SC-100 Certification Practice Question #49

Question

You plan to implement an Azure environment based on Microsoft Cloud Adoption Framework for enterprise-scale landing zone architecture principles. The environment will host three apps that have the following characteristics:

•	Each app will have a development environment, a test environment, and a production environment.
•	Each environment will be managed by a separate team.
•	Each app will store its secrets in Azure Key Vault.

You need to recommend how many Azure subscriptions and key vaults to deploy to the application landing zones.

What should you recommend? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

Enterprise-scale CAF dictates a separate application-landing-zone subscription per workload **environment**. With 3 apps each having dev, test, and prod environments managed by separate teams, that is 3 × 3 = **9 subscriptions**, which also cleanly maps subscriptions to the separate management teams. Each app stores its secrets in Key Vault, and under Zero Trust least-privilege isolation a key vault should not span environments or teams; placing one vault per app per environment yields **9 key vaults**, one alongside each subscription. The 1 and 3 options would force apps or environments to share a subscription/vault (breaking team and environment boundaries), and 10 has no derivation, so 9/9 is the only internally consistent selection and matches both community comments.

More SC-100 practice questions