AZ-400 · Domain 4: Develop a security and compliance plan · 13% of the exam
Task 4.3: Automate security and compliance scanning
A scanning strategy for dependencies, code, secrets and licenses, Defender for Cloud DevOps security, GitHub Advanced Security on GitHub and Azure DevOps, container and CodeQL scanning, and Dependabot alerts.
Study it
Security scanning: GitHub Advanced Security, Defender for Cloud, CodeQL and Dependabot
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the Microsoft documentation page that proves it.
Question 1 · choose 1
Developers keep committing service credentials to Azure Repos, and security finds them weeks later. The goal is to stop new secrets from ever reaching the server, from both the command line and the web editor, while also finding secrets already in history. What should you enable?
ASecret Protection for Azure DevOps, with push protection, on the repositories
BDependency scanning in the build pipeline
CA required reviewer policy on main
DA Maximum file size repository policy
Show the answer and why
ASecret Protection for Azure DevOps, with push protection, on the repositories
Correct
Push protection rejects pushes that contain high-confidence secrets, and secret scanning finds existing ones across history.
BDependency scanning in the build pipeline
Incorrect
Dependency scanning finds vulnerable packages, not credentials.
CA required reviewer policy on main
Incorrect
Reviewers may miss secrets, and pushes to other branches still reach the server.
DA Maximum file size repository policy
Incorrect
File size has nothing to do with secrets.
GitHub Advanced Security for Azure DevOps is available as GitHub Secret Protection and GitHub Code Security. Secret Protection includes secret scanning of existing code and history and push protection, which is built into Azure DevOps Git and rejects pushes with identified secrets from the command line or the web interface.
A security plan must catch two kinds of risk on every pull request: known vulnerabilities in the open-source packages the application uses, and injection flaws in the code the team writes itself. Which two scan types cover these? (Choose TWO.)
ASecret scanning of the repository history
BA load test of the deployed application
CDependency scanning of the packages the code uses
DCode scanning with CodeQL of the team's source code
EAn availability test against the production URL
Show the answer and why
ASecret scanning of the repository history
Incorrect
Secret scanning finds credentials, not package vulnerabilities or injection flaws.
BA load test of the deployed application
Incorrect
Load tests measure performance, not vulnerabilities.
CDependency scanning of the packages the code uses
Correct
Dependency scanning finds open-source components and flags known vulnerabilities in them.
DCode scanning with CodeQL of the team's source code
Correct
Code scanning analyzes the team's own code for vulnerabilities such as injection.
EAn availability test against the production URL
Incorrect
Availability tests check that the app responds.
A scanning strategy combines dependency scanning (software composition analysis of open-source components and known vulnerabilities), code scanning (static analysis such as CodeQL), secret scanning and license checks, each catching a different class of risk.
How is GitHub Advanced Security for Azure DevOps billed?
APer active committer who pushed in the last 90 days, counted once per subscription
BPer repository with Advanced Security enabled
CPer pipeline run that performs a scan
DA flat fee per organization
Show the answer and why
APer active committer who pushed in the last 90 days, counted once per subscription
Correct
Each active committer uses one license, deduplicated across the Azure subscription.
BPer repository with Advanced Security enabled
Incorrect
Billing counts committers, not repositories.
CPer pipeline run that performs a scan
Incorrect
Runs aren't the billing unit.
DA flat fee per organization
Incorrect
Charges depend on active committers.
Each active committer to at least one repository with Advanced Security enabled consumes a license; a committer is active if present in a push in the last 90 days. Committers are deduplicated across an Azure subscription, and billing goes to that subscription. With the standalone Secret Protection and Code Security products, the count is kept per product.
The same leaked token appears in 12 commits across three branches of an Azure Repos repository. How many secret scanning alerts appear?
ATwelve, one per commit
BThree, one per branch
COne, listing all the locations where the token was found
DNone, because commits older than the last push aren't scanned
Show the answer and why
ATwelve, one per commit
Incorrect
Alerts are per credential, not per commit.
BThree, one per branch
Incorrect
Branches don't split an alert.
COne, listing all the locations where the token was found
Correct
A single alert is generated for each unique credential, with every location shown.
DNone, because commits older than the last push aren't scanned
Incorrect
Scanning covers history.
Secret scanning generates one alert for each unique credential across all branches and history of a repository; the alert's Locations section lists every path and commit where it was found.
A team wants to scan Terraform files and container images in Azure Pipelines with open-source analyzers and send results to Defender for Cloud. Which pipeline task fits?
APublishTestResults with the SARIF file
BAzureLoadTest
CMicrosoftSecurityDevOps with tools such as checkov and trivy
DAzureKeyVault
Show the answer and why
APublishTestResults with the SARIF file
Incorrect
That publishes test results.
BAzureLoadTest
Incorrect
That runs load tests.
CMicrosoftSecurityDevOps with tools such as checkov and trivy
Correct
The extension runs analyzers such as Checkov, Trivy, Terrascan and Bandit and publishes SARIF results.
DAzureKeyVault
Incorrect
That downloads secrets.
The Microsoft Security DevOps extension (MicrosoftSecurityDevOps task) runs open-source tools such as Bandit, BinSkim, Checkov, ESLint, Template Analyzer, Terrascan and Trivy, and publishes SARIF results.
Developers can see Advanced Security alerts in their repository but can't dismiss false positives. Which permission must they be granted?
AAdvanced Security: manage and dismiss alerts
BAdvanced Security: view alerts
CContribute on the repository
DBypass policies when pushing to the default branch
Show the answer and why
AAdvanced Security: manage and dismiss alerts
Correct
That permission allows managing and dismissing alerts.
BAdvanced Security: view alerts
Incorrect
They already view alerts.
CContribute on the repository
Incorrect
Contribute covers code changes, not alert dismissal.
DBypass policies when pushing to the default branch
Incorrect
That's a branch permission unrelated to alerts.
Advanced Security has three permissions: view alerts, manage and dismiss alerts, and manage settings. Viewing needs Contributor rights on the repository; dismissing alerts is a separate permission, held by project administrators by default.