Design solutions that align with security best practices and priorities →hardMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design solutions that align with security best practices and priorities
A company uses Azure DevOps and wants to implement a DevSecOps practice by scanning code for secrets and vulnerabilities before deployment. Which tool should they integrate into their pipeline?
⚠ Common exam trap
Watch out — candidates often confuse GitHub Advanced Security (which is for GitHub repositories) with Microsoft Defender for DevOps (which is for Azure DevOps pipelines), leading them to choose Option C even though the question explicitly states the company uses Azure DevOps.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for DevOps
Microsoft Defender for DevOps is the correct choice because it is a unified DevSecOps solution that integrates directly into Azure DevOps pipelines to scan code for secrets, vulnerabilities, and open-source dependencies before deployment. It provides actionable security insights and remediation guidance, aligning with the requirement to implement a DevSecOps practice by scanning code for secrets and vulnerabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Policy
Why it's wrong here
Azure Policy is a governance service that evaluates and enforces rules on Azure resource configurations (e.g., resource types, tags, compliance standards) via Azure Resource Manager. It does not inspect source code, pipeline definitions, or commit history for secrets or code vulnerabilities, so it cannot remediate security issues inside a DevOps workload. Therefore, while Azure Policy enhances cloud governance, it is not the correct tool for scanning code in Azure DevOps.
- ✗
Microsoft Purview
Why it's wrong here
Microsoft Purview is a unified data governance, risk, and compliance solution focused on data mapping, classification, sensitivity labels, and eDiscovery across data sources. It manages policy for data access and protection but does not perform code-level security scanning, buffer analysis, or vulnerability detection within CI/CD pipelines. Purview's scope is data insights and compliance, not application security in a DevOps lifecycle.
- ✗
GitHub Advanced Security
Why it's wrong here
GitHub Advanced Security (GHAS) provides substantial code security via CodeQL, secret scanning, and dependency review, but it is intrinsically tied to GitHub repositories and their Ci/CD actions. Azure DevOps has its own repository and pipeline system, and GHAS connectors do not natively attach to Azure DevOps projects. In this scenario, since the company uses Azure DevOps, GHAS is misaligned; Microsoft Defender for DevOps is designed to bridge exactly this gap.
- ✓
Microsoft Defender for DevOps
Why this is correct
Microsoft Defender for DevOps is a dedicated service that integrates directly with Azure DevOps (and GitHub) to provide continuous security scanning of code, secrets, infrastructure-as-code templates, and open-source dependencies. It leverages built-in scanners like Credential Scanner and integrates with Defender for Cloud to aggregate findings across the software development life cycle. This makes it the correct choice for an Azure DevOps-centric organization seeking DevOpsSec capabilities.
Go deeper
Related to this question
About these practice questions
One of 208 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.