AZ-400 Develop a security and compliance plan — 20 Questions

Question 1

Your organization uses Azure DevOps and Azure Key Vault to manage secrets. You have a pipeline that deploys a web app to Azure App Service. The pipeline uses a variable group linked to Key Vault to retrieve the database connection string. Recently, the build started failing with the error: 'Access to Key Vault is denied. Please ensure the service connection has Get and List permissions on secrets.' The service connection uses a service principal. You have verified that the service principal has the correct Key Vault access policy with Get and List permissions. What is the most likely cause of the failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The build service identity does not have Get and List permissions on the Key Vault secrets.. The error message indicates that the identity attempting to access Key Vault lacks the required permissions. Even though the service principal has the correct access policy, the pipeline may be using a different identity—the build service identity—to authenticate with Key Vault. In Azure DevOps, when a variable group is linked to Key Vault, the pipeline's build service identity (not the service connection's service principal) must have Get and List permissions on the Key Vault secrets. This is a common misconfiguration where the service principal is granted permissions but the build service identity is not.

Answer

The service connection is configured to use the wrong Azure subscription.

Answer

The secret name in the variable group does not match the secret name in Key Vault.

Answer

The service principal used by the service connection does not have Contributor role on the Key Vault.

Question 2

A financial services company uses Azure DevOps and requires that all secrets (e.g., API keys, connection strings) be stored in Azure Key Vault. They have a pipeline that runs automated tests and deploys to staging. The pipeline uses a variable group linked to Key Vault to retrieve secrets. Recently, the pipeline failed with the error: 'Secret 'DbPassword' not found in Key Vault 'kv-prod'. Ensure the secret exists and the service principal has List permission.' The secret exists in the vault. What is the most likely cause?

Accepted Answer

The variable name in the variable group does not exactly match the secret name in Key Vault (case-sensitive).. Variable groups linked to Azure Key Vault in Azure DevOps require an exact case-sensitive match between the variable name in the variable group and the secret name in Key Vault. Even though the secret 'DbPassword' exists in the vault, if the variable group defines the variable as 'dbpassword' or 'DBPassword', the lookup will fail with the 'not found' error. The error message explicitly states the secret was not found, which is the typical symptom of a case mismatch, not a permissions or connectivity issue.

Answer

The variable group is linked to the wrong Key Vault instance.

Answer

The service principal does not have Get permission on the secret.

Answer

The Key Vault is in a different Azure region than the Azure DevOps organization.

Question 3

Your organization uses Azure DevOps and Azure Policy to enforce compliance. You need to ensure that all Azure resources deployed by Azure DevOps pipelines have specific tags (e.g., CostCenter and Environment) applied. Which TWO approaches can achieve this? (Choose TWO.)

Accepted Answer

Create an Azure Policy with the 'deny' effect that requires the tags to be present at resource creation.. Option C is correct because an Azure Policy with the 'deny' effect evaluates resource requests at deployment time and blocks any resource creation that does not include the required tags such as CostCenter and Environment, directly enforcing the tagging requirement for resources deployed by Azure DevOps pipelines. Option D is correct because a post-deployment pipeline task using Azure CLI (e.g., az resource tag) or PowerShell (e.g., Set-AzResource -Tag) can apply the required tags to resources after they are created, ensuring the tags exist even when policy enforcement is not used at creation time. Option A is incorrect because service connections in Azure DevOps authenticate and authorize deployments; they have no capability to inspect or require resource tags. Option B is incorrect because the 'audit' effect only reports non-compliant resources and does not enforce or apply the required tags. Option E is incorrect because branch policies govern pull request and merge behavior in Git repositories and cannot verify or enforce Azure resource tags.

Answer

Configure the service connection to only allow deployments with tags.

Answer

Create an Azure Policy with the 'audit' effect to report non-compliant resources.

Answer

Configure a branch policy on the main branch to require tag verification in pull requests.

Question 4

A company uses Azure DevOps and requires that all pipeline runs are audited and that sensitive information (e.g., passwords, keys) is never exposed in logs. Which TWO actions should you take? (Choose TWO.)

Accepted Answer

Use secret pipeline variables and ensure the 'Log secret values in the pipeline' checkbox is unchecked.. Secret pipeline variables are the primary method to prevent sensitive information from being exposed in logs; Azure DevOps automatically masks their values. Option A is incorrect because setting 'Logging command' to 'ignore' only disables processing of special logging commands like ##vso[task.setvariable]; script output is still captured and could contain secrets. Option B is incorrect because variable groups do not automatically mask secrets; you must use secret variables. Option C is incorrect because read-only scope does not protect secrets in logs. Enabling Azure DevOps audit logging and sending logs to a SIEM (Option E) is a best practice for monitoring and auditing pipeline runs, allowing detection of potential exposures.

Answer

In tasks that run scripts, set the 'Logging command' option to 'ignore' to prevent script output from being captured in the log.

Answer

Store all sensitive information in a variable group and reference it in the pipeline.

Answer

Configure the service connection to use 'Read-only' scope.

Question 5

You are a DevOps engineer at a healthcare company that must comply with HIPAA. The company uses Azure DevOps with YAML pipelines to deploy a multi-tier application to Azure Kubernetes Service (AKS). The application stores sensitive patient data. The security team requires that all secrets (e.g., database passwords, API keys) must be stored in Azure Key Vault and never hardcoded in the pipeline. The pipeline currently uses a service principal (SP1) for AKS deployments. The pipeline has a variable group 'VG-Prod' linked to Key Vault 'KV-Prod' with secrets: 'DbPassword', 'ApiKey'. The pipeline runs successfully in non-production environments. However, when you run the pipeline for production, it fails at the stage that deploys to AKS with the error: 'Error: failed to get secret 'DbPassword' from Key Vault: Forbidden'. You have verified that the secret exists and the variable group is correctly linked. The service principal SP1 has the 'Get' and 'List' permissions on KV-Prod secrets. The AKS cluster is in a different subscription than the Key Vault. What is the most likely cause and how should you fix it?

Accepted Answer

The service principal used by the Azure Resource Manager service connection that links the variable group to Key Vault does not have 'Get' and 'List' permissions on KV-Prod; add it to the Key Vault access policy.. The pipeline fails because the service principal used by the Azure DevOps service connection that links the variable group to Key Vault (not SP1, which is used for AKS deployments) does not have 'Get' and 'List' permissions on KV-Prod. When a variable group is linked to a Key Vault, Azure Pipelines fetches secrets using the Azure Resource Manager service connection configured for that variable group. That service principal must be explicitly granted Get and List permissions in the Key Vault access policy. SP1's permissions are irrelevant because it is not the identity used for secret retrieval.

Answer

The variable group VG-Prod is not properly linked to KV-Prod; re-link it.

Answer

The secret 'DbPassword' does not exist in KV-Prod; create it.

Answer

The service principal SP1 does not have 'Get' and 'List' permissions on KV-Prod; add them.

Question 6

A financial services company uses Azure DevOps to manage CI/CD pipelines for a critical application. The security team requires that all production deployments be approved by two different managers, and that the build artifacts are immutable and signed. Currently, the pipeline uses a manual approval gate with one approver and stores artifacts in Azure Artifacts. What should the DevOps engineer implement to meet the security requirements?

Accepted Answer

Configure a second manual approval gate and enable immutable feed in Azure Artifacts.. The requirements are two approvals, immutable artifacts, and signed artifacts. Option C supplies two approval gates and an immutable feed but omits code signing. Option D only validates signing, not performs it. Branch policies (B) apply to pull requests, not deployment approvals. Key Vault (A) is for secrets, not artifacts. Therefore, a correct solution would require combining C with an explicit code-signing step, which is not offered. The question should be revised to include an option that covers all three requirements.

Answer

Store artifacts in Azure Key Vault and use access policies to control deployment.

Answer

Use branch policies to require two reviewers on pull requests.

Answer

Add a pipeline decorator that injects a validation step for code signing.

Question 7

A company is adopting Azure DevOps and needs to ensure that all pipelines comply with regulatory standards. The security team wants to enforce that every build includes a security scan and that deployment to production requires approval from a compliance officer. Which TWO actions should the DevOps engineer take?

Accepted Answer

Create a required template that includes the security scan task and mandate its use via a pipeline resource.. Option B is correct because a required template (enforced via the 'Required templates' setting on an agent pool or via a pipeline resource/extends template) guarantees that every pipeline inheriting it includes the security scan task, making compliance mandatory rather than optional. Option D is correct because configuring a required reviewer (approval) on the production stage of a release pipeline enforces that a compliance officer must approve before deployment proceeds to production. Option A is not correct because branch policies on pull requests only gate code merges, not every build, and do not guarantee a security scan runs in the build pipeline itself. Option C is not correct because a variable group merely stores values such as secrets or scan results; it does not enforce scanning or approvals. Option E is not correct because a pipeline decorator injects steps automatically but does not by itself enforce the required approval for production deployment, and the question specifies enforcement of both scanning and approval.

Answer

Configure branch policies to require a security scan on pull requests.

Answer

Add a variable group to store security scan results and reference it in the pipeline.

Answer

Use a pipeline decorator to automatically run a security scan on every build.

Question 8

Your team uses GitHub Actions for CI/CD. Security policies require that secrets must be automatically rotated every 90 days. Which Azure DevOps feature should you integrate to enforce this requirement?

Accepted Answer

Azure Key Vault with rotation policy. Azure Key Vault supports automated secret rotation policies that can be configured to rotate secrets at a specified interval, such as every 90 days. By integrating Azure Key Vault with GitHub Actions, you can enforce the security policy that secrets must be automatically rotated without manual intervention. This is the correct choice because it directly meets the requirement for automated rotation within Azure's ecosystem.

Answer

Microsoft Purview Compliance Manager

Answer

GitHub Actions secrets with scheduled workflows

Answer

Azure Managed Identities

Question 9

You are reviewing a compliance policy for Azure Pipelines. What does this policy enforce?

Accepted Answer

Requires multi-factor authentication to approve use of secret variables in the 'MySecrets' variable group. The question prompt only states 'You are reviewing a compliance policy for Azure Pipelines' but does not describe what the policy enforces. Without the policy details, it is impossible to choose any of the options. Furthermore, Azure DevOps does not have a native feature that requires MFA specifically for approving secret variable usage; MFA is generally enforced through Microsoft Entra Conditional Access. Therefore, the question is invalid as written.

Answer

Enforces MFA for all pipeline runs that use the 'MySecrets' variable group

Answer

Requires MFA to edit variables in the 'MySecrets' variable group

Answer

Blocks all access to the 'MySecrets' variable group unless MFA is used

Question 10

You are reviewing an Azure DevOps permissions JSON. What access does the user 'user@contoso.com' have?

Accepted Answer

Contributor access to the build pipeline named 'Build-1'. The question as presented lacks the critical JSON snippet. Without it, it is impossible to verify any of the options. To make this question valid, the full permissions JSON must be provided in the stem, showing the explicit assignment for user@contoso.com. With that JSON, one could then determine whether they have Contributor to Build-1, Reader, etc.

Answer

Reader access to the build pipeline

Answer

Contributor access to all build pipelines

Answer

Reader access to the project

Question 11

You are analyzing Azure DevOps audit logs with a KQL query. What is the purpose of this query?

Accepted Answer

Find the top 5 users who created the most projects in the last 30 days. No query is shown in the stem. Without the actual KQL query, none of the options can be confirmed as the purpose. The question is invalid as written.

Answer

List the top 5 most active users in Azure DevOps

Answer

Display detailed audit records of project creation with timestamps

Answer

Identify users who created projects and have admin role

Question 12

Your team uses GitHub Enterprise to manage source code. You need to implement a security and compliance plan that ensures all commits are signed using GPG keys and that secrets are scanned before code is merged. Which GitHub features should you combine?

Accepted Answer

Enable secret scanning alerts and require signed commits via branch protection rules.. The correct combination is A: Enable secret scanning alerts to detect secrets in code before merge, and use branch protection rules to require signed commits, ensuring all commits are GPG-signed. Push protection is more proactive but not required by the stated need to 'scan' secrets. 'Vigilant mode' is not a repository-level enforcement setting; the proper branch protection option is simply 'Require signed commits'.

Answer

Enable Dependabot alerts and require pull request reviews before merging.

Answer

Configure branch protection rules to require code owners review and enable automatic security fixes.

Answer

Enable push protection for secret scanning and configure branch protection rules with 'Require signed commits' and 'Vigilant mode'.

Question 13

Your organization uses Azure Key Vault to store secrets and certificates used in Azure Pipelines. You need to implement a security and compliance plan that ensures secrets are rotated automatically and access is audited. Which THREE actions should you take?

Accepted Answer

Enable soft-delete and purge protection on the Key Vault.. Enabling soft-delete and purge protection ensures deleted secrets and certificates can be recovered and permanent deletion is blocked, which is important for compliance and recovery. Using a managed identity for Azure Pipelines removes the need to store and rotate credentials, and each access is tied to a known identity, enabling access auditing. Configuring certificate auto-rotation with a specified lifetime ensures secrets are rotated automatically. Together, these actions address recovery, secure access, and automatic rotation as required.

Answer

Use a resource lock on the Key Vault to prevent deletion.

Answer

Use a Key Vault access policy to grant developers full access.

Question 14

Your team is adopting GitHub Copilot for code generation. The compliance team requires that all code generated by AI is reviewed and that proprietary code is not used as training data. Which TWO settings should you configure in your GitHub organization?

Accepted Answer

Configure a branch protection rule that requires all code to be reviewed before merging.. Branch protection rules enforce mandatory pull request reviews before merging, which satisfies the compliance requirement that all AI-generated code must be reviewed by a human before entering the main branch. Additionally, disabling the 'Allow GitHub to use my data for training' option in the organization's Copilot settings prevents proprietary code from being used as training data, directly addressing the compliance requirement that proprietary code not be used for training. Together, these two settings allow the team to use GitHub Copilot safely while meeting compliance.

Answer

Disable Copilot for all repositories in the organization.

Answer

Enable 'Suggestions matching public code' to block suggestions that match public code.

Answer

Enable 'Allow GitHub to use my code snippets for product improvements' to improve Copilot.

Question 15

Refer to the exhibit. Your organization has configured an Azure DevOps pipeline security setting that enforces a required template for all pipelines deploying to production and staging. The required template 'security-validation.yml' runs a series of security scans and compliance checks. A developer creates a new pipeline that deploys to a test environment, but the pipeline does not reference the required template. What will happen?

Accepted Answer

The pipeline will fail because it does not reference the required template.. The Azure DevOps 'Required template' security setting is configured at the project or organization level and applies to all YAML pipelines, regardless of the deployment target environment. There is no native option to enforce it only for specific environments like production or staging. Therefore, a new pipeline deploying to test without referencing the required template would also fail.

Answer

The pipeline will run normally because the required template enforcement only applies to production and staging environments.

Answer

The pipeline will run but the security scans will be automatically injected.

Answer

The pipeline will prompt the developer to add the required template before running.

Question 16

Your organization uses Microsoft Defender for Cloud to monitor Azure resources. The compliance team needs to ensure that all Azure DevOps projects have their pipelines scanned for security issues before deployment. Which integration should you use?

Accepted Answer

Enable GitHub Advanced Security for Azure DevOps in Microsoft Defender for Cloud.. Enabling GitHub Advanced Security for Azure DevOps in Microsoft Defender for Cloud allows Defender for Cloud to ingest security alerts from Azure DevOps repositories and pipelines, including secret scanning, code scanning, and dependency scanning. This integration ensures that all Azure DevOps projects are monitored for security issues before deployment, meeting the compliance team's requirement for centralized visibility and enforcement.

Answer

Configure branch policies in Azure Repos to require a security scan.

Answer

Configure deployment gates in Azure Pipelines to require a security scan.

Answer

Use Azure Policy to enforce scanning on Azure DevOps pipelines.

Question 17

Refer to the exhibit. You have configured a Conditional Access policy in Microsoft Entra ID to require MFA for Azure DevOps. However, users report that they can still access Azure DevOps without MFA when using a PAT for authentication. What is the most likely reason?

Accepted Answer

PATs are not subject to Conditional Access policies because they use legacy authentication.. B is correct because Personal Access Tokens (PATs) in Azure DevOps are considered legacy authentication tokens. Conditional Access policies in Microsoft Entra ID do not evaluate requests made using legacy authentication protocols, including PATs, OAuth device code flow, or IMAP/POP. Therefore, even if a Conditional Access policy requires MFA for Azure DevOps, users authenticating with a PAT bypass the policy entirely.

Answer

The policy should include 'Require device to be marked as compliant'.

Answer

The policy should be scoped to 'All cloud apps' instead of just Azure DevOps.

Answer

The Conditional Access policy is not enabled.

Question 18

Your organization needs to ensure that all containers built in Azure Pipelines are scanned for vulnerabilities before being pushed to a container registry. Which step should you add to the pipeline?

Accepted Answer

Add a step to use 'Microsoft Defender for Cloud' container image scanning.. Both Microsoft Defender for Cloud and Trivy can be used as pipeline steps to scan container images for vulnerabilities before pushing to a registry. Since the stem does not restrict to a Microsoft-native solution, both A and D are correct.

Answer

Add a step to create an Azure Container Registry task for scanning.

Answer

Add a step to push the image to Docker Hub for scanning.

Question 19

Your company uses Microsoft Purview to manage data governance. You need to classify a new dataset containing personally identifiable information (PII) and apply a data loss prevention (DLP) policy. What should you do first?

Accepted Answer

Register and scan the data source in Microsoft Purview. Before Microsoft Purview can classify PII or apply any DLP policy, the data source must be registered and scanned so Purview knows what data exists and where it lives. Registration establishes the connection and metadata boundary, while the scan populates the Data Map and triggers built-in or custom classification rules (such as the PII classifiers). Only after this discovery step can sensitivity labels or DLP policies meaningfully target the dataset, because those controls rely on the Data Map's inventory and classification results.

Answer

Create a sensitivity label in Microsoft Purview

Answer

Add the data source to an Azure service tag

Answer

Define a DLP policy in Microsoft Purview

Question 20

You are deploying a web app to Azure App Service using Azure Pipelines. The security team requires that all secrets are stored in Azure Key Vault and retrieved at deployment time. What is the best approach?

Accepted Answer

Add an Azure Key Vault task in the pipeline to download secrets. The Azure Key Vault task in Azure Pipelines directly downloads secrets from Key Vault as pipeline variables at deployment time, ensuring secrets are never stored in the pipeline definition or source control. This meets the security team's requirement for retrieving secrets at deployment time without exposing them in logs or build artifacts.

Answer

Store secrets in pipeline variables and mark them as secret

Answer

Use Variable Groups linked to Key Vault

Answer

Reference Key Vault secrets directly in App Service configuration