AZ-400 Security and Compliance 2

Question 1

What does the OWASP Top 10 represent in the context of application security?

Accepted Answer

A list of the 10 most critical web application security risks

Answer

The OWASP Top 10 is a standard awareness document published by the Open Web Application Security Project listing the 10 most critical security risks to web applications.

Question 2

In Azure Pipelines, what is the recommended way to prevent a secret variable's value from appearing in pipeline logs?

Accepted Answer

Mark the variable as secret in the pipeline variable settings

Answer

Marking a pipeline variable as secret causes Azure Pipelines to mask its value in all logs, preventing accidental exposure of credentials.

Question 3

Which Microsoft security product integrates with Azure DevOps repositories to provide code scanning, secret scanning, and dependency review?

Accepted Answer

GitHub Advanced Security

Answer

GitHub Advanced Security (GHAS) provides code scanning (SAST), secret scanning, and dependency review and can be enabled on Azure DevOps repositories as well as GitHub.

Question 4

What is the purpose of a security gate configured in an Azure DevOps release pipeline?

Accepted Answer

To automatically pause or reject releases that fail security compliance checks

Answer

Security gates evaluate compliance conditions (e.g., calling a security API or checking Azure Policy compliance) and halt a release if the criteria are not met.

Question 5

Which Azure service provides unified security posture management and gives resources a 'Secure Score' to prioritize security improvements?

Accepted Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Cloud (formerly Azure Security Center) aggregates security recommendations across resources and surfaces them as a Secure Score to help teams prioritize improvements.

AZ-400 Practice Test

AZ-400 Practice Test

AZ-400 Security and Compliance 2