SC-100 Certification Practice Question #31

Question

You have an Azure subscription.

You plan to deploy enterprise-scale landing zones based on the Microsoft Cloud Adoption Framework for Azure. The deployment will include a single-platform landing zone for all shared services and three application landing zones that will each host a different Azure application.

You need to recommend which resource to deploy to each landing zone. The solution must meet the Cloud Adoption Framework best-practice recommendations for enterprise-scale landing zones.

What should you recommend?

Accepted Answer

The CAF enterprise-scale reference architecture places shared networking resources (Azure Firewall, virtual network gateway, Private DNS zones) in the centralized platform/connectivity subscription, not in individual application landing zones. By contrast, Azure Key Vault is the resource that CAF explicitly recommends deploying into each application landing zone — "Deploy key vaults that have application secrets into the application landing zones" and "use separate key vaults for each application environment in each region." Since the question asks what to deploy to each landing zone (the single platform zone plus three application zones), Key Vault is the resource common to all, making D the best answer. The Suggested Answer, the unanimous-direction Most Voted (D, 10 votes), the highest-voted comment, and MS Learn all converge on D; the firewall dissent is discounted because it confuses the connectivity subscription with application landing zones.

More SC-100 practice questions