SC-100 Practice Question: Design solutions that align with security best practices and priorities

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use Azure App Configuration to store secrets with encryption. Run vulnerability scans using a third-party tool integrated into the pipeline. Create a custom script to check image registry location.

  Why it's wrong here

  Azure App Configuration is intended for application configuration settings, not secrets; it lacks the fine-grained access policies, secret rotation, and audit logging that Azure Key Vault provides. While a third-party scanner can detect vulnerabilities, it may not integrate with Microsoft Defender for Cloud's unified threat detection and compliance reporting. A custom script to check the image registry location is not enforceable at admission time and can be bypassed, unlike a policy-based gatekeeper that rejects non-compliant images before they are scheduled.

• ✓

  Store secrets in Azure Key Vault and use Azure DevOps Variable Groups linked to Key Vault for retrieval during pipelines. Enable Microsoft Defender for Containers on AKS to scan container images for vulnerabilities. Use Azure Policy (specifically Azure Policy for AKS with Gatekeeper) to enforce that only images from approved registries are deployed.

  Why this is correct

  Azure Key Vault is the correct service for secrets because it offers centralized management, access policies, rotation, and auditing; linking Azure DevOps Variable Groups to Key Vault retrieves secrets securely at pipeline runtime without exposing them in logs. Enabling Microsoft Defender for Containers on AKS automatically scans container images in ACR for vulnerabilities and provides runtime threat detection. Azure Policy with Gatekeeper (the AKS admission controller) enforces that only images from approved registries are deployed, providing governance and preventing unauthorized or malicious image usage.

• ✗

  Store secrets as encrypted pipeline variables in Azure DevOps. Use Azure Container Registry (ACR) tasks to scan images. Implement manual approval gates in release pipelines to verify image source.

  Why it's wrong here

  Encrypted pipeline variables in Azure DevOps are more exposed than Key Vault because they may be visible in logs or to users with pipeline edit permissions, and they lack centralized secret rotation and audit. ACR tasks primarily build and trigger on base image updates, but they are not a dedicated vulnerability scanner with Defender for Cloud integration, leaving gaps in continuous scanning. Manual approval gates are inherently fallible because they rely on human judgment rather than automated, policy-based verification of image provenance, and they do not block images that bypass the approval process.

• ✗

  Store secrets in Azure Key Vault but use a custom task to retrieve them. Scan images using Microsoft Defender for Cloud after deployment. Use role-based access control to restrict registry access.

  Why it's wrong here

  While storing secrets in Key Vault is correct, using a custom task to retrieve them introduces risk of mismanagement, such as insecure logging or improper error handling, and fails to leverage built-in managed identity integration. Scanning images with Microsoft Defender for Cloud after deployment is too late, as vulnerable or compromised containers may already be running, and remediation becomes urgent and disruptive. Role-based access control on the registry limits who can push or pull images, but it does not enforce that only images from approved registries are actually deployed, so it must be complemented by admission control policies.

Go deeper

Related to this question