AZ-400 Question 113
Single answerYou manage an Azure DevOps release pipeline for a web application that must pass stringent security requirements before being deployed to production. You have integrated a static application security testing (SAST) tool into your build process to scan for critical vulnerabilities. You want to ensure that the production deployment is halted if any new high-severity vulnerabilities are detected after the latest scan. Which solution should you recommend to enforce this requirement?
- A
Add a manual post-deployment task for a security specialist to review the logs before approving the deployment.
- B
Configure a release gate that checks the SAST tool� vulnerability report and prevents the release if new high-severity vulnerabilities are found.
- C
Run the SAST tool only after production deployment and roll back if any critical issues are flagged.
- D
Use a branch strategy that restricts merges to the main branch until all developers confirm no new vulnerabilities exist.
Show answer and explanation
Correct answer: B
Explanation
Using a release gate that queries security scan results ensures production deployments are automatically halted if high-severity vulnerabilities are discovered. According to Azure DevOps documentation (see https://learn.microsoft.com/azure/devops/pipelines/release/approvals/gates), release gates allow you to enforce quality and security checks before proceeding. This method integrates well with SAST tools, providing a reliable, automated checkpoint that supports governance and compliance requirements.
- A. Incorrect.
Option 1 is incorrect because relying solely on an ad-hoc, manual post-deployment task risks inconsistency and delays. It does not provide an automated quality gate that can block the release if issues are found.
- B. Correct.
Option 2 is correct. Configuring a release gate that automatically checks the SAST tool� report before allowing deployment ensures that no new high-severity vulnerabilities bypass production. This approach follows best practices for automated security governance.
- C. Incorrect.
Option 3 is incorrect because running the SAST tool post-deployment introduces unnecessary risk and complexity, as critical vulnerabilities might be exposed to users before a rollback is triggered.
- D. Incorrect.
Option 4 is incorrect because requiring developers to confirm no new vulnerabilities provides no automated verifiable security gate. It also creates a bottleneck and doesn�t offer a systematic blocking mechanism based on scan results.