SC-100 Certification Practice Question #45

Question

You have an Azure DevOps organization that is used to manage the development and deployment of internal apps to multiple Azure subscriptions.

You are developing a DevSecOps strategy.

You need to apply DevSecOps controls for the secure code stage and the secure operations stage. The solution must be based on Microsoft Cloud Adoption Framework for Azure principles.

What should you apply for each stage? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

Under Microsoft Cloud Adoption Framework DevSecOps controls, the "Secure code" stage focuses on scanning the codebase and its dependencies for vulnerabilities — i.e., supply chain / dependency management (SCA, dependency review, Dependabot). The "Secure operations" stage governs the solution once it is running in production, where controlling who and what can access the live application — App Access Controls — is the operational guardrail. The two Highly Voted comments (👍 6 and 👍 5) agree independently on this pairing. The minority view (👍 3) puts threat modeling under Secure code, but MS Learn places threat modeling in the earlier "Secure the design" stage, not Secure code, so it is discounted. Confidence at 84% reflects strong, doc-consistent community agreement tempered by the moderately-voted threat-modeling dissent and the absence of a captured official Suggested Answer.

More SC-100 practice questions