AZ-400 Develop a security and compliance plan Practice Test 2 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud to monitor Azure resources. The compliance team needs to ensure that all Azure DevOps projects have their pipelines scanned for security issues before deployment. Which integration should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable GitHub Advanced Security for Azure DevOps in Microsoft Defender for Cloud.. Enabling GitHub Advanced Security for Azure DevOps in Microsoft Defender for Cloud allows Defender for Cloud to ingest security alerts from Azure DevOps repositories and pipelines, including secret scanning, code scanning, and dependency scanning. This integration ensures that all Azure DevOps projects are monitored for security issues before deployment, meeting the compliance team's requirement for centralized visibility and enforcement.

Answer

Configure branch policies in Azure Repos to require a security scan.

Answer

Configure deployment gates in Azure Pipelines to require a security scan.

Answer

Use Azure Policy to enforce scanning on Azure DevOps pipelines.

Question 2

Refer to the exhibit. You have configured a Conditional Access policy in Microsoft Entra ID to require MFA for Azure DevOps. However, users report that they can still access Azure DevOps without MFA when using a PAT for authentication. What is the most likely reason?

Accepted Answer

PATs are not subject to Conditional Access policies because they use legacy authentication.. B is correct because Personal Access Tokens (PATs) in Azure DevOps are considered legacy authentication tokens. Conditional Access policies in Microsoft Entra ID do not evaluate requests made using legacy authentication protocols, including PATs, OAuth device code flow, or IMAP/POP. Therefore, even if a Conditional Access policy requires MFA for Azure DevOps, users authenticating with a PAT bypass the policy entirely.

Answer

The policy should include 'Require device to be marked as compliant'.

Answer

The policy should be scoped to 'All cloud apps' instead of just Azure DevOps.

Answer

The Conditional Access policy is not enabled.

Question 3

Your organization needs to ensure that all containers built in Azure Pipelines are scanned for vulnerabilities before being pushed to a container registry. Which step should you add to the pipeline?

Accepted Answer

Add a step to use 'Microsoft Defender for Cloud' container image scanning.. Both Microsoft Defender for Cloud and Trivy can be used as pipeline steps to scan container images for vulnerabilities before pushing to a registry. Since the stem does not restrict to a Microsoft-native solution, both A and D are correct.

Answer

Add a step to create an Azure Container Registry task for scanning.

Answer

Add a step to push the image to Docker Hub for scanning.

Question 4

Your company uses Microsoft Purview to manage data governance. You need to classify a new dataset containing personally identifiable information (PII) and apply a data loss prevention (DLP) policy. What should you do first?

Accepted Answer

Register and scan the data source in Microsoft Purview. Before Microsoft Purview can classify PII or apply any DLP policy, the data source must be registered and scanned so Purview knows what data exists and where it lives. Registration establishes the connection and metadata boundary, while the scan populates the Data Map and triggers built-in or custom classification rules (such as the PII classifiers). Only after this discovery step can sensitivity labels or DLP policies meaningfully target the dataset, because those controls rely on the Data Map's inventory and classification results.

Answer

Create a sensitivity label in Microsoft Purview

Answer

Add the data source to an Azure service tag

Answer

Define a DLP policy in Microsoft Purview

Question 5

You are deploying a web app to Azure App Service using Azure Pipelines. The security team requires that all secrets are stored in Azure Key Vault and retrieved at deployment time. What is the best approach?

Accepted Answer

Add an Azure Key Vault task in the pipeline to download secrets. The Azure Key Vault task in Azure Pipelines directly downloads secrets from Key Vault as pipeline variables at deployment time, ensuring secrets are never stored in the pipeline definition or source control. This meets the security team's requirement for retrieving secrets at deployment time without exposing them in logs or build artifacts.

Answer

Store secrets in pipeline variables and mark them as secret

Answer

Use Variable Groups linked to Key Vault

Answer

Reference Key Vault secrets directly in App Service configuration

Question 6

Your team uses Azure Pipelines and wants to ensure that builds cannot access the internet to prevent data exfiltration. What should you do?

Accepted Answer

Create a private agent pool with no internet access. Microsoft-hosted agents with network isolation (B) is a valid Azure feature. However, using a private agent pool with no internet access (A) or self-hosted agents on an isolated network (D) are also valid methods to prevent internet access for builds. The question should be revised to specify a constraint that excludes these options, or the correct options should include A and D.

Answer

Set the pipeline variable 'DisableInternetAccess' to true

Question 7

You are reviewing an Azure Policy definition applied to an Azure DevOps organization. What is the effect of this policy?

Accepted Answer

It denies creation of new pipelines. Azure Policy applies to Azure resources, not Azure DevOps pipelines. There is no Azure Policy definition that can directly deny pipeline creation. Therefore none of the listed effects are correct; the policy would have no effect on pipeline creation.

Answer

It denies creation of any Azure resource

Answer

It allows creation of all pipelines

Answer

It audits pipeline creation without blocking

Question 8

You are auditing an Azure Pipeline YAML file. The security team requires that deployments to the 'Prod' environment only occur from the main branch. Does this pipeline meet that requirement?

Accepted Answer

Yes, because the condition ensures deployment only from main. The question stem does not include the actual YAML pipeline definition. The requirement to deploy only from main cannot be verified without inspecting the pipeline's stage conditions, branches, and trigger configurations. Since the YAML is absent, it is impossible to determine whether the pipeline meets the security requirement. None of the provided options can be considered correct.

Answer

Yes, because the Deploy stage always runs after Build

Answer

No, because the Build stage should also be conditioned

Answer

No, because the condition should be 'succeeded()' only

Question 9

Your company uses GitHub and must comply with data residency requirements. Which THREE actions should you take to ensure data stays within a specific geographic region?

Accepted Answer

Use GitHub Enterprise Cloud with data residency add-on. To comply with data residency requirements, the only valid action among the options is to use GitHub Enterprise Cloud with the data residency add-on. Self-hosted runners only affect compute location, not GitHub-managed data storage. The other options (C, D, E) are unrelated to data residency. Therefore, the question incorrectly requests three actions.

Answer

Use self-hosted runners in the desired region

Answer

Enable GitHub Actions for all repositories

Answer

Enable push protection for secrets

Answer

Configure repository visibility and storage location in GitHub settings

Question 10

You are designing a plan to protect Azure DevOps pipelines from supply chain attacks. Which TWO measures should you implement?

Accepted Answer

Require approval for pipeline runs that use external resources. Option A is correct because requiring approval for pipeline runs that use external resources (e.g., templates, tasks, or repositories outside the organization) enforces a human review checkpoint that blocks untrusted or tampered external code from executing in your build/release pipeline, directly mitigating supply chain injection. Option B is correct because Dependabot continuously scans dependency manifests (e.g., package.json, .csproj, requirements.txt) and automatically opens pull requests to upgrade vulnerable or outdated packages, reducing exposure to known compromised or CVE-affected dependencies that are a primary supply chain attack vector. Option C is not correct because code coverage thresholds only measure test completeness and do not detect or prevent malicious or compromised dependencies. Option D is not correct because secret scanning detects leaked credentials in repositories but does not address the integrity of external dependencies or pipeline resources. Option E is not correct because release gates validate deployment health (e.g., monitoring alerts, work items) after or before deployment, not the provenance or trustworthiness of pipeline inputs.

Answer

Implement code coverage thresholds in pull requests

Answer

Enable secret scanning for all repositories

Answer

Use release gates to validate deployment health

Question 11

Your team uses Azure DevOps and wants to enforce branch protection policies for all repositories in a GitHub Advanced Security-enabled organization. Which approach should you use to ensure that pull requests require a successful status check from a required workflow?

Accepted Answer

Define a repository rule in GitHub that requires a successful status check from a required workflow.. GitHub repository rules (also known as repository rulesets) allow organizations to centrally enforce policies like required status checks across multiple repositories. To require a successful status check from a specific workflow on all pull requests, create an organization-level repository ruleset that includes the 'Require status checks to pass' rule and specify the workflow's check name. This applies to all selected repositories without per-repository configuration. GitHub Advanced Security is not required for this feature; it is a separate security add-on.

Answer

Use GitHub Actions secrets to store the required status check name.

Answer

Create a branch protection rule in each repository's settings.

Answer

Configure branch policies in Azure DevOps project settings.

Question 12

Your organization uses GitHub Actions and has a repository containing sensitive infrastructure code. You need to ensure that only approved actions are used in workflows. Which two settings should you configure? (Select two.)

Accepted Answer

Allow actions created by GitHub.. This is a select-two question. The correct answers are A and C. Option A is correct because enabling 'Allow actions created by GitHub' restricts workflows to only use first-party actions published by GitHub, establishing a baseline security posture. Option C is correct because further limiting actions to only those from specific approved repositories provides granular control over third-party actions that have been vetted by the organization. Together, these settings ensure that only approved actions can be used in workflows, meeting the compliance requirement.

Answer

Disable actions for the repository.

Answer

Use environment protection rules.

Answer

Store actions in encrypted secrets.

Question 13

Your organization must comply with SOC 2 requirements. You are using Azure DevOps and need to ensure that all pipeline runs are logged and that logs are retained for at least one year. Which configuration should you implement?

Accepted Answer

Enable audit streaming to a Log Analytics workspace and set retention to 365 days.. SOC 2 requires audit logging and retention of pipeline execution history for at least one year. Azure DevOps audit streaming sends all audit events (including pipeline runs) to a Log Analytics workspace, where you can set a retention policy of 365 days. This satisfies both the logging and retention requirements without relying on pipeline-level retention settings that only cover build artifacts and logs, not audit events.

Answer

Increase the retention period of pipeline logs in the Azure DevOps UI.

Answer

Configure diagnostic settings for the Azure DevOps organization.

Answer

Disable the option to delete pipelines.

Question 14

Your Azure DevOps organization has multiple projects. You need to ensure that only approved extension versions are installed across all projects. What is the most efficient way to enforce this?

Accepted Answer

Use the Azure DevOps extension management settings to mark approved extensions and block others.. Azure DevOps provides organization-level extension management settings where administrators can approve specific extensions and block others from being installed across all projects. This is the most efficient way to enforce that only approved extension versions are installed organization-wide.

Answer

Restrict extension usage to specific pipelines via YAML.

Answer

Create an Azure Policy that audits extension installations.

Answer

Uninstall all extensions and only install them per project as needed.

Question 15

Your team uses Azure Pipelines to deploy to Azure Kubernetes Service (AKS). The security team requires that all container images be scanned for vulnerabilities before deployment. You have configured a container registry with Microsoft Defender for Cloud integration. What should you add to your pipeline to ensure only compliant images are deployed?

Accepted Answer

Use the 'Azure Container Registry' task with the 'Scan' option to check vulnerabilities and fail the pipeline if critical vulnerabilities exist.. To ensure only compliant images are deployed, you must add a vulnerability scan step before deployment that fails the pipeline on critical findings. Microsoft Defender for Cloud scans images in ACR on push, and results can be queried via the Azure CLI or REST API. There is no built-in Azure Pipelines task named 'Azure Container Registry' with a 'Scan' action. A common pattern is to use an Azure CLI task to query scan results or integrate a third-party scanner like Trivy, then conditionally fail the pipeline. None of the listed options accurately describes this.

Answer

Set up Azure Policy to deny deployments of images without scan results.

Answer

Add a task that runs a vulnerability scan on the image after deployment.

Answer

Configure the AKS cluster to scan images after pulling.