Design solutions that align with security best practices and priorities →mediumMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design solutions that align with security best practices and priorities
Your organization is implementing a secure DevOps pipeline for a critical application. You need to design a solution that scans container images for vulnerabilities before they are deployed to production. Which Azure service should you integrate into the pipeline?
⚠ Common exam trap
Many candidates confuse the old name 'Azure Security Center' with the current service 'Microsoft Defender for Cloud', or assume that Azure Policy can perform vulnerability scanning when it only enforces configuration compliance, not image-level security analysis.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Cloud
Microsoft Defender for Cloud (formerly Azure Security Center) provides integrated vulnerability assessment for container images stored in Azure Container Registry (ACR). When integrated into a DevOps pipeline, Defender for Cloud can scan images on push or on demand, using the Qualys scanner to detect CVEs and generate detailed security reports. This allows the pipeline to block or flag vulnerable images before they reach production, directly addressing the requirement for pre-deployment vulnerability scanning.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Key Vault
Why it's wrong here
Azure Key Vault is a cloud service for securely storing and managing secrets, encryption keys, and certificates. While it is essential for safeguarding credentials and connection strings used in a DevOps pipeline, it does not perform any kind of image scanning or vulnerability assessment. Its purpose is access-controlled secret management, not inspecting container images for known CVEs.
- ✗
Azure Policy
Why it's wrong here
Azure Policy enforces organizational compliance by applying rules to Azure resources, such as requiring specific SKUs or denying public network access. It evaluates the configuration of resources, not the data or artifacts they contain, so it cannot scan a container image's packages or layers for vulnerabilities. This makes it useful for governance but completely ineffective for detecting security issues inside images.
- ✓
Microsoft Defender for Cloud
Why this is correct
Microsoft Defender for Cloud is the correct choice because it includes built-in vulnerability scanning for container images in Azure Container Registry and other supported registries. It continuously scans images when they are pushed, detects known vulnerabilities using integrated CVE databases, and provides actionable remediation recommendations. Integrating this into a secure DevOps pipeline allows automated gating to block vulnerable images from reaching production.
- ✗
Azure Security Center
Why it's wrong here
Azure Security Center is the former name for the security management platform that has since been consolidated into Microsoft Defender for Cloud. The standalone Security Center tier no longer exists as a separate product, and its vulnerability-scanning capabilities for container images are now delivered through Defender for Cloud's Defenders. Therefore, referencing Azure Security Center as an answer is outdated, and the current service name is Microsoft Defender for Cloud.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 208-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.