AZ-400 Develop a security and compliance plan Practice Test 4 — 15 Questions

Question 1

You are evaluating an Azure Policy assignment for Azure Pipelines. What does this policy audit?

Accepted Answer

Whether pipelines use secure files with extensions other than .pfx, .p12, or .cer. The Azure Policy for Azure Pipelines audits whether secure files have file extensions other than .pfx, .p12, or .cer. This policy is designed to enforce that only certificate-related secure files (which are typically used for code signing or TLS) are allowed, preventing the upload of arbitrary file types that could introduce security risks or misconfiguration.

Answer

Whether secure files are rotated within 90 days

Answer

Whether secure files are encrypted at rest

Answer

Whether secure files are used in production pipelines

Question 2

Your team uses GitHub. You need to automatically remove a user's access to all repositories when they leave the company. What is the most efficient approach?

Accepted Answer

Enable SCIM provisioning from Microsoft Entra ID to GitHub. SCIM (System for Cross-domain Identity Management) provisioning from Microsoft Entra ID to GitHub automates user lifecycle management. When a user is disabled or removed from Entra ID, SCIM automatically deprovisions their access across all GitHub resources, including repositories, without manual intervention. This is the most efficient approach because it is event-driven and scales to thousands of users.

Answer

Assign the user to a 'Leaver' team and remove all repository permissions

Answer

Manually remove the user from each repository

Answer

Configure SAML single sign-on (SSO) with Microsoft Entra ID

Question 3

Which TWO actions should you take to ensure that Azure Pipelines artifacts are scanned for vulnerabilities before production deployment? (Choose two.)

Accepted Answer

Run dependency scanning on the artifact manifest. For ensuring Azure Pipelines artifacts are scanned for vulnerabilities before production deployment, the correct actions are A and C. Option A: Running dependency scanning on the artifact manifest (e.g., package.json, pom.xml) identifies known vulnerabilities in open-source dependencies. Option C: Using Microsoft Defender for Cloud to scan artifacts (such as container images) during the pipeline provides comprehensive vulnerability detection. Option B is incorrect because signing artifacts with a code signing certificate ensures integrity and authenticity, not vulnerability scanning. Option D is incorrect because scanning Infrastructure as Code (IaC) templates addresses configuration security, not artifact vulnerabilities. Option E is incorrect because static code analysis examines source code for coding flaws, not dependencies or artifacts.

Answer

Sign the artifacts with a code signing certificate

Answer

Scan the infrastructure as code templates

Answer

Run static code analysis on the source code

Question 4

Which THREE measures should be implemented to protect secrets in Azure Pipelines? (Choose three.)

Accepted Answer

Restrict which pipelines can access the variable group. Restricting which pipelines can access a variable group ensures that only authorized pipelines can use secrets stored in that group, preventing unauthorized access or accidental exposure. This is a key security measure in Azure Pipelines to enforce the principle of least privilege.

Answer

Log secret values to pipeline console for debugging

Answer

Store secrets in code as environment variables

Question 5

Which TWO tools can be used to enforce branch protection policies in GitHub repositories? (Choose two.)

Accepted Answer

Azure Pipelines branch policies. Azure Pipelines branch policies allow you to enforce requirements such as requiring a minimum number of reviewers, checking for linked work items, or requiring a successful build before merging pull requests into protected branches. This integrates directly with GitHub repositories to enforce compliance and code quality standards.

Answer

Microsoft Intune compliance policies

Answer

Microsoft Purview data classification

Answer

GitHub Actions workflows

Question 6

You need to ensure that only signed-in users can view Azure DevOps project wikis. Which setting should you configure?

Accepted Answer

Set project visibility to 'Private'. Setting the project visibility to 'Private' ensures that only authenticated users who are members of the Azure DevOps organization can access the project and its wikis. Anonymous or unauthenticated users are blocked entirely at the project level, which directly satisfies the requirement to restrict wiki viewing to signed-in users only.

Answer

Configure wiki permissions to deny anonymous users

Answer

Set repository visibility to 'Private'

Answer

Use Microsoft Entra ID Application Proxy

Question 7

Your organization uses Azure DevOps to manage CI/CD pipelines. The security team requires that all pipeline runs use a specific service connection that references a managed identity in Microsoft Entra ID. However, some developers have been using personal access tokens (PATs) in their pipelines, bypassing the managed identity. What should you implement to enforce the use of the managed identity service connection?

Accepted Answer

Use a pipeline decorator to validate the service connection and fail the pipeline if an unauthorized connection is used.. Pipeline decorators allow you to inject custom validation steps into every pipeline run at the organization or project level. By using a decorator that checks the service connection ID used in each job and fails the run if it does not match the approved managed identity connection, you can enforce compliance without relying on developer cooperation or manual policy configuration.

Answer

Configure a branch policy on the main branch to require a specific service connection.

Answer

Restrict the use of PATs by setting an agent pool-level permission.

Answer

Store the service connection ID in a variable group and reference it in each pipeline.

Question 8

Your organization uses Azure DevOps and Microsoft Entra ID. The compliance team needs to ensure that access to Azure DevOps projects is governed by conditional access policies. Which Azure DevOps integration should you use?

Accepted Answer

Link the Azure DevOps organization to the Microsoft Entra ID tenant and configure conditional access policies in Microsoft Entra ID.. To govern access to Azure DevOps projects with conditional access policies, you must link the Azure DevOps organization to the Microsoft Entra ID tenant. This integration makes Azure DevOps a registered application within the tenant, allowing conditional access policies (e.g., MFA, device compliance, location-based access) to be evaluated during authentication. Only then can the compliance team enforce organization-wide access rules via Microsoft Entra ID.

Answer

Configure service hooks to enforce conditional access.

Answer

Assign managed identities to users for conditional access.

Answer

Use OAuth tokens to authenticate users.

Question 9

Your team uses GitHub Advanced Security to identify vulnerabilities in code. Which TWO actions can you take to ensure that critical security alerts are addressed before code is merged?

Accepted Answer

Configure branch protection rules to require status checks from code scanning.. Branch protection rules can require passing status checks from code scanning and secret scanning. Pull request annotations show alerts directly in the PR. Dependabot auto-merge and repository rules for bypassing are not relevant for blocking merges based on security alerts.

Answer

Enable secret scanning push protection.

Answer

Create a repository rule that allows bypassing pull request requirements.

Answer

Enable Dependabot auto-merge for pull requests.

Question 10

Your organization uses Azure Key Vault to store secrets and certificates used in Azure Pipelines. You need to implement a security and compliance plan that ensures secrets are rotated automatically and access is audited. Which THREE actions should you take?

Accepted Answer

Enable soft-delete and purge protection on the Key Vault.. Enabling soft-delete and purge protection ensures deleted secrets and certificates can be recovered and permanent deletion is blocked, which is important for compliance and recovery. Using a managed identity for Azure Pipelines removes the need to store and rotate credentials, and each access is tied to a known identity, enabling access auditing. Configuring certificate auto-rotation with a specified lifetime ensures secrets are rotated automatically. Together, these actions address recovery, secure access, and automatic rotation as required.

Answer

Use a resource lock on the Key Vault to prevent deletion.

Answer

Use a Key Vault access policy to grant developers full access.

Question 11

Your team is adopting GitHub Copilot for code generation. The compliance team requires that all code generated by AI is reviewed and that proprietary code is not used as training data. Which TWO settings should you configure in your GitHub organization?

Accepted Answer

Configure a branch protection rule that requires all code to be reviewed before merging.. Branch protection rules enforce mandatory pull request reviews before merging, which satisfies the compliance requirement that all AI-generated code must be reviewed by a human before entering the main branch. Additionally, disabling the 'Allow GitHub to use my data for training' option in the organization's Copilot settings prevents proprietary code from being used as training data, directly addressing the compliance requirement that proprietary code not be used for training. Together, these two settings allow the team to use GitHub Copilot safely while meeting compliance.

Answer

Disable Copilot for all repositories in the organization.

Answer

Enable 'Suggestions matching public code' to block suggestions that match public code.

Answer

Enable 'Allow GitHub to use my code snippets for product improvements' to improve Copilot.

Question 12

Refer to the exhibit. You receive a secret scanning alert for an Azure DevOps PAT in a GitHub repository. The push_protection_bypass is false. What does this mean and what action should you take?

Accepted Answer

The secret was blocked from being pushed; you should revoke the PAT and investigate the incident.. When `push_protection_bypass` is `false`, it means the secret was blocked from being pushed by GitHub's push protection feature. The alert indicates the secret was detected and prevented from entering the repository, so the correct action is to revoke the compromised PAT and investigate the incident to prevent future occurrences. Option D correctly identifies that the secret was blocked and prescribes the appropriate remediation steps.

Answer

The secret was pushed but push protection was bypassed; you need to revoke the PAT and use git filter-branch to remove it from history.

Answer

The secret was pushed successfully; you need to rotate the PAT and audit the commit history.

Answer

The secret was pushed and push protection was not bypassed; you need to open a support ticket with GitHub to remove the secret.

Question 13

Refer to the exhibit. Your organization has configured an Azure DevOps pipeline security setting that enforces a required template for all pipelines deploying to production and staging. The required template 'security-validation.yml' runs a series of security scans and compliance checks. A developer creates a new pipeline that deploys to a test environment, but the pipeline does not reference the required template. What will happen?

Accepted Answer

The pipeline will fail because it does not reference the required template.. The Azure DevOps 'Required template' security setting is configured at the project or organization level and applies to all YAML pipelines, regardless of the deployment target environment. There is no native option to enforce it only for specific environments like production or staging. Therefore, a new pipeline deploying to test without referencing the required template would also fail.

Answer

The pipeline will run normally because the required template enforcement only applies to production and staging environments.

Answer

The pipeline will run but the security scans will be automatically injected.

Answer

The pipeline will prompt the developer to add the required template before running.

Question 14

Your organization uses Microsoft Defender for Cloud to monitor Azure resources. The compliance team needs to ensure that all Azure DevOps projects have their pipelines scanned for security issues before deployment. Which integration should you use?

Accepted Answer

Enable GitHub Advanced Security for Azure DevOps in Microsoft Defender for Cloud.. Enabling GitHub Advanced Security for Azure DevOps in Microsoft Defender for Cloud allows Defender for Cloud to ingest security alerts from Azure DevOps repositories and pipelines, including secret scanning, code scanning, and dependency scanning. This integration ensures that all Azure DevOps projects are monitored for security issues before deployment, meeting the compliance team's requirement for centralized visibility and enforcement.

Answer

Configure branch policies in Azure Repos to require a security scan.

Answer

Configure deployment gates in Azure Pipelines to require a security scan.

Answer

Use Azure Policy to enforce scanning on Azure DevOps pipelines.

Question 15

Refer to the exhibit. You have configured a Conditional Access policy in Microsoft Entra ID to require MFA for Azure DevOps. However, users report that they can still access Azure DevOps without MFA when using a PAT for authentication. What is the most likely reason?

Accepted Answer

PATs are not subject to Conditional Access policies because they use legacy authentication.. B is correct because Personal Access Tokens (PATs) in Azure DevOps are considered legacy authentication tokens. Conditional Access policies in Microsoft Entra ID do not evaluate requests made using legacy authentication protocols, including PATs, OAuth device code flow, or IMAP/POP. Therefore, even if a Conditional Access policy requires MFA for Azure DevOps, users authenticating with a PAT bypass the policy entirely.

Answer

The policy should include 'Require device to be marked as compliant'.

Answer

The policy should be scoped to 'All cloud apps' instead of just Azure DevOps.

Answer

The Conditional Access policy is not enabled.