- A
Use Azure App Configuration to store secrets with encryption. Run vulnerability scans using a third-party tool integrated into the pipeline. Create a custom script to check image registry location.
Why wrong: App Configuration is not designed for secrets; third-party scanning may not integrate with Defender for Cloud.
- B
Store secrets in Azure Key Vault and use Azure DevOps Variable Groups linked to Key Vault for retrieval during pipelines. Enable Microsoft Defender for Containers on AKS to scan container images for vulnerabilities. Use Azure Policy (specifically Azure Policy for AKS with Gatekeeper) to enforce that only images from approved registries are deployed.
Secret security via Key Vault, automated vulnerability scanning, and policy enforcement.
- C
Store secrets as encrypted pipeline variables in Azure DevOps. Use Azure Container Registry (ACR) tasks to scan images. Implement manual approval gates in release pipelines to verify image source.
Why wrong: Pipeline variables are not as secure as Key Vault; manual gates are fallible.
- D
Store secrets in Azure Key Vault but use a custom task to retrieve them. Scan images using Microsoft Defender for Cloud after deployment. Use role-based access control to restrict registry access.
Why wrong: Scanning after deployment is too late; should scan before deployment.
Quick Answer
The correct answer is to store secrets in Azure Key Vault, link them to Azure DevOps Variable Groups for pipeline retrieval, enable Microsoft Defender for Containers on AKS for vulnerability scanning, and enforce approved registries via Azure Policy with Gatekeeper. This design directly addresses DevOps secrets management and container scanning by preventing credential exposure in source code or logs through Key Vault integration, while Defender for Containers provides continuous vulnerability assessment aligned with Microsoft Defender for Cloud. On the Microsoft Cybersecurity Architect exam, this scenario tests your ability to combine Azure Key Vault, Azure Policy, and Defender for Cloud into a cohesive DevSecOps pipeline—a common trap is choosing a solution that only scans images without enforcing registry approval, or storing secrets in pipeline variables instead of Key Vault. Remember the triad: Key Vault for secrets, Defender for scanning, Policy for approval.
SC-100 Practice Question: Design solutions that align with security best practices and priorities
This SC-100 practice question tests your understanding of design solutions that align with security best practices and priorities. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Litware, a software development company, has adopted a DevOps culture and uses Azure DevOps for CI/CD pipelines. They deploy applications to Azure Kubernetes Service (AKS) and Azure App Services. The security team wants to ensure that secrets (API keys, connection strings) are not exposed in source code or pipeline logs. They also need to scan container images for vulnerabilities before deployment and ensure that only approved images are used in production. The solution must integrate with Microsoft Defender for Cloud and follow security best practices. What should you include in the design?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue:
"best"Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Store secrets in Azure Key Vault and use Azure DevOps Variable Groups linked to Key Vault for retrieval during pipelines. Enable Microsoft Defender for Containers on AKS to scan container images for vulnerabilities. Use Azure Policy (specifically Azure Policy for AKS with Gatekeeper) to enforce that only images from approved registries are deployed.
Option B is correct because it aligns with security best practices by using Azure Key Vault to securely store secrets and linking them to Azure DevOps Variable Groups for secure retrieval during pipelines, preventing exposure in source code or logs. It enables Microsoft Defender for Containers on AKS to scan container images for vulnerabilities before deployment, and uses Azure Policy with Gatekeeper to enforce that only images from approved registries are deployed, ensuring compliance and integration with Microsoft Defender for Cloud.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Azure App Configuration to store secrets with encryption. Run vulnerability scans using a third-party tool integrated into the pipeline. Create a custom script to check image registry location.
Why it's wrong here
App Configuration is not designed for secrets; third-party scanning may not integrate with Defender for Cloud.
- ✓
Store secrets in Azure Key Vault and use Azure DevOps Variable Groups linked to Key Vault for retrieval during pipelines. Enable Microsoft Defender for Containers on AKS to scan container images for vulnerabilities. Use Azure Policy (specifically Azure Policy for AKS with Gatekeeper) to enforce that only images from approved registries are deployed.
Why this is correct
Secret security via Key Vault, automated vulnerability scanning, and policy enforcement.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Store secrets as encrypted pipeline variables in Azure DevOps. Use Azure Container Registry (ACR) tasks to scan images. Implement manual approval gates in release pipelines to verify image source.
Why it's wrong here
Pipeline variables are not as secure as Key Vault; manual gates are fallible.
- ✗
Store secrets in Azure Key Vault but use a custom task to retrieve them. Scan images using Microsoft Defender for Cloud after deployment. Use role-based access control to restrict registry access.
Why it's wrong here
Scanning after deployment is too late; should scan before deployment.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse Azure App Configuration with Azure Key Vault for secret storage, or assume that post-deployment scanning is acceptable, but the requirement explicitly demands scanning before deployment and integration with Microsoft Defender for Cloud.
Detailed technical explanation
How to think about this question
Azure Key Vault supports soft-delete and purge protection, ensuring secrets are recoverable and not permanently lost, and when linked to Azure DevOps Variable Groups via the 'Azure Key Vault' task, secrets are fetched at pipeline runtime without being stored in pipeline artifacts or logs. Microsoft Defender for Containers uses the Defender agent on AKS nodes to scan images in ACR and at runtime, leveraging the Common Vulnerabilities and Exposures (CVE) database for vulnerability detection. Azure Policy for AKS with Gatekeeper (based on Open Policy Agent) enforces admission controller rules, such as requiring that container images originate from a specific ACR instance, by intercepting Kubernetes API requests before pod creation.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Design solutions that align with security best practices and priorities — study guide chapter
Learn the concepts, then practise the questions
- →
Design solutions that align with security best practices and priorities practice questions
Targeted practice on this topic area only
- →
All SC-100 questions
969 questions across all exam domains
- →
Microsoft Cybersecurity Architect study guide
Full concept coverage aligned to exam objectives
- →
SC-100 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related SC-100 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Design solutions that align with security best practices and priorities practice questions
Practise SC-100 questions linked to Design solutions that align with security best practices and priorities.
Design security operations, identity, and compliance capabilities practice questions
Practise SC-100 questions linked to Design security operations, identity, and compliance capabilities.
Design security solutions for infrastructure practice questions
Practise SC-100 questions linked to Design security solutions for infrastructure.
Design a Zero Trust strategy and architecture practice questions
Practise SC-100 questions linked to Design a Zero Trust strategy and architecture.
Design security solutions for applications and data practice questions
Practise SC-100 questions linked to Design security solutions for applications and data.
Evaluate GRC and security operations strategies practice questions
Practise SC-100 questions linked to Evaluate GRC and security operations strategies.
Design security for infrastructure practice questions
Practise SC-100 questions linked to Design security for infrastructure.
Design a strategy for data and applications practice questions
Practise SC-100 questions linked to Design a strategy for data and applications.
Recommend security best practices and priorities practice questions
Practise SC-100 questions linked to Recommend security best practices and priorities.
SC-100 fundamentals practice questions
Practise SC-100 questions linked to SC-100 fundamentals.
SC-100 scenario practice questions
Practise SC-100 questions linked to SC-100 scenario.
SC-100 troubleshooting practice questions
Practise SC-100 questions linked to SC-100 troubleshooting.
Practice this exam
Start a free SC-100 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this SC-100 question test?
Design solutions that align with security best practices and priorities — This question tests Design solutions that align with security best practices and priorities — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Store secrets in Azure Key Vault and use Azure DevOps Variable Groups linked to Key Vault for retrieval during pipelines. Enable Microsoft Defender for Containers on AKS to scan container images for vulnerabilities. Use Azure Policy (specifically Azure Policy for AKS with Gatekeeper) to enforce that only images from approved registries are deployed. — Option B is correct because it aligns with security best practices by using Azure Key Vault to securely store secrets and linking them to Azure DevOps Variable Groups for secure retrieval during pipelines, preventing exposure in source code or logs. It enables Microsoft Defender for Containers on AKS to scan container images for vulnerabilities before deployment, and uses Azure Policy with Gatekeeper to enforce that only images from approved registries are deployed, ensuring compliance and integration with Microsoft Defender for Cloud.
What should I do if I get this SC-100 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 24, 2026
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.