az 400 revision 2

You need to consider the underlined segment to establish whether it is accurate.
To find when common open source libraries are added to the code base, you should add Jenkins to the build pipeline.
Select `No adjustment required` if the underlined segment is accurate. If the underlined segment is inaccurate, select the accurate option.

• • A. No adjustment required.

• • B. SourceGear Vault

• • C. WhiteSource

• • D. OWASP ZAP

Answer explanation

WhiteSource is the leader in continuous open source software security and compliance management. WhiteSource integrates into your build process, irrespective of your programming languages, build tools, or development environments. It works automatically, continuously, and silently in the background, checking the security, licensing, and quality of your open source components against WhiteSource constantly-updated definitive database of open source repositories.
Azure DevOps integration with WhiteSource Bolt will enable you to:
1. Detect and remedy vulnerable open source components.
2. Generate comprehensive open source inventory reports per project or build.
3. Enforce open source license compliance, including dependencies' licenses.
4. Identify outdated open source libraries with recommendations to update.

You use Azure Pipelines to manage build pipelines, GitHub to store source code, and Dependabot to manage dependencies.
You have an app named App1.
Dependabot detects a dependency in App1 that requires an update.
What should you do first to apply the update?

• • A. Create a pull request.

• • B. Approve the pull request.

• • C. Create a branch.

• • D. Perform a commit.

Answer explanation

DependaBot is a useful tool to regularly check for dependency updates. By helping to keep your project up to date, DependaBot can reduce technical debt and immediately apply security vulnerabilities when patches are released. How does DependaBot work?
1. DependaBot regularly checks dependencies for updates
2. If an update is found, DependaBot creates a new branch with this upgrade and Pull Request for approval
3. You review the new Pull Request, ensure the tests passed, review the code, and decide if you can merge the change

You plan to provision a self-hosted Linux agent.
Which authentication mechanism should you use to register the self-hosted agent?

• • A. personal access token (PAT)

• • B. SSH key

• • C. Alternate credentials

• • D. certificate

Answer explanation

PAT Supported only on Azure Pipelines and TFS 2017 and newer. After you choose PAT, paste the PAT token you created into the command prompt window. Use a personal access token (PAT) if your Azure DevOps Server or TFS instance and the agent machine are not in a trusted domain. PAT authentication is handled by your Azure DevOps Server or TFS instance instead of the domain controller.

Your company uses Azure DevOps. Only users who have accounts in Azure Active Directory can access the Azure DevOps environment. You need to ensure that only devices that are connected to the on-premises network can access the Azure DevOps environment. What should you do?

• • A. Assign the Stakeholder access level to all users.

• • B. In Azure DevOps, configure Security in Project Settings.

• • C. In Azure AD, configure conditional access.

• • D. In Azure AD, configure risky sign-ins.

Answer explanation

C. In Azure AD, configure conditional access. Conditional access in Azure AD allows you to define access policies that determine the conditions under which users and devices can access Azure DevOps and other Microsoft services. Option A (Assign the Stakeholder access level to all users): The Stakeholder access level in Azure DevOps is related to permissions and roles within the DevOps environment but does not control network-level access. It's not directly related to enforcing network access restrictions. Option B (In Azure DevOps, configure Security in Project Settings): While security settings within Azure DevOps are important for controlling access and permissions within the platform, they do not directly address the requirement of restricting access to on-premises network-connected devices. Option D (In Azure AD, configure risky sign-ins):

You have an application that consists of several Azure App Service web apps and Azure functions.
You need to assess the security of the web apps and the functions.
Which Azure feature can you use to provide a recommendation for the security of the application?

• • A. Security & Compliance in Azure Log Analytics

• • B. Resource health in Azure Service Health

• • C. Smart Detection in Azure Application Insights

• • D. Compute & apps in Azure Security Center

Answer explanation

Monitor compute and app services: Compute & apps include the App Services tab, which App services: list of your App service environments and current security state of each.

Recommendations -
This section has a set of recommendations for each VM and computer, web and worker roles, Azure App Service Web Apps, and Azure App Service Environment that Security Center monitors. The first column lists the recommendation. The second column shows the total number of resources that are affected by that recommendation. The third column shows the severity of the issue.
Incorrect Answers:

You need to consider the underlined segment to establish whether it is accurate.
Black Duck can be used to make sure that all the open source libraries conform to your company's licensing criteria.
Select `No adjustment required` if the underlined segment is accurate. If the underlined segment is inaccurate, select the accurate option.

• • A. No adjustment required.

• • B. Maven

• • C. Bamboo

• • D. CMAKE

Answer explanation

Secure and Manage Open Source Software
Black Duck helps organizations identify and mitigate open source security, license compliance and code-quality risks across application and container portfolios.
Black Duck Hub and its plugin for Team Foundation Server (TFS) allows you to automatically find and fix open source security vulnerabilities during the build process, so you can proactively manage risk. The integration allows you to receive alerts and fail builds when any Black Duck Hub policy violations are met.

You have a branch policy in a project in Azure DevOps. The policy requires that code always builds successfully.
You need to ensure that a specific user can always merge changes to the master branch, even if the code fails to compile. The solution must use the principle of least privilege.
What should you do?

• • A. Add the user to the Build Administrators group.

• B. Add the user to the Project Administrators group

• • C. From the Security settings of the repository, modify the access control for the user.

• • D. From the Security settings of the branch, modify the access control for the user.

Answer explanation

n some cases, you need to bypass policy requirements so you can push changes to the branch directly or complete a pull request even if branch policies are not satisfied. For these situations, grant the desired permission from the previous list to a user or group. You can scope this permission to an entire project, a repo, or a single branch. Manage this permission along the with other Git permissions.

You are building a Microsoft ASP.NET application that requires authentication.
You need to authenticate users by using Azure Active Directory (Azure AD).
What should you do first?

• • A. Assign an enterprise application to users and groups

• • B. Create an app registration in Azure AD

• • C. Configure the application to use a SAML endpoint

• • D. Create a new OAuth token from the application

• • E. Create a membership database in an Azure SQL database

Answer explanation

Register your application to use Azure Active Directory. Registering the application means that your developers can use Azure AD to authenticate users and request access to user resources such as email, calendar, and documents.

You need to configure GitHub to use Azure Active Directory (Azure AD) for authentication.
What should you do first?

• • A. Create a conditional access policy in Azure AD.

• • B. Register GitHub in Azure AD.

• • C. Create an Azure Active Directory B2C (Azure AD B2C) tenant.

• • D. Modify the Security settings of the GitHub organization.

Answer explanation

When you connect to a Git repository from your Git client for the first time, the credential manager prompts for credentials. Provide your Microsoft account or Azure
AD credentials.
Note: Git Credential Managers simplify authentication with your Azure Repos Git repositories. Credential managers let you use the same credentials that you use for the Azure DevOps Services web portal. Credential managers support multi-factor authentication through Microsoft account or Azure Active Directory (Azure
AD). Besides supporting multi-factor authentication with Azure Repos, credential managers also support two-factor authentication with GitHub repositories.

You have a multi-tier application that has an Azure Web Apps front end and an Azure SQL Database back end. You need to recommend a solution to capture and store telemetry data. The solution must meet the following requirements: ✑ Support using ad-hoc queries to identify baselines. ✑ Trigger alerts when metrics in the baseline are exceeded. ✑ Store application and database metrics in a central location. What should you include in the recommendation?

• • A. Azure Event Hubs

• • B. Azure SQL Database Intelligent Insights

• • C. Azure Application Insights

• • D. Azure Log Analytics

Answer explanation

Azure Platform as a Service (PaaS) resources, like Azure SQL and Web Sites (Web Apps), can emit performance metrics data natively to Log Analytics.
The Premium plan will retain up to 12 months of data, giving you an excellent baseline ability.
There are two options available in the Azure portal for analyzing data stored in Log analytics and for creating queries for ad hoc analysis.
Incorrect Answers: