A team builds a container image in Azure DevOps and pushes it to Azure Container Registry. They want to automatically scan the image for OS and library vulnerabilities before it is deployed to production. What should you configure in the pipeline?

Use the Trivy scan task in the pipeline to scan the image after pushing to the registry.

Add a task that runs `docker scan` after the image is built and fails the pipeline if vulnerabilities are found.

Configure a webhook in Azure Container Registry to trigger a scan on image push.

Enable vulnerability scanning in Azure Container Registry and rely on the registry scan results.

What is the primary purpose of Microsoft Defender for Cloud DevOps Security?

To replace the need for separate code scanning tools in the pipeline

To automatically fix all security vulnerabilities found in the code

To manage user permissions for DevOps pipelines

To provide centralized security management and recommendations for DevOps environments

A team uses GitHub for a JavaScript application. They want to automatically receive alerts when a dependency has a known vulnerability and also see the impact on their repository. What should you enable?

GitHub Advanced Security secret scanning.

Microsoft Certified:DevOps Engineer Expert

Domain 4Objective 3

Automate Security and Compliance Scanning AZ-400 Practice Questions (Page 2)

Part of the Develop a security and compliance plan domain, which makes up ~19% of our current practice bank. Microsoft does not publish an official question count, but from its 140-minute exam (~55–95 total, ~10–18 in this domain), expect 3–6 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

6concepts

Questions 6–10

6application · medium
A team builds a container image in Azure DevOps and pushes it to Azure Container Registry. They want to automatically scan the image for OS and library vulnerabilities before it is deployed to production. What should you configure in the pipeline?
Select an answer first
7foundation · easy
In Azure DevOps, which feature provides GitHub Advanced Security-like capabilities such as code scanning and secret scanning?
Select an answer first
8foundation · easy
What is the primary purpose of Microsoft Defender for Cloud DevOps Security?
Select an answer first
9foundation · easy
Which Microsoft service provides a unified dashboard for security recommendations across GitHub repositories and Azure DevOps pipelines?
Select an answer first
10application · medium
A team uses GitHub for a JavaScript application. They want to automatically receive alerts when a dependency has a known vulnerability and also see the impact on their repository. What should you enable?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-400

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-400” is a trademark of its owner, used for identification only.

Automate Security and Compliance Scanning AZ-400 Practice Questions (Page 2)

Questions 6–10

A team builds a container image in Azure DevOps and pushes it to Azure Container Registry. They want to automatically scan the image for OS and library vulnerabilities before it is deployed to production. What should you configure in the pipeline?

In Azure DevOps, which feature provides GitHub Advanced Security-like capabilities such as code scanning and secret scanning?

What is the primary purpose of Microsoft Defender for Cloud DevOps Security?

Which Microsoft service provides a unified dashboard for security recommendations across GitHub repositories and Azure DevOps pipelines?

A team uses GitHub for a JavaScript application. They want to automatically receive alerts when a dependency has a known vulnerability and also see the impact on their repository. What should you enable?

Keep studying — Develop a security and compliance plan