AZ-400 Security and Compliance 3

Question 1

What is a Software Bill of Materials (SBOM) used for in a DevSecOps context?

Accepted Answer

Providing a complete inventory of all components and dependencies in a software artifact

Answer

An SBOM is a formal, machine-readable inventory of all components, libraries, and dependencies in a software product, enabling rapid identification of affected systems when new CVEs are disclosed.

Question 2

Which Azure service combination enables automatic vulnerability scanning of container images when they are pushed to the registry?

Accepted Answer

Azure Container Registry with Microsoft Defender for Containers

Answer

Enabling Microsoft Defender for Containers on Azure Container Registry triggers automatic vulnerability scans of images on push, surfacing CVEs before images are deployed.

Question 3

Which Azure Policy effect automatically deploys a resource or configuration to bring a non-compliant resource into compliance?

Accepted Answer

DeployIfNotExists

Answer

The DeployIfNotExists effect triggers a remediation deployment when a resource is found to be missing required configurations, automatically restoring compliance.

Question 4

In DevSecOps, what does Infrastructure as Code (IaC) scanning accomplish?

Accepted Answer

Analyzing IaC templates like Terraform or Bicep for security misconfigurations before deployment

Answer

IaC scanning tools (e.g., Checkov, tfsec, Microsoft Defender for DevOps) analyze Terraform, ARM, and Bicep templates for misconfigurations and policy violations before infrastructure is provisioned.

Question 5

Which configuration is recommended to prevent forked repository pull requests from accessing protected pipeline secrets in Azure Pipelines?

Accepted Answer

Configure fork build validation to limit secret access and require manual approval for fork PRs

Answer

Azure Pipelines fork protection settings can prevent secrets from being passed to fork PR builds and require a team member to manually approve the run before it starts.

AZ-400 Practice Test

AZ-400 Practice Test

AZ-400 Security and Compliance 3