AZ-400 Question 259
Select 2You are designing a CI/CD pipeline in Azure DevOps for a microservices solution. The application relies on several open-source libraries and requires sensitive secrets for database and API integrations. Your security and compliance team mandates that all code must be scanned for vulnerabilities, secrets should not be exposed, and open-source licenses must be verified for compliance. Which TWO actions should you implement in your pipeline strategy to satisfy these requirements?
- A
A. Configure an automated dependency scanning tool that checks for both security vulnerabilities and license compliance in any open-source libraries used by the project.
- B
B. Store secrets in plain text within repository files but rely on post-deployment scripts to remove them from the final build artifacts.
- C
C. Enable a gated check-in policy that runs secret scanning, preventing merges if any sensitive information is detected in pull requests.
- D
D. Disable static analysis to avoid slowing down the build process and conduct manual quarterly code reviews instead.
- E
E. Use a third-party system to asynchronously email security alerts to the team after each production deployment, leaving the build pipeline unchanged.
Show answer and explanation
Correct answers: A, C
Explanation
A comprehensive strategy for security and compliance scanning in Azure DevOps includes integrating automated dependency (SCA) and secret-scanning tools directly into the CI/CD pipeline. Gated check-in policies prevent vulnerable or non-compliant code from being merged and help identify exposed secrets early in the development cycle. Refer to Microsoft DevOps documentation on secure DevOps practices for additional guidance: https://learn.microsoft.com/en-us/azure/devops/learn/what-is-devops/secure-devops-practices.
- A. Correct.
A. Correct. Integrating an automated dependency scanning tool (such as WhiteSource or other Software Composition Analysis solutions) in your pipeline ensures early detection of security vulnerabilities and license issues, meeting compliance requirements in real time.
- B. Incorrect.
B. Incorrect. Storing secrets in plain text within the repository is a security risk. This violates best practices for secret management and fails the requirement of preventing exposed secrets.
- C. Correct.
C. Correct. Enforcing a gated check-in policy with secret scanning ensures secrets are detected before merges. Any failure automatically blocks merges until secrets are removed or secured, aligning with the mandate against exposing credentials.
- D. Incorrect.
D. Incorrect. Disabling static analysis undermines code security and compliance efforts. Relying on manual reviews can lead to missed vulnerabilities due to human error, failing the security requirement for robust scanning.
- E. Incorrect.
E. Incorrect. Sending asynchronous emails after production deployment does not prevent insecure code or unmanaged licenses from entering production. Real-time pipeline checks are necessary to detect and block risks before release.