Question 60
Another team measures security by scanned repository count without verifying scan policies or findings coverage. Which unsupported assumption should the engineer challenge FIRST?
Explanation
Correct Answer
Zero displayed vulnerabilities do not establish zero vulnerabilities when scanning is disabled or incomplete. This is the relevant unsupported assumption because security visibility must account for detection coverage and unresolved exceptions, not only reported finding counts.
Incorrect Answers
This caution is valid in design and implement traceability and flow of work, but it is not the failure assumption illustrated by this scenario. The directly relevant risk is: Zero displayed vulnerabilities do not establish zero vulnerabilities when scanning is disabled or incomplete.
This caution is valid in configure collaboration and communication, but it is not the failure assumption illustrated by this scenario. The directly relevant risk is: Zero displayed vulnerabilities do not establish zero vulnerabilities when scanning is disabled or incomplete.
This caution is valid in configure collaboration and communication, but it is not the failure assumption illustrated by this scenario. The directly relevant risk is: Zero displayed vulnerabilities do not establish zero vulnerabilities when scanning is disabled or incomplete.






Designing and Implementing Microsoft DevOps Solutions (AZ-400) Practice Tests