Microsoft Cybersecurity Architect (SC-100)Design security for applications and dataEasy
A global manufacturing company uses Azure DevOps for its software development lifecycle (SDLC). The security team wants to integrate security best practices directly into the CI/CD pipelines to identify and remediate vulnerabilities early in the development process, including Infrastructure as Code (IaC) misconfigurations and insecure container images. Which Microsoft Defender for Cloud capability should the architect recommend?
- AMicrosoft Defender for Cloud Apps
- BMicrosoft Defender for Endpoint
- CMicrosoft Defender for IoT
- DMicrosoft Defender for Cloud - DevOps Security
Show answer & explanationAnswer & explanation
Correct answer: D. Microsoft Defender for Cloud - DevOps Security
Microsoft Defender for Cloud's DevOps Security feature integrates directly into CI/CD pipelines (like Azure DevOps) to scan IaC templates, container images, and source code for vulnerabilities and misconfigurations early in the development lifecycle.
Why the other options are wrong
- A. Microsoft Defender for Cloud Apps (formerly MCAS) is a Cloud Access Security Broker (CASB) for SaaS application security, not CI/CD pipeline security.
- B. Microsoft Defender for Endpoint is an Endpoint Detection and Response (EDR) solution for device security, not DevOps pipeline security.
- C. Microsoft Defender for IoT provides security for IoT devices and environments, not software development pipelines.
Microsoft Defender for Cloud - DevOps Security
A capability within Microsoft Defender for Cloud that integrates security into development pipelines (e.g., Azure DevOps, GitHub) to identify and remediate vulnerabilities in code, IaC, and container images early in the SDLC.
- Shifts security left in the SDLC
- Scans code, IaC templates, and container images
- Integrates with Azure DevOps and GitHub
- Provides centralized visibility and recommendations
Memory trick: DevOps Security is like a pipeline's security checkpoint.