A lock-lab CI pipeline is about to apply Terraform that opens a storage account to the Internet. As the Azure security engineer reviewing Microsoft Defender for Cloud DevOps Security, what should you focus on first?
Select an answer to reveal the explanation.
Short Explanation
Don’t tear up the whole release train because one Terraform plan looks shady. Pop open Defender for Cloud DevOps Security, read the IaC findings and PR annotations, and catch that public storage opening before it lands.
Full Explanation
Microsoft Defender for Cloud DevOps Security surfaces code and infrastructure-as-code posture findings—including pull-request annotations when the connected plan provides them. The Azure security engineer’s first job is to review those security findings for the risky Terraform change, not to redesign branching or release stages. Product selection mistakes such as relying on Defender for Cloud Apps, or jumping straight to deleting the storage account, miss the connect-and-configure DevOps Security skill.