Correct Answer: Prepare Analysis Configuration -> Build Task -> Run Code Analysis -> Publish Quality Gate Result
For compiled languages like .NET or Java, SonarQube requires the analysis environment to be prepped before compilation begins. The correct sequence is: 1) Prepare Analysis Configur...
Correct Answer
Prepare Analysis Configuration -> Build Task -> Run Code Analysis -> Publish Quality Gate Result
Why This Answer Is Correct
For compiled languages like .NET or Java, SonarQube requires the analysis environment to be prepped before compilation begins. The correct sequence is: 1) Prepare Analysis Configuration, 2) Build the code (MSBuild hooks into the prep), 3) Run Code Analysis (analyzes the compiled output), 4) Publish Quality Gate Result.
This question evaluates your knowledge of DevSecOps — a core concept tested in Microsoft Certified: DevOps Engineer Expert (AZ-400). Understanding DevSecOps is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
Your code is hosted in GitHub. A developer accidentally commits an Azure Storage Account access key directly into the repository. You need a system that immediately detects this exposed key and alerts the security team. Which feature should you enable?
You are implementing DevSecOps practices. You need to scan your open-source dependencies (npm, NuGet) for known security vulnerabilities and licensing compliance issues during the CI build process. Which third-party tool natively integrates with Azure DevOps to provide this capability?