AZ-400 Security and Compliance 1 — Questions and Answers
Question 1: Which Azure service should you use to store and manage secrets, keys, and certificates referenced in Azure Pipelines?
- Azure Key Vault (Correct answer)
- Azure Security Center
- Azure Active Directory
- Azure Blob Storage
Correct answer: Azure Key Vault
Azure Key Vault is the designated service for securely storing and managing secrets, keys, and certificates that can be referenced in Azure Pipelines using variable groups or task steps.
Question 2: What does 'shift-left security' mean in the context of DevSecOps?
- Moving security testing to the final production stage
- Integrating security practices earlier in the software development lifecycle (Correct answer)
- Shifting security responsibilities entirely to the operations team
- Moving security configurations to the left pane of the Azure portal
Correct answer: Integrating security practices earlier in the software development lifecycle
Shift-left security means integrating security practices and testing earlier in the SDLC so vulnerabilities are caught sooner, reducing the cost and risk of remediation.
Question 3: Which tool is most commonly used for Static Application Security Testing (SAST) integration in Azure DevOps pipelines?
- OWASP ZAP
- SonarQube (Correct answer)
- Selenium
- Terraform
Correct answer: SonarQube
SonarQube analyzes source code without executing it, identifying security vulnerabilities, bugs, and code smells, and integrates directly into Azure Pipelines as a SAST tool.
Question 4: What Azure feature allows you to define governance rules that Azure resources must comply with, and can block non-compliant deployments?
- Azure Blueprints
- Azure Policy (Correct answer)
- Azure Monitor
- Azure DevTest Labs
Correct answer: Azure Policy
Azure Policy lets you create and assign policies that enforce organizational rules on resources; deployments that violate a Deny-effect policy are blocked automatically.
Question 5: Which type of security scanning detects vulnerabilities in a running web application by simulating real attacks against it?
- Static Application Security Testing (SAST)
- Software Composition Analysis (SCA)
- Dynamic Application Security Testing (DAST) (Correct answer)
- Interactive Application Security Testing (IAST)
Correct answer: Dynamic Application Security Testing (DAST)
DAST tests a running application from the outside by simulating attacks, finding runtime vulnerabilities such as SQL injection and XSS that static analysis cannot detect.
Question 6: What is the primary purpose of Software Composition Analysis (SCA) in a DevSecOps pipeline?
- Scanning infrastructure templates for misconfigurations
- Identifying vulnerabilities in third-party and open-source dependencies (Correct answer)
- Testing application APIs for authentication flaws
- Monitoring runtime application behavior for anomalies
Correct answer: Identifying vulnerabilities in third-party and open-source dependencies
SCA scans open-source and third-party libraries used in an application to identify known CVEs, outdated packages, and license compliance issues.
Question 7: Which Azure DevOps feature enforces security review by requiring designated approvers before code can be merged into a protected branch?
- Branch policies with required reviewers (Correct answer)
- Azure Test Plans required test cases
- Work item state transitions
- Pipeline approval gates
Correct answer: Branch policies with required reviewers
Branch policies in Azure Repos can mandate that specified security reviewers approve a pull request before the merge is allowed, embedding human security oversight into the workflow.
AZ-400 Security and Compliance 1
Which Azure service should you use to store and manage secrets, keys, and certificates referenced in Azure Pipelines?