AZ-400 Develop a security and compliance plan Practice Test 2 — 15 Questions

Question 1

Your company is migrating from on-premises TFS to Azure DevOps Services in the cloud. The security policy mandates that all access to Azure DevOps must go through a conditional access policy that requires multi-factor authentication (MFA) for users outside the corporate network. Additionally, the policy requires that service accounts (used for automated deployments) must use device-based authentication and cannot be interactive. You are configuring Microsoft Entra ID (formerly Azure AD) conditional access. The Azure DevOps organization is connected to the corporate Entra ID tenant. You have the following options:

Option A: Create a conditional access policy that applies to all users and service principals, requiring MFA for all cloud apps, and exclude the Azure DevOps app from the policy.

Option B: Create a conditional access policy that targets the Azure DevOps app, grant access requiring MFA for all users, and create a separate policy for service accounts that requires device compliance.

Option C: Create a conditional access policy that applies to the Azure DevOps app, requiring MFA for all users, and exclude service accounts by user group. Then create a separate policy for service accounts that requires a compliant device.

Option D: Use Azure DevOps IP address restrictions to block external traffic and rely on VPN for external users.

Which option best meets the requirements?

Accepted Answer

Create a conditional access policy that applies to the Azure DevOps app, requiring MFA for all users, and exclude service accounts by user group. Then create a separate policy for service accounts that requires a compliant device. The correct answer is Option D as listed in the answer choices. It creates a conditional access policy targeting the Azure DevOps app, requiring MFA for all users, and excludes service accounts by user group. A separate policy for service accounts requires a compliant device, meeting the device-based, non-interactive authentication requirement while enforcing MFA for external users. Option A excludes Azure DevOps, so no MFA is enforced. Option B applies MFA to service accounts as well, violating the non-interactive requirement. Option C (the IP restriction option) does not use conditional access and does not meet MFA requirements.

Answer

Create a conditional access policy that applies to all users and service principals, requiring MFA for all cloud apps, and exclude the Azure DevOps app

Answer

Create a conditional access policy that targets the Azure DevOps app, grant access requiring MFA for all users, and create a separate policy for service accounts that requires device compliance

Answer

Use Azure DevOps IP address restrictions to block external traffic and rely on VPN for external users

Question 2

Your development team uses GitHub Enterprise with GitHub Actions for CI/CD. The security team wants to ensure that all secrets used in workflows are stored in GitHub Secrets and that they are not accessible to forked repositories. Currently, some workflows reference secrets directly in YAML files. You need to implement a solution that meets the following requirements: (1) Secrets must be stored in GitHub Secrets, not in YAML files. (2) Workflows triggered from forked repositories must not have access to organization secrets. (3) Auditors must be able to see which workflows access which secrets.

Option A: Move all secrets to GitHub Secrets, configure the repository to require approval for all external contributions, and enable audit logging for secret usage.

Option B: Move all secrets to GitHub Secrets, and in the repository settings, disable 'Allow GitHub Actions to create and approve pull requests' and enable 'Fork pull request workflows from outside collaborators' to require approval.

Option C: Move all secrets to GitHub Secrets, and in the organization settings, enable 'Private repository fork policy' to only allow forks from within the organization, and use environment secrets with required reviewers.

Option D: Move all secrets to GitHub Secrets, and for each workflow that uses secrets, add a condition to check if the event is from a fork, and if so, skip the step.

Which option best satisfies all requirements?

Accepted Answer

Move all secrets to GitHub Secrets, configure the repository to require approval for all external contributions, and enable audit logging for secret usage. All options satisfy requirement 1 by moving secrets to GitHub Secrets. For requirement 2, GitHub does not pass secrets to workflows triggered by pull requests from forks, so no additional approval setting is required; however, a pull_request_target workflow can expose secrets, and only option A (or a similar fork-check condition) addresses that. For requirement 3, GitHub audit logging for secrets records only secret management events (creation, update, deletion) and does not log which workflow accessed which secret. Therefore, no option fully satisfies the auditor requirement, and the marked answer B is incorrect.

Answer

Move all secrets to GitHub Secrets, and for each workflow that uses secrets, add a condition to check if the event is from a fork, and if so, skip the step

Answer

Move all secrets to GitHub Secrets, and in the repository settings, disable 'Allow GitHub Actions to create and approve pull requests' and enable 'Fork pull request workflows from outside collaborators' to require approval

Answer

Move all secrets to GitHub Secrets, and in the organization settings, enable 'Private repository fork policy' to only allow forks from within the organization, and use environment secrets with required reviewers

Question 3

Your organization uses Microsoft Defender for Cloud and Azure DevOps. Security teams need to automatically detect and block secrets (e.g., passwords, keys) pushed to Azure Repos. Which TWO actions should you take?

Accepted Answer

Enable push protection for secrets in GitHub Advanced Security for Azure Repos.. The correct two actions are to enable GitHub Advanced Security for Azure Repos (which includes secret scanning) and then enable push protection for secrets in the repository settings. Enabling public push protection in GitHub Advanced Security for Azure Repos blocks secrets before they are pushed. Branch policies, Key Vault, and Microsoft Purview Information Protection do not directly detect and block secrets pushed to Azure Repos.

Answer

Set branch policies to require a pull request for all changes.

Answer

Store all secrets in Azure Key Vault and reference them in pipelines.

Answer

Configure Microsoft Purview Information Protection to scan repositories.

Question 4

Your company is deploying Azure DevOps pipelines for a critical financial application. Compliance requires that all pipeline runs are immutable and auditable. You must ensure that once a pipeline completes, its logs, artifacts, and test results cannot be modified or deleted by anyone, including administrators, for 7 years. You also need to prevent any pipeline runs from being deleted. Azure DevOps retention policies are currently set to 30 days. What should you do?

Accepted Answer

Configure Azure DevOps to export all logs to Azure Log Analytics with a 7-year retention.. Azure Log Analytics retention does not provide immutability—data can be purged by administrators. It also does not cover artifacts, test results, or prevent deletion of pipeline runs. The correct solution would be to export all pipeline data to a customer-owned Azure Storage account configured with WORM (immutability) for 7 years and to enforce storage-level deletion prevention. No option describes this.

Answer

Use Azure Policy to enforce immutability on the storage account backing Azure DevOps artifacts, and set pipeline retention policy to 9999 days.

Answer

Assign the 'Project Collection Administrators' group a custom role that denies delete permissions.

Answer

Set branch policies to require approval before any deletion.

Question 5

A company uses Azure DevOps for CI/CD. The security team requires that all pipeline runs must use a specific service connection (ServiceConnection-Prod) that has been approved for production deployments. However, developers are accidentally using unapproved connections. You need to enforce that only the approved service connection can be used in any pipeline that deploys to the production environment. What should you do?

Accepted Answer

Create an Azure Pipeline decorator that validates the service connection used in each task and fails the pipeline if it is not the approved one.. Azure Pipeline decorators inject custom validation logic at runtime, allowing you to inspect each task's service connection and fail the pipeline if it does not match the approved one. This enforces the security requirement centrally without relying on developer compliance or manual gates.

Answer

Define a required template for all pipelines that includes the service connection, and instruct developers to use it.

Answer

Set up a manual approval gate on the production environment stage in the pipeline.

Answer

Configure a branch policy on the main branch to require a successful build before merging.

Question 6

Your organization uses Azure DevOps and Azure Key Vault to manage secrets. You have a pipeline that deploys a web app to Azure App Service. The pipeline uses a variable group linked to Key Vault to retrieve the database connection string. Recently, the build started failing with the error: 'Access to Key Vault is denied. Please ensure the service connection has Get and List permissions on secrets.' The service connection uses a service principal. You have verified that the service principal has the correct Key Vault access policy with Get and List permissions. What is the most likely cause of the failure?

Accepted Answer

The build service identity does not have Get and List permissions on the Key Vault secrets.. The error message indicates that the identity attempting to access Key Vault lacks the required permissions. Even though the service principal has the correct access policy, the pipeline may be using a different identity—the build service identity—to authenticate with Key Vault. In Azure DevOps, when a variable group is linked to Key Vault, the pipeline's build service identity (not the service connection's service principal) must have Get and List permissions on the Key Vault secrets. This is a common misconfiguration where the service principal is granted permissions but the build service identity is not.

Answer

The service connection is configured to use the wrong Azure subscription.

Answer

The secret name in the variable group does not match the secret name in Key Vault.

Answer

The service principal used by the service connection does not have Contributor role on the Key Vault.

Question 7

A company uses Azure DevOps and needs to ensure that all pipelines use approved YAML templates from a central repository. The security team wants to prevent developers from referencing unapproved templates. What is the best way to enforce this?

Accepted Answer

Use a pipeline decorator to check the template origin and fail the pipeline if unapproved.. The correct approach is to use a pipeline decorator that runs at the start of every pipeline, inspects the YAML for template references, and fails the pipeline if any template is not from the approved central repository. The 'Required template' setting forces inclusion of a template but does not block additional unapproved template references.

Answer

Create a branch policy on the repository that requires all pull requests to be approved by security team members.

Answer

Configure a variable group with the approved template repository and require it in all pipelines.

Answer

Set the 'Required template' repository setting in the Azure DevOps project to the approved central repository.

Question 8

You are designing a compliance strategy for Azure DevOps pipelines that deploy to production. The company policy requires that all production deployments must be reviewed by a security lead. Additionally, the deployment must use a specific release pipeline that has been pre-approved. How should you implement this?

Accepted Answer

Define a 'production' environment in Azure DevOps and configure an approval check that requires the security lead. Have the pipeline deploy to that environment.. Azure DevOps environments allow you to define approval checks that must be satisfied before a deployment proceeds. By creating a 'production' environment and adding a pre-deployment approval check requiring the security lead, you enforce the mandatory review. The pipeline then deploys to that environment, ensuring only the pre-approved release pipeline is used.

Answer

Create a branch policy that requires the security lead to approve the pull request before merging.

Answer

Use a Classic release pipeline with a pre-deployment approval gate for the production stage.

Answer

Store the approved pipeline definition in a variable group and reference it in all pipelines.

Question 9

A financial services company uses Azure DevOps and requires that all secrets (e.g., API keys, connection strings) be stored in Azure Key Vault. They have a pipeline that runs automated tests and deploys to staging. The pipeline uses a variable group linked to Key Vault to retrieve secrets. Recently, the pipeline failed with the error: 'Secret 'DbPassword' not found in Key Vault 'kv-prod'. Ensure the secret exists and the service principal has List permission.' The secret exists in the vault. What is the most likely cause?

Accepted Answer

The variable name in the variable group does not exactly match the secret name in Key Vault (case-sensitive).. Variable groups linked to Azure Key Vault in Azure DevOps require an exact case-sensitive match between the variable name in the variable group and the secret name in Key Vault. Even though the secret 'DbPassword' exists in the vault, if the variable group defines the variable as 'dbpassword' or 'DBPassword', the lookup will fail with the 'not found' error. The error message explicitly states the secret was not found, which is the typical symptom of a case mismatch, not a permissions or connectivity issue.

Answer

The variable group is linked to the wrong Key Vault instance.

Answer

The service principal does not have Get permission on the secret.

Answer

The Key Vault is in a different Azure region than the Azure DevOps organization.

Question 10

Your organization uses Azure DevOps and Azure Policy to enforce compliance. You need to ensure that all Azure resources deployed by Azure DevOps pipelines have specific tags (e.g., CostCenter and Environment) applied. Which TWO approaches can achieve this? (Choose TWO.)

Accepted Answer

Create an Azure Policy with the 'deny' effect that requires the tags to be present at resource creation.. An Azure Policy with the 'deny' effect prevents the creation of any resource that does not include the required tags (e.g., CostCenter and Environment). This enforces compliance at the moment of deployment, blocking non-compliant resources from being provisioned by Azure DevOps pipelines. Option D is correct because adding a pipeline task (using Azure CLI or PowerShell) after resource creation programmatically applies the required tags, ensuring resources are tagged even if the initial deployment omitted them.

Answer

Configure the service connection to only allow deployments with tags.

Answer

Create an Azure Policy with the 'audit' effect to report non-compliant resources.

Answer

Configure a branch policy on the main branch to require tag verification in pull requests.

Question 11

A company uses Azure DevOps and has a security policy that all pipeline runs must use a specific service connection scoped to a resource group. A developer reports that a pipeline fails with the error: 'The service connection does not have permission to access the resource.' What is the most likely cause?

Accepted Answer

The service principal used by the service connection does not have the required role assignment on the resource group.. The error 'The service connection does not have permission to access the resource' indicates that the service principal associated with the service connection lacks the necessary Azure RBAC role assignment on the target resource group. In Azure DevOps, a service connection authenticates via a service principal, and that principal must have a role (e.g., Contributor) explicitly assigned at the resource group scope to perform actions like deploying resources. Without this role assignment, the pipeline fails with an access-denied error.

Answer

The Azure subscription linked to the service connection is disabled.

Answer

The service connection name is misspelled in the pipeline YAML.

Answer

The variable group in the library does not include the service connection ID.

Question 12

A company is adopting Azure DevOps and needs to ensure that all pipelines comply with regulatory standards. The security team wants to enforce that every build includes a security scan and that deployment to production requires approval from a compliance officer. Which TWO actions should the DevOps engineer take?

Accepted Answer

Create a required template that includes the security scan task and mandate its use via a pipeline resource.. Creating a required template with the security scan task and mandating its use via a pipeline resource ensures every pipeline inherits the security scan. Option D is correct because configuring a required reviewer approval on the production stage enforces compliance officer approval. Options A, C, and E are incorrect: Branch policies (A) only apply to pull requests, not all builds; storing results (C) does not enforce the scan; and while a pipeline decorator (E) can run a scan on every build, it does not enforce the required approval for production deployment.

Answer

Configure branch policies to require a security scan on pull requests.

Answer

Add a variable group to store security scan results and reference it in the pipeline.

Answer

Use a pipeline decorator to automatically run a security scan on every build.

Question 13

You are reviewing an Azure Policy assignment in a DevOps environment. The exhibit shows the policy assignment JSON. The policy set includes the built-in policy 'Allowed Locations' with effect Deny. During a pipeline deployment, a resource creation fails with a policy violation error. The resource being deployed is a storage account in the 'centralus' region. What is the most likely reason for the failure?

Accepted Answer

The resource being deployed is in a region that is not allowed by the policy assignment parameters.. The policy assignment includes the built-in 'Allowed Locations' policy with the Deny effect. The resource being deployed (a storage account) is in the 'centralus' region, but the policy assignment parameters likely specify a list of allowed regions that does not include 'centralus'. Since the Deny effect prevents any non-compliant resource creation, the deployment fails with a policy violation error. This is the most direct and common cause of such failures in Azure Policy.

Answer

The policy assignment is misconfigured because it does not specify a policy set definition.

Answer

The resource group is located in a region that overrides the policy assignment.

Answer

The policy set definition does not include the 'Allowed Locations' policy.

Question 14

Your organization uses Azure DevOps for a multi-tier web application. The application consists of a React frontend, a Node.js API, and a SQL database. The security team has mandated the following: (1) All code changes must be scanned for secrets before merging to the main branch. (2) Infrastructure-as-code templates (ARM) must be validated for security compliance before deployment. (3) Production deployments must use a service connection with a managed identity that has only the required permissions. You have set up a CI/CD pipeline with two stages: Build and Release. The Build stage runs on pull requests and the Release stage deploys to a production environment. Recently, a developer accidentally committed a secret (API key) to a configuration file. The secret was not caught by the pipeline, and the code was merged to main. You need to prevent this in the future. What should you do?

Accepted Answer

Add a 'Credential Scanner' task to the Build pipeline and configure it to fail the build if any secrets are found. Also, move all secrets to Azure Key Vault and reference them via variable groups.. It directly addresses the root cause: secrets were not being scanned before merge. The Credential Scanner task (part of Microsoft Security Code Analysis) scans for hardcoded secrets and can fail the build, preventing the merge. Moving secrets to Azure Key Vault and referencing them via variable groups (linked to the vault) ensures secrets are never stored in the repository, eliminating the risk of accidental commits.

Answer

Configure a branch policy to require at least two reviewers on pull requests to the main branch.

Answer

Implement a manual approval gate on the Release stage to review each deployment for secrets.

Answer

Use a pipeline decorator to inject a validation step that runs Azure Policy on the code repository.

Question 15

A company's Azure DevOps project uses a custom agent pool with self-hosted agents. The security team discovers that pipeline runs can access secrets stored in Azure Key Vault, but the team wants to ensure that secrets are only accessible to approved pipelines. Which configuration should the team implement?

Accepted Answer

Use a library variable group linked to Key Vault and configure pipeline permissions with branch control.. The correct configuration is to create a library variable group linked to Azure Key Vault and then use pipeline permissions to grant access only to approved pipelines. This restricts secret access at the pipeline level. Branch-specific restrictions are not available on variable groups; to limit access by branch, the pipeline YAML must conditionally include the variable group (e.g., using an `if` expression based on the source branch) or separate pipelines must be used.

Answer

Store secrets directly in pipeline variables and use 'Make secrets available to all pipelines' setting.

Answer

Assign pipeline-level permissions to the Key Vault using Azure RBAC.

Answer

Limit the number of agents in the custom agent pool.