Download Microsoft.AZ-400.Dump4Pass.2024-01-05.164q.vcex

Register your application to use Azure Active Directory. Registering the application means that your developers can use Azure AD to authenticate users and request access to user resources such as email, calendar, and documents.    Reference: https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/developer-guidance-for-integrating-applications

1. In Azure portal navigate to the az400-9940427-main app.  2. Scroll down to the Settings group in the left navigation.  3. Select Managed identity.  4. Within the System assigned tab, switch Status to On. Click Save.              Reference: https://docs.microsoft.com/en-us/azure/app-service/overview-managed-identity

When you need to pass a secure value (like a password) as a parameter during deployment, you can retrieve the value from an Azure Key Vault. You retrieve the value by referencing the key vault and secret in your parameter file. The value is never exposed because you only reference its key vault ID. The key vault can exist in a different subscription than the resource group you are deploying to.    Reference: https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-keyvault-parameter

With the storage account ready, you can configure backs up in the web app or App Service.  1. Open the App Service az400-11566895-main, which you want to protect, in the Azure Portal and browse to Settings > Backups. Click Configure and a Backup  Configuration blade should appear.  2. Select the storage account.  3. Click + to create a private container. You could name this container after the web app or App Service.  4. Select the container.  5. If you want to schedule backups, then set Scheduled Backup to On and configure a schedule: every five hours 6. Select your retention. Note that 0 means never delete backups.  7. Decide if at least one backup should always be retained.  8. Choose if any connected databases should be included in the web app backup.  9. Click Save to finalize the backup configuration.            Reference: https://petri.com/backing-azure-app-service

Box 1: Azure Pipelines service connection   Box 2: Managed Service Identity Authentication The managed identities for Azure resources feature in Azure Active Directory (Azure AD) provides Azure services with an automatically managed identity in Azure AD. You can use the identity to authenticate to any service that supports Azure AD authentication, including Key Vault, without any credentials in your code.    Reference: https://docs.microsoft.com/en-us/azure/devops/pipelines/tasks/deploy/azure-key-vault   https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview

Secure and Manage Open Source Software  Black Duck helps organizations identify and mitigate open source security, license compliance and code-quality risks across application and container portfolios.  Black Duck Hub and its plugin for Team Foundation Server (TFS) allows you to automatically find and fix open source security vulnerabilities during the build process, so you can proactively manage risk. The integration allows you to receive alerts and fail builds when any Black Duck Hub policy violations are met.    Note: There are several versions of this question in the exam. The question has two possible correct answers: Black Duck  WhiteSource Bolt    Other incorrect answer options you may see on the exam include the following: OWASP ZAP  PDM  SourceGear  SourceGear Vault    Reference: https://marketplace.visualstudio.com/items?itemName=black-duck-software.hub-tfs

Box 1: A Build task Trigger a build  You have a Java code provisioned by the Azure DevOps demo generator. You will use WhiteSource Bolt extension to check the vulnerable components present in this code.  1. Go to Builds section under Pipelines tab, select the build definition WhiteSourceBolt and click on Queue to trigger a build.  2. To view the build in progress status, click on ellipsis and select View build results.    Box 2: WhiteSource Bolt WhiteSource is the leader in continuous open source software security and compliance management. WhiteSource integrates into your build process, irrespective of your programming languages, build tools, or development environments. It works automatically, continuously, and silently in the background, checking the security, licensing, and quality of your open source components against WhiteSource constantly-updated definitive database of open source repositories.    Reference: https://www.azuredevopslabs.com/labs/vstsextend/whitesource/ 

Box 1: Threat modeling - Threat modeling’s motto should be, “The earlier the better, but not too late and never ignore.”    Box 2: Static code analysis - Validation in the CI/CD begins before the developer commits his or her code. Static code analysis tools in the IDE provide the first line of defense to help ensure that security vulnerabilities are not introduced into the CI/CD process.    Box 3: Penetration testing - Once your code quality is verified, and the application is deployed to a lower environment like development or QA, the process should verify that there are not any security vulnerabilities in the running application. This can be accomplished by executing automated penetration test against the running application to scan it for vulnerabilities.    Reference: https://docs.microsoft.com/en-us/azure/devops/articles/security-validation-cicd-pipeline?view=vsts

WhiteSource provides WhiteSource Bolt, a lightweight open source security and management solution developed specifically for integration with Azure DevOps and Azure DevOps Server.    Note: WhiteSource is the leader in continuous open source software security and compliance management. WhiteSource integrates into your build process, irrespective of your programming languages, build tools, or development environments. It works automatically, continuously, and silently in the background, checking the security, licensing, and quality of your open source components against WhiteSource constantly-updated definitive database of open source repositories.    Note: There are several versions of this question in the exam. The question has two possible correct answers: 1. Black Duck  2. WhiteSource Bolt    Other incorrect answer options you may see on the exam include the following: 1. Microsoft Visual SourceSafe  2. PDM  3. SourceGear  4. SourceGear Vault  Reference: https://www.azuredevopslabs.com/labs/vstsextend/whitesource/

The Azure Pipelines app uses the OAuth authentication protocol, and requires Third-party application access via OAuth for the organization to be enabled. To enable this setting, navigate to Organization Settings > Security > Policies, and set the Third-party application access via OAuth for the organization setting to On.    Reference: https://docs.microsoft.com/en-us/azure/devops/pipelines/integrations/microsoft-teams