AZ-400 Security and Compliance 3

Question 1

What is a Software Bill of Materials (SBOM) used for in a DevSecOps context?

Accepted Answer

Providing a complete inventory of all components and dependencies in a software artifact

Answer

Tracking the total cost of software licenses across projects

Answer

Managing software release schedules and deployment approvals

Answer

Documenting architectural decisions made during sprint planning

Question 2

Which Azure service combination enables automatic vulnerability scanning of container images when they are pushed to the registry?

Accepted Answer

Azure Container Registry with Microsoft Defender for Containers

Answer

Azure Kubernetes Service with Azure Monitor

Answer

Azure Container Instances with Azure Policy

Answer

Azure App Service with Azure Security Center Classic

Question 3

Which Azure Policy effect automatically deploys a resource or configuration to bring a non-compliant resource into compliance?

Accepted Answer

DeployIfNotExists

Answer

Audit

Answer

Deny

Answer

Append

Question 4

In DevSecOps, what does Infrastructure as Code (IaC) scanning accomplish?

Accepted Answer

Analyzing IaC templates like Terraform or Bicep for security misconfigurations before deployment

Answer

Monitoring live infrastructure for performance anomalies

Answer

Automatically provisioning dedicated security infrastructure resources

Answer

Converting infrastructure runbooks into executable code

Question 5

Which configuration is recommended to prevent forked repository pull requests from accessing protected pipeline secrets in Azure Pipelines?

Accepted Answer

Configure fork build validation to limit secret access and require manual approval for fork PRs

Answer

Grant all fork contributors full repository access so they can manage their own secrets

Answer

Disable fork contributions entirely on all repositories

Answer

Store secrets in the pipeline YAML file instead of pipeline variables

Question 6

What is the recommended modern approach for authenticating Azure DevOps pipelines to Azure without storing service principal secrets?

Accepted Answer

Using workload identity federation to eliminate stored secrets

Answer

Embedding credentials directly in pipeline YAML variables

Answer

Sharing a single service principal across all pipelines for simplicity

Answer

Rotating service principal certificates manually every six months

Question 7

Which framework provides Microsoft's prescriptive security best practices and control mappings specifically for Azure and multi-cloud environments?

Accepted Answer

Microsoft Cloud Security Benchmark (MCSB)

Answer

HIPAA Security Rule

Answer

PCI DSS v4.0

Answer

NIST SP 800-53