A DevSecOps engineer is configuring Chef InSpec to perform security compliance checks on an Azure environment. The engineer needs to authenticate with azure using a Service Principal Name (SPN), execute InSpec scans against the Azure environment and Ensure authentication is handled securely and efficiently. Which is the best way to configure authentication before running the InSpec scan?

• A. Store Azure credentials in the ~/.azure/credentials file and execute inspec exec azure_profile -t azure://.
• B. Use only AZURE_SUBSCRIPTION_ID as an environment variable to authenticate.
• C. Manually enter Azure credentials every time before running an InSpec scan.
• D. Authenticate using the Azure CLI before every InSpec execution without storing credentials.

An enterprise healthcare application was recently targeted by a sophisticated attack. The attackers exploited misconfigured data flows and improperly secured API endpoints, exposing sensitive patient records. The DevSecOps team immediately deployed a tool to analyze the application's architecture by modeling its assets in a YAML file. This analysis revealed the exact vulnerabilities and provided detailed mitigation strategies, such as securing data flows with encryption and implementing stricter API access controls. The generated report helped the team resolve the issues swiftly and prevent future breaches. Which tool was likely used to handle this scenario?

• A. Snyk.
• B. AWS Shield.
• C. Threagile.
• D. GitLab Duo.

Charles Rettig, a DevSecOps engineer at an IT company specializing in IoT software and web applications, is responsible for ensuring the security of web applications deployed across various devices. To automate security testing, Charles integrates Burp Suite with Jenkins using the Command Line Interface (CLI) to Identify vulnerabilities in web applications. During a security audit, Charles realizes that traditional security scanning approaches often produce false positives and fail to detect vulnerabilities that only appear during real-time interactions. To address this issue, he enables a Burp Suite feature that minimizes false positives. Which Burp Suite feature helps Charles detect invisible vulnerabilities while minimizing false positives?

• A. OAST (Out-of-band Application Security Testing).
• B. BAST (Burp-Suite Application Security Testing).
• C. QAST (Query-based Application Security Testing).
• D. FAST (False-Positive Application Security Testing).

Sophia Adams, a DevSecOps Engineer at CloudSecure Solutions, is responsible for securing sensitive credentials used in the company's CI/CD pipeline. To ensure secure storage and retrieval of secrets, she decides to integrate Azure Key Vault with Jenkins. She Creates an Azure Key Vault and stores credentials securely, Installs the Azure Key Vault plugin in Jenkins and Navigates to the Jenkins "Configure System" section and adds the Azure Key Vault URL. Now, Sophia needs to ensure that Jenkins can securely access secrets stored in Azure Key Vault to complete the integration. Which of the following should Sophia do next?

• A. Restart Jenkins to automatically fetch secrets from Azure Key Vault without further configuration.
• B. Configure an Azure Service Principal and grant it access to Azure Key Vault.
• C. Manually copy and paste secrets from Azure Key Vault into Jenkins pipeline scripts.
• D. Enable role-based access control (RBAC) in Jenkins to automatically retrieve secrets.