SC-100 Certification Practice Question #159

Question

Your company plans to follow DevSecOps best practices of the Microsoft Cloud Adoption Framework for Azure to integrate DevSecOps processes into continuous integration and continuous deployment (CI/CD) DevOps pipelines.

You need to recommend which security-related tasks to integrate into each stage of the DevOps pipelines.

What should recommend? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The DevOps pipeline stages in the dropdowns mirror the Microsoft Cloud Adoption Framework DevSecOps controls model. Static application security testing (SAST) is a source-code gating control that runs the moment code is committed, so it maps to **Commit the code** (the "secure the code" stage gates vulnerable code from entering the repo). Infrastructure (and image/container) scanning validates the deployable artifacts and environment as they are produced, so it maps to **Build and test**. Both the cited CAF DevSecOps controls article/diagram and the community comments agree explicitly on this pairing, and MS Learn's DevSecOps life-cycle guidance places SAST at the code/commit gate and infrastructure scanning in the build-and-test stage. Confidence is set at 88% (HOTSPOT confidently resolved) rather than higher because the dump carries no official Suggested Answer or vote tally — the resolution rests on consistent community confirmation plus MS Learn.

More SC-100 practice questions