AZ-400 Develop a security and compliance plan Practice Test 2 — 15 Questions

Question 1

The exhibit shows a draft Azure Monitor alert rule for Key Vault secret expiry. However, the query fails to return results for secrets that have already expired. What is the most likely reason?

Accepted Answer

The condition `DaysToExpiry > 0` excludes secrets that have already expired.. Option B is correct because the query filters on `DaysToExpiry > 0`, which only returns secrets with a positive number of days remaining until expiry. Once a secret has expired, its `DaysToExpiry` becomes zero or negative, so it is excluded from the results. This is a logical filter error: the condition should be `DaysToExpiry <= 0` or remove the filter entirely to include expired secrets.

Answer

The query does not include secrets that have no expiry date set.

Answer

The query only checks secrets that are enabled.

Answer

The `limit 10` clause restricts to only 10 secrets, which may miss expired ones.

Question 2

You are a DevOps engineer for a financial services company with strict regulatory compliance requirements (e.g., PCI-DSS, SOX). The company uses Azure DevOps for CI/CD and manages multiple projects. Each project has its own set of service connections, variable groups, and agent pools. The security team recently audited the environment and found that several service connections have been granted Contributor rights at the subscription level, and some variable groups are accessible by all pipelines across all projects. Additionally, audit logs show that a former employee's service principal still has active service connections in two projects. You need to implement a security and compliance plan to address these issues. Which approach should you take?

Accepted Answer

Implement Azure Policy to enforce that service connections cannot have subscription-level Contributor role; instead, require specific resource group roles. Use Azure AD access reviews to automatically remove stale service principals. Use pipeline decorators to enforce branch policy and approval checks on variable groups that contain secrets.. Option D is correct because it provides a comprehensive, automated, and scalable approach to enforcing least privilege and compliance. Azure Policy can audit and enforce that service connections are scoped to resource groups rather than subscriptions, preventing over-permissioned Contributor access. Azure AD access reviews automate the detection and removal of stale service principals, addressing the former employee issue without manual effort. Pipeline decorators enforce mandatory approval checks and branch policies on variable groups containing secrets, ensuring that sensitive variables are not accessible to all pipelines across projects.

Answer

Conduct a manual audit of all service connections and variable groups every quarter, and revoke any permissions that are not needed. Disable service connections associated with the former employee.

Answer

Immediately delete all service connections associated with the former employee and recreate them using service principals with the least privilege. Then, update all pipelines to use the new connections.

Answer

Restrict all service connections to use resource-group level scoped permissions instead of subscription-level. For variable groups, set them to be accessible only to specific pipelines.

Question 3

Your team is implementing a security and compliance plan for Azure DevOps. Which TWO actions should you take to meet regulatory requirements for audit logging and access control?

Accepted Answer

Enable Azure DevOps audit log to track changes to security policies and user permissions.. Enabling the Azure DevOps audit log (option B) is essential for regulatory compliance because it records changes to security policies, user permissions, and other critical events, providing an immutable trail for forensic analysis and reporting. This directly meets audit logging requirements by capturing who did what and when, which is necessary for standards like SOC 2, ISO 27001, or GDPR.

Answer

Enable anonymous access to project boards for external stakeholders.

Answer

Grant all users Project Collection Administrator role to simplify access management.

Answer

Disable auditing for the project to reduce log volume.

Question 4

Your company, Contoso Ltd., is a financial services firm that must comply with PCI DSS. You manage a Azure DevOps organization with over 200 projects. Each project uses a service principal to deploy to Azure using service connections stored in library variable groups. Recently, an auditor flagged that a developer used a service principal with Contributor rights on a production subscription to accidentally delete a storage account. The developer had been granted access to the variable group containing that service principal's credentials. You are tasked with implementing a security and compliance plan to prevent this from recurring. The solution must minimize administrative overhead and follow the principle of least privilege. Current environment: All service principals are created in Azure AD and assigned to variable groups. Developers are granted 'User' access level in Azure DevOps and are members of various teams. You have the ability to create Azure AD groups and custom roles. Which course of action should you take?

Accepted Answer

Create custom Azure RBAC roles with minimal required permissions for each service principal, restrict service connections to specific pipelines using Azure DevOps security settings (e.g., 'Use' permission), and assign developers only the 'Use' permission to the service connections they need, not the variable groups containing credentials.. Option D is correct because it enforces the principle of least privilege by creating custom Azure RBAC roles with minimal permissions, restricting service connections to specific pipelines via Azure DevOps security settings (e.g., 'Use' permission), and assigning developers only the 'Use' permission to the service connections rather than the variable groups containing credentials. This prevents developers from directly accessing or modifying the service principal credentials, eliminating the risk of accidental or malicious use of high-privilege roles like Contributor.

Answer

Remove all variable groups and require developers to use their own Azure AD accounts for deployments, granting them Contributor rights only on non-production environments.

Answer

Require all pipeline runs that use production service connections to be approved by a security team via Azure Pipelines approval gates.

Answer

Implement Azure DevOps pipeline decorators to inject a security task that checks the service connection's role before each deployment, and fail the pipeline if the role is Contributor or higher.

Question 5

Drag and drop the steps to perform a blue-green deployment in Azure using App Service slots into the correct order.

Question 6

Drag and drop the steps to configure Azure Monitor alerts for application performance into the correct order.

Question 7

Match each YAML pipeline trigger to its behavior.

Question 8

Match each Azure DevOps extension type to its example.

Question 9

Your team uses GitHub Actions for CI/CD. Security policies require that secrets must be automatically rotated every 90 days. Which Azure DevOps feature should you integrate to enforce this requirement?

Accepted Answer

Azure Key Vault with rotation policy. Option C is correct because Azure Key Vault supports automatic secret rotation policies. Option A is wrong because Microsoft Purview is for data governance, not secret rotation. Option B is wrong because Managed Identities are for authentication, not rotation. Option D is wrong because GitHub Actions secrets do not support automatic rotation natively.

Answer

Microsoft Purview Compliance Manager

Answer

GitHub Actions secrets with scheduled workflows

Answer

Azure Managed Identities

Question 10

Your organization uses Azure Boards and requires that all changes to work items in the 'Security' area path be audited. Which solution ensures that any modification to a work item triggers an audit event in Microsoft Sentinel?

Accepted Answer

Configure Azure DevOps Audit Streaming to send logs to Microsoft Sentinel. Option A is correct because Azure DevOps audit logs can be streamed to Microsoft Sentinel via the Azure DevOps data connector. Option B is wrong because service hooks don't directly integrate with Sentinel. Option C is wrong because Microsoft Purview is for data governance, not real-time auditing. Option D is wrong because export to CSV is a manual process.

Answer

Enable Microsoft Purview to scan Azure DevOps and detect changes

Answer

Export Azure DevOps audit logs to CSV and import to Sentinel daily

Answer

Create a service hook in Azure DevOps that calls a logic app to create incidents in Sentinel

Question 11

You need to ensure that only approved users can deploy to production from Azure Pipelines. What should you implement?

Accepted Answer

Environment checks with required approvers. Option D is correct because Azure Pipelines approval gates allow requiring manual approval before deployment. Option A is wrong because branch policies control code changes, not deployments. Option B is wrong because environment checks can include approvals but are not the primary mechanism. Option C is wrong because Microsoft Entra ID provides authentication but not approval workflows.

Answer

Pipeline approval gates

Answer

Microsoft Entra ID Conditional Access policies

Answer

Branch protection rules in GitHub

Question 12

You are reviewing a compliance policy for Azure Pipelines. What does this policy enforce?

Accepted Answer

Requires multi-factor authentication to approve use of secret variables in the 'MySecrets' variable group. Option A is correct because the policy requires MFA approval when accessing the variable group 'MySecrets'. Option B is wrong because the policy is scoped to the variable group, not all pipeline runs. Option C is wrong because it requires approval, not just MFA authentication. Option D is wrong because it refers to a specific variable group.

Answer

Enforces MFA for all pipeline runs that use the 'MySecrets' variable group

Answer

Requires MFA to edit variables in the 'MySecrets' variable group

Answer

Blocks all access to the 'MySecrets' variable group unless MFA is used

Question 13

Your company uses GitHub Advanced Security. You need to ensure that all code in the main branch is free of high-severity secrets before deployment. What is the most efficient way to enforce this?

Accepted Answer

Enable secret scanning push protection. Option B is correct because secret scanning push protection blocks commits containing secrets. Option A is wrong because code scanning alerts are not blocked at push time. Option C is wrong because Dependabot alerts are for dependencies, not secrets. Option D is wrong because manual review is not efficient.

Answer

Require manual review of all pull requests for secrets

Answer

Configure Dependabot to flag secrets in dependencies

Answer

Enable code scanning alerts for secrets

Question 14

You need to implement a compliance framework that ensures Azure Pipelines build agents are always patched with the latest security updates. What should you use?

Accepted Answer

Azure Update Management to schedule patching. Option C is correct because Azure Update Management can patch VMs used as build agents. Option A is wrong because VM image builder creates images but doesn't patch running agents. Option B is wrong because Azure Policy evaluates compliance but doesn't apply patches. Option D is wrong because Azure Automation State Configuration applies desired state configuration but is not primarily for patching.

Answer

Azure VM Image Builder to create patched images

Answer

Azure Policy to enforce that agents must be patched

Answer

Azure Automation State Configuration to enforce desired state

Question 15

Your organization uses Microsoft Entra ID. You want to ensure that only users from specific countries can access Azure DevOps. Which security feature should you configure?

Accepted Answer

Microsoft Entra ID Conditional Access policies. Option D is correct because Conditional Access policies in Microsoft Entra ID can restrict access based on location. Option A is wrong because Azure DevOps permissions are not geo-aware. Option B is wrong because network security groups are for network traffic, not user access. Option C is wrong because Microsoft Intune manages devices, not user location access.

Answer

Azure Network Security Group (NSG) rules

Answer

Azure DevOps security groups with allowed IP ranges

Answer

Microsoft Intune compliance policies

AZ-400 Develop a security and compliance plan Practice Test 2 — 15 Questions

Exhibit

AZ-400 Develop a security and compliance plan Practice Test 2 — 15 Questions

Exhibit