Exam SC-100 topic 1 question 27 discussion

In the context of deploying applications using CI/CD pipelines in Azure and following DevSecOps best practices from the Microsoft Cloud Adoption Framework for Azure, using managed identities is often recommended. Managed identities provide an identity for applications to use when connecting to resources that support Azure AD authentication, without needing to manage credentials like usernames and passwords. A managed identity in Azure is automatically managed by Azure and does not require you to provision or rotate secrets. This aligns with the principles of DevSecOps, where security is integrated into the development process, and the management of secrets and credentials is handled securely and automatically. So, the correct recommendation for this scenario would be: A. a managed identity in Azure.

Its both but it depends where the resources needed for CI/CD are stored and who authenticates/authorises access to them. According to the link below: Key Vault makes it possible for your client application to use a secret to access resources not secured by Microsoft Entra ID. Managed identities are automatically managed by Azure. https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/tutorial-windows-vm-access-nonaad

A. A managed identity in Azure is the most appropriate solution because it is secure, doesn’t require managing credentials, and integrates seamlessly with Azure services, making it the ideal choice for automated deployments in a CI/CD pipeline

as writer writes, added for wrote count

as writer writes, added for wrote count

https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/secure/best-practices/secure-devops

https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/tutorial-windows-vm-access-nonaad

D as per the link below and key words from the question: https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/secure/best-practices/secure-devops#azure-key-vault

Pipelines and code repositories should not include hard-coded credentials and secrets. Credentials and secrets should be stored elsewhere and use CI vendor features for security. A.- Is not correct if the CI vendor has internal users/credentials Check the indicated https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/secure/best-practices/secure-devops where indicates "If your CI platform supports it, consider storing credentials in a dedicated secret store, for example Azure Key Vault. Credentials are fetched at runtime by the build agent and your attack surface is reduced."

Long and behold, Azure DevOps now supports managed identities. https://devblogs.microsoft.com/devops/introducing-service-principal-and-managed-identity-support-on-azure-devops/ https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/service-principal-managed-identity?view=azure-devops#create-a-managed-identity

azure devops cannot connect to azure using managed identities (You need to recommend which types of identities to use for the deployment credentials of the service connection.)

A - since D says user account

For an Azure DevOps solution that follows DevSecOps best practices from the Microsoft Cloud Adoption Framework for Azure, the recommended choice for deployment credentials in a service connection is a managed identity in Azure (Option A). Here's why this is the recommended choice: A. Managed identity in Azure: Managed identities provide a secure way to authenticate and authorize services or applications in Azure without the need for explicit credentials such as passwords or secrets. Using a managed identity ensures that your CI/CD pipelines can securely access Azure resources without exposing credentials. It also aligns with best practices for security and eliminates the need to manage and rotate passwords or secrets.

A. a managed identity in Azure https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview

Managed Identities, nobody knows the password, not accessible to anyone except the identity itself.

A. A managed identity in Azure Using a managed identity aligns with DevSecOps best practices, as it provides a secure and automated way to manage credentials for your CI/CD pipelines. This approach reduces the risk of exposing sensitive information and follows the principle of least privilege

A, 100%