SC-100 Certification Practice Question #48

Question

You are designing new Azure applications based on security best practices from the Microsoft Cloud Adoption Framework for Azure. Each application will be deployed to a dedicated and secure environment that will contain isolated instances of the following key Azure security resources:

•	Azure Key Vault
•	Virtual networks
•	An Azure subscription
•	Azure Policy assignments
•	Network security groups (NSGs)
•	Role-based access control (RBAC) assignments

You need to recommend which type of environment and which module to use to deploy the applications. The solution must use infrastructure as code (IaC) to deploy each application environment.

What should you recommend? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The scenario describes a dedicated, secure, isolated environment per application containing a subscription, virtual networks, NSGs, RBAC, Key Vault, and Azure Policy assignments — that is the textbook definition of an Azure landing zone (specifically an application landing zone) in the Cloud Adoption Framework, so the environment type is Landing zone. CAF and the Azure Landing Zones IaC accelerator explicitly recommend deploying landing zones with Bicep or Terraform (Azure Verified Modules), which is the only module option pairing the two recommended IaC languages without the legacy ARM JSON dependency. emadmf76's community answer matches both selections. Confidence is 87% (HOTSPOT confidently resolved) rather than higher because no usable Suggested Answer was captured (the lone "D" comment does not correspond to a HOTSPOT cell) and only one substantive community vote exists, but MS Learn grounding for both rows is direct and unambiguous.

More SC-100 practice questions