Correct Answer: WhiteSource (Mend) Bolt
WhiteSource Bolt (now known as Mend Bolt) is heavily integrated into Azure DevOps specifically for Software Composition Analysis (SCA). It scans open-source components for known se...
Correct Answer
WhiteSource (Mend) Bolt
Why This Answer Is Correct
WhiteSource Bolt (now known as Mend Bolt) is heavily integrated into Azure DevOps specifically for Software Composition Analysis (SCA). It scans open-source components for known security vulnerabilities (CVEs) and licensing issues. SonarQube is used for Static Application Security Testing (SAST) of your own source code, not third-party dependencies.
This question evaluates your knowledge of DevSecOps — a core concept tested in Microsoft Certified: DevOps Engineer Expert (AZ-400). Understanding DevSecOps is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
Your code is hosted in GitHub. A developer accidentally commits an Azure Storage Account access key directly into the repository. You need a system that immediately detects this exposed key and alerts the security team. Which feature should you enable?
You are using Azure Pipelines and want to run Static Application Security Testing (SAST) on your code. You configure the SonarQube tasks in your pipeline. In which exact order must the SonarQube tasks be placed for a .NET application?