AZ-400 Develop a security and compliance plan Practice Question
Which TWO actions should you take to ensure that Azure Pipelines artifacts are scanned for vulnerabilities before production deployment? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run dependency scanning on the artifact manifest
For ensuring Azure Pipelines artifacts are scanned for vulnerabilities before production deployment, the correct actions are A and C. Option A: Running dependency scanning on the artifact manifest (e.g., package.json, pom.xml) identifies known vulnerabilities in open-source dependencies. Option C: Using Microsoft Defender for Cloud to scan artifacts (such as container images) during the pipeline provides comprehensive vulnerability detection. Option B is incorrect because signing artifacts with a code signing certificate ensures integrity and authenticity, not vulnerability scanning. Option D is incorrect because scanning Infrastructure as Code (IaC) templates addresses configuration security, not artifact vulnerabilities. Option E is incorrect because static code analysis examines source code for coding flaws, not dependencies or artifacts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Run dependency scanning on the artifact manifest
Why this is correct
Dependency scanning on the artifact manifest examines the SBOM or dependency lock files (e.g., package-lock.json, packages.lock.json) to identify known Common Vulnerabilities and Exposures (CVEs) in third-party libraries. In Azure Pipelines, this is done with tools like Trivy or OWASP Dependency Check, ensuring that the exact dependency versions that ship in the artifact are assessed for vulnerabilities.
- ✗
Sign the artifacts with a code signing certificate
Why it's wrong here
Code signing certificates establish the authenticity and integrity of an artifact by verifying the publisher and detecting tampering, but they do not inspect the artifact's contents for known vulnerabilities. Signing protects against malicious modification, not against using a dependency that contains a critical CVE, so it cannot replace dependency or vulnerability scanning in the pipeline.
- ✓
Use Microsoft Defender for Cloud to scan the artifact during the pipeline
Why this is correct
Microsoft Defender for Cloud can scan container images and other artifacts for OS-level and library-level vulnerabilities during the pipeline, using its integrated vulnerability assessment engine. Running this scan against the built artifact, typically by publishing the image to a registry or using the Defender for Cloud Azure DevOps extension, provides a direct security gate before deployment.
- ✗
Scan the infrastructure as code templates
Why it's wrong here
Scanning infrastructure as code templates (e.g., Terraform, ARM templates) with tools like Checkov or Terrascan identifies misconfigurations in the deployed environment, such as open ports or weak access controls. This is environment-level security, completely separate from artifact-level vulnerability scanning, and therefore does not ensure the pipeline artifact itself is free of known weaknesses.
- ✗
Run static code analysis on the source code
Why it's wrong here
Static code analysis on source code (e.g., SonarQube, CodeQL) inspects the application's own code for defects and security patterns before compilation, but it does not evaluate the built artifact. Because a build can resolve, download, or embed dependencies not present in source, this step cannot guarantee that the final artifact lacks known vulnerable components.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Dependency scanning
Dependency scanning is the automated process of checking software components for known security vulnerabilities and outdated versions.
Key term
Pipeline
A pipeline is an automated series of steps that takes code from development to production, ensuring quality and speed.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.