Question 900
Another project lets application developers edit both the security scanner policy and the protected release gate unreviewed. Which unsupported assumption should the engineer challenge FIRST?
Explanation
Correct Answer
A code-scanning job written in YAML is not a strong control if every contributor may remove the job. This is the relevant unsupported assumption because security gates are trustworthy only when the subjects they control cannot silently disable them.
Incorrect Answers
This caution is valid in design and implement a strategy for managing sensitive information in automation, but it is not the failure assumption illustrated by this scenario. The directly relevant risk is: A code-scanning job written in YAML is not a strong control if every contributor may remove the job.
This caution is valid in design and implement a strategy for managing sensitive information in automation, but it is not the failure assumption illustrated by this scenario. The directly relevant risk is: A code-scanning job written in YAML is not a strong control if every contributor may remove the job.
This caution is valid in design and implement authentication and authorization methods, but it is not the failure assumption illustrated by this scenario. The directly relevant risk is: A code-scanning job written in YAML is not a strong control if every contributor may remove the job.






Designing and Implementing Microsoft DevOps Solutions (AZ-400) Practice Tests