You have an Azure DevOps organization.You are designing an automated security and compliance solution that will use GitHub Advanced Security for Azure DevOps.You need to ensure that security checks and compliance requirements are enforced automatically throughout the development lifecycle.Which two features should you include in the solution? Each correct answer presents part of the solution.Note: Each correct selection is worth one point.
Answer(s): B,D
B: Dependency scanningDependency scanning in GitHub Advanced Security for Azure DevOps detects the open source components used in your source code and detects if there are any associated vulnerabilities. Any found vulnerabilities from open source components get flagged as an alert.Dependency scanning generates an alert for any open-source component, direct or transitive, found to be vulnerable that your code depends upon. Direct vulnerabilities are the libraries your code directly uses.Transitive dependencies are the libraries or other software that direct dependencies use.D: Secret scanning - Detect secrets, for example keys and tokens, that have been checked into private repositories. If push protection is enabled, GitHub also detects secrets when they are pushed to your repository. Secret scanning alerts for users and push protection are available and free of charge for all public repositories on GitHub.com.Incorrect:Not A: CodeQL CLI - Run CodeQL processes locally on software projects or to generate code scanning results for upload to GitHub.You can use the CodeQL CLI to:Run CodeQL analyses using queries provided by GitHub engineers and the open source community Generate code scanning alerts that you can upload to display in GitHub Create CodeQL databases to use in the CodeQL for Visual Studio Code extension.Develop and test custom CodeQL queries to use in your own analyses Note: A GitHub Advanced Security license provides the following additional features for private repositories:* Code scanning* CodeQL CLI -* Secret scanning* Dependency review -* Dependency review -
https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security https://learn.microsoft.com/en-us/azure/devops/repos/security/github-advanced-security-dependency-scanning
DRAG DROP (Drag and Drop is not supported)You use GitHub Enterprise Server as a source code repository.You create an Azure DevOps organization named Contoso.In the Contoso organization, you create a project named Project1.You need to link GitHub commits, pull requests, and issues to the work items of Project1. The solution must use OAuth-based authentication.Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.Select and Place:
Answer(s): A
Step 1: From Developer settings in GitHub Enterprise Server, register a new OAuth app. If you plan to use OAuth to connect Azure DevOps Services or Azure DevOps Server with your GitHub Enterprise Server, you first need to register the application as an OAuth AppStep 2: From Organization settings in Azure DevOps, add an OAuth configuration Register your OAuth configuration in Azure DevOps Services.Note:1. Sign into the web portal for Azure DevOps Services.2. Add the GitHub Enterprise Oauth configuration to your organization.3. Open Organization settings>Oauth configurations, and choose Add Oauth configuration.4. Fill in the form that appears, and then choose Create.Step 3: From Project Settings in Azure DevOps, add a GitHub connection.Connect Azure DevOps Services to GitHub Enterprise ServerChoose the Azure DevOps logo to open Projects, and then choose the Azure Boards project you want to configure to connect to your GitHub Enterprise repositories.Choose (1) Project Settings, choose (2) GitHub connections and then (3) Click here to connect to your GitHub Enterprise organization.
https://docs.microsoft.com/en-us/azure/devops/boards/github/connect-to-github
HOTSPOT (Drag and Drop is not supported)You have a project in Azure DevOps that has three teams as shown in the Teams exhibit. (Click the Teams tab.)You create a new dashboard named Dash1.You configure the dashboard permissions for the Contoso project as shown in the Permissions exhibit (Click the Permissions tab.)All other permissions have the default values set.For each of the following statements, select Yes if the statement is true. Otherwise, select No.Note: Each correct selection is worth one point.Hot Area:
Box 1: NoBox 2: YesContoso Teams is the default project team.Box 3: Yes
https://docs.microsoft.com/en-us/azure/devops/report/dashboards/charts-dashboard-permissions-access
You manage code by using GitHub.You plan to use Dependabot to scan for code dependencies.You need to identify when scanning will be triggered automatically.Which two actions will trigger a scan? Each correct answer presents a complete solution.Note: Each correct solution is worth one point.
Answer(s): A,E
About Dependabot alerts, Detection of insecure dependenciesDependabot performs a scan of the default branch of your repository to detect insecure dependencies, and sends Dependabot alerts when:A new advisory is added to the GitHub Advisory Database.Note: Only advisories that have been reviewed by GitHub will trigger Dependabot alerts.The dependency graph for a repository changes. For example, when a contributor pushes a commit to change the packages or versions it depends on, or when the code of one of the dependencies changes.
https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with- github-actions
You have an Azure subscription that contains 20 virtual machines.You plan to deploy an Azure infrastructure by using Bicep files. The files will be deployed by using self-hosted GitHub runners on the virtual machines.You need to ensure that the GitHub runners can authenticate to Azure. The solution must minimize administrative effort.What should you use?
Answer(s): D
To authenticate a self-hosted GitHub Actions runner with Azure, you'll typically use either a managed identity or a service principal with OpenID Connect (OIDC). Managed identities are generally preferred for simplicity and security, especially with Azure Virtual Machines. Alternatively, you can use a service principal and configure it with a federated identity credential, which can be helpful in more complex scenarios.System-assigned managed identities are tied to a specific Azure resource and are deleted when the resource is deleted, while user-assigned managed identities are separate Azure resources that can be assigned to multiple resources.In this scenario we need only a single user-assigned managed identity.Incorrect:Not A: Managed Identities vs. Service Principals:Managed identities are generally preferred for their simplicity and security. Service principals are needed when managed identities are not feasible.Not B: We would need 20 system-assigned managed identities.Not C: Personal access tokens (PATs) is fine when you are using one single virtual machine.The PAT would also need to be refreshed.
https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-manage-user- assigned-managed-identities https://learn.microsoft.com/en-us/azure/developer/github/connect-from-azure-identity
Post your Comments and Discuss Microsoft AZ-400 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-400 content, but please register or login to continue.