judgement is examining real designs, including your own.

• Take a system you know and write down what an attacker would reach from one compromised laptop. That single exercise covers a surprising amount of this exam.
• Read your organisation's actual recovery plan and find the assumption nobody has tested.
• Look at where privileged access really lives, including the service desk, the build agents and the software you buy.
• Pick a regulation your organisation carries and trace one requirement all the way to a control somebody operates.
• Sketch what you would monitor if you had a tenth of the budget. Prioritisation is most of this exam.

How to use practice tests alongside this

Read the explanations even when you were right, which matters more on this exam than the others. The reasoning is the content, and a guess that lands is worth nothing on the day.

Worth knowing about ours: our SC-100 questions are written with one defensible answer, because a practice question you can argue with teaches you less than one you can check. The real paper will hand you several reasonable options and ask which is best, so practise that ranking against the real thing as well: take an option you rejected here and say what would have to be true for it to win.

If a question feels unfair, work out which constraint in the scenario you skimmed. That is almost always the answer, and noticing it is the skill.