SC-100: Microsoft Cybersecurity Architect Certification (2025 Update)

The SC-100: Microsoft Cybersecurity Architect certification is a prestigious credential under Microsoft’s role-based certification program. It validates an individual’s expertise in designing and evolving cybersecurity strategies that safeguard an organization’s mission and business processes. By completing this exam, professionals can demonstrate their skills in handling complex security challenges across enterprise environments.

This learning path includes comprehensive, full-length mock tests developed with a wide range of questions to help candidates assess and improve their readiness. This foundational content is tailored for individuals preparing to become certified Microsoft Cybersecurity Architects.

Certification Path and Prerequisites

The SC-100 exam serves as the capstone certification for Microsoft’s security track. To achieve the Microsoft Certified: Cybersecurity Architect Expert designation, candidates must first pass one of the following certifications:

SC-200: Microsoft Security Operations Analyst SC-300: Microsoft Identity and Access Administrator AZ-500: Microsoft Azure Security Engineer Associate MS-500: Microsoft 365 Security Administrator

Once one of these certifications is earned, candidates can pursue the SC-100 exam to validate their expertise at an architect level.

What the SC-100 Exam Measures

The SC-100 exam evaluates your ability to:

• Design a Zero Trust strategy and architecture
• Evaluate Governance Risk Compliance (GRC) strategies
• Design security solutions for infrastructure
• Develop strategies for securing data and applications
• Recommend security best practices and prioritize tasks effectively

These core areas align with the responsibilities of a cybersecurity architect, ensuring that certified professionals are capable of making strategic security decisions within complex environments.

Building a Foundation for Success

This course content serves as a springboard for exam preparation. Practice exams and mock questions are designed to mimic the structure and complexity of the actual test, providing candidates with critical experience and exposure to real-world scenarios. This helps individuals not only test their knowledge but also develop confidence in tackling the actual exam.

SC-100 Exam Objectives and Weightage

• Understand how to assess and mitigate organizational risk
• Establish strategic security goals and metrics
• Align architecture with enterprise-wide security priorities

Design security operations, identity, and compliance capabilities (30–35%)

• Develop strategies for threat detection and response
• Plan for identity governance and lifecycle management
• Align solutions with compliance requirements and frameworks

Design security solutions for infrastructure (20–25%)

• Architect secure network and hybrid cloud solutions
• Integrate secure workload strategies for IaaS and PaaS
• Implement endpoint security solutions

Design security solutions for applications and data (20–25%)

• Design protection for sensitive data in storage and transit
• Secure application development and deployment environments
• Implement governance and data classification strategies

Key Learning Points and Coverage

The course thoroughly covers the entire SC-100 syllabus, including every topic and sub-topic identified in the official exam blueprint. This ensures comprehensive exam preparation without any knowledge gaps.

Instructor Expertise

The course material is developed and reviewed by instructors with deep experience in Microsoft Certifications. Their real-world insights contribute to the practical relevance and applicability of the content.

Rapid Q&A Support

Learners receive prompt responses to their queries within 24 hours, supporting continuous learning and clarity of concepts.

Core Topics Covered in Practice Questions

Zero Trust and Resiliency Strategies

• Design architecture based on Zero Trust principles
• Develop resiliency strategies for ransomware and advanced persistent threats
• Implement multifactor authentication and conditional access policies

Microsoft Reference Architectures

• Design solutions based on Microsoft Cybersecurity Reference Architectures (MCRA)
• Apply Microsoft Cloud Security Benchmark (MCSB) standards
• Align strategies with the Microsoft Cloud Adoption Framework and Well-Architected Framework

Identity and Access Management

• Develop secure identity architectures across hybrid environments
• Secure privileged access and implement Just-In-Time access strategies
• Integrate identity solutions across Microsoft 365 and Azure ecosystems

Regulatory Compliance and Security Posture

• Design for compliance with regional and industry-specific regulations
• Implement solutions for compliance reporting and audits
• Enhance security posture using Microsoft Defender and Secure Score

Application and Data Security

• Secure application environments across development pipelines
• Classify and protect sensitive data using Microsoft Purview and other tools
• Design for encryption, tokenization, and data loss prevention

Hybrid and Multicloud Security

• Build consistent security posture management strategies across hybrid and multicloud setups.
• Leverage Microsoft Defender for Cloud to manage risk
• Design secure connectivity and data flow across environments

Endpoint and SaaS Security

• Protect both server and client endpoints from threats
• Implement antivirus, EDR, and vulnerability management tools
• Secure SaaS environments and third-party application integrations

Audience for This Learning Path

This course is intended for IT professionals aiming to specialize in cybersecurity architecture. It is ideal for individuals looking to transition into strategic roles where they influence enterprise-wide security planning.

SC-100 Exam Candidates

Those preparing specifically for the SC-100 exam will find this content valuable for reviewing core concepts, testing their readiness, and identifying areas for improvement.

Security Teams and Analysts

Security professionals involved in designing and evaluating security policies, infrastructure, and tools will benefit from the depth and scope of the topics covered.

Enterprise Architects and Consultants

Architects tasked with designing end-to-end security strategies across cloud and on-premises infrastructures can use this material to enhance their existing knowledge base.

Deep Dive into Designing Solutions Aligned with Security Best Practices and Priorities

Designing solutions that align with security best practices is fundamental to enterprise security architecture. This domain focuses on understanding and applying strategic concepts that elevate an organization’s cybersecurity posture through tailored architectural solutions.

Establishing a Risk Management Framework

A successful architecture begins with a comprehensive risk assessment framework. Security architects must identify potential vulnerabilities, threats, and risks associated with both legacy and modern IT environments. Implementing a continuous risk evaluation process allows organizations to proactively adapt their defenses.

Security architects must collaborate with executive leadership to define risk tolerance levels. These thresholds determine which assets are prioritized for protection and influence the allocation of budget and resources. Effective use of tools like Microsoft Defender for Cloud and Microsoft Purview can automate risk identification and assessment.

Aligning with Business Objectives

Security is not just a technical challenge; it’s a business enabler. Architects must ensure that security strategies align with business objectives, regulatory requirements, and stakeholder expectations. Effective communication of security goals to non-technical leadership helps secure buy-in and ensure ongoing investment.

A clear business-aligned security roadmap will include defining measurable KPIs for security effectiveness, establishing executive dashboards to monitor real-time posture, and translating complex threats into business impact metrics.

Defining a Cybersecurity Vision and Strategy

Creating a cybersecurity vision involves understanding both the current maturity level of an organization’s defenses and the desired future state. Frameworks like the NIST Cybersecurity Framework or ISO/IEC 27001 provide structured models to evaluate and develop these strategies.

The vision should address enterprise-wide adoption of Zero Trust principles, a phased roadmap for implementing identity, data, and network protections, and investment in security awareness and training.

Prioritizing Critical Systems and Data

One of the core functions of a cybersecurity architect is to help the organization classify assets and assign security priorities. Identifying business-critical applications, sensitive data repositories, and key operational systems helps guide the protection strategy.

Data classification tools and sensitivity labels assist in automating this process. Additionally, architects must ensure that backup and disaster recovery plans are in place for all critical assets.

Governance and Metrics

Without governance, even the best security strategy may fail. Governance involves defining policies, responsibilities, and controls that guide daily security operations. Effective governance includes establishing a Security Steering Committee, documenting and enforcing acceptable use and data handling policies, and tracking metrics and reporting through security dashboards.

Metrics should provide insight into control effectiveness, incident response times, and vulnerability remediation rates.

Designing Security Operations, Identity, and Compliance Capabilities

Security operations, identity management, and compliance capabilities form the backbone of a robust security program. This domain focuses on the operationalization of strategy through scalable solutions.

Building a Security Operations Center (SOC)

A modern SOC integrates tools and processes to monitor, detect, and respond to threats in real time. Architects must design SOC solutions that support centralized log collection and analysis, include automation for alert triage and incident response, and utilize AI and ML capabilities to enhance detection.

Microsoft Sentinel serves as a cloud-native SIEM/SOAR platform that supports hybrid and multicloud telemetry ingestion.

Incident Response Planning

Designing effective incident response capabilities involves developing structured playbooks for different threat scenarios. The incident response plan must define roles and responsibilities, detection and triage workflows, and containment, eradication, and recovery procedures.

Response automation is a key component, using tools like Logic Apps and Playbooks within Microsoft Sentinel to minimize manual effort.

Designing for Identity Lifecycle Management

Identity is a primary attack vector. A resilient architecture must ensure secure identity lifecycle processes, including provisioning, deprovisioning, and role transitions. Azure AD offers tools like access reviews, entitlement management, and Identity Protection.

Security architects must also enforce least privilege access using RBAC, ABAC, and group policies.

Securing Privileged Access

Privileged accounts require elevated protection due to their broad capabilities. Solutions include dedicated administrative workstations, secure access workstations, and Just-In-Time access with Privileged Identity Management.

Architects should design Tiered Administration Models to isolate access at different privilege levels.

Compliance Automation

Architects are responsible for ensuring that security solutions meet industry regulations and standards. This involves mapping security controls to frameworks like GDPR, HIPAA, and FedRAMP, automating compliance assessments using Microsoft Purview Compliance Manager, and enabling audit trails for sensitive actions.

Designing Security Solutions for Infrastructure

Infrastructure security is vital for protecting workloads running across cloud and on-premises environments. This section covers architectural considerations for securing compute, network, and storage resources.

Network Security Architecture

Architects must develop a segmented network architecture that limits lateral movement. Best practices include implementing hub-and-spoke architecture with Azure Virtual WAN, using network security groups and application security groups, and deploying Azure Firewall and Web Application Firewall for perimeter security.

Architects should also implement private endpoints and service endpoints to restrict public exposure.

Secure Workload Deployment

Deploying secure workloads involves scanning virtual machines and containers for vulnerabilities, implementing automated patch management, and using templates with security baselines in ARM or Bicep.

Azure Policy and Blueprints help ensure workloads are deployed consistently and in compliance with requirements.

Endpoint Protection

Endpoints represent a major threat surface. Designing a layered protection model includes deploying Microsoft Defender for Endpoint, implementing attack surface reduction rules, and enforcing security baselines through Group Policy and Intune.

Endpoint detection and response tools provide behavioral analytics to identify and contain threats.

Designing Security Solutions for Applications and Data

Modern application environments require embedded security at every layer. Similarly, data must be protected throughout its lifecycle. This domain focuses on architectural design that embeds protection from the ground up.

Securing Application Development Pipelines

DevSecOps practices ensure that security is integrated into CI/CD pipelines. Architects must incorporate security scanning tools like Microsoft Defender for DevOps, enforce code quality and secret detection, and implement signed build processes and secure artifact repositories.

Protecting Application Environments

Applications should be deployed in isolated, controlled environments. Security design includes using App Service Environments for internal applications, enforcing HTTPS-only traffic, and integrating Web Application Firewall protections.

Role-based access to application resources must be tightly controlled.

Data Classification and Sensitivity Labels

Data classification helps apply the correct level of protection. Microsoft Purview provides capabilities to apply automatic classification based on content inspection, use sensitivity labels to enforce encryption and access restrictions, and track data usage and sharing.

These capabilities must be integrated into data governance strategies.

Data Loss Prevention and Encryption

Architects must ensure data is protected at rest, in transit, and use. Key principles include enabling data loss prevention policies for email, documents, and cloud apps, using Azure Information Protection for labeling and encryption, and implementing Azure Key Vault for secure key management.

Data in use can be protected using confidential computing technologies.

Leveraging Advanced Microsoft Security Tools

Microsoft provides a suite of integrated tools that can enhance the architecture’s effectiveness and simplify management.

Microsoft Defender Suite

A unified platform for threat protection across identities, endpoints, apps, email, and infrastructure. Includes Defender for Identity, Defender for Office 365, Defender for Endpoint, and Defender for Cloud.

Microsoft Sentinel

A scalable cloud-native SIEM and SOAR solution, Sentinel aggregates logs, applies analytics, and orchestrates automated responses.

Microsoft Purview

A compliance and governance platform that includes data classification and lifecycle management, insider risk management, eDiscovery, and audit.

Purview enhances visibility and control across the data estate.

Advanced SC-100 Exam Strategies and Scenario-Based Learning

The final phase of preparing for the SC-100: Microsoft Cybersecurity Architect Exam involves applying concepts in realistic contexts. This part of the guide focuses on building analytical skills, tackling scenario-based questions, and developing strategies for success in the exam.

Understanding the SC-100 Exam Format

The SC-100 exam is designed to evaluate high-level architectural thinking, requiring candidates to assess, recommend, and justify security solutions across a wide variety of enterprise scenarios. The exam includes case studies, multiple-choice questions, drag-and-drop activities, and hot area questions. Unlike technical configuration exams, this test focuses on aligning business needs with security architecture principles.

Understanding question styles helps in managing time and expectations. Scenario questions are typically long and require reading comprehension, cross-referencing architectural elements, and identifying the most suitable solutions based on Microsoft best practices. Candidates should read the last line of the question first to understand what is being asked, then return to read the scenario details.

Building Scenario-Based Reasoning

Scenario-based reasoning is critical for this exam. Candidates should practice analyzing business challenges, understanding existing environments, and designing architecture that meets security, compliance, and operational requirements.

Consider a scenario where a multinational company is migrating to Azure and needs to enforce Zero Trust principles while ensuring compliance with GDPR. The ideal answer would integrate Azure AD Conditional Access, Microsoft Purview, and Microsoft Defender for Cloud while proposing a phased adoption strategy.

When faced with multiple correct answers, choose the one that best aligns with Microsoft’s recommended architecture and industry standards. Always prioritize security maturity, scalability, and cost-effectiveness.

Common Pitfalls and How to Avoid Them

Many candidates fail the SC-100 exam not due to a lack of knowledge, but due to misreading questions, poor time management, and overcomplicating answers. Here are some of the most common pitfalls:

Misinterpreting what the question is asking leads to selecting an answer that may be technically correct but does not meet the scenario’s business requirement.

Ignoring cost or user experience when choosing solutions often results in answers that are secure but impractical.

Failing to align with Microsoft’s Zero Trust model can result in selecting outdated architecture models.

Neglecting compliance implications in hybrid and multicloud scenarios is another common mistake.

To avoid these issues, candidates must review key architectural models provided by Microsoft, understand licensing and product capabilities, and practice identifying the intent behind each scenario.

Realistic Practice Scenario 1: Zero Trust Strategy for a Hybrid Organization

A government agency is moving workloads to Azure but needs to maintain some critical systems on-premises. The organization faces increasing ransomware threats and compliance requirements under national security policies.

The architecture should implement Microsoft Defender for Endpoint and Defender for Servers for hybrid protection, use Azure AD with Conditional Access for identity security, deploy Azure Firewall and Private Link for secure connectivity, and integrate Microsoft Sentinel for unified visibility and response.

The solution must be designed with Zero Trust principles: verify explicitly, use least privileged access, and assume breach. Policies must enforce multi-factor authentication, continuous session monitoring, and secure device access. Compliance should be managed through Microsoft Purview Compliance Manager.

Realistic Practice Scenario 2: Global Enterprise Data Protection

A global retail chain processes large volumes of customer data and operates in jurisdictions with different data privacy regulations, including GDPR and CCPA. They want to centralize their security management and data governance.

The proposed design includes implementing Microsoft Purview for data classification, sensitivity labeling, and data loss prevention. Azure Information Protection is used for encryption, while Microsoft Defender for Cloud secures the infrastructure. Endpoint protection is managed through Microsoft Intune and Defender for Endpoint.

The organization should segment data by geography using management groups and deploy region-specific compliance policies. Logs and audit trails are centralized in Microsoft Sentinel for real-time visibility and threat detection.

Realistic Practice Scenario 3: Secure Application Development Lifecycle

A fintech startup is building a SaaS platform hosted in Azure. Their priorities include securing customer data, implementing DevSecOps, and preparing for ISO 27001 certification.

A well-architected solution includes integrating GitHub with Microsoft Defender for DevOps to scan repositories, using Azure Key Vault to store secrets, and enabling Application Gateway with Web Application Firewall. CI/CD pipelines are managed using Azure DevOps, and infrastructure is deployed with secure templates and Azure Policy.

Sensitive data is encrypted using managed keys, and access is controlled via Azure AD roles. Microsoft Purview supports classification and compliance tracking. Microsoft Sentinel monitors anomalies across build and runtime environments.

Key Study Techniques for Success

Studying for SC-100 requires an architectural mindset. Key techniques include summarizing Microsoft reference architectures such as the Microsoft Cybersecurity Reference Architecture (MCRA), reviewing Microsoft Learn paths and whitepapers related to SC-100, and participating in discussions and communities to compare approaches and rationale.

Additionally, candidates should use flashcards for key product capabilities, simulate scenarios using practice exams, and conduct whiteboarding sessions to practice architectural thinking.

Reviewing case studies, aligning solutions with business impact, and discussing trade-offs helps reinforce the decision-making framework required in the exam. Microsoft documentation often provides use-case diagrams and real-world deployment examples that mirror exam scenarios.

Time Management During the Exam

The SC-100 exam allows ample time, but poor time management can still hinder performance. Candidates should aim to spend no more than two minutes on non-scenario questions and reserve extra time for lengthy case studies.

Flagging complex questions for review is advisable, but avoid leaving too many unanswered. A best practice is to answer every question, even if uncertain, and return to it if time allows. Eliminate wrong choices first, then choose the most appropriate from the remaining options.

Reviewing Microsoft Security and Compliance Capabilities

Candidates should be familiar with how Microsoft 365 Defender integrates various security functions, how Microsoft Sentinel operates across multiple data sources, and how Microsoft Purview enables compliance and data lifecycle management.

Knowledge of the Microsoft Cloud Adoption Framework and Azure Well-Architected Framework provides context for governance and risk decisions. Understanding Azure AD architecture, B2B and B2C identities, Conditional Access, and Privileged Identity Management is crucial.

Cloud-native security controls such as Azure Policy, Azure Firewall, Azure DDoS Protection, and Azure Monitor Logs must be part of the candidate’s architectural toolbox.

Final Checklist Before the Exam

Before taking the exam, candidates should:

Understand the structure and format of the SC-100 exam thoroughly. Review key Microsoft reference materials and architecture guides. Practice at least three full-length scenario-based mock exams. Revisit topics on Zero Trust, data governance, identity security, and hybrid architecture. Ensure familiarity with licensing considerations and cost management tools.

Expert-Level Insights and Final SC-100 Exam Simulation

The role of a cybersecurity architect has transformed from focusing solely on technical security controls to becoming a strategic advisor within the enterprise. This role now includes managing risk across cloud and on-premises environments, influencing leadership decisions, aligning with compliance requirements, and driving Zero Trust adoption.

Security architects must master both the technical and business sides of the organization. They guide security investments, translate executive strategy into security solutions, and ensure that technology adoption supports business continuity and resilience.

Key Responsibilities of Cybersecurity Architects

Establish scalable security frameworks that address hybrid and multicloud deployments. Lead incident response and risk governance committees. Align cybersecurity strategy with business continuity planning. Bridge communication between security teams, IT operations, and executive leadership.

Architecting for Innovation and Resilience

Security is no longer a reactive function. Today, architects are expected to enable secure innovation. This includes working with DevOps teams to embed security early in the software lifecycle, enabling secure data analytics environments, and supporting secure IoT and edge computing projects.

Designing for resilience includes more than just backup and disaster recovery. It requires continuous monitoring of infrastructure health, proactive identification of attack vectors, and seamless failover between regions and services. Leveraging tools like Azure Arc, Microsoft Defender for Cloud, and Azure Monitor plays a vital role in these capabilities.

Security must be embedded in agile development pipelines, container environments, and AI workloads. Architects are now at the forefront of enabling secure digital transformation.

Simulated SC-100 Exam Case Study: Multinational Financial Institution

A global financial services provider operating in 40 countries with data centers on-premises and in Azure. Recently acquired two regional banks and plans to integrate systems securely while maintaining compliance with financial regulations like SOX, PCI DSS, and GDPR.

Security Challenges

Legacy systems with inconsistent identity models and access controls. No centralized visibility across hybrid workloads. Manual compliance assessments. Inconsistent endpoint protection across regions.

Business Requirements

Implement unified identity management for employees, contractors, and partners. Enable centralized logging and incident response across hybrid workloads. Ensure regulatory compliance for all customer data. Support secure collaboration with acquired institutions.

Proposed Architecture

Use Azure AD B2B for partner access and Azure AD Connect for on-premises synchronization. Deploy Microsoft Sentinel across all regions with data connectors to Microsoft 365, Azure, and on-premises SIEM. Implement Microsoft Purview for data classification, labeling, and compliance monitoring. Enforce Conditional Access and Privileged Identity Management for all administrative accounts. Deploy Microsoft Defender for Cloud and Microsoft Defender for Endpoint to secure workloads.

Key Outcomes

Increased visibility and automated response capabilities. Streamlined compliance through built-in assessments and audit-ready reporting. Unified access management across the enterprise. Improved threat detection and incident response with AI-powered analytics.

Exam Simulation Walkthrough

Scenario-Based Question

Your organization has a cloud-first strategy. The CTO asks you to design a Zero Trust strategy that reduces reliance on perimeter-based security. What should you recommend?

Answer Strategy

This question tests understanding of Zero Trust architecture. Focus on verifying explicitly, enforcing least privilege, and assuming breach. Recommend:

Azure AD Conditional Access for policy enforcement. Microsoft Defender for Identity for threat detection across identities. Use of private endpoints and service endpoints to limit exposure. Just-In-Time VM access and role-based access control. Microsoft Purview for securing data access based on sensitivity.

Hot Area Question

Select the appropriate security service for each requirement.

Secure user identities with risk-based policies: Azure AD Identity Protection. Automatically label sensitive documents: Microsoft Purview. Centralized threat detection across all workloads: Microsoft Sentinel.

Drag-and-Drop Question

Match the Microsoft security product to its primary function:

Microsoft Defender for Cloud: Cloud workload protection. Azure Key Vault: Secrets management. Microsoft Defender for Office 365: Email threat protection. Azure Policy: Governance and compliance enforcement.

Multiple Choice Question

Which Microsoft product allows secure partner collaboration without creating new user accounts in your directory?

Answer: Azure AD B2B.

Key Areas to Focus On

Understand the key Microsoft security frameworks: MCRA, CAF, and MCSB. Master the use cases and capabilities of the Microsoft Defender suite, Microsoft Sentinel, and Microsoft Purview. Practice scenario-based reasoning with real-world case studies. Ensure alignment between business needs, compliance requirements, and technical controls. Use official Microsoft Learn resources and whitepapers for the latest information.

Outlook on the Future of Cybersecurity Architecture

The SC-100 certification is not just a milestone but a foundation for lifelong learning. The cybersecurity landscape is evolving rapidly with the emergence of AI-powered threats, supply chain attacks, and expanding multicloud environments.

Microsoft is continuously enhancing its security capabilities through integrated, intelligent platforms. Architects must stay current by adopting a culture of continuous improvement, participating in security communities, and leveraging threat intelligence.

Key Future Trends

Increased reliance on AI-driven threat detection and response. Expansion of Zero Trust beyond IT to include OT and IoT environments. Greater integration of security in software development and data pipelines. Evolution of compliance models to include ethical and algorithmic governance.

Conclusion

This final part of the SC-100 exam guide has equipped you with advanced strategic insights, a detailed exam simulation, and a view of the cybersecurity landscape beyond the exam. You are now ready to not only pass the exam but also contribute meaningfully to your organization’s cybersecurity journey.

In your journey beyond certification, continuing education and experience will be essential in staying ahead of evolving cyber threats. Becoming a Microsoft Cybersecurity Architect Expert marks a turning point in your career where your focus should shift from just technical know-how to influencing enterprise-wide security strategy. Whether designing hybrid identity solutions, recommending data protection controls, or aligning cloud adoption with security best practices, your role will be pivotal in transforming IT into a resilient, secure engine for innovation.

Prepare to be an advocate for change within your organization. As threats grow more sophisticated and regulatory expectations increase, your ability to design forward-thinking, risk-aware architectures becomes your greatest asset. Build relationships with compliance officers, participate in executive planning meetings, and push for integrating security into digital initiatives from the start.

The SC-100 certification opens doors not only to technical leadership but also to positions of trust and responsibility at the highest levels of IT governance. Develop a mindset of continuous security improvement, embrace new technologies thoughtfully, and mentor the next generation of security professionals.

Finally, remember that cybersecurity is a team effort. Collaborate with your peers in networking, cloud architecture, software engineering, and compliance to build defenses that are strong, agile, and adaptive. With the foundation laid by this guide and the insights gained throughout your SC-100 preparation, you are well-equipped to lead your organization through the complexities of modern cybersecurity.

Success in this field requires more than passing an exam, it demands curiosity, critical thinking, collaboration, and a commitment to staying informed in a dynamic threat environment. Stay engaged with the community, keep learning, and continue driving security forward wherever your career takes you.