AZ-400 Question 31
Select 2Your organization has integrated multiple security scanning solutions (SAST, DAST, and container image scanning) into an Azure DevOps pipeline. You want to track important security metrics in Azure Monitor and configure queries that identify high-severity vulnerabilities in near real time. Which two approaches best meet these requirements for designing and implementing appropriate security metrics and queries?
- A
Use Kusto Query Language (KQL) in Azure Monitor to create alerts for vulnerabilities above a defined severity threshold
- B
Rely solely on ephemeral, on-demand queries that are only run manually after a major security breach occurs
- C
Define a custom metric that measures the average time to remediate newly discovered vulnerabilities
- D
Disable logging of security scan results in Azure Monitor to reduce overhead costs
Show answer and explanation
Correct answers: A, C
Explanation
In a real-world DevOps pipeline, implementing continuous security monitoring is crucial. By defining security-related metrics (e.g., mean time to remediate) and leveraging Kusto-based queries in Azure Monitor, organizations can proactively identify, respond to, and measure the impact of vulnerabilities. Relying solely on manual or ad hoc queries, or disabling security logging for cost reasons, often leads to gaps in visibility and delays in response. For more details, refer to official Microsoft documentation on Azure Monitor, Kusto Query Language (KQL), and security best practices.
- A. Correct.
Option 1 is correct. By creating KQL-based alerts in Azure Monitor, you can proactively detect vulnerabilities that exceed a designated severity level. This enables real-time notifications, reducing response time and maintaining ongoing visibility into security posture.
- B. Incorrect.
Option 2 is incorrect. Running queries only after a breach occurs is reactive, not proactive. It fails to offer continuous monitoring or early detection, defeating the purpose of real-time or near real-time security metrics.
- C. Correct.
Option 3 is correct. Tracking the average time to remediate vulnerabilities provides a meaningful, actionable metric. It helps measure the effectiveness of your security response processes and can drive improvements in remediation practices.
- D. Incorrect.
Option 4 is incorrect. Disabling logging in Azure Monitor removes visibility into security events and prevents building useful metrics and alerts. Cost considerations should not override the requirement for robust security monitoring.