AZ-400 Develop a security and compliance plan Practice Test 8 — 15 Questions

Question 1

You receive a GitHub Dependabot alert as shown. The repository 'my-app' is internal. What is the best immediate action to mitigate the risk?

Accepted Answer

Update the lodash dependency to the latest patched version. The Dependabot alert indicates a known vulnerability in the lodash dependency. The best immediate action is to update lodash to the latest patched version, which directly resolves the security issue by applying the fix provided by the maintainers. This aligns with the principle of remediating vulnerabilities at the source rather than implementing workarounds.

Answer

Dismiss the alert as it is a false positive

Answer

Create a private fork of the repository

Answer

Enable secret scanning on the repository

Question 2

Your organization is implementing a security compliance plan for Azure DevOps. Which TWO actions help enforce the principle of least privilege?

Accepted Answer

Use Azure DevOps security groups to grant minimal permissions. Option B is correct because Azure DevOps security groups (such as Project Administrators, Contributors, or custom groups) let you assign only the specific permissions each team needs, directly implementing least privilege instead of granting broad access. Option D is correct because restricting agent pool creation to a small admin team limits a powerful, organization- or project-level capability (managing agent pools and their security) to the few users who require it, reducing the attack surface. Option A is wrong because allowing all team members to edit security permissions grants everyone the ability to change ACLs, which violates least privilege. Option C is wrong because using built-in roles without customizing can over-grant permissions, since built-in roles often include more rights than a given user needs. Option E is wrong because Project Collection Administrators is the highest-privilege group in Azure DevOps and should be tightly limited, not assigned to all developers.

Answer

Allow all team members to edit security permissions

Answer

Use built-in roles without customizing

Answer

Grant Project Collection Administrators group to all developers

Question 3

A company uses Microsoft Defender for Cloud to assess the security posture of Azure Pipelines agents. They notice that self-hosted agents are flagged as having high-severity vulnerabilities. What is the recommended action to remediate these findings while minimizing downtime?

Accepted Answer

Apply the security updates recommended by Microsoft Defender for Cloud to the agent VMs.. Microsoft Defender for Cloud identifies vulnerabilities on the VMs hosting self-hosted Azure Pipelines agents and provides specific security update recommendations. Applying these updates directly remediates the high-severity findings without requiring agent replacement or disabling security monitoring, thus minimizing downtime by patching in-place.

Answer

Disable Microsoft Defender for Cloud for the agent pool.

Answer

Uninstall the self-hosted agents and use only Microsoft-hosted agents.

Answer

Replace all self-hosted agents with Microsoft-hosted agents.

Question 4

Your organization requires that all code changes be signed using a valid code signing certificate before they can be merged. Which feature in GitHub should you enable to enforce this?

Accepted Answer

Commit signature verification.. GitHub's commit signature verification uses GPG, SSH, or S/MIME keys to cryptographically sign commits and tags, and branch protection/rulesets can require signed commits before merging. This enforces that all code changes carry a verified signature tied to a trusted identity.

Answer

Dependabot.

Answer

Code scanning.

Answer

Secret scanning.

Question 5

You are designing a security compliance plan for Azure Pipelines. The plan must ensure that no pipeline can use variables containing secrets unless those variables are stored in Azure Key Vault and referenced via a variable group linked to Key Vault. What is the best way to enforce this across all pipelines in an Azure DevOps organization?

Accepted Answer

Create a YAML template that mandates the use of Key Vault references.. You can enforce a YAML template at the organization level using required template policies. This ensures all pipelines include a template that mandates Key Vault references for secrets, providing a scalable enforcement mechanism. Option B is incorrect because Azure Policy applies to Azure resources, not Azure DevOps constructs like variable groups. Option C is incorrect because manual approvals do not enforce Key Vault usage. Option D is incorrect because branch policies control code, not variable usage during execution.

Answer

Implement an Azure Policy that audits variable groups and requires Key Vault integration.

Answer

Require manual approval for all pipeline runs that use variables.

Answer

Use branch policies to prevent merging code that contains secrets.

Question 6

Your team uses Azure DevOps and wants to automatically scan pull requests for secrets before they are merged. Which Azure DevOps feature should you use?

Accepted Answer

GitHub Advanced Security.. GitHub Advanced Security (GHAS) for Azure DevOps provides secret scanning that automatically detects secrets (e.g., API keys, passwords, connection strings) in pull requests before they are merged. This feature is integrated into Azure Repos when Advanced Security is enabled and triggers on PR creation, blocking the merge if secrets are found. Therefore, the correct choice is GitHub Advanced Security, not a separate 'Secret scanning in Azure DevOps' feature, which does not exist as a native built-in feature.

Answer

Azure Policy.

Answer

Secret scanning in Azure DevOps.

Answer

Branch policy with a required reviewer.

Question 7

Your company uses Microsoft Defender for Cloud to monitor Azure DevOps environments. You receive an alert that a service principal has excessive permissions. What is the first step you should take to investigate and remediate?

Accepted Answer

Review the Microsoft Entra ID audit logs for the service principal.. Reviewing the Microsoft Entra ID audit logs is the correct first step because it allows you to investigate the service principal's activity, such as which resources it accessed, when, and from where, before taking any remediation action. This forensic analysis is essential to understand the scope of the excessive permissions and to ensure that reducing permissions or other actions do not inadvertently disrupt legitimate operations. Without this step, you risk breaking functionality or missing evidence of misuse.

Answer

Reduce the service principal's permissions to the minimum required.

Answer

Immediately delete the service principal.

Answer

Reset the service principal's credentials.

Question 8

Your team uses GitHub and wants to automatically detect exposed credentials in code. Which GitHub feature should you enable?

Accepted Answer

Secret scanning.. Secret scanning is the correct GitHub feature because it is specifically designed to automatically detect exposed credentials, tokens, and other secrets in code repositories. It scans for known patterns of sensitive data, such as AWS keys, GitHub tokens, and private keys, and alerts repository administrators when a match is found. This directly addresses the requirement to detect exposed credentials without needing custom workflows or additional configuration.

Answer

Code scanning.

Answer

Dependabot.

Answer

GitHub Actions.

Question 9

You are reviewing an Azure Policy definition that denies pipeline creation if the pipeline template path is not '/pipeline-templates/my-template.yml'. What does this policy do?

Accepted Answer

Denies any pipeline that does not use a specific YAML template.. This Azure Policy definition uses a 'deny' effect with a condition that checks whether the pipeline references a specific YAML template. If the pipeline does not reference that template, the policy denies the pipeline creation or update. Option D is correct because the policy explicitly denies any pipeline that does not use the specified YAML template, enforcing compliance by blocking non-compliant pipelines.

Answer

Denies pipelines that use an outdated template version.

Answer

Allows only pipelines that use a specific YAML template.

Answer

Allows only pipelines in the pipeline-templates folder.

Question 10

You are analyzing Azure DevOps audit logs with the KQL query above. Your security team wants to ensure that only approved service connections are used. After running the query, you find multiple service connections created by a user who is not on the approved list. What should you do next?

Accepted Answer

Review each unapproved service connection's permissions and usage.. The immediate priority is to assess the risk of each unapproved service connection before taking action. Service connections in Azure DevOps can have varying permissions and may be used by pipelines, so blindly deleting them could break critical deployments. The correct next step is to review each connection's permissions (e.g., who can use it, which service principals are linked) and its usage history (e.g., which pipelines reference it) to determine whether it is malicious or simply an oversight.

Answer

Immediately delete all service connections created by that user.

Answer

Disable the user's account in Microsoft Entra ID.

Answer

Modify the query to also include the user's email address.

Question 11

You are reviewing a pipeline YAML file. The variable 'prod-db-password' is stored in a variable group linked to Azure Key Vault. However, the pipeline fails with an error that the secret cannot be accessed. What is the most likely cause?

Accepted Answer

The pipeline's authorized service principal lacks 'Get' permission on the Key Vault.. The most likely cause is that the pipeline's authorized service principal lacks 'Get' permission on the Key Vault. When a variable group is linked to Azure Key Vault, Azure Pipelines uses a service principal (the pipeline's identity) to retrieve secrets. Even if the variable group and secret name are correct, the pipeline will fail if the service principal does not have the 'Get' secret permission in the Key Vault access policy. This is a common misconfiguration because the variable group link only establishes the mapping, not the actual access rights.

Answer

The YAML syntax for referencing the variable is incorrect.

Answer

The variable group 'prod-variables' does not exist.

Answer

The secret name in Key Vault does not match 'prod-db-password'.

Question 12

Your organization is adopting GitHub Copilot and wants to ensure that no proprietary code is used to train models. Which setting should you configure in the GitHub organization?

Accepted Answer

Opt out of allowing GitHub to use code snippets for product improvement.. GitHub provides an organization-level setting to opt out of allowing GitHub to use code snippets for product improvement, which prevents Copilot from training on that code. Option A is incorrect because secret scanning is unrelated to model training. Option B is incorrect because Dependabot alerts focus on dependency vulnerabilities, not data usage. Option C is incorrect because disabling Copilot prevents its use but does not address the underlying data usage for training; the organization may still want to use Copilot while preventing training on proprietary code.

Answer

Enable secret scanning.

Answer

Enable Dependabot alerts.

Answer

Disable GitHub Copilot for the organization.

Question 13

You are using Microsoft Defender for Cloud to secure Azure Pipelines. You need to receive alerts when a pipeline run uses a service principal with excessive permissions. Which feature should you enable?

Accepted Answer

Enable Microsoft Defender for Cloud's identity and access monitoring.. Microsoft Defender for Cloud's identity and access monitoring continuously assesses the permissions of service principals used in Azure Pipelines and generates alerts when it detects over-privileged or anomalous usage. This feature is specifically designed to identify excessive permissions in real-time, enabling proactive security responses without manual log review or policy enforcement.

Answer

Enable Azure DevOps audit logs and review them manually.

Answer

Create an Azure Policy to deny over-privileged service principals.

Answer

Configure Microsoft Entra ID Conditional Access policies.

Question 14

Your organization uses Azure DevOps and requires that all pipelines enforce branch policy for pull requests. A developer creates a pipeline that builds and tests code on push to any branch. The security team wants to ensure that no code can be deployed to production without passing through a pull request with required reviewers. Which action should you take to meet this requirement?

Accepted Answer

Configure branch policy on the main branch to require a pull request with a minimum number of reviewers.. Azure DevOps branch policies enforce that all changes to the main branch must go through a pull request with required reviewers. This ensures no code can be deployed to production without passing through the defined review process, meeting the security team's requirement.

Answer

Disable CI triggers on the pipeline and require manual builds.

Answer

Modify the service connection to require admin approval.

Answer

Set the pipeline to require approval from the security team before running.

Question 15

Your company uses GitHub Enterprise and wants to implement a secret scanning policy to detect and block secrets (e.g., API keys) in code pushes. The policy must allow exceptions for test repositories that use fake secrets. What is the recommended approach?

Accepted Answer

Configure secret scanning with custom patterns and use the 'secret_scanning_push_protection' setting with an allow-list for test repositories.. GitHub Enterprise's secret scanning push protection can be configured with custom patterns and an allow-list (via the `secret_scanning_push_protection` setting in the repository's security settings or through the API). This allows you to block pushes containing secrets across all repositories while explicitly exempting test repositories that use fake secrets, meeting the requirement for exceptions without manual intervention.

Answer

Use a pre-commit hook to detect secrets and allow developers to bypass it.

Answer

Implement a GitHub Actions workflow that scans for secrets and fails the push.

Answer

Enable secret scanning for all repositories, then manually disable it for test repositories.