StudyByteLearn
← SC-100: Microsoft Cybersecurity Architect
SC-100 · CAF Well Architected and secure adoption

Practice question 75 of 498 · easy

A critical API uses vulnerable third-party packages. Which test category most directly identifies known dependency issues?

Choose the single best answer.

  1. A.Infrastructure-as-code configuration scanning alone
  2. B.Dynamic application testing without dependency inventory
  3. C.Software composition analysis
  4. D.Static code analysis limited to first-party source
Show the answer and explanation

✓ Correct answer

  • Software composition analysis

SCA focuses on components and known dependency vulnerabilities. First-party static analysis, runtime behavior testing, and IaC scanning evaluate different surfaces and do not replace dependency inventory/security analysis.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.