AZ-400 Question 33
Select 2Your organization uses Azure DevOps for CI/CD pipelines. You want to proactively monitor security anomalies by collecting pipeline logs and scanning tool outputs in Azure Monitor. The goal is to create meaningful metrics and queries that highlight critical vulnerabilities and repeated security failures. Which two actions should you take to effectively design and implement these security metrics and queries?
- A
Configure continuous export of Azure DevOps pipeline logs to Azure Monitor, then leverage Kusto Query Language (KQL) in Log Analytics to filter and visualize high-severity vulnerabilities.
- B
Enable branch policies that automatically block all pull requests lacking a security review, ensuring no vulnerability data ever appears in the logs.
- C
Set up Azure Monitor alerts that rely on a custom KQL query, triggering notifications when more than a predefined threshold of security issues are found in a single pipeline run.
- D
Use Azure Automation to periodically move pipeline logs to an on-premises file share for manual monthly security reviews without integrating with Log Analytics.
Show answer and explanation
Correct answers: A, C
Explanation
Designing and implementing security metrics in Azure DevOps involves integrating pipeline logs with a service like Azure Monitor, then using Kusto Query Language (KQL) to create real-time or near real-time queries and alerts. By continuously exporting logs and vulnerability findings to Azure Monitor and setting up custom alert thresholds, you can promptly detect and respond to high-severity issues. For further guidance, refer to official Microsoft documentation on using Azure Monitor logs for continuous monitoring and security analysis (https://learn.microsoft.com/azure/azure-monitor/logs/log-query-overview).
- A. Correct.
Option 1 is correct. Exporting pipeline logs to Azure Monitor and using KQL in Log Analytics provides the capability to filter, query, and visualize high-severity vulnerabilities in near real-time. This approach is aligned with best practices for centralized tracking of security data and building actionable metrics.
- B. Incorrect.
Option 2 is incorrect. While branch policies are important for code quality and security, simply blocking pull requests without analyzing the logs does not achieve the goal of creating robust metrics and queries for vulnerabilities. This option avoids generating certain logs rather than monitoring and acting on them.
- C. Correct.
Option 3 is correct. Implementing Azure Monitor alerts with custom KQL queries allows you to respond quickly to suspicious activity or critical vulnerabilities. By specifying thresholds, you can tailor notifications to trigger only when the number of detected issues exceeds a certain level, helping to reduce noise and focus on genuine threats.
- D. Incorrect.
Option 4 is incorrect. Manually moving pipeline logs to an on-premises file share for monthly reviews does not leverage the real-time analytics and alerting capabilities of Azure Monitor and KQL. This approach can result in delayed detection of security anomalies and lacks the automated insights gained from continuous monitoring.