AZ-400 Question 260
Select 2Your organization is building a new microservices application in Azure DevOps using multiple open-source dependencies. The security team mandates that each change must be checked for potential code vulnerabilities, secrets, licensing issues, and outdated dependencies before deployment. You want to design a single CI/CD pipeline strategy to address all these requirements without significantly slowing down the development process. Which two approaches should you implement to meet these security and compliance mandates?
- A
A. Perform code vulnerability checks only at the end of the pipeline, after deployment is completed, to minimize build times.
- B
B. Integrate a pipeline task that runs a static code analysis tool (SAST) for vulnerabilities, as well as a separate open-source software (OSS) license compliance scan, during the early stages of the CI process.
- C
C. Use a secrets scanning tool directly integrated into the repository to detect hidden credentials in pull requests, and couple it with a daily dependency audit job.
- D
D. Rely solely on manual code reviews for detecting licensing issues and potential security flaws to reduce automated pipeline overhead.
Show answer and explanation
Correct answers: B, C
Explanation
A best-practice DevSecOps strategy involves integrating security checks (including vulnerability scans, license checks, and secret detection) throughout the CI/CD pipeline, rather than waiting until deployment or relying solely on human reviews. Refer to Microsoft� documentation on integrating code scanning tasks in Azure DevOps (https://docs.microsoft.com/azure/devops/pipelines/security/security-analysis-overview) and OSS license scanning tools (https://docs.microsoft.com/azure/devops/pipelines/tasks/reference) for guidance on setting up these scans and ensuring continuous compliance.
- A. Incorrect.
Option A: Incorrect. Post-deployment security checks delay the detection of vulnerabilities, secrets, or dependency issues until after the application is already released. This is risky and does not meet continuous compliance standards.
- B. Correct.
Option B: Correct. Running a static code analysis tool for vulnerabilities (SAST) and an OSS license scan in early stages ensures that issues are detected before significant resources are spent on building and deploying. This proactive approach is a key best practice in DevSecOps.
- C. Correct.
Option C: Correct. Scanning for commits that contain secrets (e.g., private keys, passwords) as part of pull requests helps catch these issues before they reach production. Combining that with a regular dependency-audit job ensures any newly discovered vulnerabilities are addressed swiftly.
- D. Incorrect.
Option D: Incorrect. Manual reviews alone are error-prone and cannot efficiently scale for comprehensive licensing and security checks. Automated scanning is a standard practice to enforce consistent security and compliance.