AZ-400 Develop a security and compliance plan Practice Test 7 — 15 Questions

Question 1

You are analyzing Azure DevOps audit logs with the KQL query above. Your security team wants to ensure that only approved service connections are used. After running the query, you find multiple service connections created by a user who is not on the approved list. What should you do next?

Accepted Answer

Review each unapproved service connection's permissions and usage.. Option A is correct because the first step is to review the service connections and their permissions to understand the impact. Option B is wrong because deleting all connections created by that user could break running pipelines. Option C is wrong because disabling the user might be premature without investigation. Option D is wrong because the query already shows the creator.

Answer

Immediately delete all service connections created by that user.

Answer

Disable the user's account in Microsoft Entra ID.

Answer

Modify the query to also include the user's email address.

Question 2

You are reviewing a pipeline YAML file. The variable 'prod-db-password' is stored in a variable group linked to Azure Key Vault. However, the pipeline fails with an error that the secret cannot be accessed. What is the most likely cause?

Accepted Answer

The pipeline's authorized service principal lacks 'Get' permission on the Key Vault.. Option C is correct because the pipeline's service principal needs permission to access the Key Vault secrets. Option A is wrong because the variable group is already linked. Option B is wrong because the syntax is correct. Option D is wrong because the secret name in Key Vault might differ, but the error indicates access issue.

Answer

The YAML syntax for referencing the variable is incorrect.

Answer

The variable group 'prod-variables' does not exist.

Answer

The secret name in Key Vault does not match 'prod-db-password'.

Question 3

Your organization is adopting GitHub Copilot and wants to ensure that no proprietary code is used to train models. Which setting should you configure in the GitHub organization?

Accepted Answer

Opt out of allowing GitHub to use code snippets for product improvement.. Option B is correct because GitHub Copilot allows you to opt out of code snippet sharing for training. Option A is wrong because Copilot is not a feature that can be disabled for specific repositories only. Option C is wrong because Dependabot does not affect Copilot training. Option D is wrong because secret scanning is unrelated.

Answer

Enable secret scanning.

Answer

Enable Dependabot alerts.

Answer

Disable GitHub Copilot for the organization.

Question 4

Your Azure DevOps organization has multiple projects. You need to ensure that only approved extension versions are installed across all projects. What is the most efficient way to enforce this?

Accepted Answer

Use the Azure DevOps extension management settings to mark approved extensions and block others.. Option A is correct because Azure DevOps allows you to manage extensions at the organization level and restrict installation to approved ones. Option B is wrong because uninstalling extensions in each project is not efficient. Option C is wrong because Azure Policy does not manage Azure DevOps extensions. Option D is wrong because extensions cannot be restricted to specific pipelines.

Answer

Restrict extension usage to specific pipelines via YAML.

Answer

Create an Azure Policy that audits extension installations.

Answer

Uninstall all extensions and only install them per project as needed.

Question 5

You are using Microsoft Defender for Cloud to secure Azure Pipelines. You need to receive alerts when a pipeline run uses a service principal with excessive permissions. Which feature should you enable?

Accepted Answer

Enable Microsoft Defender for Cloud's identity and access monitoring.. Option B is correct because Defender for Cloud's identity and access monitoring can alert on over-privileged service principals used in pipelines. Option A is wrong because audit logs alone do not generate alerts. Option C is wrong because conditional access policies are for user sign-ins, not service principals in pipelines. Option D is wrong because Azure Policy does not generate real-time alerts for pipeline runs.

Answer

Enable Azure DevOps audit logs and review them manually.

Answer

Create an Azure Policy to deny over-privileged service principals.

Answer

Configure Microsoft Entra ID Conditional Access policies.

Question 6

Your organization uses Azure DevOps and requires that all pipelines enforce branch policy for pull requests. A developer creates a pipeline that builds and tests code on push to any branch. The security team wants to ensure that no code can be deployed to production without passing through a pull request with required reviewers. Which action should you take to meet this requirement?

Accepted Answer

Configure branch policy on the main branch to require a pull request with a minimum number of reviewers.. Option C is correct because branch policies in Azure Repos can enforce that changes must go through a pull request with required reviewers before merging to the main branch. Option A is incorrect because disabling CI triggers does not enforce pull request requirements. Option B is incorrect because pipeline permissions don't enforce code review. Option D is incorrect because service connections control access to external resources, not code review.

Answer

Disable CI triggers on the pipeline and require manual builds.

Answer

Modify the service connection to require admin approval.

Answer

Set the pipeline to require approval from the security team before running.

Question 7

Your company uses GitHub Enterprise and wants to implement a secret scanning policy to detect and block secrets (e.g., API keys) in code pushes. The policy must allow exceptions for test repositories that use fake secrets. What is the recommended approach?

Accepted Answer

Configure secret scanning with custom patterns and use the 'secret_scanning_push_protection' setting with an allow-list for test repositories.. Option B is correct because GitHub secret scanning can be configured with custom patterns and allow-listed repositories. Option A is incorrect because disabling for test repos would be manual and not scalable. Option C is incorrect because pre-commit hooks are client-side and not enforceable server-side. Option D is incorrect because GitHub Actions cannot directly block pushes; secret scanning is a separate feature.

Answer

Use a pre-commit hook to detect secrets and allow developers to bypass it.

Answer

Implement a GitHub Actions workflow that scans for secrets and fails the push.

Answer

Enable secret scanning for all repositories, then manually disable it for test repositories.

Question 8

Your team uses Microsoft Defender for Cloud to monitor Azure resources. You need to ensure that all Azure DevOps pipelines are scanned for security misconfigurations before deployment. Which integration should you enable?

Accepted Answer

Enable the 'Defender for DevOps' integration in Microsoft Defender for Cloud.. Option A is correct because Microsoft Defender for Cloud can integrate with Azure DevOps to scan infrastructure as code templates. Option B is incorrect because Microsoft Sentinel is a SIEM, not a scanner. Option C is incorrect because Microsoft Purview is for data governance. Option D is incorrect because Microsoft Intune manages devices.

Answer

Connect Azure DevOps to Microsoft Sentinel.

Answer

Deploy Microsoft Intune policies to Azure DevOps agents.

Answer

Configure Microsoft Purview to scan Azure DevOps repositories.

Question 9

Your organization uses GitHub Actions and needs to enforce that only approved actions from the GitHub Marketplace can be used in workflows. Developers have been using custom actions from third-party repositories. What is the most effective way to control which actions are allowed?

Accepted Answer

Use the 'Allow actions created by GitHub and verified partners' policy and add specific actions to the allow list.. Option D is correct because GitHub allows organization owners to set a policy to allow only specific actions, including those from the marketplace. Option A is incorrect because it does not restrict third-party actions. Option B is incorrect because disabling third-party actions entirely may block legitimate needs. Option C is incorrect because manual review is not scalable.

Answer

Create a manual approval process for each new action.

Answer

Set the organization to disallow all third-party actions.

Answer

Configure the organization to allow only actions created by GitHub.

Question 10

Your team uses Azure Pipelines to deploy to Azure Kubernetes Service (AKS). The security team requires that all container images be scanned for vulnerabilities before deployment. You have configured a container registry with Microsoft Defender for Cloud integration. What should you add to your pipeline to ensure only compliant images are deployed?

Accepted Answer

Use the 'Azure Container Registry' task with the 'Scan' option to check vulnerabilities and fail the pipeline if critical vulnerabilities exist.. Option B is correct because you can use the 'ACR Task' or a script to check scan results before deployment. Option A is incorrect because scanning is not done at build time by default. Option C is incorrect because scanning the running container is too late. Option D is incorrect because security policies in Azure Policy can block non-compliant resources but are not pipeline-level.

Answer

Set up Azure Policy to deny deployments of images without scan results.

Answer

Add a task that runs a vulnerability scan on the image after deployment.

Answer

Configure the AKS cluster to scan images after pulling.

Question 11

Your organization uses Microsoft Entra ID (formerly Azure AD) for identity management. You need to ensure that only authorized users can access the Azure DevOps organization. What is the most secure way to manage access?

Accepted Answer

Require all users to use multi-factor authentication (MFA) and enable Conditional Access policies.. Option D is correct because Conditional Access policies provide granular access control based on conditions like location, device compliance, and risk. Option A is incorrect because it does not enforce additional security. Option B is incorrect because manual review is not scalable. Option C is incorrect because disabling external users is not the most secure; it still allows all internal users.

Answer

Disable external user access and only allow internal users.

Answer

Use IP address restrictions to limit access to the corporate network.

Answer

Add users to the Azure DevOps organization and assign them to the 'Basic' access level.

Question 12

Your company uses GitHub and wants to implement a compliance framework that requires signed commits for all repositories. Developers use various IDEs and Git clients. What is the best way to enforce signed commits across the organization?

Accepted Answer

Enable 'Require signed commits' in the branch protection rules for the default branch.. Option C is correct because GitHub allows repository administrators to enable 'Require signed commits' in branch protection rules. Option A is incorrect because it is not enforceable; commits can be unsigned. Option B is incorrect because it only encourages, not enforces. Option D is incorrect because it does not enforce signing.

Answer

Set the repository to 'Require pull request reviews before merging' and rely on reviewers to check commit signatures.

Answer

Ask developers to configure GPG keys and sign commits manually.

Answer

Use a GitHub Action that fails if commits are unsigned.

Question 13

Your team uses Azure Pipelines to deploy a web app to Azure App Service. You need to ensure that secrets (e.g., connection strings) are not exposed in the pipeline logs. What is the recommended approach?

Accepted Answer

Use secret pipeline variables and reference them in the pipeline.. Option B is correct because Azure Pipelines allows you to mark variables as 'secret' to mask them in logs. Option A is incorrect because environment variables can still be logged. Option C is incorrect because Key Vault is for storing secrets, but if logged they can be exposed. Option D is incorrect because removing logging is not practical.

Answer

Remove all logging from the pipeline.

Answer

Store secrets in Azure Key Vault and retrieve them in the pipeline, then log them for debugging.

Answer

Store secrets as environment variables in the pipeline.

Question 14

Your organization uses Microsoft Purview to classify and protect sensitive data. You need to ensure that source code in Azure DevOps repositories containing credit card numbers is detected and flagged. What should you configure?

Accepted Answer

Configure a Microsoft Purview Data Classification scan for Azure DevOps repositories.. Option C is correct because Microsoft Purview Data Classification can scan repositories for sensitive data using built-in or custom sensitive information types. Option A is incorrect because DLP policies are for endpoints, not repositories. Option B is incorrect because Microsoft Sentinel is a SIEM. Option D is incorrect because Microsoft Defender for Cloud is for cloud security posture.

Answer

Create a Data Loss Prevention (DLP) policy in Microsoft 365.

Answer

Set up Microsoft Sentinel to monitor Azure DevOps logs.

Answer

Enable Microsoft Defender for Cloud to scan repositories.

Question 15

Which TWO actions should you take to ensure that only approved pipelines can deploy to production in Azure DevOps? (Choose two.)

Accepted Answer

Configure a pipeline approval gate on the production environment.. Options A and D are correct: Use pipeline approvals to require manual approval before deployment, and use branch policies to enforce that only code from protected branches can be deployed. Option B is incorrect because disabling parallel jobs does not enforce approvals. Option C is incorrect because using a single agent pool does not enforce security. Option E is incorrect because the main branch can have many pipelines.

Answer

Disable parallel jobs for the project.

Answer

Limit the number of pipelines that can deploy from the main branch.

Answer

Use a single agent pool for all pipelines.

AZ-400 Develop a security and compliance plan Practice Test 7 — 15 Questions

Exhibit

AZ-400 Develop a security and compliance plan Practice Test 7 — 15 Questions

Exhibit