Microsoft DevOps Engineer Expert AZ-400 Practice Question

Your organization hosts 150 private GitHub repositories that build and publish Docker images by using Azure Pipelines.
You must meet the following security and compliance requirements:

Identify known vulnerabilities in the base image before the image is pushed to Azure Container Registry (ACR).
Block pull requests that introduce credentials, tokens, or other secrets.
Prevent packages that carry any GPL license from being added to the dependency graph.
Provide a single, centrally-managed solution that requires little or no per-repository maintenance and surfaces results directly in each pull request conversation.

Which strategy should you recommend?

Create an Azure DevOps pipeline template that runs OWASP Dependency-Check, Gitleaks, and Trivy in separate jobs; reference the template from every repository's pipeline definition.
Enable GitHub Advanced Security for the GitHub organization, require secret scanning, CodeQL, and dependency review status checks, and publish a reusable organization-level workflow that runs the azure/container-scan action during the build.
Apply an Azure Policy initiative that blocks pushes containing secrets, enable Qualys-based image scanning in ACR, and integrate a third-party Black Duck server for license compliance.
Install Microsoft Defender for Cloud DevOps Security, rely on its automated repository analysis, enable Dependabot alerts on each repository, and use ACR's image scan after the push completes.

Report Issue

Answer Description

Enabling GitHub Advanced Security (GHAS) at the organization level turns on secret scanning, dependency review, and CodeQL for every repository without additional per-repository configuration. Dependency review evaluates licenses on any new or updated package, and a required status check can block GPL-licensed packages. Adding a centrally-maintained reusable workflow that calls the public azure/container-scan action scans Dockerfiles and images with Trivy and uploads the SARIF report, so vulnerabilities appear as a code-scanning result in the same pull request. Because the workflow lives once in the organization's actions catalogue, repositories only need a one-line reference to consume it, satisfying the low-maintenance requirement. The other options either omit license blocking, lack pre-push image scanning, or require significant per-repository setup.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.