HOTSPOT You have an Azure subscription that contains Azure App Service apps. The apps have the following characteristics:
• The apps are deployed by using continuous integration and continuous deployment (CI/CD) pipelines in Azure DevOps.
• The apps are deployed to a test environment first, and then to a production environment.
• The source code for the apps is stored in Azure Repos. You plan to implement DevSecOps controls based on the Microsoft Cloud Adoption Framework for Azure. You need to recommend testing controls to meet the following requirements:
• All the source code must be tested for security vulnerabilities in Azure Repos before deploying the apps.
• Once the apps are deployed to the test environment, they must be tested for security vulnerabilities. Which testing method should you recommend for each stage? To answer, select the options in the answer area. NOTE: Each correct answer is worth one point.
Step Sequence / Reordering Question
Add and arrange the steps in the correct execution order.
Available Steps (5)
The apps are deployed by using continuous integration and continuous deployment (CI/CD) pipelines in Azure DevOps.
The apps are deployed to a test environment first, and then to a production environment.
The source code for the apps is stored in Azure Repos. You plan to implement DevSecOps controls based on the Microsoft Cloud Adoption Framework for Azure. You need to recommend testing controls to meet the following requirements:
All the source code must be tested for security vulnerabilities in Azure Repos before deploying the apps.
Once the apps are deployed to the test environment, they must be tested for security vulnerabilities. Which testing method should you recommend for each stage? To answer, select the options in the answer area. NOTE: Each correct answer is worth one point.
Your Ordered Steps (0 of 2)
No steps added yet. Click "Add to Sequence" from the available steps above.
Explanation
Hotspot Solution:
Recommended Community Solution:
Pre-deployment: Static Application Security Testing (SAST) Post-deployment to test environment: Dynamic Application Security Testing (DAST)
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
2
on exam. 03/11/2026
6
Pre-deployment: Static Application Security Testing (SAST) Post-deployment to test environment: Dynamic Application Security Testing (DAST)
