AZ-400 Monitoring, Feedback & Security 4

Question 1

Which OWASP-aligned practice should be integrated into an Azure DevOps pipeline to catch injection vulnerabilities in application code before release?

Accepted Answer

Static Application Security Testing (SAST) using a tool like SonarQube or Checkmarx

Answer

SAST tools analyze source code for injection flaws and other OWASP vulnerabilities during the build stage before code reaches production.

Question 2

Your team uses Azure Boards to capture post-incident learnings. Which work item type is most appropriate for tracking a recurring reliability improvement?

Accepted Answer

Bug

Answer

In Azure Boards, a Bug work item type is used to track reliability defects and recurring production issues including post-incident action items.

Question 3

A pipeline runs DAST scans against a staging environment. The scan tool reports findings as a SARIF file. How should you surface these results in Azure DevOps?

Accepted Answer

Upload the SARIF file using the PublishTestResults task with format SARIF

Answer

The PublishTestResults task supports SARIF format, which makes security findings visible natively in the Azure DevOps pipeline results UI.

Question 4

You need Application Insights to track business KPIs such as 'completed checkouts per hour' alongside technical telemetry. Which SDK method enables this?

Accepted Answer

trackEvent() with custom properties and measurements

Answer

trackEvent() allows you to emit named custom events with properties and measurements, making it ideal for business-level KPI tracking.

Question 5

Which Azure Policy effect should you use to audit non-compliant resources without blocking their creation during initial rollout of a new security standard?

Accepted Answer

Audit

Answer

The Audit effect flags non-compliant resources in the compliance report without preventing their creation, making it safe for initial rollout.

AZ-400 Practice Test

AZ-400 Practice Test

AZ-400 Monitoring, Feedback & Security 4