AZ-400 Develop a security and compliance plan Practice Test 7 — 15 Questions

Question 1

Your organization requires that all code changes be signed using a valid code signing certificate before they can be merged. Which feature in GitHub should you enable to enforce this?

Accepted Answer

Commit signature verification.. Commit signature verification in GitHub enforces that commits are signed with a verified GPG or S/MIME key, which meets the requirement of signing code changes. Option A is wrong because Dependabot handles dependency updates, not signature enforcement. Option C is wrong because code scanning analyzes code for vulnerabilities, not for commit signatures. Option D is wrong because secret scanning detects secrets in repositories, not signature enforcement.

Answer

Dependabot.

Answer

Code scanning.

Answer

Secret scanning.

Question 2

You are designing a security compliance plan for Azure Pipelines. The plan must ensure that no pipeline can use variables containing secrets unless those variables are stored in Azure Key Vault and referenced via a variable group linked to Key Vault. What is the best way to enforce this across all pipelines in an Azure DevOps organization?

Accepted Answer

Create a YAML template that mandates the use of Key Vault references.. You can enforce a YAML template at the organization level using required template policies. This ensures all pipelines include a template that mandates Key Vault references for secrets, providing a scalable enforcement mechanism. Option B is incorrect because Azure Policy applies to Azure resources, not Azure DevOps constructs like variable groups. Option C is incorrect because manual approvals do not enforce Key Vault usage. Option D is incorrect because branch policies control code, not variable usage during execution.

Answer

Implement an Azure Policy that audits variable groups and requires Key Vault integration.

Answer

Require manual approval for all pipeline runs that use variables.

Answer

Use branch policies to prevent merging code that contains secrets.

Question 3

Your organization uses GitHub Actions and has a repository containing sensitive infrastructure code. You need to ensure that only approved actions are used in workflows. Which two settings should you configure? (Select two.)

Accepted Answer

Allow actions created by GitHub.. This is a select-two question. The correct answers are A and C. Option A is correct because enabling 'Allow actions created by GitHub' restricts workflows to only use first-party actions published by GitHub, establishing a baseline security posture. Option C is correct because further limiting actions to only those from specific approved repositories provides granular control over third-party actions that have been vetted by the organization. Together, these settings ensure that only approved actions can be used in workflows, meeting the compliance requirement.

Answer

Disable actions for the repository.

Answer

Use environment protection rules.

Answer

Store actions in encrypted secrets.

Question 4

Your team uses Azure DevOps and wants to automatically scan pull requests for secrets before they are merged. Which Azure DevOps feature should you use?

Accepted Answer

GitHub Advanced Security.. GitHub Advanced Security (GHAS) for Azure DevOps provides secret scanning that automatically detects secrets (e.g., API keys, passwords, connection strings) in pull requests before they are merged. This feature is integrated into Azure Repos when Advanced Security is enabled and triggers on PR creation, blocking the merge if secrets are found. Therefore, the correct choice is GitHub Advanced Security, not a separate 'Secret scanning in Azure DevOps' feature, which does not exist as a native built-in feature.

Answer

Azure Policy.

Answer

Secret scanning in Azure DevOps.

Answer

Branch policy with a required reviewer.

Question 5

Your company uses Microsoft Defender for Cloud to monitor Azure DevOps environments. You receive an alert that a service principal has excessive permissions. What is the first step you should take to investigate and remediate?

Accepted Answer

Review the Microsoft Entra ID audit logs for the service principal.. Reviewing the Microsoft Entra ID audit logs is the correct first step because it allows you to investigate the service principal's activity, such as which resources it accessed, when, and from where, before taking any remediation action. This forensic analysis is essential to understand the scope of the excessive permissions and to ensure that reducing permissions or other actions do not inadvertently disrupt legitimate operations. Without this step, you risk breaking functionality or missing evidence of misuse.

Answer

Reduce the service principal's permissions to the minimum required.

Answer

Immediately delete the service principal.

Answer

Reset the service principal's credentials.

Question 6

Your organization must comply with SOC 2 requirements. You are using Azure DevOps and need to ensure that all pipeline runs are logged and that logs are retained for at least one year. Which configuration should you implement?

Accepted Answer

Enable audit streaming to a Log Analytics workspace and set retention to 365 days.. SOC 2 requires audit logging and retention of pipeline execution history for at least one year. Azure DevOps audit streaming sends all audit events (including pipeline runs) to a Log Analytics workspace, where you can set a retention policy of 365 days. This satisfies both the logging and retention requirements without relying on pipeline-level retention settings that only cover build artifacts and logs, not audit events.

Answer

Increase the retention period of pipeline logs in the Azure DevOps UI.

Answer

Configure diagnostic settings for the Azure DevOps organization.

Answer

Disable the option to delete pipelines.

Question 7

Your team uses GitHub and wants to automatically detect exposed credentials in code. Which GitHub feature should you enable?

Accepted Answer

Secret scanning.. Secret scanning is the correct GitHub feature because it is specifically designed to automatically detect exposed credentials, tokens, and other secrets in code repositories. It scans for known patterns of sensitive data, such as AWS keys, GitHub tokens, and private keys, and alerts repository administrators when a match is found. This directly addresses the requirement to detect exposed credentials without needing custom workflows or additional configuration.

Answer

Code scanning.

Answer

Dependabot.

Answer

GitHub Actions.

Question 8

You are reviewing an Azure Policy definition that denies pipeline creation if the pipeline template path is not '/pipeline-templates/my-template.yml'. What does this policy do?

Accepted Answer

Denies any pipeline that does not use a specific YAML template.. This Azure Policy definition uses a 'deny' effect with a condition that checks whether the pipeline references a specific YAML template. If the pipeline does not reference that template, the policy denies the pipeline creation or update. Option D is correct because the policy explicitly denies any pipeline that does not use the specified YAML template, enforcing compliance by blocking non-compliant pipelines.

Answer

Denies pipelines that use an outdated template version.

Answer

Allows only pipelines that use a specific YAML template.

Answer

Allows only pipelines in the pipeline-templates folder.

Question 9

You are analyzing Azure DevOps audit logs with the KQL query above. Your security team wants to ensure that only approved service connections are used. After running the query, you find multiple service connections created by a user who is not on the approved list. What should you do next?

Accepted Answer

Review each unapproved service connection's permissions and usage.. The immediate priority is to assess the risk of each unapproved service connection before taking action. Service connections in Azure DevOps can have varying permissions and may be used by pipelines, so blindly deleting them could break critical deployments. The correct next step is to review each connection's permissions (e.g., who can use it, which service principals are linked) and its usage history (e.g., which pipelines reference it) to determine whether it is malicious or simply an oversight.

Answer

Immediately delete all service connections created by that user.

Answer

Disable the user's account in Microsoft Entra ID.

Answer

Modify the query to also include the user's email address.

Question 10

You are reviewing a pipeline YAML file. The variable 'prod-db-password' is stored in a variable group linked to Azure Key Vault. However, the pipeline fails with an error that the secret cannot be accessed. What is the most likely cause?

Accepted Answer

The pipeline's authorized service principal lacks 'Get' permission on the Key Vault.. The most likely cause is that the pipeline's authorized service principal lacks 'Get' permission on the Key Vault. When a variable group is linked to Azure Key Vault, Azure Pipelines uses a service principal (the pipeline's identity) to retrieve secrets. Even if the variable group and secret name are correct, the pipeline will fail if the service principal does not have the 'Get' secret permission in the Key Vault access policy. This is a common misconfiguration because the variable group link only establishes the mapping, not the actual access rights.

Answer

The YAML syntax for referencing the variable is incorrect.

Answer

The variable group 'prod-variables' does not exist.

Answer

The secret name in Key Vault does not match 'prod-db-password'.

Question 11

Your organization is adopting GitHub Copilot and wants to ensure that no proprietary code is used to train models. Which setting should you configure in the GitHub organization?

Accepted Answer

Opt out of allowing GitHub to use code snippets for product improvement.. GitHub provides an organization-level setting to opt out of allowing GitHub to use code snippets for product improvement, which prevents Copilot from training on that code. Option A is incorrect because secret scanning is unrelated to model training. Option B is incorrect because Dependabot alerts focus on dependency vulnerabilities, not data usage. Option C is incorrect because disabling Copilot prevents its use but does not address the underlying data usage for training; the organization may still want to use Copilot while preventing training on proprietary code.

Answer

Enable secret scanning.

Answer

Enable Dependabot alerts.

Answer

Disable GitHub Copilot for the organization.

Question 12

Your Azure DevOps organization has multiple projects. You need to ensure that only approved extension versions are installed across all projects. What is the most efficient way to enforce this?

Accepted Answer

Use the Azure DevOps extension management settings to mark approved extensions and block others.. Azure DevOps provides extension management settings at the organization level where administrators can mark specific extensions as approved and block all others. This is the most efficient way to enforce approved extension versions across all projects. Option A is wrong because extensions cannot be restricted to specific pipelines via YAML; YAML can only reference tasks from installed extensions. Option C is wrong because Azure Policy does not manage Azure DevOps extensions; it manages Azure resources. Option D is wrong because uninstalling extensions per project is inefficient and does not enforce approved versions globally.

Answer

Restrict extension usage to specific pipelines via YAML.

Answer

Create an Azure Policy that audits extension installations.

Answer

Uninstall all extensions and only install them per project as needed.

Question 13

You are using Microsoft Defender for Cloud to secure Azure Pipelines. You need to receive alerts when a pipeline run uses a service principal with excessive permissions. Which feature should you enable?

Accepted Answer

Enable Microsoft Defender for Cloud's identity and access monitoring.. Microsoft Defender for Cloud's identity and access monitoring continuously assesses the permissions of service principals used in Azure Pipelines and generates alerts when it detects over-privileged or anomalous usage. This feature is specifically designed to identify excessive permissions in real-time, enabling proactive security responses without manual log review or policy enforcement.

Answer

Enable Azure DevOps audit logs and review them manually.

Answer

Create an Azure Policy to deny over-privileged service principals.

Answer

Configure Microsoft Entra ID Conditional Access policies.

Question 14

Your organization uses Azure DevOps and requires that all pipelines enforce branch policy for pull requests. A developer creates a pipeline that builds and tests code on push to any branch. The security team wants to ensure that no code can be deployed to production without passing through a pull request with required reviewers. Which action should you take to meet this requirement?

Accepted Answer

Configure branch policy on the main branch to require a pull request with a minimum number of reviewers.. Azure DevOps branch policies enforce that all changes to the main branch must go through a pull request with required reviewers. This ensures no code can be deployed to production without passing through the defined review process, meeting the security team's requirement.

Answer

Disable CI triggers on the pipeline and require manual builds.

Answer

Modify the service connection to require admin approval.

Answer

Set the pipeline to require approval from the security team before running.

Question 15

Your company uses GitHub Enterprise and wants to implement a secret scanning policy to detect and block secrets (e.g., API keys) in code pushes. The policy must allow exceptions for test repositories that use fake secrets. What is the recommended approach?

Accepted Answer

Configure secret scanning with custom patterns and use the 'secret_scanning_push_protection' setting with an allow-list for test repositories.. GitHub Enterprise's secret scanning push protection can be configured with custom patterns and an allow-list (via the `secret_scanning_push_protection` setting in the repository's security settings or through the API). This allows you to block pushes containing secrets across all repositories while explicitly exempting test repositories that use fake secrets, meeting the requirement for exceptions without manual intervention.

Answer

Use a pre-commit hook to detect secrets and allow developers to bypass it.

Answer

Implement a GitHub Actions workflow that scans for secrets and fails the push.

Answer

Enable secret scanning for all repositories, then manually disable it for test repositories.