Question

A financial services company is standardizing its Azure DevOps CI/CD pipelines across multiple product teams. Security reviews revealed that developers occasionally commit hardcoded credentials and connection strings into source repositories, and that vulnerable open-source dependencies reach production. The chief security architect wants to design a DevSecOps solution aligned with the Microsoft Cloud Security Benchmark (MCSB) DevOps Security control domain that shifts detection as early as possible in the development lifecycle. Which approach best satisfies this requirement?

Accepted Answer

Integrate automated secret scanning and software composition analysis (SCA) directly into pull request validation and pre-commit stages, and block merges when high-severity findings are detected.

Answer

Deploy Microsoft Defender for Cloud runtime protection on the production AKS clusters to detect leaked secrets and vulnerable packages after deployment.

Answer

Configure an Azure Policy at the subscription scope that audits deployed resources for exposed connection strings on a nightly basis.

Answer

Require a manual security team code review of every release branch before production deployment and log all findings in a ticketing system.