DRAG DROP (Drag and Drop is not supported)You have an Azure Repos repository named Repo1 that is used for source control.You need to configure code scanning for Repo1.Which three tasks should the pipeline perform in sequence? To answer, move the appropriate tasks from the list of tasks to the answer area and arrange them in the correct order.Select and Place:
Answer(s): A
Step 1: Advance Security Initialize CodeQLWorking with GitHub Advanced Security for Azure DevOpsSetup Code ScanningCode scanning in GitHub Advanced Security for Azure DevOps lets you analyze the code in an Azure DevOps repository to find security vulnerabilities and coding errors. Any problems identified by the analysis are raised as an alert. Code scanning uses CodeQL to identify vulnerabilities.Example:1. Select and Edit the pipeline you want to add scanning to2. Locate the section where the build steps are defined3. Add the task Initialize CodeQL(ms.advancedsecurity-tasks.codeql.init.AdvancedSecurity-Codeql- Init@1)directly to your YAML pipeline file. This task will be added before the Dotnet build. [Step 1]4. task: ms.advancedsecurity-tasks.codeql.init.AdvancedSecurity-Codeql-Init@1- task: ms.advancedsecurity-tasks.codeql.analyze.AdvancedSecurity-Codeql-Analyze@1. [Step 3] Add this task after dependency scanning. [Step 2]5. Click Save to save the pipeline configuration file.Step 2: Advance Security Dependency scanningStep 3: Advance Security Perform CodeQL Analysis
https://azuredevopslabs.com/labs/azuredevops/advancedsecurity/
SIMULATIONYou need to create a personal access token (PAT) named Token1 that has only the following capabilities:Read, write, and manage codeRead and execute buildsRead releasesToken1 must expire in 60 days.
Azure DevOps, Use personal access tokensCreate a PATStep 1: Sign in to your organization (https://dev.azure.com/{Your_Organization}).Step 2: From your home page, open user settings and select Personal access tokens.Step 3: Select + New Token.Step 4: Name your token [Token1], select the organization where you want to use the token, and then set your token to automatically expire after a set number of days [Set expire after 60 days].Step 5: Select the scopes for this token to authorize for your specific tasks.[Select:Read, write, and manage codeRead and execute buildsRead releases ]Step 6: Click Create
https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to- authenticate
You have a GitHub repository that uses GitHub Actions and stores access keys by using GitHub encrypted secrets.You plan to update the secrets by using the GitHub REST API.You need to wrap the secrets before adding them to a REST-based call.Which encryption library should you use?
Answer(s): C
Encrypting secrets for the REST APIEncrypting a secret using Node.jsIf you are using Node.js, you can encrypt your secret using the libsodium-wrappers library.Note: The sodium crypto library compiled to WebAssembly and pure JavaScript using Emscripten, with automatically generated wrappers to make it easy to use in web applications.The complete library weighs 188 KB (minified, gzipped, includes pure JS + WebAssembly versions) and can run in a web browser as well as server-side.
https://docs.github.com/en/rest/guides/encrypting-secrets-for-the-rest-api?apiVersion=2022-11-28 https://www.npmjs.com/package/libsodium-wrappers
HOTSPOT (Drag and Drop is not supported)You have a GitHub repository named Repo1 and an app named App1. Repo1 stores the source code for App1.You need to perform the following tests:Test1: Run a ZAP spider against App1 for one minute and wait for passive scanning to complete. The test must NOT perform active attacks.Test2: Run a ZAP spider against App1, and when complete, execute an AJAX spider scan.Which GitHub action should you use for each test? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: ZAP Baseline ScanTest1: Run a ZAP spider against App1 for one minute and wait for passive scanning to complete. The test must NOT perform active attacks.ZAP - Baseline ScanThe ZAP Baseline scan is a script that is available in the ZAP Docker images.It runs the ZAP spider against the specified target for (by default) 1 minute and then waits for the passive scanning to complete before reporting the results.This means that the script doesn't perform any actual `attacks' and will run for a relatively short period of time (a few minutes at most).By default, it reports all alerts as WARNings but you can specify a config file which can change any rules to FAIL or IGNORE.This script is intended to be ideal to run in a CI/CD environment, even against production sites.Box 2: ZAP Full ScanTest2: Run a ZAP spider against App1, and when complete, execute an AJAX spider scan.ZAP Action Full ScanA GitHub Action for running the ZAP Full Scan to perform Dynamic Application Security Testing (DAST).The ZAP full scan action runs the ZAP spider against the specified target (by default with no time limit) followed by an optional ajax spider scan and then a full active scan before reporting the results. The alerts will be maintained as a GitHub issue in the corresponding repository.Incorrect:* ZAP - API ScanThe ZAP API scan is a script that is available in the ZAP Docker images.It is tuned for performing scans against APIs defined by OpenAPI, SOAP, or GraphQL via either a local file or a URL.It imports the definition that you specify and then runs an Active Scan against the URLs found. The Active Scan is tuned to APIs, so it doesn't bother looking for things like XSSs.
https://www.zaproxy.org/docs/docker/baseline-scan https://github.com/zaproxy/action-full-scan https://www.zaproxy.org/docs/docker/api-scan
You use Azure Pipelines pipeline to build and deploy an app named App1.You need to ensure that before App1 is deployed, all the code for the app passes a security validation by using a custom tool.What should you do?
Post your Comments and Discuss Microsoft AZ-400 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-400 content, but please register or login to continue.