SIMULATION
-
Initialize the default main branch, if it does not exist already.
In the User1-12345678 organization, you need to install the Microsoft Security DevOps extension.
Next, create a new starter pipeline named starter1 that will use the following starter code.
Ensure that starter1 includes a task that executes the extension and uses the following inputs:
• Command: run
• Policy: azuredevops
• Publish: true
Save the pipeline to a new branch named starter.
Show Answer
Correct Answer: 1. Initialize the default **main** branch if it does not exist.
2. Install **Microsoft Security DevOps** extension in the *User1-12345678* organization.
3. Create a new **Starter pipeline** named **starter1**.
4. Use the provided YAML and add the Microsoft Security DevOps task with:
- Command: run
- Policy: azuredevops
- Publish: true
5. Save the pipeline to a new branch named **starter**.
Explanation: The task requires setting up the Azure DevOps environment, installing the Microsoft Security DevOps extension at the organization level, and creating a YAML-based starter pipeline. The pipeline must include the MicrosoftSecurityDevOps task configured with the specified inputs and be committed to a new branch named starter, using the provided trigger and pool settings.
Question 12
HOTSPOT
-
You have a GitHub repository named Repo1 and an app named App1. Repo1 stores the source code for App1.
You need to perform the following tests:
• Test1: Run a ZAP spider against App1 for one minute and wait for passive scanning to complete. The test must NOT perform active attacks.
• Test2: Run a ZAP spider against App1, and when complete, execute an AJAX spider scan.
Which GitHub action should you use for each test? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Test1: ZAP Baseline Scan
Test2: ZAP Full Scan
Explanation: ZAP Baseline Scan runs a spider and waits for passive scanning to complete without performing active attacks. ZAP Full Scan runs a traditional spider and supports AJAX spidering after the initial crawl.
Question 13
You have a GitHub repository that uses GitHub Actions and stores access keys by using GitHub encrypted secrets.
You plan to update the secrets by using the GitHub REST API.
You need to wrap the secrets before adding them to a REST-based call.
Which encryption library should you use?
A. CryptoNet
B. BouncyCastle
C. libsodium
D. hashlib
Show Answer
Correct Answer: C
Explanation: GitHub requires secrets sent via the REST API to be encrypted using the repository’s public key with the same mechanism GitHub uses internally. This encryption is performed with libsodium (NaCl), which is explicitly documented by GitHub for encrypting secrets. The other options are either unrelated, generic, or provide hashing rather than the required encryption.
Question 14
HOTSPOT
-
You have an Azure DevOps project that is used to build and test an app named App1.
You need to troubleshoot the following issues:
• Most bugs are detected and reported by customers.
• It takes a long time to detect failures.
Which metric should you review for each issue? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Most bugs being detected and reported by customers:
Defect escape rate
It takes a long time to detect failures:
Mean time to detection
Explanation: Defect escape rate measures how many defects bypass internal testing and are found by customers after release. Mean time to detection (MTTD) measures how long it takes to discover failures after they occur.
Question 15
You manage a project by using Azure Boards, and you manage the project code by using GitHub repositories.
You have a work item that has an ID of 123.
You need to link a commit message in GitHub to work item 123 on the board.
What are two ways to achieve the goal? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A. From the Development settings of work item 123, select Add link, and then enter the URL of the commit.
B. Add AB#123 to the text of the commit message.
C. Add GH-123 to the text of the commit message.
D. From the Links settings of work item 123, select Add link, select Existing item, and then enter the URL of the commit.
E. To work item 123, add a comment that includes the URL of the commit.
Show Answer
Correct Answer: A, B
Explanation: You can link a GitHub commit to an Azure Boards work item either automatically or manually. Adding `AB#123` in the commit message automatically links the commit to work item 123. Alternatively, from the work item’s Development section, you can add a link directly to a GitHub commit by pasting its URL, which explicitly associates the commit with the work item.
Question 16
HOTSPOT
-
You have an Azure subscription that contains multiple web apps.
You need to enable Change Analysis for the web apps.
How should you complete the script? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: Change Analysis requires the Microsoft.ChangeAnalysis resource provider to be registered. Enabling it on each web app is done by setting the hidden changeAnalysisScanEnabled tag using Set-AzResource with the web app resource ID.
Question 17
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You use an Azure Pipelines pipeline to build and release web apps.
You need to configure the pipeline to meet the following requirements:
• Only run when there is a change in the /webapp folder.
• Only run when a pr is created.
Solution: You configure the pipeline definition by using the following elements.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: To meet the requirements, the pipeline must trigger only on pull request creation and only when files under /webapp change. The described solution does not meet the goal because the trigger configuration is incorrect: the paths filter is misused (e.g., pointing to /pr or being misplaced), and branch/path filters are swapped or improperly defined. A correct configuration would disable the CI trigger, use a top-level pr trigger, and include a paths filter for /webapp/** under pr. Therefore, the stated solution does not satisfy the requirements.
Question 18
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You use an Azure Pipelines pipeline to build and release web apps.
You need to configure the pipeline to meet the following requirements:
• Only run when there is a change in the /webapp folder.
• Only run when a pr is created.
Solution: You configure the pipeline definition by using the following elements.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: The solution does not meet the goal because Azure Pipelines requires the `pr:` trigger to run on pull request creation; the `trigger:` element only applies to direct commits. Additionally, path filters must be defined under `pr:` for PR-based runs, and paths should be specified correctly (for example, `webapp/**` rather than `/webapp`). Therefore, the described configuration would not correctly limit execution to PRs that modify the webapp folder.
Question 19
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You use an Azure Pipelines pipeline to build and release web apps.
You need to configure the pipeline to meet the following requirements:
• Only run when there is a change in the /webapp folder.
• Only run when a pr is created.
Solution: You configure the pipeline definition by using the following elements.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: To meet the goal, the pipeline must run only for pull requests and only when files under /webapp change. Using a trigger with path filters will also run the pipeline on direct pushes, which violates the requirement of running only when a PR is created. The correct configuration would disable CI triggers (trigger: none) and use only a pr trigger with paths including webapp/**. Therefore, the proposed solution does not meet the goal.
Question 20
DRAG DROP
-
You have a GitHub repository named repo1 and an Azure key vault named kv1.
In repo1, you plan to create a workflow named Workflow1 that will deploy a database server by using credentials stored in kv1.
You need to ensure that Workflow1 can retrieve the credentials from kv1.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select.
Show Answer
Correct Answer: Create a service principal in Microsoft Entra ID.
Grant secret permissions to kv1.
Reference the credentials in Workflow1.
Explanation: The GitHub workflow authenticates to Azure using a service principal. That identity must be granted secret access to the Azure Key Vault. Once access is in place, the workflow can reference and retrieve the stored credentials during deployment.
$19
Get all 531 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
