A team uses GitHub Actions to build a Java application and a container image. They want to run CodeQL analysis on the Java code and also scan the container image for vulnerabilities. The pipeline must fail if a critical vulnerability is found in the image. What should they configure?

Add a step that runs `trivy` on the image and uploads the results as an artifact.

Add only CodeQL init and analyze steps to the workflow.

Enable Dependabot alerts for the repository.

Add CodeQL init and analyze steps to the workflow, and add a step that runs `docker scan` on the image with a failure condition.

Which connector in Microsoft Defender for Cloud allows ingestion of GitHub Advanced Security alerts?

Azure Active Directory connector

A security team wants to implement a policy that blocks pull requests with critical security findings in a GitHub repository. They also want to see these findings in Microsoft Defender for Cloud. However, they are concerned about developer productivity and want to avoid blocking on low-severity issues. What should you configure?

Use Microsoft Defender for Cloud to automatically block pull requests.

Enable GitHub Advanced Security and configure branch protection to require all security checks to pass.

Use Dependabot alerts and require manual review of all alerts before merging.

Use a GitHub Actions workflow that runs CodeQL and fails the build only on critical findings, and connect the repository to Defender for Cloud DevOps Security.

A team uses Azure DevOps for a .NET application. They want to automatically scan for secrets and known vulnerabilities in code and dependencies, and block pull requests when critical issues are found. What should you configure?

Configure branch policies to require a successful build before merging.

Enable GitHub Advanced Security for Azure DevOps and use the Advanced Security tasks in pipelines.

Use Microsoft Defender for Cloud to scan the Azure DevOps repositories.

Install the Dependabot app in Azure DevOps.

Microsoft Certified:DevOps Engineer Expert

Domain 4Objective 3

Automate Security and Compliance Scanning AZ-400 Practice Questions (Page 4)

Part of the Develop a security and compliance plan domain, which makes up ~19% of our current practice bank. Microsoft does not publish an official question count, but from its 140-minute exam (~55–95 total, ~10–18 in this domain), expect 3–6 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

6concepts

Questions 16–20

16expert · hard
A team uses GitHub Actions to build a Java application and a container image. They want to run CodeQL analysis on the Java code and also scan the container image for vulnerabilities. The pipeline must fail if a critical vulnerability is found in the image. What should they configure?
Select an answer first
17foundation · easy
Which connector in Microsoft Defender for Cloud allows ingestion of GitHub Advanced Security alerts?
Select an answer first
18expert · hard
A security team wants to implement a policy that blocks pull requests with critical security findings in a GitHub repository. They also want to see these findings in Microsoft Defender for Cloud. However, they are concerned about developer productivity and want to avoid blocking on low-severity issues. What should you configure?
Select an answer first
19application · medium
A team uses Azure DevOps for a .NET application. They want to automatically scan for secrets and known vulnerabilities in code and dependencies, and block pull requests when critical issues are found. What should you configure?
Select an answer first
20foundation · easy
Which tool is commonly used to scan container images for known vulnerabilities in the base operating system and installed packages?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-400

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-400” is a trademark of its owner, used for identification only.

Automate Security and Compliance Scanning AZ-400 Practice Questions (Page 4)

Questions 16–20

A team uses GitHub Actions to build a Java application and a container image. They want to run CodeQL analysis on the Java code and also scan the container image for vulnerabilities. The pipeline must fail if a critical vulnerability is found in the image. What should they configure?

Which connector in Microsoft Defender for Cloud allows ingestion of GitHub Advanced Security alerts?

A team uses Azure DevOps for a .NET application. They want to automatically scan for secrets and known vulnerabilities in code and dependencies, and block pull requests when critical issues are found. What should you configure?

Which tool is commonly used to scan container images for known vulnerabilities in the base operating system and installed packages?

Keep studying — Develop a security and compliance plan