You have a GitHub repository.You need to ensure that all the code in the repository is scanned for vulnerabilities.What should you use?
Answer(s): A
Identifying vulnerabilities in your project's dependencies with Dependabot alerts Dependabot generates Dependabot alerts when known vulnerabilities are detected in dependencies that your project uses.
https://docs.github.com/en/code-security/dependabot/dependabot-alerts
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You plan to update the Azure DevOps strategy of your company.You need to identify the following issues as they occur during the company's development process:Licensing violationsProhibited librariesSolution: You implement automated security testing.Does this meet the goal?
Correct:* You implement automated security testing.Incorrect:* You implement continuous deployment.* You implement continuous integration* You implement pre-deployment gates.Note:You can use Mend Bolt with Azure DevOps to automatically detect alerts on vulnerable open source components, outdated libraries, and license compliance issues in your code.Azure DevOps integration with Mend Bolt will enable you to:Detect and remedy vulnerable open source components.* Generate comprehensive open source inventory reports per project or build.*-> Enforce open source license compliance, including dependencies' licenses.* Identify outdated open source libraries with recommendations to update.Note 2: WhiteSource is the leader in continuous open source software security and compliance management.WhiteSource integrates into your build process, irrespective of your programming languages, build tools, or development environments. It works *automatically*, continuously, and silently in the background, checking the security, licensing, and quality of your open source components against WhiteSource constantly-updated definitive database of open source repositories.
https://azuredevopslabs.com/labs/vstsextend/whitesource/
You use release pipelines in Azure Pipelines to deploy an app. Secrets required by the pipeline are stored as pipeline variables. Logging of commands is enabled for the Azure Pipelines agent.You need to prevent the values of the secrets from being logged.What should you do?
Answer(s): C
Azure Pipelines, Set secret variablesWe make an effort to mask secrets from appearing in Azure Pipelines output, but you still need to take precautions. Never echo secrets as output. Some operating systems log command line arguments. Never pass secrets on the command line. Instead, we suggest that you map your secrets into environment variables.
https://learn.microsoft.com/en-us/azure/devops/pipelines/process/set-secret-variables
You have a private project in Azure DevOps.You need to ensure that a project manager can create and save custom work item queries to report on the project's progress. The solution must use the principle of least privilege.To which security group should you add the project manager?
Contributors have permissions to contribute fully to the project code base and work item tracking. The main permissions they don't have or those that manage or administer resources.
https://docs.microsoft.com/en-us/azure/devops/organizations/security/permissions
DRAG DROP (Drag and Drop is not supported)You have an Azure Key Vault that contains an encryption key named key1.You plan to create a Log Analytics workspace that will store logging data.You need to encrypt the workspace by using key1.Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.Select and Place:
Customer-Managed key provisioning steps (assuming there already is an Azure Key Vault):Step 1: Enable soft delete for the key vault.The Azure Key Vault must be configured as recoverable, to protect your key and the access to your data in Azure Monitor. You can verify this configuration under properties in your Key Vault, both Soft delete and Purge protection should be enabled.Step 2: Create a Log Analytics cluster.Clusters uses managed identity for data encryption with your Key Vault. Configure identity type property to SystemAssigned when creating your cluster to allow access to your Key Vault for "wrap" and "unwrap" operations.Step 3: Grant permissions to the key vault.Grant Key Vault permissions.Create Access Policy in Key Vault to grants permissions to your cluster. These permissions are used by the underlay cluster storage. Open your Key Vault in Azure portal and click Access Policies then + Add Access Policy to create a policy with these settings:Key permissions--select Get, Wrap Key and Unwrap Key.Etc.1. Creating cluster2. Granting permissions to your Key Vault3. Updating cluster with key identifier details4. Linking workspacesStep 4: Link workspaceLink workspace to cluster.This step should be performed only after the cluster provisioning. If you link workspaces and ingest data prior to the provisioning, ingested data will be dropped and won't be recoverable.
https://docs.microsoft.com/en-us/azure/azure-monitor/logs/customer-managed-keys
Post your Comments and Discuss Microsoft AZ-400 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-400 content, but please register or login to continue.