Download Microsoft.AZ-400.PrepAway.2021-02-21.129q.tqb
| Vendor: | Microsoft |
| Exam Code: | AZ-400 |
| Exam Name: | Microsoft Azure DevOps Solutions |
| Date: | Feb 21, 2021 |
| File Size: | 8 MB |
Demo Questions
Question 1
You use Azure Artifacts to host NuGet packages that you create.
You need to make one of the packages available to anonymous users outside your organization. The solution must minimize the number of publication points.
What should you do?
- Change the feed URL of the package
- Create a new feed for the package
- Promote the package to a release view.
- Publish the package to a public NuGet repository.
Correct answer: B
Explanation:
Azure Artifacts introduces the concept of multiple feeds that you can use to organize and control access to your packages. Packages you host in Azure Artifacts are stored in a feed. Setting permissions on the feed allows you to share your packages with as many or as few people as your scenario requires. Feeds have four levels of access: Owners, Contributors, Collaborators, and Readers.References: https://docs.microsoft.com/en-us/azure/devops/artifacts/feeds/feed-permissions?view=vsts&tabs=new-nav Azure Artifacts introduces the concept of multiple feeds that you can use to organize and control access to your packages.
Packages you host in Azure Artifacts are stored in a feed. Setting permissions on the feed allows you to share your packages with as many or as few people as your scenario requires.
Feeds have four levels of access: Owners, Contributors, Collaborators, and Readers.
References: https://docs.microsoft.com/en-us/azure/devops/artifacts/feeds/feed-permissions?view=vsts&tabs=new-nav
Question 2
You need to increase the security of your team’s development process.
Which type of security tool should you recommend for each stage of the development process? To answer, drag the appropriate security tools to the correct stages. Each security tool may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Correct answer: To work with this question, an Exam Simulator is required.
Explanation:
Box 1: Threat modelingThreat modeling’s motto should be, “The earlier the better, but not too late and never ignore.” Box 2: Static code analysisValidation in the CI/CD begins before the developer commits his or her code. Static code analysis tools in the IDE provide the first line of defense to help ensure that security vulnerabilities are not introduced into the CI/CD process. Box 3: Penetration testingOnce your code quality is verified, and the application is deployed to a lower environment like development or QA, the process should verify that there are not any security vulnerabilities in the running application. This can be accomplished by executing automated penetration test against the running application to scan it for vulnerabilities. References: https://docs.microsoft.com/en-us/azure/devops/articles/security-validation-cicd-pipeline?view=vsts Box 1: Threat modeling
Threat modeling’s motto should be, “The earlier the better, but not too late and never ignore.”
Box 2: Static code analysis
Validation in the CI/CD begins before the developer commits his or her code. Static code analysis tools in the IDE provide the first line of defense to help ensure that security vulnerabilities are not introduced into the CI/CD process.
Box 3: Penetration testing
Once your code quality is verified, and the application is deployed to a lower environment like development or QA, the process should verify that there are not any security vulnerabilities in the running application. This can be accomplished by executing automated penetration test against the running application to scan it for vulnerabilities.
References: https://docs.microsoft.com/en-us/azure/devops/articles/security-validation-cicd-pipeline?view=vsts
Question 3
During a code review, you discover many quality issues. Many modules contain unused variables and empty catch blocks.
You need to recommend a solution to improve the quality of the code.
What should you recommend?
- In a Grunt build task, select Enabled from Control Options.
- In a Maven build task, select Run PMD.
- In a Xcode build task, select Use xcpretty from Advanced.
- In a Gradle build task, select Run Checkstyle.
Correct answer: B
Explanation:
PMD is a source code analyzer. It finds common programming flaws like unused variables, empty catch blocks, unnecessary object creation, and so forth. There is an Apache Maven PMD Plugin which allows you to automatically run the PMD code analysis tool on your project's source code and generate a site report with its results. Incorrect Answers:C: xcpretty is a fast and flexible formatter for xcodebuild.References: https://pmd.github.io/ PMD is a source code analyzer. It finds common programming flaws like unused variables, empty catch blocks, unnecessary object creation, and so forth.
There is an Apache Maven PMD Plugin which allows you to automatically run the PMD code analysis tool on your project's source code and generate a site report with its results.
Incorrect Answers:
C: xcpretty is a fast and flexible formatter for xcodebuild.
References: https://pmd.github.io/
