AZ-400 Question 262
Select 2Your organization stores Terraform templates in Azure DevOps and ARM templates in a GitHub repository for cloud infrastructure provisioning. You want to use Microsoft Defender for Cloud DevOps Security to automatically scan these Infrastructure as Code (IaC) templates for vulnerabilities and misconfigurations across both platforms. Which two actions should you perform to configure scanning for all your Azure DevOps and GitHub repositories?
- A
Enable the Defender for DevOps plan in Microsoft Defender for Cloud and connect your Azure DevOps organization and GitHub repos in the 'DevOps Security' settings.
- B
Manually install a local scanning agent on each developer workstation to validate code before commits.
- C
Add the Defender for Cloud DevOps Security scanning task to each build or release pipeline in Azure DevOps or GitHub Actions to evaluate IaC templates during pipeline runs.
- D
Enable remote write privileges in your repositories so Microsoft Defender for Cloud can automatically push fixes to the code.
Show answer and explanation
Correct answers: A, C
Explanation
Microsoft Defender for Cloud DevOps Security (also referred to as Microsoft Defender for DevOps) integrates with both Azure DevOps and GitHub to scan IaC templates such as Terraform, ARM, or Bicep files. Configuration typically includes enabling the Defender for DevOps plan within the Microsoft Defender for Cloud portal and connecting each repository through the 'DevOps Security' settings. You then add a scanning task to your build or release pipelines to detect vulnerabilities or misconfigurations automatically. For more information, refer to the official Microsoft Defender for Cloud documentation at https://learn.microsoft.com/azure/defender-for-cloud/defender-for-devops-introduction.
- A. Correct.
Correct. You first need to enable the Defender for DevOps plan in Microsoft Defender for Cloud and connect your source code platforms (both Azure DevOps and GitHub) under 'DevOps Security' or similar settings. This allows Defender for Cloud to access your IaC files for scanning.
- B. Incorrect.
Incorrect. Deploying a local agent on each developer workstation for scanning is not a standard requirement for Microsoft Defender for Cloud DevOps Security. Defender for Cloud integrates at the service level (Azure DevOps or GitHub) rather than on each developer� machine.
- C. Correct.
Correct. After enabling the plan and connecting your repos, you add the Defender for Cloud DevOps Security scanning task in your pipelines (Azure DevOps Pipelines or GitHub Actions). This ensures that every build or release scans your IaC templates for vulnerabilities and misconfigurations.
- D. Incorrect.
Incorrect. You do not need to grant remote write privileges for Defender for Cloud to function. Defender for Cloud scans the code and reports vulnerabilities or misconfigurations, but it does not automatically alter or commit changes to your repositories.