AZ-400 Question 261
Select 3Your organization is rolling out a new microservices application hosted in Azure Repos. To comply with internal policies and industry regulations, you must ensure that all code goes through vulnerability scanning, secret detection, and license compliance checks before it is merged into the main branch. You also want to identify issues early to reduce remediation costs. Which of the following actions should be included in your scanning strategy? (Choose three.)
- A
Integrate a static application security testing (SAST) tool in the build pipeline to scan source code for vulnerabilities.
- B
Remove any dependency-check tasks from the build pipeline to shorten build times.
- C
Set up software composition analysis (SCA) to identify vulnerabilities in open-source dependencies.
- D
Disable scanning on pull requests and only scan after code merges to the main branch.
- E
Configure a license scanning process that fails the build if incompatible licenses are detected.
Show answer and explanation
Correct answers: A, C, E
Explanation
By incorporating SAST, SCA, and license scanning into the build pipeline at the pull request stage, you identify risks early, reduce remediation costs, and maintain policy compliance. These practices align with Microsoft DevOps best practices, as outlined in the Azure DevOps documentation on secure DevOps and continuous security testing.
- A. Correct.
Correct. A SAST tool integrated into the pipeline helps detect coding errors, potential vulnerabilities, and insecure practices in the code before it is merged or released.
- B. Incorrect.
Incorrect. Removing dependency checks to shorten build times would risk missing known vulnerabilities in packages and expose your application to security threats.
- C. Correct.
Correct. Software composition analysis identifies vulnerabilities in third-party libraries, ensuring you address known issues in dependencies early.
- D. Incorrect.
Incorrect. Running scans only after code merges defeats the purpose of detecting issues early. Best practice is to scan on pull requests or as early in the pipeline as possible.
- E. Correct.
Correct. A license scanning step ensures compliance with your organization� open-source usage policies, helping avoid legal and compliance risks.