AZ-400 Develop a security and compliance plan Practice Test 6 — 15 Questions

Question 1

You receive a GitHub Dependabot alert as shown. The repository 'my-app' is internal. What is the best immediate action to mitigate the risk?

Accepted Answer

Update the lodash dependency to the latest patched version. Option A is correct because updating the dependency to a patched version is the best mitigation. Option B is wrong because dismissing the alert ignores the risk. Option C is wrong because creating a private fork does not fix the vulnerability. Option D is wrong because enabling secret scanning does not address dependency vulnerabilities.

Answer

Dismiss the alert as it is a false positive

Answer

Create a private fork of the repository

Answer

Enable secret scanning on the repository

Question 2

You are auditing an Azure Pipeline YAML file. The security team requires that deployments to the 'Prod' environment only occur from the main branch. Does this pipeline meet that requirement?

Accepted Answer

Yes, because the condition ensures deployment only from main. Option B is correct because the condition checks that the source branch is main. Option A is wrong because it does meet the requirement. Option C is wrong because the condition is correct. Option D is wrong because the condition is correct.

Answer

Yes, because the Deploy stage always runs after Build

Answer

No, because the Build stage should also be conditioned

Answer

No, because the condition should be 'succeeded()' only

Question 3

Your organization is implementing a security compliance plan for Azure DevOps. Which TWO actions help enforce the principle of least privilege?

Accepted Answer

Use Azure DevOps security groups to grant minimal permissions. Options A and C are correct. Option A limits access to only what is needed. Option C restricts administrative roles. Option B is wrong because it grants more permissions. Option D is wrong because it broadens access. Option E is wrong because it does not enforce least privilege.

Answer

Allow all team members to edit security permissions

Answer

Use built-in roles without customizing

Answer

Grant Project Collection Administrators group to all developers

Question 4

Your company uses GitHub and must comply with data residency requirements. Which THREE actions should you take to ensure data stays within a specific geographic region?

Accepted Answer

Use self-hosted runners in the desired region. Options B, C, and D are correct. Option B uses GitHub Enterprise Cloud with data residency. Option C configures the repository to a specific region. Option D uses a region-specific runner. Option A is wrong because GitHub Actions does not restrict data storage by region. Option E is wrong because push protection does not affect data residency.

Answer

Enable GitHub Actions for all repositories

Answer

Enable push protection for secrets

Question 5

You are designing a plan to protect Azure DevOps pipelines from supply chain attacks. Which TWO measures should you implement?

Accepted Answer

Require approval for pipeline runs that use external resources. Options A and C are correct. Option A ensures dependencies are secure. Option C prevents unauthorized access to pipeline resources. Option B is wrong because it does not address supply chain. Option D is wrong because it is about deployment. Option E is wrong because it is about testing.

Answer

Implement code coverage thresholds in pull requests

Answer

Enable secret scanning for all repositories

Answer

Use release gates to validate deployment health

Question 6

Your team uses Azure DevOps and wants to enforce branch protection policies for all repositories in a GitHub Advanced Security-enabled organization. Which approach should you use to ensure that pull requests require a successful status check from a required workflow?

Accepted Answer

Define a repository rule in GitHub that requires a successful status check from a required workflow.. Option C is correct because GitHub repository rules allow you to define branch protection policies that require status checks, including required workflows. Option A is wrong because Azure DevOps branch policies are for Azure Repos, not GitHub. Option B is wrong because GitHub Actions secrets are for storing sensitive data, not for branch policies. Option D is wrong because branch protection rules in GitHub are per-repository, but repository rules allow organization-wide enforcement.

Answer

Use GitHub Actions secrets to store the required status check name.

Answer

Create a branch protection rule in each repository's settings.

Answer

Configure branch policies in Azure DevOps project settings.

Question 7

A company uses Microsoft Defender for Cloud to assess the security posture of Azure Pipelines agents. They notice that self-hosted agents are flagged as having high-severity vulnerabilities. What is the recommended action to remediate these findings while minimizing downtime?

Accepted Answer

Apply the security updates recommended by Microsoft Defender for Cloud to the agent VMs.. Option B is correct because using Microsoft Defender for Cloud's recommendation to update the agent VM with the latest security patches is the standard remediation. Option A is wrong because switching to Microsoft-hosted agents may not meet compliance requirements and does not remediate existing vulnerabilities. Option C is wrong because disabling Defender for Cloud would remove visibility. Option D is wrong because uninstalling agents is not a remediation.

Answer

Disable Microsoft Defender for Cloud for the agent pool.

Answer

Uninstall the self-hosted agents and use only Microsoft-hosted agents.

Answer

Replace all self-hosted agents with Microsoft-hosted agents.

Question 8

Your organization requires that all code changes be signed using a valid code signing certificate before they can be merged. Which feature in GitHub should you enable to enforce this?

Accepted Answer

Commit signature verification.. Option A is correct because commit signature verification in GitHub enforces that commits are signed with a verified GPG or S/MIME key. Option B is wrong because secret scanning detects secrets, not signature enforcement. Option C is wrong because Dependabot handles dependency updates. Option D is wrong because code scanning analyzes code for vulnerabilities.

Answer

Dependabot.

Answer

Code scanning.

Answer

Secret scanning.

Question 9

You are designing a security compliance plan for Azure Pipelines. The plan must ensure that no pipeline can use variables containing secrets unless those variables are stored in Azure Key Vault and referenced via a variable group linked to Key Vault. What is the best way to enforce this across all pipelines in an Azure DevOps organization?

Accepted Answer

Implement an Azure Policy that audits variable groups and requires Key Vault integration.. Option D is correct because using Azure Policy to audit and enforce Key Vault usage in variable groups ensures compliance across the organization. Option A is wrong because manual reviews are not scalable. Option B is wrong because YAML templates can be bypassed. Option C is wrong because branch policies do not control variable usage.

Answer

Create a YAML template that mandates the use of Key Vault references.

Answer

Require manual approval for all pipeline runs that use variables.

Answer

Use branch policies to prevent merging code that contains secrets.

Question 10

Your organization uses GitHub Actions and has a repository containing sensitive infrastructure code. You need to ensure that only approved actions are used in workflows. Which two settings should you configure? (Select two.)

Accepted Answer

Allow actions created by GitHub.. Options A and D are correct because GitHub allows you to restrict actions to those from verified creators and to allow only actions in approved repositories. Option B is wrong because disabling actions would block all workflows. Option C is wrong because secrets do not restrict actions. Option E is wrong because environment protection rules do not restrict actions.

Answer

Disable actions for the repository.

Answer

Use environment protection rules.

Answer

Store actions in encrypted secrets.

Question 11

Your team uses Azure DevOps and wants to automatically scan pull requests for secrets before they are merged. Which Azure DevOps feature should you use?

Accepted Answer

Secret scanning in Azure DevOps.. Option C is correct because Azure DevOps includes a built-in secret scanner that can be integrated into pipelines. Option A is wrong because GitHub Advanced Security is for GitHub, not Azure DevOps. Option B is wrong because branch policies do not include secret scanning. Option D is wrong because Azure Policy does not scan pull request content.

Answer

Azure Policy.

Answer

GitHub Advanced Security.

Answer

Branch policy with a required reviewer.

Question 12

Your company uses Microsoft Defender for Cloud to monitor Azure DevOps environments. You receive an alert that a service principal has excessive permissions. What is the first step you should take to investigate and remediate?

Accepted Answer

Review the Microsoft Entra ID audit logs for the service principal.. Option B is correct because reviewing the Entra ID audit logs helps understand the scope of permissions and actions taken. Option A is wrong because resetting credentials immediately might lock out legitimate users without investigation. Option C is wrong because deleting the service principal could break dependencies. Option D is wrong because you need to investigate before adjusting permissions.

Answer

Reduce the service principal's permissions to the minimum required.

Answer

Immediately delete the service principal.

Answer

Reset the service principal's credentials.

Question 13

Your organization must comply with SOC 2 requirements. You are using Azure DevOps and need to ensure that all pipeline runs are logged and that logs are retained for at least one year. Which configuration should you implement?

Accepted Answer

Enable audit streaming to a Log Analytics workspace and set retention to 365 days.. Option D is correct because enabling Azure DevOps audit streaming to a Log Analytics workspace allows long-term retention and compliance. Option A is wrong because the default retention is shorter. Option B is wrong because disabling pipeline deletion does not affect log retention. Option C is wrong because diagnostic settings in Azure are for Azure resources, not Azure DevOps pipelines.

Answer

Increase the retention period of pipeline logs in the Azure DevOps UI.

Answer

Configure diagnostic settings for the Azure DevOps organization.

Answer

Disable the option to delete pipelines.

Question 14

Your team uses GitHub and wants to automatically detect exposed credentials in code. Which GitHub feature should you enable?

Accepted Answer

Secret scanning.. Option A is correct because secret scanning detects credentials and other secrets in repositories. Option B is wrong because Dependabot handles dependency vulnerabilities. Option C is wrong because code scanning finds code quality issues. Option D is wrong because GitHub Actions is for CI/CD, not scanning for secrets.

Answer

Code scanning.

Answer

Dependabot.

Answer

GitHub Actions.

Question 15

You are reviewing an Azure Policy definition. What does this policy do?

Accepted Answer

Denies any pipeline that does not use a specific YAML template.. Option B is correct because the policy denies any pipeline whose YAML file path is not exactly '/pipeline-templates/secure-pipeline.yml'. Option A is wrong because it denies, not allows. Option C is wrong because it targets all pipelines, not just those in a specific folder. Option D is wrong because it does not enforce a specific template version.

Answer

Denies pipelines that use an outdated template version.

Answer

Allows only pipelines that use a specific YAML template.

Answer

Allows only pipelines in the pipeline-templates folder.

AZ-400 Develop a security and compliance plan Practice Test 6 — 15 Questions

Exhibit

AZ-400 Develop a security and compliance plan Practice Test 6 — 15 Questions

Exhibit