AZ-400 Develop a security and compliance plan Practice Test 5 — 15 Questions

Question 1

Your organization uses GitHub Actions for CI/CD. The security team requires that all workflows are stored in a central repository and that only approved actions can be used. What should you implement?

Accepted Answer

In the organization settings, configure the 'Actions permissions' to 'Allow specified actions' and add the approved actions to the allow list.. The security team's requirement to restrict workflows to only approved actions is directly met by configuring 'Actions permissions' in the organization settings to 'Allow specified actions' and then populating the allow list with the approved actions. This enforces a policy where any workflow, regardless of where it is stored, can only reference actions that have been explicitly allowed, preventing the use of unverified or malicious third-party actions.

Answer

Configure the repository to use only self-hosted runners.

Answer

Store all workflows in a central repository and use branch protection rules.

Answer

Enable 'Allow GitHub Actions to create and approve pull requests' in the repository settings.

Question 2

Refer to the exhibit. You run a KQL query in Microsoft Sentinel to audit Azure Container Registry login failures. The result shows 15 failed push attempts to the 'contoso/webapp' repository and 3 failed pull attempts to 'contoso/api'. What is the most likely security implication?

Accepted Answer

An attacker is attempting to push malicious images to the 'contoso/webapp' repository.. The query shows 15 failed push attempts to 'contoso/webapp' and 3 failed pull attempts to 'contoso/api'. Repeated failed push attempts to a specific repository are a classic indicator of an attacker trying to upload malicious images, as push operations require authentication and authorization. The high number of failures suggests a brute-force or credential-stuffing attack targeting the push operation, which is the most direct path to compromising the registry with unauthorized content.

Answer

The audit logs are not enabled for the container registry.

Answer

The container registry is misconfigured and allowing anonymous pushes.

Answer

The 'contoso/api' repository has been successfully pulled by an unauthorized user.

Question 3

Your organization uses Microsoft Purview to manage sensitive data in Azure DevOps repositories. The compliance team needs to automatically classify and label source code that contains personally identifiable information (PII). Which solution should you use?

Accepted Answer

Use Microsoft Purview Information Protection to automatically scan and label repositories.. Microsoft Purview Information Protection provides built-in data classification and labeling capabilities that can automatically scan Azure DevOps repositories for sensitive data such as PII. It uses sensitive information types and machine learning classifiers to detect patterns like social security numbers or credit card numbers, then applies the appropriate sensitivity label directly to the source code files. This meets the compliance team's requirement for automatic classification and labeling without custom development.

Answer

Use Azure Policy to enforce PII labeling on repositories.

Answer

Use Microsoft Sentinel to detect PII in repositories.

Answer

Use Microsoft Defender for Cloud to scan for PII.

Question 4

Your team uses Azure Pipelines to deploy to multiple environments. The compliance team requires that all deployments to the production environment are approved by a security officer. Which feature should you use?

Accepted Answer

Configure approvals and checks on the production environment in Azure Pipelines.. Approvals and checks in Azure Pipelines allow you to require manual approval before a deployment to a specific environment, such as production. By configuring an approval on the production environment, you ensure that a designated security officer must approve the deployment before it proceeds, meeting the compliance team's requirement.

Answer

Create a branch policy that requires approval for pull requests.

Answer

Use a service connection with a managed identity that requires approval.

Answer

Store the production credentials in a variable group with approval required.

Question 5

Your team uses GitHub Actions for CI/CD and needs to ensure that secrets such as Azure service principal credentials are not exposed in logs. What is the best practice to prevent secret exposure?

Accepted Answer

Store secrets as GitHub Actions secrets and reference them in workflows. GitHub Actions secrets are encrypted environment variables that are automatically masked in workflow logs when referenced. By storing Azure service principal credentials as GitHub Actions secrets and using the `${{ secrets.SECRET_NAME }}` syntax in workflows, the actual secret values are never written to logs, preventing exposure. This is the recommended approach for handling sensitive data in GitHub Actions CI/CD pipelines.

Answer

Store secrets in the workflow YAML file

Answer

Use environment protection rules to mask secrets

Answer

Encrypt workflow logs after the run completes

Question 6

Your organization uses Microsoft Entra ID for identity and Azure DevOps for source control. You need to enforce that all code changes to the main branch require a pull request with at least two approvals and no failing checks. What should you configure?

Accepted Answer

Set up a branch policy on the main branch in Azure Repos. Azure Repos branch policies allow you to enforce required pull requests, minimum number of reviewers (e.g., two approvals), and status checks (e.g., no failing checks) on the main branch. This ensures that all code changes to the protected branch comply with the defined quality and security gates before merging.

Answer

Configure a Conditional Access policy in Microsoft Entra ID

Answer

Add an environment protection rule in Azure Pipelines

Answer

Use a service hook to notify reviewers when a push occurs

Question 7

Your DevOps team is using Microsoft Defender for Cloud to monitor Azure resources. Which of the following is a security recommendation that Defender for Cloud might provide?

Accepted Answer

Enable Transparent Data Encryption (TDE) on SQL databases. Microsoft Defender for Cloud provides security recommendations based on best practices and compliance frameworks. Enabling Transparent Data Encryption (TDE) on SQL databases is a standard security recommendation because it encrypts data at rest, protecting against unauthorized access to the physical database files. This aligns with the 'Develop a security and compliance plan' domain, as TDE helps meet regulatory requirements like GDPR or HIPAA.

Answer

Allow all inbound traffic on port 22 for SSH

Answer

Disable auditing on storage accounts to reduce overhead

Answer

Configure web apps to use HTTP instead of HTTPS

Question 8

You are implementing a secrets management strategy for a multi-cloud deployment. You need to securely store and rotate API keys for a third-party service. Which Azure service should you use?

Accepted Answer

Azure Key Vault. Azure Key Vault is the correct service because it is designed specifically for securely storing and managing secrets, including API keys, with built-in support for automatic rotation via integration with Azure Event Grid and Azure Functions. It provides hardware security module (HSM)-backed encryption, access policies, and auditing, making it ideal for multi-cloud secrets management.

Answer

Microsoft Entra ID

Answer

Azure App Configuration

Answer

Azure Storage Blob

Question 9

Your organization is adopting GitHub Copilot for developers. Which security measure should you implement to ensure that no proprietary code is inadvertently shared with the AI model?

Accepted Answer

Configure content exclusions in the GitHub Copilot settings. GitHub Copilot's content exclusions allow administrators to specify files or repositories that should not be sent to the AI model for code completion suggestions. This prevents proprietary or sensitive code from being transmitted to GitHub's servers, ensuring compliance with security policies. Other options like network segmentation or audit logging do not directly block code from being shared with the AI.

Answer

Use a separate network segment for development

Answer

Disable GitHub Copilot for all users

Answer

Enable audit logging for Copilot usage

Question 10

Your team uses Azure Pipelines to deploy to multiple environments. You need to ensure that deployment to the production environment requires approval from the security team. What should you configure?

Accepted Answer

Add an environment approval check for the production environment. Environment approval checks in Azure Pipelines allow you to require manual approval before a deployment proceeds to a specific environment, such as production. By adding an approval check to the production environment, you ensure that the security team must explicitly approve the deployment, meeting the requirement without modifying the pipeline code or branch policies.

Answer

Add a branch policy to the production branch

Answer

Use a condition in the YAML pipeline to check a variable

Answer

Configure a service connection with restricted permissions

Question 11

Your company uses Microsoft Purview to manage data governance. You need to classify a new dataset containing personally identifiable information (PII) and apply a data loss prevention (DLP) policy. What should you do first?

Accepted Answer

Register and scan the data source in Microsoft Purview. To classify a new dataset containing PII and apply a DLP policy, the first step is to register and scan the data source in Microsoft Purview. Scanning automatically discovers and classifies sensitive data using built-in classifiers. Only after classification can you create sensitivity labels (option A) or define a DLP policy (option C). Adding to an Azure service tag (option B) is unrelated to data classification. Therefore, option D is the correct first step.

Answer

Create a sensitivity label in Microsoft Purview

Answer

Add the data source to an Azure service tag

Answer

Define a DLP policy in Microsoft Purview

Question 12

Your organization uses Azure DevOps and wants to enforce that all pipelines use a specific set of approved tasks. How can you achieve this?

Accepted Answer

Use the task restrictions feature in Azure DevOps to block unapproved tasks. Use the task restrictions feature in Azure DevOps to block unapproved tasks. Azure DevOps provides a 'Task restrictions' policy under Organization Settings > Policies > Add new policy, where you can specify which tasks are allowed or blocked across all pipelines. This enforces that only approved tasks are used. Option B is incorrect because assigning permissions to a task group only controls who can modify the group, not which tasks are used in pipelines. Option C is incorrect because while YAML templates can standardize tasks, they do not enforce mandatory usage; pipelines can still be created without the template. Option D is incorrect because service hooks only trigger notifications when an unapproved task is used, but do not block its usage.

Answer

Assign permissions to the task group to limit who can add tasks

Answer

Create a YAML template with the approved tasks and require all pipelines to use it

Answer

Configure a service hook to notify when an unapproved task is used

Question 13

You need to ensure that only authorized users can access the Azure DevOps organization. Which identity provider should you configure for single sign-on (SSO)?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID (formerly Azure AD) is the required identity provider for configuring single sign-on (SSO) for Azure DevOps organizations. Azure DevOps relies on Entra ID to authenticate users and enforce conditional access policies, ensuring only authorized identities from your tenant can sign in. This integration also supports SAML-based SSO and OAuth 2.0 flows, making it the native and only supported IdP for Azure DevOps SSO.

Answer

Google Workspace

Answer

Microsoft account (MSA)

Answer

GitHub ID

Question 14

Your company uses Azure Key Vault to store secrets. Which TWO actions should you take to ensure secure access? (Select TWO.)

Accepted Answer

Restrict access using Key Vault access policies. Restricting access using Key Vault access policies (Option A) is correct because Azure Key Vault uses a granular permission model where you assign specific permissions (e.g., GET, LIST, SET) to individual security principals (users, groups, or service principals) at the vault level. This ensures that only authorized identities can read or manage secrets, keys, and certificates, following the principle of least privilege. Using managed identities (Option B) is correct because they provide an automatically managed identity in Azure AD for applications to authenticate to Key Vault without storing credentials in code or configuration, eliminating the risk of secret leakage.

Answer

Enable HTTP access for performance

Answer

Disable audit logging to reduce exposure

Answer

Enable soft-delete to recover deleted secrets

Question 15

You are designing a security compliance plan for a GitHub Enterprise environment. Which THREE practices should you implement? (Select THREE.)

Accepted Answer

Configure branch protection rules to require pull request reviews. Branch protection rules with required pull request reviews enforce mandatory code review before merging, Dependabot alerts automatically monitor dependency vulnerabilities, and secret scanning detects accidental credential commits. Together these practices strengthen security compliance in GitHub Enterprise.

Answer

Disable two-factor authentication for automation accounts

Answer

Allow repository admins to bypass branch protection rules