AZ-400 Security and Compliance

Question 1

Which Azure service should you use to store and manage secrets, keys, and certificates referenced in Azure Pipelines?

Accepted Answer

Azure Key Vault

Answer

Azure Security Center

Answer

Azure Active Directory

Answer

Azure Blob Storage

Question 2

What does 'shift-left security' mean in the context of DevSecOps?

Accepted Answer

Integrating security practices earlier in the software development lifecycle

Answer

Moving security testing to the final production stage

Answer

Shifting security responsibilities entirely to the operations team

Answer

Moving security configurations to the left pane of the Azure portal

Question 3

Which tool is most commonly used for Static Application Security Testing (SAST) integration in Azure DevOps pipelines?

Accepted Answer

SonarQube

Answer

OWASP ZAP

Answer

Selenium

Answer

Terraform

Question 4

What Azure feature allows you to define governance rules that Azure resources must comply with, and can block non-compliant deployments?

Accepted Answer

Azure Policy

Answer

Azure Blueprints

Answer

Azure Monitor

Answer

Azure DevTest Labs

Question 5

Which type of security scanning detects vulnerabilities in a running web application by simulating real attacks against it?

Accepted Answer

Dynamic Application Security Testing (DAST)

Answer

Static Application Security Testing (SAST)

Answer

Software Composition Analysis (SCA)

Answer

Interactive Application Security Testing (IAST)

Question 6

What is the primary purpose of Software Composition Analysis (SCA) in a DevSecOps pipeline?

Accepted Answer

Identifying vulnerabilities in third-party and open-source dependencies

Answer

Scanning infrastructure templates for misconfigurations

Answer

Testing application APIs for authentication flaws

Answer

Monitoring runtime application behavior for anomalies

Question 7

Which Azure DevOps feature enforces security review by requiring designated approvers before code can be merged into a protected branch?

Accepted Answer

Branch policies with required reviewers

Answer

Azure Test Plans required test cases

Answer

Work item state transitions

Answer

Pipeline approval gates