AZ-400 Practice Test 45 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud to monitor Azure resources. The compliance team needs to ensure that all Azure DevOps projects have their pipelines scanned for security issues before deployment. Which integration should you use?

Accepted Answer

Enable GitHub Advanced Security for Azure DevOps in Microsoft Defender for Cloud.. Microsoft Defender for Cloud can integrate with Azure DevOps via the GitHub Advanced Security for Azure DevOps feature (now part of Defender for Cloud), which enables code scanning, secret scanning, and dependency scanning in Azure Repos and pipelines. Defender for Cloud does not directly manage branch policies, service connections, or deployment gates.

Answer

Configure branch policies in Azure Repos to require a security scan.

Answer

Configure deployment gates in Azure Pipelines to require a security scan.

Answer

Use Azure Policy to enforce scanning on Azure DevOps pipelines.

Question 2

You are implementing a secrets management strategy for a multi-cloud deployment. You need to securely store and rotate API keys for a third-party service. Which Azure service should you use?

Accepted Answer

Azure Key Vault. Option B is correct because Azure Key Vault provides secure storage and automatic rotation of secrets. Option A is wrong because Microsoft Entra ID is for identity management, not secret storage. Option C is wrong because Azure App Configuration is for application configuration, not secrets. Option D is wrong because Azure Storage is not designed for secret management.

Answer

Microsoft Entra ID

Answer

Azure App Configuration

Answer

Azure Storage Blob

Question 3

Your team uses GitHub Actions for CI/CD and needs to ensure that secrets such as Azure service principal credentials are not exposed in logs. What is the best practice to prevent secret exposure?

Accepted Answer

Store secrets as GitHub Actions secrets and reference them in workflows. Option C is correct because GitHub automatically redacts secrets in workflow logs. Option A is wrong because storing secrets in YAML files is insecure. Option B is wrong because environment protection rules are for approvals, not redaction. Option D is wrong because encrypting logs does not prevent exposure in transit.

Answer

Store secrets in the workflow YAML file

Answer

Use environment protection rules to mask secrets

Answer

Encrypt workflow logs after the run completes

Question 4

You are designing a security compliance plan for a GitHub Enterprise environment. Which THREE practices should you implement? (Select THREE.)

Accepted Answer

Configure branch protection rules to require pull request reviews. Options A, B, and D are correct. A: Dependabot alerts help manage vulnerabilities in dependencies. B: Secret scanning detects exposed secrets. D: Branch protection rules enforce code review and status checks. Option C is wrong because disabling 2FA is insecure. Option E is wrong because allowing admins to bypass policies undermines compliance.

Answer

Disable two-factor authentication for automation accounts

Answer

Allow repository admins to bypass branch protection rules

Question 5

Which TWO actions should you take to ensure that Azure Pipelines artifacts are scanned for vulnerabilities before production deployment? (Choose two.)

Accepted Answer

Run dependency scanning on the artifact manifest. Options B and C are correct. Option B: Dependency scanning identifies vulnerabilities in dependencies. Option C: Incorporating Microsoft Defender for Cloud scanning into the pipeline scans container images and other artifacts. Option A is wrong because code signing ensures integrity but not vulnerability scanning. Option D is wrong because static analysis finds code issues, not artifacts. Option E is wrong because infrastructure scanning is for IaC, not artifacts.

Answer

Sign the artifacts with a code signing certificate

Answer

Scan the infrastructure as code templates

Answer

Run static code analysis on the source code

Question 6

You are reviewing a compliance policy for Azure Pipelines. What does this policy enforce?

Accepted Answer

Requires multi-factor authentication to approve use of secret variables in the 'MySecrets' variable group. Option A is correct because the policy requires MFA approval when accessing the variable group 'MySecrets'. Option B is wrong because the policy is scoped to the variable group, not all pipeline runs. Option C is wrong because it requires approval, not just MFA authentication. Option D is wrong because it refers to a specific variable group.

Answer

Enforces MFA for all pipeline runs that use the 'MySecrets' variable group

Answer

Requires MFA to edit variables in the 'MySecrets' variable group

Answer

Blocks all access to the 'MySecrets' variable group unless MFA is used

Question 7

You need to ensure that only signed-in users can view Azure DevOps project wikis. Which setting should you configure?

Accepted Answer

Set project visibility to 'Private'. Option A is correct because project visibility controls who can view the project. Option B is wrong because repository security is for code, not wikis. Option C is wrong because Microsoft Entra ID Application Proxy is for on-prem apps. Option D is wrong because wiki permissions are per-wiki, not a global setting.

Answer

Configure wiki permissions to deny anonymous users

Answer

Set repository visibility to 'Private'

Answer

Use Microsoft Entra ID Application Proxy

Question 8

Your organization uses Azure Boards and requires that all changes to work items in the 'Security' area path be audited. Which solution ensures that any modification to a work item triggers an audit event in Microsoft Sentinel?

Accepted Answer

Configure Azure DevOps Audit Streaming to send logs to Microsoft Sentinel. Option A is correct because Azure DevOps audit logs can be streamed to Microsoft Sentinel via the Azure DevOps data connector. Option B is wrong because service hooks don't directly integrate with Sentinel. Option C is wrong because Microsoft Purview is for data governance, not real-time auditing. Option D is wrong because export to CSV is a manual process.

Answer

Enable Microsoft Purview to scan Azure DevOps and detect changes

Answer

Export Azure DevOps audit logs to CSV and import to Sentinel daily

Answer

Create a service hook in Azure DevOps that calls a logic app to create incidents in Sentinel

Question 9

Which TWO tools can be used to enforce branch protection policies in GitHub repositories? (Choose two.)

Accepted Answer

Azure Pipelines branch policies. Options A and C are correct. Option A: GitHub branch protection rules are built-in. Option C: Azure Pipelines can enforce policies via branch policy checks. Option B is wrong because GitHub Actions can run checks but not enforce policies. Option D is wrong because Microsoft Intune manages devices. Option E is wrong because Microsoft Purview is for data governance.

Answer

Microsoft Intune compliance policies

Answer

Microsoft Purview data classification

Answer

GitHub Actions workflows

Question 10

Refer to the exhibit. You receive a secret scanning alert for an Azure DevOps PAT in a GitHub repository. The push_protection_bypass is false. What does this mean and what action should you take?

Accepted Answer

The secret was blocked from being pushed; you should revoke the PAT and investigate the incident.. Push protection blocked the push, so the secret was not committed to the repository. You should revoke the PAT and investigate how it was used. The secret is not in the commit history because it was blocked. Since it was not committed, you don't need to use git filter-branch or GitHub support to remove it.

Answer

The secret was pushed but push protection was bypassed; you need to revoke the PAT and use git filter-branch to remove it from history.

Answer

The secret was pushed successfully; you need to rotate the PAT and audit the commit history.

Answer

The secret was pushed and push protection was not bypassed; you need to open a support ticket with GitHub to remove the secret.

Question 11

Your organization uses Microsoft Entra ID for identity and Azure DevOps for source control. You need to enforce that all code changes to the main branch require a pull request with at least two approvals and no failing checks. What should you configure?

Accepted Answer

Set up a branch policy on the main branch in Azure Repos. Option B is correct because Azure DevOps branch policies can require a minimum number of reviewers and check for build validation. Option A is wrong because Entra ID Conditional Access policies manage sign-in, not code reviews. Option C is wrong because environment protection rules in GitHub are for deployments, not pull requests. Option D is wrong because service hooks are for integration, not policy enforcement.

Answer

Configure a Conditional Access policy in Microsoft Entra ID

Answer

Add an environment protection rule in Azure Pipelines

Answer

Use a service hook to notify reviewers when a push occurs

Question 12

Your team uses Azure Pipelines and needs to comply with SOC 2 requirements. Which TWO features should you use to meet audit log requirements? (Select TWO.)

Accepted Answer

Enable Azure DevOps audit logging. Options A and B are correct. A: Azure DevOps audit logs track user actions. B: Azure Monitor logs can be used to store and analyze audit data. Option C is wrong because secret rotation is not logging. Option D is wrong because network security groups are for network traffic, not audit logs. Option E is wrong because service principals are for authentication, not logging.

Answer

Configure network security groups to block public access

Answer

Automate secret rotation for service connections

Answer

Create service principals for pipeline authentication

Question 13

You are reviewing an Azure Policy definition applied to an Azure DevOps organization. What is the effect of this policy?

Accepted Answer

It denies creation of new pipelines. Option B is correct because the policy denies the creation of new pipelines. Option A is wrong because it allows creation. Option C is wrong because it denies all resource creation, not just pipelines. Option D is wrong because it does not audit.

Answer

It denies creation of any Azure resource

Answer

It allows creation of all pipelines

Answer

It audits pipeline creation without blocking

Question 14

Your organization uses GitHub Actions and has a repository containing sensitive infrastructure code. You need to ensure that only approved actions are used in workflows. Which two settings should you configure? (Select two.)

Accepted Answer

Allow actions created by GitHub.. Options A and D are correct because GitHub allows you to restrict actions to those from verified creators and to allow only actions in approved repositories. Option B is wrong because disabling actions would block all workflows. Option C is wrong because secrets do not restrict actions. Option E is wrong because environment protection rules do not restrict actions.

Answer

Disable actions for the repository.

Answer

Use environment protection rules.

Answer

Store actions in encrypted secrets.

Question 15

You are using Microsoft Defender for Cloud to secure Azure Pipelines. You need to receive alerts when a pipeline run uses a service principal with excessive permissions. Which feature should you enable?

Accepted Answer

Enable Microsoft Defender for Cloud's identity and access monitoring.. Option B is correct because Defender for Cloud's identity and access monitoring can alert on over-privileged service principals used in pipelines. Option A is wrong because audit logs alone do not generate alerts. Option C is wrong because conditional access policies are for user sign-ins, not service principals in pipelines. Option D is wrong because Azure Policy does not generate real-time alerts for pipeline runs.

Answer

Enable Azure DevOps audit logs and review them manually.

Answer

Create an Azure Policy to deny over-privileged service principals.

Answer

Configure Microsoft Entra ID Conditional Access policies.