AZ-400 Practice Test 50 — 15 Questions

Question 1

Your company uses GitHub and wants to implement a compliance framework that requires signed commits for all repositories. Developers use various IDEs and Git clients. What is the best way to enforce signed commits across the organization?

Accepted Answer

Enable 'Require signed commits' in the branch protection rules for the default branch.. Option C is correct because GitHub allows repository administrators to enable 'Require signed commits' in branch protection rules. Option A is incorrect because it is not enforceable; commits can be unsigned. Option B is incorrect because it only encourages, not enforces. Option D is incorrect because it does not enforce signing.

Answer

Set the repository to 'Require pull request reviews before merging' and rely on reviewers to check commit signatures.

Answer

Ask developers to configure GPG keys and sign commits manually.

Answer

Use a GitHub Action that fails if commits are unsigned.

Question 2

Your team uses Azure Pipelines to deploy to production. You need to ensure that deployment only proceeds if a security scan passes and a manual approval is obtained. What is the best approach?

Accepted Answer

Use release gates in release pipelines. Option B is correct because release gates can run automated checks (security scan) and manual approvals. Option A is wrong because branch policies are for code review. Option C is wrong because service connections handle authentication, not approvals. Option D is wrong because pipeline variables store values, not enforce gates.

Answer

Add pipeline variables

Answer

Set up service connections

Answer

Configure branch policies

Question 3

Your team is adopting a shift-left security approach in Azure Pipelines. They want to automatically detect secrets, such as API keys or connection strings, in source code before code is committed. Which Azure DevOps feature should be configured to scan pull requests for secrets and block the PR if any are found?

Accepted Answer

Secret Scanning. Option D (Secret Scanning) is correct because GitHub Advanced Security (GHAS) provides secret scanning that can be configured to run on pull requests and block PRs containing secrets. Option A (Azure Policy) is for Azure resource compliance, not code-level scanning. Option B (Credential Scanner) is a legacy tool that is not directly integrated into PR gates. Option C (Dependency Scanning) identifies vulnerable dependencies, not secrets.

Answer

Azure Policy for Repos

Answer

Credential Scanner task in pipeline

Answer

Dependency Scanning

Question 4

Refer to the exhibit. You executed the Azure CLI command to list variable groups. A security audit requires that all variable groups containing secrets are configured to be authorized for all pipelines. Which statement is true based on the output?

Accepted Answer

The variable group 'ProdVars' contains a secret variable, but the output does not indicate whether it is authorized for all pipelines. Option B (The variable group 'ProdVars' contains a secret variable, but the output does not indicate whether it is authorized for all pipelines) is correct. The JSON output does not include an 'authorize' property; you need to check the group's settings separately. Option A is wrong because the ApiKey value is null (masked). Option C is wrong because you cannot tell from this output if it's authorized. Option D is wrong because the secret is shown as null, not exposed.

Answer

The variable group 'ProdVars' is not authorized for all pipelines because no such property exists

Answer

The variable group 'ProdVars' has exposed the secret value in the output

Answer

The variable group 'ProdVars' is authorized for all pipelines because it has secret variables

Question 5

Your organization requires that all code changes be signed using a valid code signing certificate before they can be merged. Which feature in GitHub should you enable to enforce this?

Accepted Answer

Commit signature verification.. Option A is correct because commit signature verification in GitHub enforces that commits are signed with a verified GPG or S/MIME key. Option B is wrong because secret scanning detects secrets, not signature enforcement. Option C is wrong because Dependabot handles dependency updates. Option D is wrong because code scanning analyzes code for vulnerabilities.

Answer

Dependabot.

Answer

Code scanning.

Answer

Secret scanning.

Question 6

Your organization is adopting GitHub Copilot and wants to ensure that no proprietary code is used to train models. Which setting should you configure in the GitHub organization?

Accepted Answer

Opt out of allowing GitHub to use code snippets for product improvement.. Option B is correct because GitHub Copilot allows you to opt out of code snippet sharing for training. Option A is wrong because Copilot is not a feature that can be disabled for specific repositories only. Option C is wrong because Dependabot does not affect Copilot training. Option D is wrong because secret scanning is unrelated.

Answer

Enable secret scanning.

Answer

Enable Dependabot alerts.

Answer

Disable GitHub Copilot for the organization.

Question 7

Your organization uses Microsoft Entra ID (formerly Azure AD) for identity management. You need to ensure that only authorized users can access the Azure DevOps organization. What is the most secure way to manage access?

Accepted Answer

Require all users to use multi-factor authentication (MFA) and enable Conditional Access policies.. Option D is correct because Conditional Access policies provide granular access control based on conditions like location, device compliance, and risk. Option A is incorrect because it does not enforce additional security. Option B is incorrect because manual review is not scalable. Option C is incorrect because disabling external users is not the most secure; it still allows all internal users.

Answer

Disable external user access and only allow internal users.

Answer

Use IP address restrictions to limit access to the corporate network.

Answer

Add users to the Azure DevOps organization and assign them to the 'Basic' access level.

Question 8

Your organization uses GitHub Advanced Security. A developer reports that a secret scanning alert for an Azure DevOps Personal Access Token (PAT) is a false positive. What should you do to handle this?

Accepted Answer

Mark the alert as false positive in the GitHub UI.. Option B is correct because marking the alert as false positive in the GitHub UI hides it and helps train the detection. Option A is wrong because deleting the PAT doesn't address the alert. Option C is wrong because disabling secret scanning removes detection entirely. Option D is wrong because ignoring the alert leaves it open.

Answer

Disable secret scanning for the repository.

Answer

Delete the PAT from the repository and revoke it.

Answer

Ignore the alert and leave it open.

Question 9

Refer to the exhibit. You are reviewing the branch policies for the main branch in Azure Repos. The team reports that while the branch naming policy works, the approval policy does not block pull requests when only one person approves. What is the most likely cause?

Accepted Answer

The main branch has a separate branch policy override that allows one approval. Option C (The policy is applied to all branches, but the main branch has a separate override) is correct. The exhibit shows policies defined at the project level, but branch policies for the main branch might have been explicitly set to override the project-level policy. Option A is wrong because the policy is enabled. Option B is wrong because the policy is set to require minimum 2 approvals, so it should block. Option D is wrong because creator vote counts being false means the creator's vote is not counted, which doesn't affect the approval count.

Answer

The policy is disabled in the settings

Answer

The policy is not applied to the main branch

Answer

The 'creatorVoteCounts' setting is false, so the creator's approval is not counted

Question 10

Your organization is adopting DevSecOps and wants to integrate security scanning into the CI/CD pipeline. Which tool should you use to scan container images for vulnerabilities?

Accepted Answer

Microsoft Defender for Cloud. Option A is correct because Microsoft Defender for Cloud can scan container images in Azure Container Registry. Option B is wrong because GitHub Copilot is an AI pair programmer. Option C is wrong because Azure Monitor is for observability. Option D is wrong because Azure Logic Apps is for workflows.

Answer

Azure Monitor

Answer

GitHub Copilot

Answer

Azure Logic Apps

Question 11

Your organization uses Microsoft Defender XDR to secure Azure DevOps pipelines. You need to ensure that any build pipeline triggered by a pull request automatically runs a security scan and fails if critical vulnerabilities are found. What should you configure?

Accepted Answer

Branch protection rule with required status check. Option B (Branch protection rule with status check) is correct because you can add a required status check that runs a security scan pipeline, and the PR cannot be merged if the check fails. Option A is for Azure resources, not pipelines. Option C is for code scanning in GitHub, not Azure Pipelines. Option D is not a real feature.

Answer

Code scanning alerts in GitHub

Answer

Azure Policy for Pipelines

Answer

Pipeline security gate

Question 12

Your organization uses Microsoft Defender XDR for security monitoring. You need to configure an alert that fires whenever a user with high privileges (e.g., Project Collection Administrators) is added to an Azure DevOps group. What is the most efficient approach?

Accepted Answer

Create a custom detection rule in Microsoft Defender XDR using the Azure DevOps identity provider logs. Option C (Create a custom detection rule in Microsoft Defender XDR using the Azure DevOps identity provider logs) is correct because Defender XDR can ingest Azure DevOps audit logs and create custom detections for specific activities. Option A is not efficient for real-time alerting. Option B is for Azure, not Azure DevOps. Option D is for compliance, not real-time alerting.

Answer

Set up a Microsoft Purview compliance policy for Azure DevOps

Answer

Run a weekly Azure DevOps audit log query manually

Answer

Configure a Log Analytics workspace with Azure Activity Logs

Question 13

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data in Azure DevOps repositories. The compliance team has identified that source code containing credit card numbers (PCI data) was accidentally committed to a public repository. You need to implement a solution that meets the following requirements: (1) Automatically scan all new commits in Azure Repos for sensitive data types like credit card numbers. (2) If sensitive data is detected, automatically block the push and notify the security team. (3) The solution must be integrated with Microsoft Purview and Azure DevOps.

Option A: Configure a branch policy in Azure Repos that runs a custom Azure Function via a service hook when a push occurs, and the function uses Purview APIs to scan the commit.

Option B: Enable Microsoft Purview Data Loss Prevention for Azure DevOps, which automatically scans and blocks pushes containing sensitive data.

Option C: Use GitHub Advanced Security secret scanning for Azure Repos, and configure a webhook to notify the security team.

Option D: Install a third-party extension from Azure DevOps Marketplace that provides content scanning and configure it to block pushes.

Which option is the most appropriate and efficient?

Accepted Answer

Enable Microsoft Purview Data Loss Prevention for Azure DevOps, which automatically scans and blocks pushes containing sensitive data. Option B is correct. Microsoft Purview DLP for Azure DevOps (in preview/GA) provides native scanning and blocking of sensitive data in commits. Option A is complex and not native. Option C is for GitHub, not Azure Repos. Option D might not be native and may not integrate with Purview.

Answer

Configure a branch policy in Azure Repos that runs a custom Azure Function via a service hook when a push occurs, and the function uses Purview APIs to scan the commit

Answer

Install a third-party extension from Azure DevOps Marketplace that provides content scanning and configure it to block pushes

Answer

Use GitHub Advanced Security secret scanning for Azure Repos, and configure a webhook to notify the security team

Question 14

Which THREE measures should you implement to protect secrets (e.g., API keys, passwords) used in Azure Pipelines?

Accepted Answer

Mark variables as 'Secret' in pipeline YAML or UI definitions. Option A, Option C, and Option D are correct. Option A (Use Azure Key Vault to store secrets) is a best practice. Option C (Mark variables as 'Secret' in pipeline definitions) prevents secrets from being exposed in logs. Option D (Use service connections with managed identity instead of personal access tokens) reduces secret exposure. Option B is wrong because storing secrets in Git is insecure. Option E is wrong because environment variables are not encrypted by default.

Answer

Store secrets as plain text in a secure Git repo with restricted access

Answer

Use environment variables in the pipeline to pass secrets at runtime

Question 15

Your team uses GitHub for source control and GitHub Actions for CI/CD. Security policy requires that all code changes must be signed by a verified contributor using a GPG key. You need to enforce this requirement at the organization level. However, some developers use SSH keys for authentication, and you want to allow them to continue. What should you do?

Accepted Answer

In GitHub organization settings, enable 'Require signed commits' and 'Require SSH keys for authentication'.. Option B is correct because enabling 'Require signed commits' on the organization enforces GPG signing. Requiring SSH keys is separate. Option A is wrong because branch protection rules only apply per branch, not org-wide. Option C is wrong because SSH keys are for authentication, not signing. Option D is wrong because it's not an organization-level enforcement.

Answer

Enforce S/MIME signing via Microsoft Entra ID Conditional Access.

Answer

Add a branch protection rule for the default branch requiring signed commits.

Answer

Configure a GitHub Action that rejects unsigned commits in CI.