AZ-400 Develop a security and compliance plan Practice Test 4 — 15 Questions

Question 1

Your company is deploying Azure DevOps pipelines for a critical financial application. Compliance requires that all pipeline runs are immutable and auditable. You must ensure that once a pipeline completes, its logs, artifacts, and test results cannot be modified or deleted by anyone, including administrators, for 7 years. You also need to prevent any pipeline runs from being deleted. Azure DevOps retention policies are currently set to 30 days. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Azure DevOps to export all logs to Azure Log Analytics with a 7-year retention.. Azure Log Analytics retention does not provide immutability—data can be purged by administrators. It also does not cover artifacts, test results, or prevent deletion of pipeline runs. The correct solution would be to export all pipeline data to a customer-owned Azure Storage account configured with WORM (immutability) for 7 years and to enforce storage-level deletion prevention. No option describes this.

Answer

Use Azure Policy to enforce immutability on the storage account backing Azure DevOps artifacts, and set pipeline retention policy to 9999 days.

Answer

Assign the 'Project Collection Administrators' group a custom role that denies delete permissions.

Answer

Set branch policies to require approval before any deletion.

Question 2

Your team uses GitHub for source control and GitHub Actions for CI/CD. Security policy requires that all code changes must be signed by a verified contributor using a GPG key. You need to enforce this requirement at the organization level. However, some developers use SSH keys for authentication, and you want to allow them to continue. What should you do?

Accepted Answer

Add a branch protection rule for the default branch requiring signed commits.. GitHub branch protection rules support a 'Require signed commits' setting that enforces GPG or S/MIME signature verification on commits pushed to the protected branch. This is the correct mechanism to enforce signed commits at the branch level while allowing SSH keys for authentication, since SSH keys and commit signing are independent. Organization-level settings do not offer a combined 'require signed commits and SSH keys' toggle.

Answer

In GitHub organization settings, enable 'Require signed commits' and 'Require SSH keys for authentication'.

Answer

Enforce S/MIME signing via Microsoft Entra ID Conditional Access.

Answer

Configure a GitHub Action that rejects unsigned commits in CI.

Question 3

Your organization uses Azure DevOps with classic pipelines. Security audit requires that all pipeline variables containing secrets (e.g., API keys) are stored in Azure Key Vault and referenced dynamically. Currently, secrets are stored as plain text in the pipeline UI. You need to migrate to Key Vault with minimal downtime and ensure that secret values are never exposed in logs. What should you do?

Accepted Answer

Create a variable group linked to Key Vault, mark variables as 'secret', and reference them in pipelines. Update pipeline steps to use the variable group.. Creating a variable group linked to Azure Key Vault allows you to store secrets in Key Vault and reference them in pipelines. Marking variables as 'secret' ensures they are not exposed in logs. This approach provides centralized secret management with minimal changes to pipelines.

Answer

Store secrets in a secure file in Azure DevOps.

Answer

Use the 'Azure Key Vault' task to download secrets as pipeline variables.

Answer

Add each secret as a pipeline variable with the 'secret' type.

Question 4

You are a DevOps engineer for a retail company. Your team uses Azure Pipelines to deploy to Azure Kubernetes Service (AKS). The security team requires that container images are scanned for vulnerabilities before deployment, and that only images from a trusted registry are used. You need to integrate image scanning into the pipeline. What should you do?

Accepted Answer

Add a pipeline task that runs a container scanning tool (e.g., Trivy) and fails the build if vulnerabilities are found.. Integrating a container scanning task into the pipeline allows you to scan images for vulnerabilities before deployment. By failing the build on detection, you enforce the security policy. This is the most direct and effective way to meet both requirements: scanning and blocking vulnerable images.

Answer

Use Kubernetes admission controllers to block images with known vulnerabilities.

Answer

Configure AKS to only pull images from Azure Container Registry and rely on ACR's built-in vulnerability scanning.

Answer

Enable Azure Defender for container registries and set up alerts for vulnerabilities.

Question 5

You are an Azure DevOps administrator for a healthcare company. The security team requires that all members of the 'Release Managers' group must authenticate with multi-factor authentication before they can approve a production release in Azure Pipelines. You need to enforce this requirement without affecting other users. What should you configure?

Accepted Answer

Enable multi-factor authentication for all users in Azure Active Directory, and then create a conditional access policy that requires MFA for the 'Release Managers' group when accessing Azure DevOps.. The requirement is to enforce MFA only for the 'Release Managers' group when they approve production releases. Microsoft Entra Conditional Access can target specific groups and cloud apps, including Azure DevOps, and require MFA. This is the correct mechanism because it provides granular control without affecting other users, and it directly addresses the authentication step before approval.

Answer

Configure a branch policy on the production branch that requires approval from the 'Release Managers' group, and enable 'Require a minimum number of reviewers'.

Answer

Create an Azure Policy that audits Azure DevOps organizations and denies access to release pipelines unless MFA is enabled.

Answer

Enable multi-factor authentication in the Azure DevOps organization settings under 'Security' and assign it to the 'Release Managers' group.

Question 6

You are a DevOps engineer for a company that uses Azure Pipelines. The security team requires that all pipeline runs that deploy to production must use a service connection that is restricted to a specific Azure subscription and resource group, and that the service connection credentials are stored securely. You need to configure the service connection to meet these requirements. Which two actions should you perform? (Choose two.)

Accepted Answer

Create a service connection of type 'Azure Resource Manager' using the 'Service principal (automatic)' authentication method, and scope it to the specific subscription and resource group.. The requirement is to use a service connection restricted to a specific subscription and resource group, with secure credential storage. Both an Azure Resource Manager service connection with automatic service principal and one using a managed identity can be scoped appropriately and store credentials securely. The service principal method uses Microsoft Entra ID-managed credentials, while managed identity avoids secrets entirely. Both are valid and secure.

Answer

Use a generic service connection with a username and password stored in a secure file, and restrict access to the secure file to only the production pipeline.

Answer

Store the service principal secret in Azure Key Vault and reference it in the pipeline using a variable group linked to Key Vault.

Answer

Enable the 'Grant access permission to all pipelines' setting on the service connection to ensure all pipelines can use it.

Question 7

You manage an Azure DevOps organization for a company that must comply with GDPR. The security team requires that all personal data processed by pipelines is encrypted at rest and in transit. You need to ensure that pipeline artifacts and logs stored in Azure DevOps are encrypted. What should you do?

Accepted Answer

Verify that the Azure DevOps organization is using the default encryption provided by Microsoft, which encrypts data at rest and in transit.. Azure DevOps Services encrypts all data at rest and in transit by default using Microsoft-managed keys. This includes pipeline artifacts, logs, and other data. Therefore, no additional configuration is needed to meet the encryption requirement for GDPR. The correct action is to verify that the default encryption is in place, which it always is.

Answer

Configure the pipeline to use HTTPS for all connections and ensure that artifacts are stored in an Azure Storage account with encryption enabled.

Answer

Enable Azure DevOps organization policy to use customer-managed keys for encryption.

Answer

Create a variable group linked to Azure Key Vault and store all pipeline artifacts and logs in Key Vault.

Question 8

A company uses Azure DevOps for CI/CD. The security team requires that all pipeline runs must use a specific service connection (ServiceConnection-Prod) that has been approved for production deployments. However, developers are accidentally using unapproved connections. You need to enforce that only the approved service connection can be used in any pipeline that deploys to the production environment. What should you do?

Accepted Answer

Create an Azure Pipeline decorator that validates the service connection used in each task and fails the pipeline if it is not the approved one.. Azure Pipeline decorators inject custom validation logic at runtime, allowing you to inspect each task's service connection and fail the pipeline if it does not match the approved one. This enforces the security requirement centrally without relying on developer compliance or manual gates.

Answer

Define a required template for all pipelines that includes the service connection, and instruct developers to use it.

Answer

Set up a manual approval gate on the production environment stage in the pipeline.

Answer

Configure a branch policy on the main branch to require a successful build before merging.

Question 9

A company uses Azure DevOps and needs to ensure that all pipelines use approved YAML templates from a central repository. The security team wants to prevent developers from referencing unapproved templates. What is the best way to enforce this?

Accepted Answer

Use a pipeline decorator to check the template origin and fail the pipeline if unapproved.. The correct approach is to use a pipeline decorator that runs at the start of every pipeline, inspects the YAML for template references, and fails the pipeline if any template is not from the approved central repository. The 'Required template' setting forces inclusion of a template but does not block additional unapproved template references.

Answer

Create a branch policy on the repository that requires all pull requests to be approved by security team members.

Answer

Configure a variable group with the approved template repository and require it in all pipelines.

Answer

Set the 'Required template' repository setting in the Azure DevOps project to the approved central repository.

Question 10

You are designing a compliance strategy for Azure DevOps pipelines that deploy to production. The company policy requires that all production deployments must be reviewed by a security lead. Additionally, the deployment must use a specific release pipeline that has been pre-approved. How should you implement this?

Accepted Answer

Define a 'production' environment in Azure DevOps and configure an approval check that requires the security lead. Have the pipeline deploy to that environment.. Azure DevOps environments allow you to define approval checks that must be satisfied before a deployment proceeds. By creating a 'production' environment and adding a pre-deployment approval check requiring the security lead, you enforce the mandatory review. The pipeline then deploys to that environment, ensuring only the pre-approved release pipeline is used.

Answer

Create a branch policy that requires the security lead to approve the pull request before merging.

Answer

Use a Classic release pipeline with a pre-deployment approval gate for the production stage.

Answer

Store the approved pipeline definition in a variable group and reference it in all pipelines.

Question 11

A company uses Azure DevOps and has a security policy that all pipeline runs must use a specific service connection scoped to a resource group. A developer reports that a pipeline fails with the error: 'The service connection does not have permission to access the resource.' What is the most likely cause?

Accepted Answer

The service principal used by the service connection does not have the required role assignment on the resource group.. The error 'The service connection does not have permission to access the resource' indicates that the service principal associated with the service connection lacks the necessary Azure RBAC role assignment on the target resource group. In Azure DevOps, a service connection authenticates via a service principal, and that principal must have a role (e.g., Contributor) explicitly assigned at the resource group scope to perform actions like deploying resources. Without this role assignment, the pipeline fails with an access-denied error.

Answer

The Azure subscription linked to the service connection is disabled.

Answer

The service connection name is misspelled in the pipeline YAML.

Answer

The variable group in the library does not include the service connection ID.

Question 12

You are reviewing an Azure Policy assignment in a DevOps environment. The exhibit shows the policy assignment JSON. The policy set includes the built-in policy 'Allowed Locations' with effect Deny. During a pipeline deployment, a resource creation fails with a policy violation error. The resource being deployed is a storage account in the 'centralus' region. What is the most likely reason for the failure?

Accepted Answer

The resource being deployed is in a region that is not allowed by the policy assignment parameters.. The policy assignment includes the built-in 'Allowed Locations' policy with the Deny effect. The resource being deployed (a storage account) is in the 'centralus' region, but the policy assignment parameters likely specify a list of allowed regions that does not include 'centralus'. Since the Deny effect prevents any non-compliant resource creation, the deployment fails with a policy violation error. This is the most direct and common cause of such failures in Azure Policy.

Answer

The policy assignment is misconfigured because it does not specify a policy set definition.

Answer

The resource group is located in a region that overrides the policy assignment.

Answer

The policy set definition does not include the 'Allowed Locations' policy.

Question 13

Your organization uses Azure DevOps for a multi-tier web application. The application consists of a React frontend, a Node.js API, and a SQL database. The security team has mandated the following: (1) All code changes must be scanned for secrets before merging to the main branch. (2) Infrastructure-as-code templates (ARM) must be validated for security compliance before deployment. (3) Production deployments must use a service connection with a managed identity that has only the required permissions. You have set up a CI/CD pipeline with two stages: Build and Release. The Build stage runs on pull requests and the Release stage deploys to a production environment. Recently, a developer accidentally committed a secret (API key) to a configuration file. The secret was not caught by the pipeline, and the code was merged to main. You need to prevent this in the future. What should you do?

Accepted Answer

Add a 'Credential Scanner' task to the Build pipeline and configure it to fail the build if any secrets are found. Also, move all secrets to Azure Key Vault and reference them via variable groups.. It directly addresses the root cause: secrets were not being scanned before merge. The Credential Scanner task (part of Microsoft Security Code Analysis) scans for hardcoded secrets and can fail the build, preventing the merge. Moving secrets to Azure Key Vault and referencing them via variable groups (linked to the vault) ensures secrets are never stored in the repository, eliminating the risk of accidental commits.

Answer

Configure a branch policy to require at least two reviewers on pull requests to the main branch.

Answer

Implement a manual approval gate on the Release stage to review each deployment for secrets.

Answer

Use a pipeline decorator to inject a validation step that runs Azure Policy on the code repository.

Question 14

A company's Azure DevOps project uses a custom agent pool with self-hosted agents. The security team discovers that pipeline runs can access secrets stored in Azure Key Vault, but the team wants to ensure that secrets are only accessible to approved pipelines. Which configuration should the team implement?

Accepted Answer

Use a library variable group linked to Key Vault and configure pipeline permissions with branch control.. The correct configuration is to create a library variable group linked to Azure Key Vault and then use pipeline permissions to grant access only to approved pipelines. This restricts secret access at the pipeline level. Branch-specific restrictions are not available on variable groups; to limit access by branch, the pipeline YAML must conditionally include the variable group (e.g., using an `if` expression based on the source branch) or separate pipelines must be used.

Answer

Store secrets directly in pipeline variables and use 'Make secrets available to all pipelines' setting.

Answer

Assign pipeline-level permissions to the Key Vault using Azure RBAC.

Answer

Limit the number of agents in the custom agent pool.

Question 15

Which TWO actions should a DevOps engineer take to ensure that Azure DevOps pipelines comply with the principle of least privilege for service connections?

Accepted Answer

Create a service principal with permissions scoped to the minimum required Azure resources.. Creating a service principal with permissions scoped to the minimum required Azure resources directly implements the principle of least privilege. By assigning only the necessary roles (e.g., Contributor on a specific resource group) to the service principal used in the service connection, you ensure that the pipeline can only perform actions on those resources, reducing the attack surface. This aligns with Azure RBAC best practices for securing automated deployments.

Answer

Use the Project Collection Build Service account for all pipeline runs.

Answer

Use Workload identity federation to avoid managing secrets.

Answer

Use the same service connection for both build and release pipelines.