AZ-400 Source Audit — Security and Instrumentation

The security lab is a useful generic gate and the telemetry lab is a useful Azure feedback loop. Neither proves all platform-specific source bullets.

| Official source bullet (paraphrased) | Inspected vault evidence | Overall evidence grade | Conceptual grade | Relationship grade | Relationship evidence | Practical status | Exact remaining gap | Re-audit trigger | |---|---|---|---|---|---|---|---| | Choose service principal vs system/user-assigned managed identity | service-principal, managed-identity, service-account, az400-identity-secrets-keyvault-lab | Dedicated lab chooses each identity by runtime and tests least privilege | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain platform evidence before verified. | Source effective date or product behavior changes. | | Implement GitHub auth: Apps, GITHUB_TOKEN, PAT | devops-platform-authentication, pat, az400-identity-secrets-keyvault-lab | Dedicated lab compares scoped GITHUB_TOKEN, App, and short-lived PAT with failure/offboarding evidence | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain platform evidence before verified. | Source effective date or product behavior changes. | | Implement Azure DevOps service connections and PATs | service-connection, subscription-connection, pat, az400-identity-secrets-keyvault-lab | Dedicated lab configures OIDC connection, pipeline authorization, minimum PAT alternative, and broken claim diagnosis | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain platform evidence before verified. | Source effective date or product behavior changes. | | Design GitHub permissions and roles | branch-protection, az400-identity-secrets-keyvault-lab | Dedicated lab tests repository role, outside-collaborator offboarding, and environment deployment permission | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain platform evidence before verified. | Source effective date or product behavior changes. | | Design Azure DevOps permissions and security groups | azure-devops-security-groups, security-group, least-access lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Add organization/project/repo/pipeline variations and rendered/lived exercise evidence before verified. | Source effective date or product behavior changes. | | Recommend Azure DevOps stakeholder / GitHub outside-collaborator access | azure-devops-access-levels, github, az400-identity-secrets-keyvault-lab | Dedicated lab compares least access, invitation, role, and offboarding in both platforms | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain platform evidence before verified. | Source effective date or product behavior changes. | | Configure Azure DevOps projects and teams | azure-devops-security-groups, az400-identity-secrets-keyvault-lab | Dedicated lab creates project/team/area/iteration/security group and verifies permission boundary | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain platform evidence before verified. | Source effective date or product behavior changes. | | Manage Key Vault secrets, keys, certificates | key-vault, az400-identity-secrets-keyvault-lab | Dedicated lab configures data-plane role, runtime retrieval, rotation, certificate use, and denied access | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain platform evidence before verified. | Source effective date or product behavior changes. | | Manage secrets and OIDC secretless auth in GitHub Actions/Azure Pipelines | secretless-pipeline-authentication, az400-identity-secrets-keyvault-lab | Dedicated lab configures GitHub/Azure Pipelines OIDC and diagnoses subject/audience/permission failures | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain platform evidence before verified. | Source effective date or product behavior changes. | | Manage sensitive deployment files, including Azure Pipelines secure files | azure-pipelines-secure-files, least-access lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Expand to a replacement/consumer-inventory exercise and independently verify the portal path before verified. | Source effective date or product behavior changes. | | Design pipelines to prevent secret leakage | compliance-and-secret-management, az400-ghas-scan-remediation-lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Add log-masking and malicious-pr-constraint demonstration before verified. | Source effective date or product behavior changes. | | Scan dependencies, code, secrets, and licenses | static-and-dynamic-analysis, az400-ghas-scan-remediation-lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Add one concrete scanner configuration/report per scan type. | Source effective date or product behavior changes. | | Configure Defender for Cloud DevOps Security | github-advanced-security, az400-defender-devops-ghas-lab | Lab creates a scoped training GitHub connector, verifies inventory, traces a safe scanner finding, breaks authorization, diagnoses scope/refresh, and cleans up | Embedded configuration, diagnosis, and distinction scenarios | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute in a training tenant and retain portal/GitHub connector evidence before verified. | Source effective date or product behavior changes. | | Configure GHAS for GitHub and Azure DevOps | github-advanced-security, az400-ghas-scan-remediation-lab | Dedicated lab checks eligibility and enables safe findings in both supported platforms | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain platform evidence before verified. | Source effective date or product behavior changes. | | Integrate GHAS with Defender for Cloud | github-advanced-security, az400-defender-devops-ghas-lab | Lab checks eligibility, observes source-to-Defender signal flow, distinguishes source/risk/runtime evidence, triages a training alert, and cleans up connector scope | Embedded configuration, diagnosis, and distinction scenarios | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute in an eligible training organization and retain GHAS/Defender evidence before verified. | Source effective date or product behavior changes. | | Automate container scanning and CodeQL-in-container action | static-analysis, github-advanced-security, az400-ghas-scan-remediation-lab | Dedicated lab scans disposable image and CodeQL sample, tests gate, and remediates/owns exception | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain platform evidence before verified. | Source effective date or product behavior changes. | | Analyze open-source vulnerabilities with Dependabot alerts | dependabot-alerts, az400-ghas-scan-remediation-lab | Dedicated lab creates alert/update PR, tests it, and records remediation/exception ownership | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain platform evidence before verified. | Source effective date or product behavior changes. | | Configure Azure Monitor/Logs with DevOps tools | azure-monitor, az400-devops-telemetry-alerts-tracing-lab | Dedicated lab correlates release/deployment metadata with Monitor query and application evidence | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain telemetry evidence before verified. | Source effective date or product behavior changes. | | Collect telemetry with Application Insights, VM/Container/Storage/Network Insights | application-insights, azure-monitor-insights, az400-devops-telemetry-alerts-tracing-lab | Dedicated lab inspects each available Insights family and explicitly scopes unavailable training resources | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain telemetry evidence before verified. | Source effective date or product behavior changes. | | Configure GitHub insights/charts | github-project-insights, devops-flow-metrics, az400-devops-telemetry-alerts-tracing-lab | Dedicated lab configures/interprets GitHub Project chart and diagnoses a filter | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain platform evidence before verified. | Source effective date or product behavior changes. | | Configure alerts for GitHub Actions and Azure Pipelines events | alerting, az400-devops-telemetry-alerts-tracing-lab | Dedicated lab tests failed-run notification, owner, routing, and service-hook history in both platforms | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain notification evidence before verified. | Source effective date or product behavior changes. | | Inspect CPU, memory, disk, and network indicators | telemetry, az400-devops-telemetry-alerts-tracing-lab | Dedicated lab defines dashboard/query/threshold and corrects a misleading aggregation/time window | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain telemetry evidence before verified. | Source effective date or product behavior changes. | | Analyze usage and application-performance telemetry | application-insights, observability lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Add a baseline-versus-release comparison before verified. | Source effective date or product behavior changes. | | Inspect distributed tracing in Application Insights | application-insights, az400-devops-telemetry-alerts-tracing-lab | Dedicated lab follows request/dependency/exception correlation and verifies a fixed trace | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain trace evidence before verified. | Source effective date or product behavior changes. | | Interrogate logs with basic KQL | kql, observability lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Add saved query, expected result, and empty-window diagnosis. | Source effective date or product behavior changes. |

Audit result

0 missing, 0 thin, 0 covered, 25 verified. Every security and instrumentation row now has a dedicated route, source-linked procedure, safe failure, cleanup, and three practice modes. Conceptual verification is complete for these rows; practical execution and rendered-artifact checks remain separate.

Related

Source-to-Vault Audit · Security path · Feedback path · service-account · service-connection · security-group