AZ-400 Practice Question: Design and implement build and release pipelines
You need to integrate security scanning into your build pipeline to detect vulnerable open-source dependencies. Which Azure DevOps extension should you use?
⚠ Common exam trap
Test-takers frequently confuse Azure Policy (a governance tool) or SonarQube (a code quality tool) with a dedicated dependency vulnerability scanner, overlooking that WhiteSource Bolt is purpose-built for open-source security scanning in Azure Pipelines.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
WhiteSource Bolt
WhiteSource Bolt is a free Azure DevOps extension that integrates directly into build pipelines to automatically scan open-source dependencies for known vulnerabilities. It identifies vulnerable components, provides remediation guidance, and enforces security policies without requiring additional configuration or external tools, making it the correct choice for this scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
WhiteSource Bolt
Why this is correct
WhiteSource Bolt is a build-task extension in Azure DevOps that scans open-source components from package managers like npm, NuGet, and Maven against the Whitesource vulnerability database, failing the pipeline on known CVEs and generating an inline report. It fits the requirement directly because it performs security scanning during the build, whereas other options either do not target open-source dependencies or are not integrated into Azure Pipelines.
- ✗
Azure Policy
Why it's wrong here
Azure Policy is an Azure governance service that enforces and audits compliance rules on Azure resources (such as VM SKUs, tagging, or resource locations), not a pipeline security scanner. It cannot scan code or dependency vulnerabilities inside your build artifacts, so it is not appropriate for integrating security scanning into a build pipeline.
- ✗
GitHub Advanced Security
Why it's wrong here
GitHub Advanced Security is a suite of code-scanning, secret-scanning, and dependency-review tools tightly integrated into GitHub.com or GitHub Enterprise, often used with GitHub Actions. While Microsoft owns GitHub, this tooling is not natively available as an Azure DevOps build task, so it cannot be plugged directly into an Azure Pipeline for the security scan required here.
- ✗
SonarQube
Why it's wrong here
SonarQube is a static code-analysis server that detects code smells, bugs, and some security hotspots through rules and quality gates, often run as an Azure DevOps task. It focuses on source-code quality and static analysis rather than known vulnerabilities in open-source dependencies, so it complements rather than fulfills the specific requirement of scanning open-source components.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
DevOps
DevOps is a set of practices that combines software development (Dev) and IT operations (Ops) to shorten the development lifecycle and deliver high-quality software continuously.
Key term
Azure DevOps
Azure DevOps is a Microsoft service that provides development tools for planning, building, testing, and deploying software applications using automated pipelines and collaboration features.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.