AZ400-Q: enforce dependency licensing policy
Legal requires the build to block packages with unapproved licenses, while allowing a documented temporary exception. Which strategy best meets this requirement?
- A) Ask developers to remember license names.
- B) Scan only production logs after deployment.
- C) Disable package updates entirely.
- D) Add dependency/license scanning to CI and a policy gate with a reviewed, time-bound exception process. ✓
Answer: D. Automated scanning and a documented gate make the rule repeatable while exception ownership and expiry prevent silent permanent bypasses.
Why not the others: Memory and post-deploy detection are unreliable; freezing all updates creates other security risks.
Related
dependency-management · compliance-gate · dependency-vulnerabilities