AZ-400 Security and Compliance

Question 1

Which Azure service should you use to store and manage secrets, keys, and certificates referenced in Azure Pipelines?

Accepted Answer

Azure Key Vault

Answer

Azure Key Vault is the designated service for securely storing and managing secrets, keys, and certificates that can be referenced in Azure Pipelines using variable groups or task steps.

Question 2

What does 'shift-left security' mean in the context of DevSecOps?

Accepted Answer

Integrating security practices earlier in the software development lifecycle

Answer

Shift-left security means integrating security practices and testing earlier in the SDLC so vulnerabilities are caught sooner, reducing the cost and risk of remediation.

Question 3

Which tool is most commonly used for Static Application Security Testing (SAST) integration in Azure DevOps pipelines?

Accepted Answer

SonarQube

Answer

SonarQube analyzes source code without executing it, identifying security vulnerabilities, bugs, and code smells, and integrates directly into Azure Pipelines as a SAST tool.

Question 4

What Azure feature allows you to define governance rules that Azure resources must comply with, and can block non-compliant deployments?

Accepted Answer

Azure Policy

Answer

Azure Policy lets you create and assign policies that enforce organizational rules on resources; deployments that violate a Deny-effect policy are blocked automatically.

Question 5

Which type of security scanning detects vulnerabilities in a running web application by simulating real attacks against it?

Accepted Answer

Dynamic Application Security Testing (DAST)

Answer

DAST tests a running application from the outside by simulating attacks, finding runtime vulnerabilities such as SQL injection and XSS that static analysis cannot detect.

AZ-400 Practice Test

AZ-400 Practice Test

AZ-400 Security and Compliance