AZ-400 Stuff > Develop a security and compliance plan > Flashcards

Develop a security and compliance plan Flashcards

(96 cards)

Study These Flashcards
1
Q

What is the difference between authentication and authorization

A

Authentication verifies identity while authorization grants access to resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

When should you use a Service Principal in Azure DevOps

A

When a nonhuman application or automation needs to access Azure resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the purpose of a Managed Identity in Azure

A

To provide an automatically managed identity for Azure services without credentials

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Describe the difference between a system-assigned and user-assigned Managed Identity

A

System-assigned is tied to one resource user-assigned can be shared among resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

When would you choose a user-assigned Managed Identity

A

When multiple resources need to share the same identity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How is authentication handled for GitHub Actions using GITHUB_TOKEN

A

GitHub automatically creates a short-lived token available to the workflow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a GitHub App used for

A

For integrating external tools or services in a secure granular way

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

When should you use a personal access token in GitHub

A

For manual authentication by users or custom scripts that cannot use GITHUB_TOKEN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How do you securely store a GitHub personal access token in a workflow

A

Add it as an encrypted repository secret

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a service connection in Azure DevOps

A

A secure connection for Azure Pipelines or Releases to access external services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which Azure DevOps token type is designed for personal automation or API access

A

Personal Access Token PAT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Why should you prefer service connections over PATs in Azure DevOps

A

Service connections have more granular controls and can be managed centrally

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are permissions in GitHub

A

Settings defining what actions users and teams can perform in repositories

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How do you assign repository access to a team in GitHub

A

Add the team to the repository and set the desired permission level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the role of security groups in Azure DevOps

A

To organize users and manage permissions across projects and teams

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How do you restrict permission inheritance in Azure DevOps

A

Use custom security groups or set explicit permissions at project or resource level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the benefit of using Teams in Azure DevOps

A

To manage permissions work items and notifications for a group of users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What access level is given to users who can only view work items in Azure DevOps

A

Stakeholder access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Who are outside collaborators in GitHub

A

Users invited to individual repositories with limited access to the organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the purpose of organizing projects in Azure DevOps

A

To logically separate workloads teams and security boundaries

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

How do you add a new team to a project in Azure DevOps

A

Go to Project Settings Teams and select New team

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the principle of least privilege in DevOps security

A

Granting users and services only the access absolutely necessary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Where should you store secrets keys and certificates for Azure pipelines

A

Azure Key Vault

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

How can a pipeline access values from Azure Key Vault

A

Using an Azure Key Vault task or variable group in the pipeline

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What is a best practice for storing secrets in GitHub Actions
Store them as encrypted secrets at the repo or org level
26
How do you prevent accidental exposure of secrets in pipeline logs
Mask secret values and avoid echoing values in output
27
What is the Azure Pipelines secure files feature used for
Storing sensitive files like certificates for access during pipeline runs
28
How do you upload a sensitive file to be used securely in Azure Pipelines
Store it as a secure file within the pipeline library
29
What should you avoid in your scripts and templates to prevent secret leakage
Never hardcode secrets and do not print secret variables
30
How does a pipeline variable marked as secret behave
Its value is redacted in logs to avoid exposure
31
Name a method for limiting secret lifetime in automation
Use short-lived tokens or rotate secrets regularly
32
What is dependency scanning in secure DevOps
Checking dependencies for known vulnerabilities or outdated versions
33
What is code scanning used for in DevOps
Automatically analyzing source code for security vulnerabilities or bugs
34
Which tool does Microsoft recommend for automating code scanning in GitHub
CodeQL
35
What is a secret scan in the context of CI
Searching for credentials and sensitive values accidentally checked into source code
36
How can you automate license compliance checks in open source projects
Use automated tools like Dependabot to report licensing compliance
37
What does Microsoft Defender for Cloud DevOps Security provide
Integrated security analysis and monitoring for Azure DevOps and GitHub
38
How do you enable Microsoft Defender for Cloud DevOps Security
Turn on Defender for DevOps under Microsoft Defender for Cloud settings
39
What is GitHub Advanced Security used for
Advanced code scanning secret scanning and dependency review in GitHub and Azure DevOps
40
How can GitHub Advanced Security be integrated with Azure DevOps
Enable Advanced Security in the Azure DevOps project then connect with GitHub Advanced Security
41
How does Microsoft Defender for Cloud integrate with GitHub Advanced Security
Combines insights and alerts from both platforms for holistic security visibility
42
What type of resources can be protected with GitHub Advanced Security
GitHub repositories and Azure DevOps repositories
43
Which built-in tool can automatically update and scan dependencies in GitHub
Dependabot
44
What is the role of CodeQL analysis within containers
It scans containerized application code for security vulnerabilities
45
How do you initiate CodeQL analysis as part of a GitHub Actions workflow
Add the GitHub Actions CodeQL workflow to the repository
46
What is container image scanning
Analyzing container images for security vulnerabilities and compliance issues
47
Name a Microsoft service that provides container image scanning
Microsoft Defender for Containers
48
Why is it important to scan open-source dependencies
To identify vulnerabilities and licensing issues before production
49
How does Dependabot help manage open-source vulnerabilities
It creates alerts and pull requests with fixes for outdated or vulnerable packages
50
What is a key benefit of using GITHUB_TOKEN over a personal access token
It is short-lived automatically rotated and restricted in scope
51
Where are GitHub Actions secrets encrypted
On GitHub servers until used in a workflow
52
How should you avoid exposing secrets in build output
Do not log or echo secret variables in scripts or pipeline steps
53
What is a good practice for managing access to repository secrets in GitHub
Limit secret access to required workflows and individuals only
54
What does Azure Key Vault provide for certificates
Secure certificate storage lifecycle management and access controls
55
How do you reference Azure Key Vault secrets from an ARM template or Bicep file
Use a Key Vault reference as part of the template parameter
56
What type of files should be stored as Azure Pipelines secure files
Certificates provisioning profiles or any sensitive deployment assets
57
How do you remove unused secrets from a repository or pipeline
Delete them from the secrets management or key vault interface
58
Why is regular secret rotation important for security
It reduces exposure from potential leaks or compromised credentials
59
When configuring a service connection what is a security best practice
Use the minimum required permissions and enable approval if available
60
What Azure DevOps feature allows granular pipeline run permissions
Pipeline permissions in project security settings
61
How can you monitor unauthorized access attempts in DevOps platforms
Review audit logs and configure alerting on unusual activity
62
What is the recommended way to share deployment credentials across multiple pipelines
Use a centrally managed vault such as Azure Key Vault or organization secrets
63
How do you control which users can approve pipeline deployments
Set environment protection rules or approval policies
64
What is one way to automate compliance checks in a DevOps pipeline
Add automated tasks or extensions for compliance scanning tools
65
How is secret scanning enabled in GitHub repositories
Enable secret scanning in repository or organization settings with Advanced Security
66
What does enabling GitHub Advanced Security provide to a repository
Enables code scanning secret scanning and dependency review features
67
What is the recommended tool for security scanning in Azure DevOps
Microsoft Defender for Cloud DevOps Security or integrated third-party scanners
68
How do you configure a GitHub App for fine-grained repository access
Set specific repository and organization permissions during app registration
69
What is RBAC and how is it applied in Azure DevOps
Role-Based Access Control assigns user roles and permissions to restrict resources
70
What is the best practice for providing access to a contractor in GitHub
Invite as an outside collaborator to relevant repositories only
71
What type of information should never be committed to source control
Passwords private keys connection strings and API keys
72
How do you keep sensitive configuration files safe during deployment
Store them as secure files and only decrypt when running in the appropriate environment
73
What policy can you enable to require secret scanning in GitHub Actions workflows
Use required workflows and enable secret scanning at the org or repo level
74
What is Azure DevOps Stakeholder access appropriate for
Users who need basic work tracking without contributing code or accessing resources
75
How do you automate open source package vulnerability checks in GitHub
Enable Dependabot alerts for the repository
76
What setting allows automatic dependency updates in Azure DevOps
Enable pipeline tasks for dependency updates or use extensions like Dependabot for Azure
77
When integrating with a third-party service what is a safer credential storage method for pipelines
Use Azure Key Vault or GitHub secrets instead of plaintext variables
78
How do you ensure deleted users no longer have access to your DevOps platform
Regularly audit memberships and use automated identity management controls
79
What type of compliance scanning is critical in regulated environments
License verification vulnerability scans and audit logging
80
How does CodeQL assist with compliance and security
Automatically identifies vulnerabilities and coding errors as part of the workflow
81
How do you configure a pipeline to run security analysis on every pull request
Set triggers on pull requests to run security or code scanning jobs
82
What environment variable provides the token in GitHub Actions workflows
GITHUB_TOKEN
83
What is the benefit of using secret variables over plain variables in pipeline definitions
Secret variables are encrypted and masked in build logs
84
How do you restrict which workflows can access a specific secret in GitHub
Configure secret access policy in repository or environment settings
85
Why automate secret expiration and rotation
Limits the attack window if credentials are exposed
86
What is a primary benefit of system-assigned Managed Identities
They automatically clean up with the resource and do not require user management
87
How do you monitor compliance of open source dependencies
Automate dependency checks with tools like Dependabot or native scanning solutions
88
What logging feature is crucial for investigating security incidents in pipelines
Centralized audit logs for access and pipeline actions
89
How can you enforce multi-factor authentication for DevOps tool access
Configure MFA or SSO with organization identity providers
90
How do you ensure that only authorized users can modify pipeline definitions
Restrict repository branch protection and pipeline editing permissions
91
What is Secure DevOps Kit for Azure
A collection of tools and scripts for security best practices in Azure environments
92
How do you integrate SAST Static Application Security Testing into CI workflows
Add SAST scanning tasks or steps in the build pipeline
93
What is a recommended process for managing certificates in automated deployments
Store in a vault and use secure file tasks for deployment retrieval
94
How do you ensure compliance checks are repeated for every deployment
Include automated compliance or security scanning steps in each pipeline run
95
How is the audit trail maintained for pipeline usage and changes
Enable auditing and use source control for pipeline definitions
96
What is the use of Azure Policies in the context of DevOps security
To enforce deployment standards and security rules automatically
AZ-400 Stuff
flashcards
Decks in class (5)
# Cards
Brainscape helps you reach your goals faster, through stronger study habits.
© 2026 Bold Learning Solutions. Terms and Conditions