AZ-400 Monitoring, Feedback & Security 4 — Questions and Answers
Question 1: Which OWASP-aligned practice should be integrated into an Azure DevOps pipeline to catch injection vulnerabilities in application code before release?
- Infrastructure-as-code scanning with Checkov
- Static Application Security Testing (SAST) using a tool like SonarQube or Checkmarx (Correct answer)
- Dynamic penetration testing against production
- Container image scanning with Trivy
Correct answer: Static Application Security Testing (SAST) using a tool like SonarQube or Checkmarx
SAST tools analyze source code for injection flaws and other OWASP vulnerabilities during the build stage before code reaches production.
Question 2: Your team uses Azure Boards to capture post-incident learnings. Which work item type is most appropriate for tracking a recurring reliability improvement?
- Bug (Correct answer)
- Impediment
- Feature
- Epic
Correct answer: Bug
In Azure Boards, a Bug work item type is used to track reliability defects and recurring production issues including post-incident action items.
Question 3: A pipeline runs DAST scans against a staging environment. The scan tool reports findings as a SARIF file. How should you surface these results in Azure DevOps?
- Email the SARIF file to the security team
- Upload the SARIF file using the PublishTestResults task with format SARIF (Correct answer)
- Store the SARIF in Azure Blob Storage and link it in the release notes
- Convert SARIF to CSV and attach it to the pipeline artifact
Correct answer: Upload the SARIF file using the PublishTestResults task with format SARIF
The PublishTestResults task supports SARIF format, which makes security findings visible natively in the Azure DevOps pipeline results UI.
Question 4: You need Application Insights to track business KPIs such as 'completed checkouts per hour' alongside technical telemetry. Which SDK method enables this?
- trackException()
- trackEvent() with custom properties and measurements (Correct answer)
- trackDependency()
- trackPageView()
Correct answer: trackEvent() with custom properties and measurements
trackEvent() allows you to emit named custom events with properties and measurements, making it ideal for business-level KPI tracking.
Question 5: Which Azure Policy effect should you use to audit non-compliant resources without blocking their creation during initial rollout of a new security standard?
- Deny
- DeployIfNotExists
- Audit (Correct answer)
- Modify
Correct answer: Audit
The Audit effect flags non-compliant resources in the compliance report without preventing their creation, making it safe for initial rollout.
Question 6: A security team needs to ensure no pipeline can access Azure resources using a long-lived secret stored in a variable group. Which approach eliminates long-lived secrets?
- Rotate secrets in the variable group every 30 days
- Use an Azure DevOps service connection with workload identity federation (OIDC) (Correct answer)
- Encrypt variable groups with a customer-managed key
- Store secrets in Azure Key Vault and link them to the variable group
Correct answer: Use an Azure DevOps service connection with workload identity federation (OIDC)
Workload identity federation allows pipelines to authenticate to Azure using short-lived OIDC tokens, eliminating the need for stored client secrets.
Question 7: You want to create an alert that fires when the 95th percentile response time for a web API exceeds 2 seconds over the last 10 minutes. Which alert type is most appropriate?
- Metric alert on server response time with average aggregation
- Log alert using a KQL query on Application Insights requests table with percentile aggregation (Correct answer)
- Activity log alert on API Management gateway errors
- Smart Detection alert for slow server response times
Correct answer: Log alert using a KQL query on Application Insights requests table with percentile aggregation
A Log alert with a KQL query using the percentile() function on the requests table provides precise 95th-percentile response time alerting.
AZ-400 Monitoring, Feedback & Security 4
Which OWASP-aligned practice should be integrated into an Azure DevOps pipeline to catch injection vulnerabilities in application code before release?