SC-100: Microsoft Cybersecurity ArchitectDemo

The Microsoft cloud security benchmark is applied through Defender for Cloud as security recommendations that are backed by Azure Policy, and Azure Policy (using audit, deny, and DeployIfNotExists/Enforce effects) is what keeps deployed App Service resources compliant with MCSB recommendations — regardless of whether they were deployed via Azure DevOps. "DevOps security in Microsoft Defender for Cloud" (A) assesses pipeline/repository posture such as secret and IaC scanning, and Microsoft Defender for App Service (B) provides runtime threat protection; neither enforces resource-level MCSB compliance. A branch policy (D) governs source control, not Azure resource compliance. So Azure Policy is the recommendation.