SC-100 · Question #322
You have a Microsoft 365 tenant. You have an Azure subscription that contains Azure App Service web apps. The apps have the following characteristics: - The apps use third-party and open-source…
The correct answer is A. secret scanning. Secret scanning is the correct answer because supply chain attacks frequently exploit leaked credentials - such as API keys, tokens, and passwords accidentally committed to source repositories - to compromise downstream systems like CI/CD pipelines, package registries, or…
Question
You have a Microsoft 365 tenant. You have an Azure subscription that contains Azure App Service web apps. The apps have the following characteristics:
- The apps use third-party and open-source components.
- The apps were developed by using C#, Python, and Java.
- The app deployment process is managed by using Azure DevOps.
- The source code for the apps is stored in GitHub Enterprise Cloud
repositories and protected by using GitHub Advanced Security. You need to reduce the risk of supply chain attacks during the application lifecycle. What should you implement?
Options
- Asecret scanning
- BDependabot alerts
- Capp governance in Microsoft Defender for Cloud Apps
- DNuGet Audit
How the community answered
(50 responses)- A58% (29)
- B6% (3)
- C22% (11)
- D14% (7)
Explanation
Secret scanning is the correct answer because supply chain attacks frequently exploit leaked credentials - such as API keys, tokens, and passwords accidentally committed to source repositories - to compromise downstream systems like CI/CD pipelines, package registries, or deployment targets. GitHub Advanced Security includes secret scanning, which detects and alerts on exposed secrets before they can be weaponized. In this scenario, apps are built with third-party/open-source components deployed through Azure DevOps, making the build and delivery pipeline a prime supply chain attack target; a leaked token could allow an attacker to inject malicious artifacts or tamper with deployments. Option B (Dependabot alerts) addresses known-vulnerable dependencies, which is a vulnerability management concern rather than a supply chain attack vector specifically. Option C (app governance in Defender for Cloud Apps) governs OAuth app permissions, unrelated to source-code supply chain risks. Option D (NuGet Audit) only covers .NET NuGet packages and does not address Python or Java dependencies used in these apps.
Topics
Community Discussion
No community discussion yet for this question.