SC-100 Certification Practice Question #231

Question

You have an Azure subscription.

You plan to deploy Azure App Services apps by using Azure DevOps.

You need to recommend a solution to ensure that deployed apps maintain compliance with Microsoft cloud security benchmark (MCSB) recommendations.

What should you include in the recommendation?

Accepted Answer

The goal is to keep *deployed* App Service apps compliant with the Microsoft cloud security benchmark. MS Learn's MCSB guidance names Azure Policy as the mechanism to "establish guardrails to automate secure configurations and enforce compliance with MCSB," and the App Service security baseline repeats that Azure Policy is used to "alert, audit, and enforce" standard security configurations on deployed App Service apps. Defender for Cloud surfaces MCSB recommendations, but the enforcement engine behind those guardrails (including the Deny/DeployIfNotExist effects) is Azure Policy. DevOps security in Defender (A) targets the pipeline/repo posture, Defender for App Service (B) is runtime threat protection, and an Azure DevOps branch policy (D) gates source code — none enforce resource-level MCSB compliance. Suggested Answer, a unanimous community vote (C, 11), and MS Learn all agree with no meaningful dissent, supporting high confidence.

More SC-100 practice questions