SC-100 Certification Practice Question #128

Question

You have an Azure subscription that contains 15 custom apps. The source files for the apps are stored in Git repositories. The apps are deployed by using Azure DevOps.

You need to recommend a DevSecOps solution to implement static application security testing (SAST) of the app code to identify hard-coded secrets.

What should you include in the recommendation?

Accepted Answer

This is a genuine community split — the Suggested Answer and Most Voted (D, 5 votes) point to Microsoft Defender for Cloud DevOps security, while Hameet's A (GitHub Advanced Security) has 4 👍 and is technically the scanner that performs the SAST/secret detection. MS Learn is the tiebreaker. Within Defender for Cloud, DevOps security is the recommended DevSecOps "solution" that integrates with Azure DevOps and surfaces code, **secrets**, and dependency findings in a central console; the underlying secret scanning for Azure DevOps repos "relies on GitHub Advanced Security for... Azure DevOps." Because the question frames it as a DevSecOps *solution* recommendation in an Azure subscription using Azure DevOps, the Microsoft-positioned answer (and the official key) is D — D is the management/recommendation layer, with GHAzDO as its scanning engine. The dissent toward A is well-reasoned (it is the literal SAST/secret-scan engine), so confidence is held at 78% to reflect the Suggested-vs-dissent tension; both views are documented and MS Learn favors the Defender for Cloud framing for the "recommendation."

More SC-100 practice questions