AZ-400 Develop a security and compliance plan Practice Test 3 — 15 Questions

Question 1

You are evaluating an Azure Policy assignment for Azure Pipelines. What does this policy audit?

Accepted Answer

Whether pipelines use secure files with extensions other than .pfx, .p12, or .cer. Option A is correct because the policy audits that only specific secure file types are allowed. Option B is wrong because it does not restrict number of files. Option C is wrong because it does not require encryption. Option D is wrong because it does not restrict pipeline use.

Answer

Whether secure files are rotated within 90 days

Answer

Whether secure files are encrypted at rest

Answer

Whether secure files are used in production pipelines

Question 2

Your team uses GitHub. You need to automatically remove a user's access to all repositories when they leave the company. What is the most efficient approach?

Accepted Answer

Enable SCIM provisioning from Microsoft Entra ID to GitHub. Option D is correct because linking GitHub to Microsoft Entra ID via SCIM automates deprovisioning. Option A is wrong because manual removal is not efficient. Option B is wrong because SAML SSO provides authentication but not automatic deprovisioning. Option C is wrong because GitHub organization roles are not automatically updated.

Answer

Assign the user to a 'Leaver' team and remove all repository permissions

Answer

Manually remove the user from each repository

Answer

Configure SAML single sign-on (SSO) with Microsoft Entra ID

Question 3

Which TWO actions should you take to ensure that Azure Pipelines artifacts are scanned for vulnerabilities before production deployment? (Choose two.)

Accepted Answer

Run dependency scanning on the artifact manifest. Options B and C are correct. Option B: Dependency scanning identifies vulnerabilities in dependencies. Option C: Incorporating Microsoft Defender for Cloud scanning into the pipeline scans container images and other artifacts. Option A is wrong because code signing ensures integrity but not vulnerability scanning. Option D is wrong because static analysis finds code issues, not artifacts. Option E is wrong because infrastructure scanning is for IaC, not artifacts.

Answer

Sign the artifacts with a code signing certificate

Answer

Scan the infrastructure as code templates

Answer

Run static code analysis on the source code

Question 4

Which THREE measures should be implemented to protect secrets in Azure Pipelines? (Choose three.)

Accepted Answer

Restrict which pipelines can access the variable group. Options A, B, and D are correct. Option A: Using variable groups with locked variables prevents modification. Option B: Linking Azure Key Vault centrally manages secrets. Option D: Limiting scope of secret-using pipelines reduces exposure. Option C is wrong because logging secrets to console exposes them. Option E is wrong because storing secrets in code defeats the purpose.

Answer

Log secret values to pipeline console for debugging

Answer

Store secrets in code as environment variables

Question 5

Which TWO tools can be used to enforce branch protection policies in GitHub repositories? (Choose two.)

Accepted Answer

Azure Pipelines branch policies. Options A and C are correct. Option A: GitHub branch protection rules are built-in. Option C: Azure Pipelines can enforce policies via branch policy checks. Option B is wrong because GitHub Actions can run checks but not enforce policies. Option D is wrong because Microsoft Intune manages devices. Option E is wrong because Microsoft Purview is for data governance.

Answer

Microsoft Intune compliance policies

Answer

Microsoft Purview data classification

Answer

GitHub Actions workflows

Question 6

You are reviewing an Azure DevOps permissions JSON. What access does the user 'user@contoso.com' have?

Accepted Answer

Contributor access to the build pipeline named 'Build-1'. Option B is correct because the user has Contributor role scoped to the build pipeline 'Build-1'. Option A is wrong because Reader is a group, not the user. Option C is wrong because scope is specific to build, not all pipelines. Option D is wrong because the user has Contributor, not Reader.

Answer

Reader access to the build pipeline

Answer

Contributor access to all build pipelines

Answer

Reader access to the project

Question 7

You need to ensure that only signed-in users can view Azure DevOps project wikis. Which setting should you configure?

Accepted Answer

Set project visibility to 'Private'. Option A is correct because project visibility controls who can view the project. Option B is wrong because repository security is for code, not wikis. Option C is wrong because Microsoft Entra ID Application Proxy is for on-prem apps. Option D is wrong because wiki permissions are per-wiki, not a global setting.

Answer

Configure wiki permissions to deny anonymous users

Answer

Set repository visibility to 'Private'

Answer

Use Microsoft Entra ID Application Proxy

Question 8

You are analyzing Azure DevOps audit logs with a KQL query. What is the purpose of this query?

Accepted Answer

Find the top 5 users who created the most projects in the last 30 days. Option C is correct because the query filters for successful project creation events, groups by actor, and returns the top 5 users by count. Option A is wrong because it does not filter by role. Option B is wrong because it only counts project creation, not all operations. Option D is wrong because it does not show creation time details.

Answer

List the top 5 most active users in Azure DevOps

Answer

Display detailed audit records of project creation with timestamps

Answer

Identify users who created projects and have admin role

Question 9

Your organization uses Azure DevOps to manage CI/CD pipelines. The security team requires that all pipeline runs use a specific service connection that references a managed identity in Microsoft Entra ID. However, some developers have been using personal access tokens (PATs) in their pipelines, bypassing the managed identity. What should you implement to enforce the use of the managed identity service connection?

Accepted Answer

Use a pipeline decorator to validate the service connection and fail the pipeline if an unauthorized connection is used.. Azure DevOps pipeline decorators can inject a task at the beginning of every pipeline to validate that only approved service connections are used, rejecting pipelines that use PATs or other unauthorized connections. Branch policies protect branches but don't control service connection usage. Agent pools and variable groups don't enforce service connection selection.

Answer

Configure a branch policy on the main branch to require a specific service connection.

Answer

Restrict the use of PATs by setting an agent pool-level permission.

Answer

Store the service connection ID in a variable group and reference it in each pipeline.

Question 10

Your team uses GitHub Enterprise to manage source code. You need to implement a security and compliance plan that ensures all commits are signed using GPG keys and that secrets are scanned before code is merged. Which GitHub features should you combine?

Accepted Answer

Enable push protection for secret scanning and configure branch protection rules with 'Require signed commits' and 'Vigilant mode'.. Push protection in secret scanning prevents secrets from being pushed. Commit signature verification with Vigilant mode blocks unsigned commits. Branch protection rules enforce both. Secret scanning alerts only notify after a push. Dependabot and code owners address dependency and review requirements, not signing or secret prevention.

Answer

Enable secret scanning alerts and require signed commits via branch protection rules.

Answer

Enable Dependabot alerts and require pull request reviews before merging.

Answer

Configure branch protection rules to require code owners review and enable automatic security fixes.

Question 11

Your organization uses Azure DevOps and Microsoft Entra ID. The compliance team needs to ensure that access to Azure DevOps projects is governed by conditional access policies. Which Azure DevOps integration should you use?

Accepted Answer

Link the Azure DevOps organization to the Microsoft Entra ID tenant and configure conditional access policies in Microsoft Entra ID.. Azure DevOps supports Microsoft Entra ID conditional access policies, which apply to all users accessing Azure DevOps through the organization's tenant. Service hooks and OAuth tokens are for automation, not access control. Managed identities are for Azure resources, not user access.

Answer

Configure service hooks to enforce conditional access.

Answer

Assign managed identities to users for conditional access.

Answer

Use OAuth tokens to authenticate users.

Question 12

Your team uses GitHub Advanced Security to identify vulnerabilities in code. Which TWO actions can you take to ensure that critical security alerts are addressed before code is merged?

Accepted Answer

Configure branch protection rules to require status checks from code scanning.. Branch protection rules can require passing status checks from code scanning and secret scanning. Pull request annotations show alerts directly in the PR. Dependabot auto-merge and repository rules for bypassing are not relevant for blocking merges based on security alerts.

Answer

Enable secret scanning push protection.

Answer

Create a repository rule that allows bypassing pull request requirements.

Answer

Enable Dependabot auto-merge for pull requests.

Question 13

Your organization uses Azure Key Vault to store secrets and certificates used in Azure Pipelines. You need to implement a security and compliance plan that ensures secrets are rotated automatically and access is audited. Which THREE actions should you take?

Accepted Answer

Enable soft-delete and purge protection on the Key Vault.. Key Vault supports automatic certificate rotation with expiration dates. Soft-delete and purge protection prevent permanent deletion. Managed identities allow pipelines to access Key Vault without secrets in code. Resource locks prevent accidental deletion but not rotation or auditing. Access policies or RBAC control access but don't enable rotation.

Answer

Use a resource lock on the Key Vault to prevent deletion.

Answer

Use a Key Vault access policy to grant developers full access.

Question 14

Your team is adopting GitHub Copilot for code generation. The compliance team requires that all code generated by AI is reviewed and that proprietary code is not used as training data. Which TWO settings should you configure in your GitHub organization?

Accepted Answer

Configure a branch protection rule that requires all code to be reviewed before merging.. GitHub Copilot for Business allows admins to disable training on user code and enforce policies. Disallowing public code suggestions from being used as training data protects proprietary code. Requiring Copilot to only suggest from approved libraries is not a feature. Disabling Copilot entirely is not the goal. Enabling suggestions matching public code is the opposite of what is needed.

Answer

Disable Copilot for all repositories in the organization.

Answer

Enable 'Suggestions matching public code' to block suggestions that match public code.

Answer

Enable 'Allow GitHub to use my code snippets for product improvements' to improve Copilot.

Question 15

Refer to the exhibit. You receive a secret scanning alert for an Azure DevOps PAT in a GitHub repository. The push_protection_bypass is false. What does this mean and what action should you take?

Accepted Answer

The secret was blocked from being pushed; you should revoke the PAT and investigate the incident.. Push protection blocked the push, so the secret was not committed to the repository. You should revoke the PAT and investigate how it was used. The secret is not in the commit history because it was blocked. Since it was not committed, you don't need to use git filter-branch or GitHub support to remove it.

Answer

The secret was pushed but push protection was bypassed; you need to revoke the PAT and use git filter-branch to remove it from history.

Answer

The secret was pushed successfully; you need to rotate the PAT and audit the commit history.

Answer

The secret was pushed and push protection was not bypassed; you need to open a support ticket with GitHub to remove the secret.

AZ-400 Develop a security and compliance plan Practice Test 3 — 15 Questions

Exhibit

AZ-400 Develop a security and compliance plan Practice Test 3 — 15 Questions

Exhibit