What's changed: Created SC-100 Chapter 1 (Domain 1 "Design solutions that align with security best practices and priorities": Zero Trust 3 principles/6 pillars/Conditional Access/RaMP; MCRA/MCSB/Defender for Cloud/Secure Score/defenses by attack type; CAF/WAF/Azure landing zones/Azure Policy/DevSecOps/workload identity; resiliency/business-critical assets/BCDR/immutable backups/Azure Backup/Site Recovery/ransomware priorities/security updates).
1.3CAF, WAF, Azure landing zones, and DevSecOps
Understand security/governance strategy based on the Cloud Adoption Framework (CAF) and the Azure Well-Architected Framework (WAF), implementing governance via Azure landing zones, and designing a DevSecOps process aligned to CAF.
Best practices are needed both for "the organization-wide adoption strategy" and for "individual workload design." CAF addresses the former, WAF the latter. Architects keep the two distinct and apply each where it fits.
1.3.1Roles of CAF and WAF
The Cloud Adoption Framework (CAF) guides the entire cloud adoption journey (Strategy→Plan→Ready→Adopt→Govern→Manage); its Secure and Govern methodologies provide security/governance strategy. The Azure Well-Architected Framework (WAF) is a design-quality lens that evaluates an individual workload across five pillars (Reliability, Security, Cost Optimization, Operational Excellence, Performance Efficiency). Choose CAF for "org-wide governance/adoption strategy" and WAF for "security design review of this workload."
1.3.2Implementing governance with Azure landing zones
Azure landing zones operationalize CAF strategy. They establish a management-group hierarchy, centralized guardrails via Azure Policy, subscription topology, and networking/identity foundations in a code-reproducible way, so new workloads land in a "policy-compliant from day one" environment. When asked "where to place org-wide controls that prevent drift," architects make landing zones + Azure Policy central to the design.
1.3.3DevSecOps aligned to CAF
DevSecOps shifts security left (earlier) in the development lifecycle. It embeds threat modeling, code/dependency/secret scanning, IaC policy checks, and pipeline workload identity (no embedded keys), continuing into post-release posture/threat detection. Architects design a process that "continuously verifies via automated gates" rather than relying on human gatekeepers, aligned to CAF’s Secure methodology.
Cues: "org-wide adoption/governance strategy; where to place controls" = CAF (implemented via landing zones + Azure Policy). "Review this workload’s design quality / Security pillar" = WAF. "Embed security in the pipeline for early detection" = DevSecOps (shift-left).
Watch the mix-ups: (1) Do not confuse CAF (the org’s adoption journey) with WAF (an individual workload’s design quality). (2) Landing zones are the "foundation" that implements CAF, not the "strategy." (3) Azure Policy is a preventive/audit guardrail, not threat detection (Defender).
1.3.4Section summary
- CAF = org-wide adoption journey (strategy via Secure/Govern); WAF = design-quality lens evaluating a workload across five pillars
- Landing zones + Azure Policy = the governance foundation implementing CAF (policy-compliant landing spots from day one)
- DevSecOps = shift-left, embedding threat modeling/scanning/workload identity into the pipeline
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To provide org-wide, reproducible landing spots where new workloads are policy-compliant from day one, which is best?
Q2. To review a single workload’s design across reliability, security, cost, operations, and performance, which framework is best?
Q3. Which guidance drives the org-wide "strategy" for cloud adoption and governance?
Q4. To authenticate the pipeline to Azure resources without embedding secrets, which DevSecOps design is best?
Q5. Which correctly describes the role of Azure Policy?