AZ-400 Develop a security and compliance plan Practice Test 6 — 15 Questions

Question 1

Your team uses Azure Pipelines and needs to comply with SOC 2 requirements. Which TWO features should you use to meet audit log requirements? (Select TWO.)

Accepted Answer

Enable Azure DevOps audit logging. Azure DevOps audit logging (Option C) captures a detailed, immutable record of events such as pipeline runs, permission changes, and access attempts, which is essential for SOC 2 audit log requirements. Streaming these logs to Azure Monitor Log Analytics (Option E) enables long-term retention, advanced querying, and alerting, satisfying the need for secure log storage and monitoring.

Answer

Configure network security groups to block public access

Answer

Automate secret rotation for service connections

Answer

Create service principals for pipeline authentication

Question 2

Your team uses GitHub repositories and wants to ensure that all code changes are signed by a verified contributor before merging. Which branch protection rule should you enable?

Accepted Answer

Require signed commits. Requiring signed commits ensures that each commit is cryptographically verified using a GPG or S/MIME key linked to the contributor's GitHub account. This enforces non-repudiation and confirms the identity of the author, directly addressing the requirement that all code changes be signed by a verified contributor before merging.

Answer

Require pull request reviews before merging

Answer

Require linear history

Answer

Restrict who can push to matching branches

Question 3

Your company uses Azure DevOps and must enforce that all pipelines use approved agent pools. The security team wants to prevent the use of the default agent pool. What should you do?

Accepted Answer

Set agent pool permissions to deny the default pool for all projects. Setting agent pool permissions to deny the default pool for all projects explicitly blocks its use across the organization. This enforces the security policy by preventing any pipeline from selecting the default agent pool, while still allowing administrators to manage the pool if needed. In Azure DevOps, agent pool permissions control which users, teams, or projects can use a pool, and setting 'Deny' overrides any inherited 'Allow' permissions.

Answer

Use pipeline settings to require authorization for the default pool

Answer

Remove the default agent pool from the organization

Answer

Disable the default agent pool in project settings

Question 4

You are deploying a web app to Azure App Service using Azure Pipelines. The security team requires that all secrets are stored in Azure Key Vault and retrieved at deployment time. What is the best approach?

Accepted Answer

Add an Azure Key Vault task in the pipeline to download secrets. The Azure Key Vault task in Azure Pipelines directly downloads secrets from Key Vault as pipeline variables at deployment time, ensuring secrets are never stored in the pipeline definition or source control. This meets the security team's requirement for retrieving secrets at deployment time without exposing them in logs or build artifacts.

Answer

Store secrets in pipeline variables and mark them as secret

Answer

Use Variable Groups linked to Key Vault

Answer

Reference Key Vault secrets directly in App Service configuration

Question 5

Your team uses GitHub and wants to automatically detect and block secrets pushed to repositories. Which GitHub feature should you enable?

Accepted Answer

Push protection. Push protection is the GitHub feature that automatically detects known types of secrets in pushed content and blocks the push, preventing exposure. Secret scanning, on the other hand, scans for secrets and alerts after they exist in the repository but does not block the push unless push protection is enabled. Since the requirement is to 'automatically detect and block secrets pushed', the feature to enable is Push protection.

Answer

Dependabot alerts

Answer

Code scanning

Answer

Secret scanning

Question 6

You are designing a compliance plan for Azure DevOps. The compliance officer requires that all changes to build pipelines are audited and cannot be reverted without approval. What should you implement?

Accepted Answer

Store pipeline YAML in a repository with branch policies. Storing pipeline YAML in a repository with branch policies ensures that every change to the pipeline definition goes through a pull request (PR) process, which is auditable and requires approval before merging. Once merged, the change is recorded in the Git history, and reverting it requires another PR with approval, meeting the compliance requirement that changes cannot be reverted without approval.

Answer

Enable Azure DevOps audit logs

Answer

Use release approval gates

Answer

Set pipeline retention policies

Question 7

Your organization uses Microsoft Entra ID and Azure DevOps. You need to ensure that only users from specific Entra ID groups can create new Azure DevOps organizations. What should you configure?

Accepted Answer

Assign the Azure DevOps Administrator role to the security group. The Azure DevOps Administrator role in Microsoft Entra ID is specifically designed to manage Azure DevOps service-level settings, including the ability to restrict who can create new Azure DevOps organizations. By assigning this role to a security group, only members of that group can create new organizations, which directly meets the requirement.

Answer

Assign the Global Administrator role to the security group

Answer

Configure Conditional Access policies to block non-group members

Answer

Use Azure DevOps security policies to restrict organization creation

Question 8

Your team uses Azure Pipelines and wants to ensure that builds cannot access the internet to prevent data exfiltration. What should you do?

Accepted Answer

Create a private agent pool with no internet access. Microsoft-hosted agents with network isolation (B) is a valid Azure feature. However, using a private agent pool with no internet access (A) or self-hosted agents on an isolated network (D) are also valid methods to prevent internet access for builds. The question should be revised to specify a constraint that excludes these options, or the correct options should include A and D.

Answer

Set the pipeline variable 'DisableInternetAccess' to true

Question 9

You are using GitHub Advanced Security. The security team wants to prevent developers from introducing code with high-severity vulnerabilities. What is the best way to enforce this?

Accepted Answer

Enable code scanning and configure a quality gate to fail PRs with high-severity alerts. Enabling code scanning with a quality gate that fails pull requests (PRs) on high-severity alerts directly prevents vulnerable code from being merged. This enforces security policy at the PR merge point, using GitHub's CodeQL analysis to detect vulnerabilities before they reach the main branch. Dependabot and secret scanning address different risks (outdated dependencies and leaked secrets) and do not block code with high-severity vulnerabilities.

Answer

Enable Dependabot and require pull request reviews for dependency updates

Answer

Enable push protection for all repositories

Answer

Enable secret scanning and block pushes with high-confidence secrets

Question 10

Your company uses Azure DevOps and must comply with SOC 2. The auditor requires proof that all production deployments went through a change management process with approval. What should you implement?

Accepted Answer

Configure release approval gates in Azure Pipelines. Release approval gates in Azure Pipelines enforce a formal approval process before deployment, providing the required change management and approval evidence for SOC 2 audits. Option A is incorrect because branch policies control code changes, not deployments. Option B is incorrect because pipeline retention policies only manage artifact storage, not approval process. Option C is incorrect because audit logging records events but does not enforce an approval process.

Answer

Use branch policies to require pull request approvals

Answer

Set pipeline retention policies to keep deployment records

Answer

Enable audit logging for all pipelines

Question 11

You receive a GitHub Dependabot alert as shown. The repository 'my-app' is internal. What is the best immediate action to mitigate the risk?

Accepted Answer

Update the lodash dependency to the latest patched version. The Dependabot alert indicates a known vulnerability in the lodash dependency. The best immediate action is to update lodash to the latest patched version, which directly resolves the security issue by applying the fix provided by the maintainers. This aligns with the principle of remediating vulnerabilities at the source rather than implementing workarounds.

Answer

Dismiss the alert as it is a false positive

Answer

Create a private fork of the repository

Answer

Enable secret scanning on the repository

Question 12

Your organization is implementing a security compliance plan for Azure DevOps. Which TWO actions help enforce the principle of least privilege?

Accepted Answer

Use Azure DevOps security groups to grant minimal permissions. Azure DevOps security groups allow administrators to assign specific permissions to groups rather than individuals, enabling granular control over who can perform actions like editing work items or managing pipelines. This directly supports the principle of least privilege by ensuring users have only the permissions necessary for their role. Option D is correct because restricting agent pool creation to a small admin team prevents unauthorized users from deploying agents that could execute arbitrary code or access sensitive resources, which is a common attack vector in CI/CD environments.

Answer

Allow all team members to edit security permissions

Answer

Use built-in roles without customizing

Answer

Grant Project Collection Administrators group to all developers

Question 13

You are designing a plan to protect Azure DevOps pipelines from supply chain attacks. Which TWO measures should you implement?

Accepted Answer

Require approval for pipeline runs that use external resources. Options A and B are correct. Option A requires approval for pipeline runs that use external resources, which helps prevent unauthorized or malicious external dependencies from being used in builds, directly reducing supply chain attack risk. Option B uses Dependabot to automatically update vulnerable dependencies, ensuring known vulnerabilities are patched promptly. Option C is incorrect because code coverage thresholds are a code quality measure, not a supply chain security control. Option D is incorrect because secret scanning detects secrets in repositories but does not prevent supply chain attacks. Option E is incorrect because release gates validate deployment health, not supply chain integrity.

Answer

Implement code coverage thresholds in pull requests

Answer

Enable secret scanning for all repositories

Answer

Use release gates to validate deployment health

Question 14

Your team uses Azure DevOps and wants to enforce branch protection policies for all repositories in a GitHub Advanced Security-enabled organization. Which approach should you use to ensure that pull requests require a successful status check from a required workflow?

Accepted Answer

Define a repository rule in GitHub that requires a successful status check from a required workflow.. GitHub repository rules (also known as repository rulesets) allow organizations to centrally enforce policies like required status checks across multiple repositories. To require a successful status check from a specific workflow on all pull requests, create an organization-level repository ruleset that includes the 'Require status checks to pass' rule and specify the workflow's check name. This applies to all selected repositories without per-repository configuration. GitHub Advanced Security is not required for this feature; it is a separate security add-on.

Answer

Use GitHub Actions secrets to store the required status check name.

Answer

Create a branch protection rule in each repository's settings.

Answer

Configure branch policies in Azure DevOps project settings.

Question 15

A company uses Microsoft Defender for Cloud to assess the security posture of Azure Pipelines agents. They notice that self-hosted agents are flagged as having high-severity vulnerabilities. What is the recommended action to remediate these findings while minimizing downtime?

Accepted Answer

Apply the security updates recommended by Microsoft Defender for Cloud to the agent VMs.. Microsoft Defender for Cloud identifies vulnerabilities on the VMs hosting self-hosted Azure Pipelines agents and provides specific security update recommendations. Applying these updates directly remediates the high-severity findings without requiring agent replacement or disabling security monitoring, thus minimizing downtime by patching in-place.

Answer

Disable Microsoft Defender for Cloud for the agent pool.

Answer

Uninstall the self-hosted agents and use only Microsoft-hosted agents.

Answer

Replace all self-hosted agents with Microsoft-hosted agents.