AZ-400 Develop a security and compliance plan Practice Test 8 — 15 Questions

Question 1

Your team uses Microsoft Defender for Cloud to monitor Azure resources. You need to ensure that all Azure DevOps pipelines are scanned for security misconfigurations before deployment. Which integration should you enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the 'Defender for DevOps' integration in Microsoft Defender for Cloud.. Microsoft Defender for Cloud includes a 'Defender for DevOps' integration that allows you to connect Azure DevOps environments and scan pipelines for security misconfigurations, such as Infrastructure as Code (IaC) template issues or exposed secrets, before deployment. This integration provides built-in security posture assessments and actionable recommendations directly within the Defender for Cloud dashboard, enabling shift-left security practices.

Answer

Connect Azure DevOps to Microsoft Sentinel.

Answer

Deploy Microsoft Intune policies to Azure DevOps agents.

Answer

Configure Microsoft Purview to scan Azure DevOps repositories.

Question 2

Your organization uses GitHub Actions and needs to enforce that only approved actions from the GitHub Marketplace can be used in workflows. Developers have been using custom actions from third-party repositories. What is the most effective way to control which actions are allowed?

Accepted Answer

Use the 'Allow actions created by GitHub and verified partners' policy and add specific actions to the allow list.. The 'Allow actions created by GitHub and verified partners' policy, combined with an explicit allow list, provides granular control over which actions can run in workflows. This approach blocks unverified third-party actions by default while permitting specific approved actions from the Marketplace, directly addressing the need to enforce only approved actions without unnecessarily restricting all third-party actions.

Answer

Create a manual approval process for each new action.

Answer

Set the organization to disallow all third-party actions.

Answer

Configure the organization to allow only actions created by GitHub.

Question 3

Your organization uses Microsoft Entra ID (formerly Azure AD) for identity management. You need to ensure that only authorized users can access the Azure DevOps organization. What is the most secure way to manage access?

Accepted Answer

Require all users to use multi-factor authentication (MFA) and enable Conditional Access policies.. Requiring multi-factor authentication (MFA) and enabling Conditional Access policies provides the most secure access control. MFA adds an extra layer of security beyond passwords, and Conditional Access allows granular policy enforcement based on user, device, location, and risk, ensuring only authorized users under secure conditions can access Azure DevOps. Option B is less secure as it does not enforce additional authentication. Option C only restricts access by network location but does not prevent unauthorized access if an attacker is on the corporate network. Option D only grants basic access without security controls.

Answer

Disable external user access and only allow internal users.

Answer

Use IP address restrictions to limit access to the corporate network.

Answer

Add users to the Azure DevOps organization and assign them to the 'Basic' access level.

Question 4

Your company uses GitHub and wants to implement a compliance framework that requires signed commits for all repositories. Developers use various IDEs and Git clients. What is the best way to enforce signed commits across the organization?

Accepted Answer

Enable 'Require signed commits' in the branch protection rules for the default branch.. GitHub allows repository administrators to enable 'Require signed commits' in branch protection rules. Option A is incorrect because it is not enforceable; commits can be unsigned. Option B is incorrect because it only encourages, not enforces. Option D is incorrect because it does not enforce signing.

Answer

Set the repository to 'Require pull request reviews before merging' and rely on reviewers to check commit signatures.

Answer

Ask developers to configure GPG keys and sign commits manually.

Answer

Use a GitHub Action that fails if commits are unsigned.

Question 5

Your team uses Azure Pipelines to deploy a web app to Azure App Service. You need to ensure that secrets (e.g., connection strings) are not exposed in the pipeline logs. What is the recommended approach?

Accepted Answer

Use secret pipeline variables and reference them in the pipeline.. Azure Pipelines supports secret pipeline variables that are masked in logs, preventing exposure of sensitive data like connection strings. When you mark a variable as secret, its value is automatically hidden from pipeline output, and you can reference it securely using $(variableName) syntax. This is the recommended approach for handling secrets directly within the pipeline without additional service dependencies.

Answer

Remove all logging from the pipeline.

Answer

Store secrets in Azure Key Vault and retrieve them in the pipeline, then log them for debugging.

Answer

Store secrets as environment variables in the pipeline.

Question 6

Your organization uses Microsoft Purview to classify and protect sensitive data. You need to ensure that source code in Azure DevOps repositories containing credit card numbers is detected and flagged. What should you configure?

Accepted Answer

Configure a Microsoft Purview Data Classification scan for Azure DevOps repositories.. Microsoft Purview Data Classification scans can be configured to scan Azure DevOps repositories for sensitive data types, such as credit card numbers, using built-in or custom sensitive information types. This allows the organization to detect and flag source code containing credit card numbers directly within the repository, aligning with the requirement to classify and protect sensitive data under a compliance plan.

Answer

Create a Data Loss Prevention (DLP) policy in Microsoft 365.

Answer

Set up Microsoft Sentinel to monitor Azure DevOps logs.

Answer

Enable Microsoft Defender for Cloud to scan repositories.

Question 7

Which TWO actions should you take to ensure that only approved pipelines can deploy to production in Azure DevOps? (Choose two.)

Accepted Answer

Configure a pipeline approval gate on the production environment.. Configuring a pipeline approval gate on the production environment ensures that every deployment to production requires explicit approval from designated reviewers, preventing unauthorized or unapproved pipelines from deploying. Option C is correct because setting branch policies to require a pull request before merging to the main branch enforces code review and validation, ensuring that only approved changes reach the main branch, which is typically the source for production deployments.

Answer

Disable parallel jobs for the project.

Answer

Limit the number of pipelines that can deploy from the main branch.

Answer

Use a single agent pool for all pipelines.

Question 8

Which TWO practices should you follow to ensure compliance with regulatory requirements (e.g., PCI DSS) when using Azure DevOps? (Choose two.)

Accepted Answer

Enable Azure DevOps audit logging to track changes to pipelines and policies.. Azure DevOps audit logging captures a detailed, immutable record of changes to pipelines, policies, and other critical resources, which is essential for demonstrating compliance with frameworks like PCI DSS that require evidence of who made what change and when. Audit logs can be exported to SIEM tools or retained for forensic analysis, satisfying the 'audit trail' requirement without manual intervention. Additionally, using branch policies enforces mandatory code reviews and approvals for changes, ensuring that all modifications go through a controlled, auditable process. Together, these practices provide both the immutable audit trail and the controlled change management required for regulatory compliance.

Answer

Manually track changes to pipelines in a spreadsheet.

Answer

Allow all users to create and modify pipelines without restrictions.

Answer

Disable audit logging to reduce storage costs.

Question 9

Your team uses GitHub Actions for CI/CD and must ensure that only approved contributors can merge code to the main branch. You need to enforce a policy where every pull request must be reviewed by at least two members of the security team. Which branch protection rule should you configure?

Accepted Answer

Require a minimum number of reviewers. The 'Require a minimum number of reviewers' branch protection rule in GitHub directly enforces that a specified number of reviewers must approve a pull request before it can be merged. By setting this minimum to two and restricting review permissions to the security team, you ensure that only approved security team members can authorize merges to the main branch, meeting the policy requirement.

Answer

Require pull request reviews before merging

Answer

Require status checks to pass before merging

Answer

Dismiss stale pull request approvals

Question 10

Your company is migrating to Microsoft Entra ID and needs to manage secrets used in Azure Pipelines. Which service should you use to securely store and rotate secrets?

Accepted Answer

Azure Key Vault. Azure Key Vault is the correct service to securely store and rotate secrets used in Azure Pipelines. It is natively integrated with Azure Pipelines via library variable groups, allowing secrets to be referenced in pipelines without exposing them. Option B, GitHub Secrets, is designed for GitHub Actions, not Azure Pipelines. Option C, Azure App Configuration, manages feature flags and configuration settings, not secrets. Option D, Microsoft Purview, is for data governance and compliance, not secret management.

Answer

GitHub Secrets

Answer

Azure App Configuration

Answer

Microsoft Purview

Question 11

Your Azure DevOps organization contains multiple teams. You need to ensure that code reviews require approval from a member of the security team before merging to the main branch. What is the best way to implement this?

Accepted Answer

Configure branch policies in Azure Repos. Configuring branch policies in Azure Repos (option D) is the correct approach because branch policies allow you to require specific reviewers—such as members of the security team—for pull requests targeting the main branch. This ensures that every merge to main must be approved by the security team. Option A is incorrect: Azure Pipelines is designed for continuous integration and delivery (CI/CD), not for enforcing code review requirements. Option B is incorrect: Microsoft Defender for Cloud focuses on cloud security posture management and threat protection, not on code review policies. Option C is incorrect: Microsoft Sentinel is a security information and event management (SIEM) tool for security analytics and threat intelligence, not for managing branch-level review policies.

Answer

Add a validation step in Azure Pipelines

Answer

Enable Microsoft Defender for Cloud

Answer

Deploy Microsoft Sentinel

Question 12

Your organization uses GitHub Advanced Security. A developer reports that a secret scanning alert for an Azure DevOps Personal Access Token (PAT) is a false positive. What should you do to handle this?

Accepted Answer

Mark the alert as false positive in the GitHub UI.. Marking the alert as a false positive in the GitHub UI closes the alert and helps train the detection algorithm for future scans. Option A is incorrect because disabling secret scanning entirely would stop detection for all secrets, which is not appropriate for a single false positive. Option B is incorrect because deleting the PAT might be necessary if it were real, but since it's a false positive, it is unnecessary and could break functionality. Option D is incorrect because ignoring the alert leaves it open and does not resolve the false positive.

Answer

Disable secret scanning for the repository.

Answer

Delete the PAT from the repository and revoke it.

Answer

Ignore the alert and leave it open.

Question 13

Your team uses Azure Pipelines to deploy to production. You need to ensure that deployment only proceeds if a security scan passes and a manual approval is obtained. What is the best approach?

Accepted Answer

Use release gates in release pipelines. Release gates in Azure Pipelines allow you to define automated checks (like security scans) and manual approvals before a deployment proceeds. Option A is incorrect because pipeline variables are used to store values, not to enforce deployment conditions. Option B is incorrect because service connections manage authentication to external services, not approval workflows. Option C is incorrect because branch policies apply to pull requests in repositories, not to release pipelines.

Answer

Add pipeline variables

Answer

Set up service connections

Answer

Configure branch policies

Question 14

Your organization is adopting DevSecOps and wants to integrate security scanning into the CI/CD pipeline. Which tool should you use to scan container images for vulnerabilities?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (Option C) is the correct tool for scanning container images for vulnerabilities in a CI/CD pipeline, as it integrates with Azure Container Registry to perform vulnerability assessments. Option A (Azure Monitor) is incorrect because it is a monitoring and observability service, not a security scanner. Option B (GitHub Copilot) is incorrect as it is an AI code completion tool. Option D (Azure Logic Apps) is incorrect because it is a workflow automation service, not a security scanning tool.

Answer

Azure Monitor

Answer

GitHub Copilot

Answer

Azure Logic Apps

Question 15

Your team uses GitHub Actions and needs to enforce that all workflows must use approved actions from a curated list. What is the best way to implement this?

Accepted Answer

Set up an allowed list of actions in organization settings. GitHub Organizations allow administrators to define an 'allowed list' of actions under Settings > Actions > Policies, restricting workflow execution to only approved actions from the curated list. This directly enforces the requirement that all workflows use only approved actions, preventing the use of unverified or malicious third-party actions.

Answer

Configure branch protection rules

Answer

Enable Dependabot alerts

Answer

Use OpenID Connect (OIDC)