AZ-400 Develop a security and compliance plan Practice Test 3 — 15 Questions

Question 1

Which TWO actions should a DevOps engineer take to ensure that Azure DevOps pipelines comply with the principle of least privilege for service connections?

Accepted Answer

Create a service principal with permissions scoped to the minimum required Azure resources.. Creating a service principal with permissions scoped to the minimum required Azure resources directly implements the principle of least privilege. By assigning only the necessary roles (e.g., Contributor on a specific resource group) to the service principal used in the service connection, you ensure that the pipeline can only perform actions on those resources, reducing the attack surface. This aligns with Azure RBAC best practices for securing automated deployments.

Answer

Use the Project Collection Build Service account for all pipeline runs.

Answer

Use Workload identity federation to avoid managing secrets.

Answer

Use the same service connection for both build and release pipelines.

Question 2

The exhibit shows a draft Azure Monitor alert rule for Key Vault secret expiry. However, the query fails to return results for secrets that have already expired. What is the most likely reason?

Accepted Answer

The condition `DaysToExpiry > 0` excludes secrets that have already expired.. The query filters on `DaysToExpiry > 0`, which only returns secrets with a positive number of days remaining until expiry. Once a secret has expired, its `DaysToExpiry` becomes zero or negative, so it is excluded from the results. This is a logical filter error: the condition should be `DaysToExpiry <= 0` or remove the filter entirely to include expired secrets.

Answer

The query does not include secrets that have no expiry date set.

Answer

The query only checks secrets that are enabled.

Answer

The `limit 10` clause restricts to only 10 secrets, which may miss expired ones.

Question 3

You are a DevOps engineer for a financial services company with strict regulatory compliance requirements (e.g., PCI-DSS, SOX). The company uses Azure DevOps for CI/CD and manages multiple projects. Each project has its own set of service connections, variable groups, and agent pools. The security team recently audited the environment and found that several service connections have been granted Contributor rights at the subscription level, and some variable groups are accessible by all pipelines across all projects. Additionally, audit logs show that a former employee's service principal still has active service connections in two projects. You need to implement a security and compliance plan to address these issues. Which approach should you take?

Accepted Answer

Implement Azure Policy to enforce that service connections cannot have subscription-level Contributor role; instead, require specific resource group roles. Use Azure AD access reviews to automatically remove stale service principals. Use pipeline decorators to enforce branch policy and approval checks on variable groups that contain secrets.. It provides a comprehensive, automated, and scalable approach to enforcing least privilege and compliance. Azure Policy can audit and enforce that service connections are scoped to resource groups rather than subscriptions, preventing over-permissioned Contributor access. Azure AD access reviews automate the detection and removal of stale service principals, addressing the former employee issue without manual effort. Pipeline decorators enforce mandatory approval checks and branch policies on variable groups containing secrets, ensuring that sensitive variables are not accessible to all pipelines across projects.

Answer

Conduct a manual audit of all service connections and variable groups every quarter, and revoke any permissions that are not needed. Disable service connections associated with the former employee.

Answer

Immediately delete all service connections associated with the former employee and recreate them using service principals with the least privilege. Then, update all pipelines to use the new connections.

Answer

Restrict all service connections to use resource-group level scoped permissions instead of subscription-level. For variable groups, set them to be accessible only to specific pipelines.

Question 4

Your team is implementing a security and compliance plan for Azure DevOps. Which TWO actions should you take to meet regulatory requirements for audit logging and access control?

Accepted Answer

Enable Azure DevOps audit log to track changes to security policies and user permissions.. Enabling the Azure DevOps audit log (option B) is essential for regulatory compliance because it records changes to security policies, user permissions, and other critical events, providing an immutable trail for forensic analysis and reporting. This directly meets audit logging requirements by capturing who did what and when, which is necessary for standards like SOC 2, ISO 27001, or GDPR.

Answer

Enable anonymous access to project boards for external stakeholders.

Answer

Grant all users Project Collection Administrator role to simplify access management.

Answer

Disable auditing for the project to reduce log volume.

Question 5

Your company, Contoso Ltd., is a financial services firm that must comply with PCI DSS. You manage a Azure DevOps organization with over 200 projects. Each project uses a service principal to deploy to Azure using service connections stored in library variable groups. Recently, an auditor flagged that a developer used a service principal with Contributor rights on a production subscription to accidentally delete a storage account. The developer had been granted access to the variable group containing that service principal's credentials. You are tasked with implementing a security and compliance plan to prevent this from recurring. The solution must minimize administrative overhead and follow the principle of least privilege. Current environment: All service principals are created in Azure AD and assigned to variable groups. Developers are granted 'User' access level in Azure DevOps and are members of various teams. You have the ability to create Azure AD groups and custom roles. Which course of action should you take?

Accepted Answer

Create custom Azure RBAC roles with minimal required permissions for each service principal, restrict service connections to specific pipelines using Azure DevOps security settings (e.g., 'Use' permission), and assign developers only the 'Use' permission to the service connections they need, not the variable groups containing credentials.. It enforces the principle of least privilege by creating custom Azure RBAC roles with minimal permissions, restricting service connections to specific pipelines via Azure DevOps security settings (e.g., 'Use' permission), and assigning developers only the 'Use' permission to the service connections rather than the variable groups containing credentials. This prevents developers from directly accessing or modifying the service principal credentials, eliminating the risk of accidental or malicious use of high-privilege roles like Contributor.

Answer

Remove all variable groups and require developers to use their own Azure AD accounts for deployments, granting them Contributor rights only on non-production environments.

Answer

Require all pipeline runs that use production service connections to be approved by a security team via Azure Pipelines approval gates.

Answer

Implement Azure DevOps pipeline decorators to inject a security task that checks the service connection's role before each deployment, and fail the pipeline if the role is Contributor or higher.

Question 6

Drag and drop the steps to perform a blue-green deployment in Azure using App Service slots into the correct order.

Accepted Answer

1. Create a staging slot, 2. Deploy the application to the staging slot, 3. Validate the staging slot, 4. Swap the staging slot to production, 5. Monitor the production slot. Blue-green deployment involves creating a slot, deploying to it, validating, swapping, and monitoring.

Answer

1. Deploy the application to the staging slot, 2. Create a staging slot, 3. Validate the staging slot, 4. Swap the staging slot to production, 5. Monitor the production slot

Answer

1. Create a staging slot, 2. Deploy the application to the staging slot, 3. Swap the staging slot to production, 4. Validate the staging slot, 5. Monitor the production slot

Answer

1. Create a staging slot, 2. Deploy the application to the staging slot, 3. Validate the staging slot, 4. Monitor the production slot, 5. Swap the staging slot to production

Question 7

Drag and drop the steps to configure Azure Monitor alerts for application performance into the correct order.

Accepted Answer

Enable monitoring, then Create alert rule, then Set condition, then Configure action groups, then Test alert. Alert setup begins with enabling monitoring, creating rule, setting condition, action groups, and testing.

Answer

Enable monitoring, then Create alert rule, then Configure action groups, then Set condition, then Test alert

Answer

Create alert rule, then Enable monitoring, then Set condition, then Configure action groups, then Test alert

Answer

Enable monitoring, then Create alert rule, then Set condition, then Test alert, then Configure action groups

Question 8

Match each YAML pipeline trigger to its behavior.

Accepted Answer

CI trigger: Triggers a pipeline when a push occurs on the specified branch. In Azure Pipelines YAML, each trigger type has a distinct purpose: CI for push events, PR for pull requests, Schedules for cron-based runs, and Pipeline for cross-pipeline dependencies. Common confusions mix the behaviors of CI/PR or PR/Pipeline triggers.

Answer

CI trigger: Triggers a pipeline when a pull request is opened

Answer

PR trigger: Triggers a pipeline on completion of another pipeline

Question 9

Match each Azure DevOps extension type to its example.

Accepted Answer

Build task: NuGet Tool Installer. In this matching exercise, the correct pairs are: Build task → NuGet Tool Installer, Dashboard widget → Sprint Burndown, and Service hook → Notify Slack on build completion. The distractors incorrectly assign Sprint Burndown as a build task and NuGet Tool Installer as a dashboard widget, testing your ability to distinguish between extension types based on their purpose. Build tasks execute during pipeline runs, dashboard widgets display information on dashboards, and service hooks trigger external actions on events.

Answer

Build task: Sprint Burndown

Answer

Dashboard widget: NuGet Tool Installer

Question 10

Your team uses GitHub Actions for CI/CD. Security policies require that secrets must be automatically rotated every 90 days. Which Azure DevOps feature should you integrate to enforce this requirement?

Accepted Answer

Azure Key Vault with rotation policy. Azure Key Vault supports automated secret rotation policies that can be configured to rotate secrets at a specified interval, such as every 90 days. By integrating Azure Key Vault with GitHub Actions, you can enforce the security policy that secrets must be automatically rotated without manual intervention. This is the correct choice because it directly meets the requirement for automated rotation within Azure's ecosystem.

Answer

Microsoft Purview Compliance Manager

Answer

GitHub Actions secrets with scheduled workflows

Answer

Azure Managed Identities

Question 11

Your organization uses Azure Boards and requires that all changes to work items in the 'Security' area path be audited. Which solution ensures that any modification to a work item triggers an audit event in Microsoft Sentinel?

Accepted Answer

Configure Azure DevOps Audit Streaming to send logs to Microsoft Sentinel. Azure DevOps Audit Streaming is the correct solution because it natively streams audit events (including work item modifications) to Microsoft Sentinel via the Azure Event Hubs or Log Analytics workspace integration. This ensures real-time, continuous auditing without manual intervention, meeting the requirement for all changes in the 'Security' area path to trigger audit events in Sentinel.

Answer

Enable Microsoft Purview to scan Azure DevOps and detect changes

Answer

Export Azure DevOps audit logs to CSV and import to Sentinel daily

Answer

Create a service hook in Azure DevOps that calls a logic app to create incidents in Sentinel

Question 12

You need to ensure that only approved users can deploy to production from Azure Pipelines. What should you implement?

Accepted Answer

Environment checks with required approvers. Azure Pipelines environment checks with required approvers allow you to enforce that only specific users or groups can approve deployments to a production environment. This is a native Azure DevOps feature that integrates with pipeline stages to gate deployments based on manual approval, ensuring that unauthorized users cannot trigger or approve production releases.

Answer

Pipeline approval gates

Answer

Microsoft Entra ID Conditional Access policies

Answer

Branch protection rules in GitHub

Question 13

Your company uses GitHub Advanced Security. You need to ensure that all code in the main branch is free of high-severity secrets before deployment. What is the most efficient way to enforce this?

Accepted Answer

Enable secret scanning push protection. Secret scanning push protection (option B) is the most efficient way to enforce that no high-severity secrets reach the main branch because it blocks the push at the Git level before the commit is accepted. This prevents secrets from ever entering the repository, eliminating the need for post-hoc detection or manual review. Other options either rely on reactive detection or do not address secrets in code.

Answer

Require manual review of all pull requests for secrets

Answer

Configure Dependabot to flag secrets in dependencies

Answer

Enable code scanning alerts for secrets

Question 14

You need to implement a compliance framework that ensures Azure Pipelines build agents are always patched with the latest security updates. What should you use?

Accepted Answer

Azure Update Management to schedule patching. Azure Update Management is the correct choice because it provides a native, scheduled patching solution for Azure Pipelines build agents. It integrates with Azure Automation and Log Analytics to assess missing updates and deploy them on a recurring schedule, ensuring agents remain compliant with the latest security patches without manual intervention.

Answer

Azure VM Image Builder to create patched images

Answer

Azure Policy to enforce that agents must be patched

Answer

Azure Automation State Configuration to enforce desired state

Question 15

Your organization uses Microsoft Entra ID. You want to ensure that only users from specific countries can access Azure DevOps. Which security feature should you configure?

Accepted Answer

Microsoft Entra ID Conditional Access policies. Microsoft Entra ID Conditional Access policies allow you to enforce location-based access controls by specifying allowed countries or IP ranges. By configuring a Conditional Access policy that targets Azure DevOps (as a cloud app) and setting the condition to 'Locations' with 'Selected countries,' you can restrict sign-ins to only users from those countries. This is the correct approach because Azure DevOps relies on Entra ID for authentication, and Conditional Access is the native mechanism to control access based on geographic location.

Answer

Azure Network Security Group (NSG) rules

Answer

Azure DevOps security groups with allowed IP ranges

Answer

Microsoft Intune compliance policies