AZ-400 Develop a security and compliance plan Practice Test 4 — 15 Questions

Question 1

Refer to the exhibit. Your organization has configured an Azure DevOps pipeline security setting that enforces a required template for all pipelines deploying to production and staging. The required template 'security-validation.yml' runs a series of security scans and compliance checks. A developer creates a new pipeline that deploys to a test environment, but the pipeline does not reference the required template. What will happen?

Accepted Answer

The pipeline will run normally because the required template enforcement only applies to production and staging environments.. The required template enforcement is scoped to 'production' and 'staging' environments. Pipelines targeting other environments like 'test' are not required to use the template. The pipeline will run without the security template. It will not be blocked or fail unless it explicitly targets production or staging.

Answer

The pipeline will run but the security scans will be automatically injected.

Answer

The pipeline will fail because it does not reference the required template.

Answer

The pipeline will prompt the developer to add the required template before running.

Question 2

Your organization uses Microsoft Defender for Cloud to monitor Azure resources. The compliance team needs to ensure that all Azure DevOps projects have their pipelines scanned for security issues before deployment. Which integration should you use?

Accepted Answer

Enable GitHub Advanced Security for Azure DevOps in Microsoft Defender for Cloud.. Microsoft Defender for Cloud can integrate with Azure DevOps via the GitHub Advanced Security for Azure DevOps feature (now part of Defender for Cloud), which enables code scanning, secret scanning, and dependency scanning in Azure Repos and pipelines. Defender for Cloud does not directly manage branch policies, service connections, or deployment gates.

Answer

Configure branch policies in Azure Repos to require a security scan.

Answer

Configure deployment gates in Azure Pipelines to require a security scan.

Answer

Use Azure Policy to enforce scanning on Azure DevOps pipelines.

Question 3

Refer to the exhibit. You have configured a Conditional Access policy in Microsoft Entra ID to require MFA for Azure DevOps. However, users report that they can still access Azure DevOps without MFA when using a PAT for authentication. What is the most likely reason?

Accepted Answer

PATs are not subject to Conditional Access policies because they use legacy authentication.. Conditional Access policies do not apply to legacy authentication protocols or tokens like PATs. PATs are considered non-interactive and bypass device-based policies. The policy is correctly configured for interactive sessions, but PATs are not subject to the same conditions. Enabling additional client app conditions or using a trusted location would not help. Blocking legacy authentication is a separate policy.

Answer

The policy should include 'Require device to be marked as compliant'.

Answer

The policy should be scoped to 'All cloud apps' instead of just Azure DevOps.

Answer

The Conditional Access policy is not enabled.

Question 4

Your organization uses GitHub Actions for CI/CD. The security team requires that all workflows are stored in a central repository and that only approved actions can be used. What should you implement?

Accepted Answer

In the organization settings, configure the 'Actions permissions' to 'Allow specified actions' and add the approved actions to the allow list.. GitHub Actions allow you to restrict actions to only those in a specific organization or marketplace list via the 'Allow specified actions' policy. Setting 'Allow GitHub Actions to create and approve pull requests' is not relevant. Using reusable workflows in a central repository ensures standardization, but to restrict actions, you need the allow list policy. Self-hosted runners do not enforce which actions are used.

Answer

Configure the repository to use only self-hosted runners.

Answer

Store all workflows in a central repository and use branch protection rules.

Answer

Enable 'Allow GitHub Actions to create and approve pull requests' in the repository settings.

Question 5

Your organization needs to ensure that all containers built in Azure Pipelines are scanned for vulnerabilities before being pushed to a container registry. Which step should you add to the pipeline?

Accepted Answer

Add a step to use 'Microsoft Defender for Cloud' container image scanning.. Microsoft Defender for Cloud's vulnerability scanner can be integrated into Azure Pipelines to scan container images for vulnerabilities before push. Trivy is a third-party tool, not native. Docker Hub scanning is external. Azure Container Registry tasks are for post-push scanning.

Answer

Add a step to create an Azure Container Registry task for scanning.

Answer

Add a step to push the image to Docker Hub for scanning.

Answer

Add a step to run Trivy to scan the image.

Question 6

Refer to the exhibit. You run a KQL query in Microsoft Sentinel to audit Azure Container Registry login failures. The result shows 15 failed push attempts to the 'contoso/webapp' repository and 3 failed pull attempts to 'contoso/api'. What is the most likely security implication?

Accepted Answer

An attacker is attempting to push malicious images to the 'contoso/webapp' repository.. Multiple failed push attempts could indicate an attacker trying to push malicious images. Failed pulls are less concerning. The query does not show successful pushes. The failures are not necessarily due to misconfiguration; they are authentication failures. Audit logs are already enabled, and RBAC assignment is a mitigation, not the most likely implication.

Answer

The audit logs are not enabled for the container registry.

Answer

The container registry is misconfigured and allowing anonymous pushes.

Answer

The 'contoso/api' repository has been successfully pulled by an unauthorized user.

Question 7

Your organization uses Microsoft Purview to manage sensitive data in Azure DevOps repositories. The compliance team needs to automatically classify and label source code that contains personally identifiable information (PII). Which solution should you use?

Accepted Answer

Use Microsoft Purview Information Protection to automatically scan and label repositories.. Microsoft Purview Information Protection can automatically classify and label sensitive data, including source code. Microsoft Sentinel is for security information and event management, not classification. Microsoft Defender for Cloud is for cloud security posture management. Azure Policy enforces rules on Azure resources, not on source code content.

Answer

Use Azure Policy to enforce PII labeling on repositories.

Answer

Use Microsoft Sentinel to detect PII in repositories.

Answer

Use Microsoft Defender for Cloud to scan for PII.

Question 8

Your team uses Azure Pipelines to deploy to multiple environments. The compliance team requires that all deployments to the production environment are approved by a security officer. Which feature should you use?

Accepted Answer

Configure approvals and checks on the production environment in Azure Pipelines.. Approvals and checks in Azure Pipelines allow you to require manual approval before deployment to a specific environment. Branch policies are for GitHub/Azure Repos branches. Service connections are for authentication. Variable groups store variables, not approvals.

Answer

Create a branch policy that requires approval for pull requests.

Answer

Use a service connection with a managed identity that requires approval.

Answer

Store the production credentials in a variable group with approval required.

Question 9

Your team uses GitHub Actions for CI/CD and needs to ensure that secrets such as Azure service principal credentials are not exposed in logs. What is the best practice to prevent secret exposure?

Accepted Answer

Store secrets as GitHub Actions secrets and reference them in workflows. Option C is correct because GitHub automatically redacts secrets in workflow logs. Option A is wrong because storing secrets in YAML files is insecure. Option B is wrong because environment protection rules are for approvals, not redaction. Option D is wrong because encrypting logs does not prevent exposure in transit.

Answer

Store secrets in the workflow YAML file

Answer

Use environment protection rules to mask secrets

Answer

Encrypt workflow logs after the run completes

Question 10

Your organization uses Microsoft Entra ID for identity and Azure DevOps for source control. You need to enforce that all code changes to the main branch require a pull request with at least two approvals and no failing checks. What should you configure?

Accepted Answer

Set up a branch policy on the main branch in Azure Repos. Option B is correct because Azure DevOps branch policies can require a minimum number of reviewers and check for build validation. Option A is wrong because Entra ID Conditional Access policies manage sign-in, not code reviews. Option C is wrong because environment protection rules in GitHub are for deployments, not pull requests. Option D is wrong because service hooks are for integration, not policy enforcement.

Answer

Configure a Conditional Access policy in Microsoft Entra ID

Answer

Add an environment protection rule in Azure Pipelines

Answer

Use a service hook to notify reviewers when a push occurs

Question 11

Your DevOps team is using Microsoft Defender for Cloud to monitor Azure resources. Which of the following is a security recommendation that Defender for Cloud might provide?

Accepted Answer

Enable Transparent Data Encryption (TDE) on SQL databases. Option A is correct because Defender for Cloud includes recommendations such as enabling encryption on Azure SQL databases. Option B is wrong because Defender for Cloud does not recommend disabling logging. Option C is wrong because using HTTP instead of HTTPS is insecure. Option D is wrong because allowing all inbound traffic is a security risk.

Answer

Allow all inbound traffic on port 22 for SSH

Answer

Disable auditing on storage accounts to reduce overhead

Answer

Configure web apps to use HTTP instead of HTTPS

Question 12

You are implementing a secrets management strategy for a multi-cloud deployment. You need to securely store and rotate API keys for a third-party service. Which Azure service should you use?

Accepted Answer

Azure Key Vault. Option B is correct because Azure Key Vault provides secure storage and automatic rotation of secrets. Option A is wrong because Microsoft Entra ID is for identity management, not secret storage. Option C is wrong because Azure App Configuration is for application configuration, not secrets. Option D is wrong because Azure Storage is not designed for secret management.

Answer

Microsoft Entra ID

Answer

Azure App Configuration

Answer

Azure Storage Blob

Question 13

Your organization is adopting GitHub Copilot for developers. Which security measure should you implement to ensure that no proprietary code is inadvertently shared with the AI model?

Accepted Answer

Configure content exclusions in the GitHub Copilot settings. Option C is correct because GitHub Copilot for Business allows administrators to configure content exclusions to prevent certain repositories from being used as context. Option A is wrong because disabling Copilot entirely is not necessary and reduces productivity. Option B is wrong because network segmentation does not affect Copilot's data usage. Option D is wrong because auditing alone does not prevent sharing.

Answer

Use a separate network segment for development

Answer

Disable GitHub Copilot for all users

Answer

Enable audit logging for Copilot usage

Question 14

Your team uses Azure Pipelines to deploy to multiple environments. You need to ensure that deployment to the production environment requires approval from the security team. What should you configure?

Accepted Answer

Add an environment approval check for the production environment. Option D is correct because Azure Pipelines environment approvals allow you to require manual approval before deployment. Option A is wrong because branch policies apply to code changes, not deployments. Option B is wrong because YAML conditions are for runtime decisions, not manual approval. Option C is wrong because service connections manage credentials, not approvals.

Answer

Add a branch policy to the production branch

Answer

Use a condition in the YAML pipeline to check a variable

Answer

Configure a service connection with restricted permissions

Question 15

Your company uses Microsoft Purview to manage data governance. You need to classify a new dataset containing personally identifiable information (PII) and apply a data loss prevention (DLP) policy. What should you do first?

Accepted Answer

Register and scan the data source in Microsoft Purview. Option A is correct because scanning the data source in Purview automatically classifies sensitive data. Option B is wrong without scanning first. Option C is wrong because DLP policies require classification. Option D is wrong because service tags do not classify data.

Answer

Create a sensitivity label in Microsoft Purview

Answer

Add the data source to an Azure service tag

Answer

Define a DLP policy in Microsoft Purview

AZ-400 Develop a security and compliance plan Practice Test 4 — 15 Questions

Exhibit

AZ-400 Develop a security and compliance plan Practice Test 4 — 15 Questions

Exhibit