AZ-400 Develop a security and compliance plan Practice Test 7 — 15 Questions

Question 1

You are implementing a secrets management strategy for a multi-cloud deployment. You need to securely store and rotate API keys for a third-party service. Which Azure service should you use?

Accepted Answer

Azure Key Vault. Azure Key Vault is the correct service because it is designed specifically for securely storing and managing secrets, including API keys, with built-in support for automatic rotation via integration with Azure Event Grid and Azure Functions. It provides hardware security module (HSM)-backed encryption, access policies, and auditing, making it ideal for multi-cloud secrets management.

Answer

Microsoft Entra ID

Answer

Azure App Configuration

Answer

Azure Storage Blob

Question 2

Your organization is adopting GitHub Copilot for developers. Which security measure should you implement to ensure that no proprietary code is inadvertently shared with the AI model?

Accepted Answer

Configure content exclusions in the GitHub Copilot settings. GitHub Copilot's content exclusions allow administrators to specify files or repositories that should not be sent to the AI model for code completion suggestions. This prevents proprietary or sensitive code from being transmitted to GitHub's servers, ensuring compliance with security policies. Other options like network segmentation or audit logging do not directly block code from being shared with the AI.

Answer

Use a separate network segment for development

Answer

Disable GitHub Copilot for all users

Answer

Enable audit logging for Copilot usage

Question 3

Your team uses Azure Pipelines to deploy to multiple environments. You need to ensure that deployment to the production environment requires approval from the security team. What should you configure?

Accepted Answer

Add an environment approval check for the production environment. Environment approval checks in Azure Pipelines allow you to require manual approval before a deployment proceeds to a specific environment, such as production. By adding an approval check to the production environment, you ensure that the security team must explicitly approve the deployment, meeting the requirement without modifying the pipeline code or branch policies.

Answer

Add a branch policy to the production branch

Answer

Use a condition in the YAML pipeline to check a variable

Answer

Configure a service connection with restricted permissions

Question 4

Your organization uses Azure DevOps and wants to enforce that all pipelines use a specific set of approved tasks. How can you achieve this?

Accepted Answer

Use the task restrictions feature in Azure DevOps to block unapproved tasks. Use the task restrictions feature in Azure DevOps to block unapproved tasks. Azure DevOps provides a 'Task restrictions' policy under Organization Settings > Policies > Add new policy, where you can specify which tasks are allowed or blocked across all pipelines. This enforces that only approved tasks are used. Option B is incorrect because assigning permissions to a task group only controls who can modify the group, not which tasks are used in pipelines. Option C is incorrect because while YAML templates can standardize tasks, they do not enforce mandatory usage; pipelines can still be created without the template. Option D is incorrect because service hooks only trigger notifications when an unapproved task is used, but do not block its usage.

Answer

Assign permissions to the task group to limit who can add tasks

Answer

Create a YAML template with the approved tasks and require all pipelines to use it

Answer

Configure a service hook to notify when an unapproved task is used

Question 5

You need to ensure that only authorized users can access the Azure DevOps organization. Which identity provider should you configure for single sign-on (SSO)?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID (formerly Azure AD) is the required identity provider for configuring single sign-on (SSO) for Azure DevOps organizations. Azure DevOps relies on Entra ID to authenticate users and enforce conditional access policies, ensuring only authorized identities from your tenant can sign in. This integration also supports SAML-based SSO and OAuth 2.0 flows, making it the native and only supported IdP for Azure DevOps SSO.

Answer

Google Workspace

Answer

Microsoft account (MSA)

Answer

GitHub ID

Question 6

Your company uses Azure Key Vault to store secrets. Which TWO actions should you take to ensure secure access? (Select TWO.)

Accepted Answer

Restrict access using Key Vault access policies. Restricting access using Key Vault access policies (Option A) is correct because Azure Key Vault uses a granular permission model where you assign specific permissions (e.g., GET, LIST, SET) to individual security principals (users, groups, or service principals) at the vault level. This ensures that only authorized identities can read or manage secrets, keys, and certificates, following the principle of least privilege. Using managed identities (Option B) is correct because they provide an automatically managed identity in Microsoft Entra ID for applications to authenticate to Key Vault without storing credentials in code or configuration, eliminating the risk of secret leakage.

Answer

Enable HTTP access for performance

Answer

Disable audit logging to reduce exposure

Answer

Enable soft-delete to recover deleted secrets

Question 7

You are designing a security compliance plan for a GitHub Enterprise environment. Which THREE practices should you implement? (Select THREE.)

Accepted Answer

Configure branch protection rules to require pull request reviews. Branch protection rules with required pull request reviews enforce mandatory code review before merging, Dependabot alerts automatically monitor dependency vulnerabilities, and secret scanning detects accidental credential commits. Together these practices strengthen security compliance in GitHub Enterprise.

Answer

Disable two-factor authentication for automation accounts

Answer

Allow repository admins to bypass branch protection rules

Question 8

Your team uses Azure Pipelines and needs to comply with SOC 2 requirements. Which TWO features should you use to meet audit log requirements? (Select TWO.)

Accepted Answer

Enable Azure DevOps audit logging. Azure DevOps audit logging (Option C) captures a detailed, immutable record of events such as pipeline runs, permission changes, and access attempts, which is essential for SOC 2 audit log requirements. Streaming these logs to Azure Monitor Log Analytics (Option E) enables long-term retention, advanced querying, and alerting, satisfying the need for secure log storage and monitoring.

Answer

Configure network security groups to block public access

Answer

Automate secret rotation for service connections

Answer

Create service principals for pipeline authentication

Question 9

Your team uses GitHub repositories and wants to ensure that all code changes are signed by a verified contributor before merging. Which branch protection rule should you enable?

Accepted Answer

Require signed commits. Requiring signed commits ensures that each commit is cryptographically verified using a GPG or S/MIME key linked to the contributor's GitHub account. This enforces non-repudiation and confirms the identity of the author, directly addressing the requirement that all code changes be signed by a verified contributor before merging.

Answer

Require pull request reviews before merging

Answer

Require linear history

Answer

Restrict who can push to matching branches

Question 10

Your company uses Azure DevOps and must enforce that all pipelines use approved agent pools. The security team wants to prevent the use of the default agent pool. What should you do?

Accepted Answer

Set agent pool permissions to deny the default pool for all projects. Setting agent pool permissions to deny the default pool for all projects explicitly blocks its use across the organization. This enforces the security policy by preventing any pipeline from selecting the default agent pool, while still allowing administrators to manage the pool if needed. In Azure DevOps, agent pool permissions control which users, teams, or projects can use a pool, and setting 'Deny' overrides any inherited 'Allow' permissions.

Answer

Use pipeline settings to require authorization for the default pool

Answer

Remove the default agent pool from the organization

Answer

Disable the default agent pool in project settings

Question 11

Your team uses GitHub and wants to automatically detect and block secrets pushed to repositories. Which GitHub feature should you enable?

Accepted Answer

Push protection. Push protection is the GitHub feature that automatically detects known types of secrets in pushed content and blocks the push, preventing exposure. Secret scanning, on the other hand, scans for secrets and alerts after they exist in the repository but does not block the push unless push protection is enabled. Since the requirement is to 'automatically detect and block secrets pushed', the feature to enable is Push protection.

Answer

Dependabot alerts

Answer

Code scanning

Answer

Secret scanning

Question 12

You are designing a compliance plan for Azure DevOps. The compliance officer requires that all changes to build pipelines are audited and cannot be reverted without approval. What should you implement?

Accepted Answer

Store pipeline YAML in a repository with branch policies. Storing pipeline YAML in a repository with branch policies ensures that every change to the pipeline definition goes through a pull request (PR) process, which is auditable and requires approval before merging. Once merged, the change is recorded in the Git history, and reverting it requires another PR with approval, meeting the compliance requirement that changes cannot be reverted without approval.

Answer

Enable Azure DevOps audit logs

Answer

Use release approval gates

Answer

Set pipeline retention policies

Question 13

Your organization uses Microsoft Entra ID and Azure DevOps. You need to ensure that only users from specific Entra ID groups can create new Azure DevOps organizations. What should you configure?

Accepted Answer

Assign the Azure DevOps Administrator role to the security group. The Azure DevOps Administrator role in Microsoft Entra ID is specifically designed to manage Azure DevOps service-level settings, including the ability to restrict who can create new Azure DevOps organizations. By assigning this role to a security group, only members of that group can create new organizations, which directly meets the requirement.

Answer

Assign the Global Administrator role to the security group

Answer

Configure Conditional Access policies to block non-group members

Answer

Use Azure DevOps security policies to restrict organization creation

Question 14

You are using GitHub Advanced Security. The security team wants to prevent developers from introducing code with high-severity vulnerabilities. What is the best way to enforce this?

Accepted Answer

Enable code scanning and configure a quality gate to fail PRs with high-severity alerts. Enabling code scanning with a quality gate that fails pull requests (PRs) on high-severity alerts directly prevents vulnerable code from being merged. This enforces security policy at the PR merge point, using GitHub's CodeQL analysis to detect vulnerabilities before they reach the main branch. Dependabot and secret scanning address different risks (outdated dependencies and leaked secrets) and do not block code with high-severity vulnerabilities.

Answer

Enable Dependabot and require pull request reviews for dependency updates

Answer

Enable push protection for all repositories

Answer

Enable secret scanning and block pushes with high-confidence secrets

Question 15

Your company uses Azure DevOps and must comply with SOC 2. The auditor requires proof that all production deployments went through a change management process with approval. What should you implement?

Accepted Answer

Configure release approval gates in Azure Pipelines. Release approval gates in Azure Pipelines allow you to define approvers who must approve a deployment before it proceeds. This enforces a change management process with documented approval, providing an audit trail that satisfies SOC 2 requirements. Approval gates can be configured for specific environments or stages, ensuring that all production deployments are reviewed.

Answer

Use branch policies to require pull request approvals

Answer

Set pipeline retention policies to keep deployment records

Answer

Enable audit logging for all pipelines