A team uses GitHub Actions to build a container image. They want to run CodeQL analysis inside the container build process to detect vulnerabilities in the code that will be deployed. What should you do?

Run a container scan using Trivy in the workflow.

Use Azure Container Registry tasks to run CodeQL.

Enable Dependabot alerts for the repository.

Add a CodeQL workflow that runs during the build and uses the container as the analysis environment.

A company uses GitHub Enterprise Cloud for a Java application. They have enabled Dependabot alerts, but the security team is concerned that some vulnerabilities are not being detected because the dependency graph is incomplete. They also want to ensure that CodeQL is run on every pull request. What should you do?

Ensure the dependency graph is enabled and that all build tools are configured to submit dependencies, and add a CodeQL workflow that runs on pull_request events.

Enable Dependabot security updates and rely on them to fix vulnerabilities.

Use GitHub Advanced Security secret scanning to detect additional vulnerabilities.

Run CodeQL only on the default branch to reduce build time.

A company builds a container image using GitHub Actions. The image is based on a custom base image that is not publicly available. The security team wants to scan the image for vulnerabilities before it is pushed to a private registry. They also want to run CodeQL analysis on the source code. What should you do?

Use Azure Container Registry tasks to run CodeQL.

Use Dependabot to scan the base image dependencies.

Use Microsoft Defender for Cloud to scan the image after it is pushed to the registry.

Use a GitHub Actions workflow that runs CodeQL on the source and uses a container scanner like Trivy on the built image before pushing.

A company uses GitHub Advanced Security and Microsoft Defender for Cloud. They want to automatically create work items in Azure Boards when a new code scanning alert is detected in Defender for Cloud. What should you configure?

Configure a GitHub Actions workflow that creates an Azure Boards work item when a code scanning alert is raised.

Enable continuous export from Defender for Cloud to a Logic App that creates work items.

Use the DevOps security connector to bring alerts into Defender for Cloud, then configure an automation rule that triggers an Azure DevOps work item creation.

Use the GitHub API to create work items directly in Azure Boards.

A GitHub repository uses Maven for a Java application. The security team wants to automatically receive pull requests that update vulnerable dependencies to a fixed version. What should you configure?

Enable Dependabot security updates.

Enable Dependabot version updates.

Enable GitHub Advanced Security code scanning.

Configure a GitHub Actions workflow to run `mvn versions:display-dependency-updates`.

Microsoft Certified:DevOps Engineer Expert

Domain 4Objective 3

Automate Security and Compliance Scanning AZ-400 Practice Questions (Page 1)

Part of the Develop a security and compliance plan domain, which makes up ~19% of our current practice bank. Microsoft does not publish an official question count, but from its 140-minute exam (~55–95 total, ~10–18 in this domain), expect 3–6 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

6concepts

Questions 1–5

1application · medium
A team uses GitHub Actions to build a container image. They want to run CodeQL analysis inside the container build process to detect vulnerabilities in the code that will be deployed. What should you do?
Select an answer first
2expert · hard
A company uses GitHub Enterprise Cloud for a Java application. They have enabled Dependabot alerts, but the security team is concerned that some vulnerabilities are not being detected because the dependency graph is incomplete. They also want to ensure that CodeQL is run on every pull request. What should you do?
Select an answer first
3expert · hard
A company builds a container image using GitHub Actions. The image is based on a custom base image that is not publicly available. The security team wants to scan the image for vulnerabilities before it is pushed to a private registry. They also want to run CodeQL analysis on the source code. What should you do?
Select an answer first
4expert · hard
A company uses GitHub Advanced Security and Microsoft Defender for Cloud. They want to automatically create work items in Azure Boards when a new code scanning alert is detected in Defender for Cloud. What should you configure?
Select an answer first
5application · medium
A GitHub repository uses Maven for a Java application. The security team wants to automatically receive pull requests that update vulnerable dependencies to a fixed version. What should you configure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-400

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-400” is a trademark of its owner, used for identification only.

Automate Security and Compliance Scanning AZ-400 Practice Questions (Page 1)

Questions 1–5

A team uses GitHub Actions to build a container image. They want to run CodeQL analysis inside the container build process to detect vulnerabilities in the code that will be deployed. What should you do?

A company uses GitHub Advanced Security and Microsoft Defender for Cloud. They want to automatically create work items in Azure Boards when a new code scanning alert is detected in Defender for Cloud. What should you configure?

A GitHub repository uses Maven for a Java application. The security team wants to automatically receive pull requests that update vulnerable dependencies to a fixed version. What should you configure?

Keep studying — Develop a security and compliance plan