nerdexam
Microsoft

AZ-400 · Question #311

Drag and Drop Question You need to increase the security of your team's development process. Which type of security tool should you recommend for each stage of the development process? To answer, drag

The correct answer is Static code analysis; Static code analysis; Penetration testing. Static code analysis is the appropriate tool for early development stages (such as coding and code review) because it automatically scans source code for vulnerabilities without executing the program, catching issues like SQL injection or buffer overflows early and cheaply in the

Submitted by yuki_2020· Mar 6, 2026Security in the Software Development Lifecycle (SDLC) - identifying and applying appropriate security tools at each phase of the development process (e.g., CompTIA Security+, CSSLP, or AZ-400 DevSecOps domain)

Question

Drag and Drop Question You need to increase the security of your team's development process. Which type of security tool should you recommend for each stage of the development process? To answer, drag the appropriate security tools to the correct stages. Each security tool may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Answer:

Exhibits

AZ-400 question #311 exhibit 1
AZ-400 question #311 exhibit 2

Answer Area

Drag items

Penetration testingStatic code analysisThreat modeling

Correct arrangement

  • Static code analysis
  • Static code analysis
  • Penetration testing

Explanation

Static code analysis is the appropriate tool for early development stages (such as coding and code review) because it automatically scans source code for vulnerabilities without executing the program, catching issues like SQL injection or buffer overflows early and cheaply in the SDLC. Penetration testing is best suited for later stages (such as pre-production or release) because it simulates real-world attacks against a running application or system to identify exploitable vulnerabilities that only manifest at runtime. Threat modeling, while valuable, is typically applied at the design/planning phase and is not mapped to the stages presented in this question, making it the unused option here.

Topics

#Secure SDLC#DevSecOps#Application Security#Security Testing Tools

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-400 Practice