AZ-400 Develop a security and compliance plan Practice Test 9 — 15 Questions

Question 1

Your team uses GitHub Enterprise and GitHub Actions for CI/CD. You need to implement a security compliance plan. The organization has the following requirements: 1) All code pushed to the main branch must be scanned for secrets and vulnerabilities. 2) Developers must use signed commits. 3) Only approved GitHub Actions can be used. 4) Dependencies must be scanned for vulnerabilities. You have enabled secret scanning and code scanning (CodeQL) on all repositories. You have configured branch protection rules to require signed commits using GPG keys. To restrict actions, you have set an allowed list of actions in the organization settings. You have enabled Dependabot alerts. However, during an audit, a reviewer notes that secret scanning alerts are not being reviewed within 30 days. You need to ensure that secret scanning alerts are triaged within 30 days. What should you do?

Accepted Answer

Assign secret scanning alerts to the security team using the 'Assign to' feature in the alerts view.. Option D is correct because GitHub secret scanning alerts can be assigned to specific teams for triage, ensuring accountability. Option A is wrong because auto-closing alerts may miss genuine secrets. Option B is wrong because disabling secret scanning is counterproductive. Option C is wrong because webhooks are for notifications, not triage assurance.

Answer

Set up a webhook to send secret scanning alerts to a security team's email.

Answer

Disable secret scanning on repositories that do not contain secrets.

Answer

Configure secret scanning to automatically close alerts after 30 days.

Question 2

Your team is adopting a shift-left security approach in Azure Pipelines. They want to automatically detect secrets, such as API keys or connection strings, in source code before code is committed. Which Azure DevOps feature should be configured to scan pull requests for secrets and block the PR if any are found?

Accepted Answer

Secret Scanning. Option D (Secret Scanning) is correct because GitHub Advanced Security (GHAS) provides secret scanning that can be configured to run on pull requests and block PRs containing secrets. Option A (Azure Policy) is for Azure resource compliance, not code-level scanning. Option B (Credential Scanner) is a legacy tool that is not directly integrated into PR gates. Option C (Dependency Scanning) identifies vulnerable dependencies, not secrets.

Answer

Azure Policy for Repos

Answer

Credential Scanner task in pipeline

Answer

Dependency Scanning

Question 3

Your organization uses Microsoft Defender XDR to secure Azure DevOps pipelines. You need to ensure that any build pipeline triggered by a pull request automatically runs a security scan and fails if critical vulnerabilities are found. What should you configure?

Accepted Answer

Branch protection rule with required status check. Option B (Branch protection rule with status check) is correct because you can add a required status check that runs a security scan pipeline, and the PR cannot be merged if the check fails. Option A is for Azure resources, not pipelines. Option C is for code scanning in GitHub, not Azure Pipelines. Option D is not a real feature.

Answer

Code scanning alerts in GitHub

Answer

Azure Policy for Pipelines

Answer

Pipeline security gate

Question 4

Your team uses GitHub Copilot for code suggestions. To comply with your organization's data protection policies, you need to ensure that code snippets and prompts sent to Copilot are not stored or used by Microsoft for service improvement. What should you configure?

Accepted Answer

Enable the 'Data Exclusion' setting in Copilot's enterprise settings. Option A (Enable the 'Data Exclusion' setting in Copilot's enterprise settings) is correct because GitHub Copilot for Business provides a data exclusion setting that prevents Microsoft from storing or using code snippets. Option B is for Azure OpenAI, not Copilot. Option C is a generic compliance setting. Option D is for Azure DevOps, not GitHub Copilot.

Answer

Set a compliance grade in Microsoft Defender for Cloud

Answer

Apply a Microsoft Purview Data Loss Prevention policy

Answer

Configure Azure OpenAI Service content filtering

Question 5

You are designing a security compliance plan for Azure Pipelines. The plan must ensure that all pipelines: (1) run on Microsoft-hosted agents in a specific geo-region, (2) use approved Docker images from a private Azure Container Registry, and (3) enforce that pipeline variables containing secrets are never logged. Which combination of Azure DevOps features should you use?

Accepted Answer

Agent pools with geo-filtering, Azure Policy for Repos to restrict image sources, and secret variables with 'Logging command' disabled. Option D (Agent pools with geo-filtering, Azure Policy for Repos to restrict image sources, and secret variables with 'Logging command' disabled) is correct. Agent pools can be scoped to a specific geography. Azure Policy for Repos can enforce that pipelines only use approved container registries. Secret variables in Azure Pipelines have an option to 'Allow at runtime' and can be marked as secret to prevent logging. Option A uses Azure Policy for Pipelines (not a real feature). Option B's compliance gates are for release pipelines, not build. Option C's Access reviews are for user permissions, not image sources.

Answer

Compliance gates in release pipelines, service connections, and audit logs

Answer

Entra ID Conditional Access, Azure Container Registry firewall, and pipeline decorators

Answer

Azure Policy for Pipelines, secret variables, and geo-restricted agent pools

Question 6

Your organization uses Microsoft Defender XDR for security monitoring. You need to configure an alert that fires whenever a user with high privileges (e.g., Project Collection Administrators) is added to an Azure DevOps group. What is the most efficient approach?

Accepted Answer

Create a custom detection rule in Microsoft Defender XDR using the Azure DevOps identity provider logs. Option C (Create a custom detection rule in Microsoft Defender XDR using the Azure DevOps identity provider logs) is correct because Defender XDR can ingest Azure DevOps audit logs and create custom detections for specific activities. Option A is not efficient for real-time alerting. Option B is for Azure, not Azure DevOps. Option D is for compliance, not real-time alerting.

Answer

Set up a Microsoft Purview compliance policy for Azure DevOps

Answer

Run a weekly Azure DevOps audit log query manually

Answer

Configure a Log Analytics workspace with Azure Activity Logs

Question 7

Your team is using GitHub Enterprise and wants to ensure that every pull request includes a link to a work item in Azure Boards. Which GitHub Apps or Azure DevOps Services integration should you configure?

Accepted Answer

GitHub-Azure Boards integration. Option B (GitHub-Azure Boards integration) is correct because this official integration enforces linking work items to PRs. Option A is for Azure Repos. Option C is for Azure Pipelines. Option D is a generic term, not a specific integration.

Answer

Azure Repos branch policy

Answer

Azure DevOps OAuth app

Answer

Azure Pipelines GitHub App

Question 8

Which TWO actions should you take to ensure that Azure Pipelines artifacts are securely stored and access is audited?

Accepted Answer

Enable Azure Artifacts retention policies to automatically delete old artifact versions. Option B and Option E are correct. Option B (Enable Azure Artifacts retention policies) ensures old artifacts are removed, reducing attack surface. Option E (Configure audit logging for artifact downloads) provides audit trail. Option A is wrong because Azure Pipelines does not support storage account firewall for artifacts. Option C is wrong because artifacts are already encrypted at rest. Option D is wrong because artifacts are not deployed to production via storage accounts.

Answer

Configure the storage account firewall to only allow access from Azure Pipelines IP ranges

Answer

Use Azure Policy to enforce that artifacts are only deployed to production storage accounts

Answer

Enable customer-managed keys (CMK) for artifact encryption

Question 9

Which THREE measures should you implement to protect secrets (e.g., API keys, passwords) used in Azure Pipelines?

Accepted Answer

Mark variables as 'Secret' in pipeline YAML or UI definitions. Option A, Option C, and Option D are correct. Option A (Use Azure Key Vault to store secrets) is a best practice. Option C (Mark variables as 'Secret' in pipeline definitions) prevents secrets from being exposed in logs. Option D (Use service connections with managed identity instead of personal access tokens) reduces secret exposure. Option B is wrong because storing secrets in Git is insecure. Option E is wrong because environment variables are not encrypted by default.

Answer

Store secrets as plain text in a secure Git repo with restricted access

Answer

Use environment variables in the pipeline to pass secrets at runtime

Question 10

Which TWO compliance frameworks are directly supported by Microsoft Purview Compliance Manager for Azure DevOps?

Accepted Answer

ISO 27001. Option A and Option D are correct. Option A (SOC 2) and Option D (ISO 27001) are included in Purview Compliance Manager templates. Option B (PCI DSS) is not directly mapped to Azure DevOps in Purview. Option C (FedRAMP High) is for Azure infrastructure, not Azure DevOps specifically. Option E (HIPAA) is not directly mapped to Azure DevOps in Purview.

Answer

HIPAA

Answer

PCI DSS

Answer

FedRAMP High

Question 11

Refer to the exhibit. You are reviewing the branch policies for the main branch in Azure Repos. The team reports that while the branch naming policy works, the approval policy does not block pull requests when only one person approves. What is the most likely cause?

Accepted Answer

The main branch has a separate branch policy override that allows one approval. Option C (The policy is applied to all branches, but the main branch has a separate override) is correct. The exhibit shows policies defined at the project level, but branch policies for the main branch might have been explicitly set to override the project-level policy. Option A is wrong because the policy is enabled. Option B is wrong because the policy is set to require minimum 2 approvals, so it should block. Option D is wrong because creator vote counts being false means the creator's vote is not counted, which doesn't affect the approval count.

Answer

The policy is disabled in the settings

Answer

The policy is not applied to the main branch

Answer

The 'creatorVoteCounts' setting is false, so the creator's approval is not counted

Question 12

Refer to the exhibit. You executed the Azure CLI command to list variable groups. A security audit requires that all variable groups containing secrets are configured to be authorized for all pipelines. Which statement is true based on the output?

Accepted Answer

The variable group 'ProdVars' contains a secret variable, but the output does not indicate whether it is authorized for all pipelines. Option B (The variable group 'ProdVars' contains a secret variable, but the output does not indicate whether it is authorized for all pipelines) is correct. The JSON output does not include an 'authorize' property; you need to check the group's settings separately. Option A is wrong because the ApiKey value is null (masked). Option C is wrong because you cannot tell from this output if it's authorized. Option D is wrong because the secret is shown as null, not exposed.

Answer

The variable group 'ProdVars' is not authorized for all pipelines because no such property exists

Answer

The variable group 'ProdVars' has exposed the secret value in the output

Answer

The variable group 'ProdVars' is authorized for all pipelines because it has secret variables

Question 13

You are a security engineer for a large financial institution. The organization uses Azure DevOps with multiple projects, each containing hundreds of pipelines. The security team recently discovered that several pipeline variables marked as 'Secret' were inadvertently printed to logs due to a custom script task that echoed the variable. Consequently, the compliance officer requires that all secrets used in pipelines must be centrally managed in Azure Key Vault, and any pipeline that references a variable not from Key Vault must be blocked from running. Additionally, the solution must minimize administrative overhead and provide real-time enforcement across all projects in the organization. You have the following options:

Option A: Create an Azure Policy definition that audits pipelines for the use of non-Key Vault variables and attach it to the management group containing the Azure DevOps resources.

Option B: Develop a custom pipeline task that checks at runtime whether all secret variables originate from Key Vault, and add it to every pipeline YAML file manually.

Option C: Configure a pipeline decorator in the organization settings that injects a task at the beginning of every pipeline to validate that all secret variables are linked to Key Vault, and fail the pipeline if any are not.

Option D: Use Azure DevOps Audit Logs to periodically review pipeline runs and manually identify pipelines that use non-Key Vault secrets.

Which option meets the requirements most effectively?

Accepted Answer

Configure a pipeline decorator in the organization settings that injects a task at the beginning of every pipeline to validate that all secret variables are linked to Key Vault. Option C (Configure a pipeline decorator) is correct because it provides real-time enforcement at the organization level with minimal overhead. Option A is wrong because Azure Policy does not apply to Azure DevOps pipeline configurations. Option B is wrong because manual addition to each pipeline is high overhead and error-prone. Option D is wrong because it is reactive and does not block non-compliant runs.

Answer

Develop a custom pipeline task that checks at runtime whether all secret variables originate from Key Vault

Answer

Create an Azure Policy definition that audits pipelines for the use of non-Key Vault variables

Answer

Use Azure DevOps Audit Logs to periodically review pipeline runs

Question 14

Your company is migrating from on-premises TFS to Azure DevOps Services in the cloud. The security policy mandates that all access to Azure DevOps must go through a conditional access policy that requires multi-factor authentication (MFA) for users outside the corporate network. Additionally, the policy requires that service accounts (used for automated deployments) must use device-based authentication and cannot be interactive. You are configuring Microsoft Entra ID (formerly Azure AD) conditional access. The Azure DevOps organization is connected to the corporate Entra ID tenant. You have the following options:

Option A: Create a conditional access policy that applies to all users and service principals, requiring MFA for all cloud apps, and exclude the Azure DevOps app from the policy.

Option B: Create a conditional access policy that targets the Azure DevOps app, grant access requiring MFA for all users, and create a separate policy for service accounts that requires device compliance.

Option C: Create a conditional access policy that applies to the Azure DevOps app, requiring MFA for all users, and exclude service accounts by user group. Then create a separate policy for service accounts that requires a compliant device.

Option D: Use Azure DevOps IP address restrictions to block external traffic and rely on VPN for external users.

Which option best meets the requirements?

Accepted Answer

Create a conditional access policy that applies to the Azure DevOps app, requiring MFA for all users, and exclude service accounts by user group. Then create a separate policy for service accounts that requires a compliant device. Option C is correct. It correctly applies MFA to all users except service accounts, and uses device compliance for service accounts. Option A excludes the Azure DevOps app, which would not enforce MFA. Option B applies MFA to service accounts as well, which is not allowed for automated accounts. Option D does not provide MFA and is less secure.

Answer

Create a conditional access policy that applies to all users and service principals, requiring MFA for all cloud apps, and exclude the Azure DevOps app

Answer

Create a conditional access policy that targets the Azure DevOps app, grant access requiring MFA for all users, and create a separate policy for service accounts that requires device compliance

Answer

Use Azure DevOps IP address restrictions to block external traffic and rely on VPN for external users

Question 15

Your development team uses GitHub Enterprise with GitHub Actions for CI/CD. The security team wants to ensure that all secrets used in workflows are stored in GitHub Secrets and that they are not accessible to forked repositories. Currently, some workflows reference secrets directly in YAML files. You need to implement a solution that meets the following requirements: (1) Secrets must be stored in GitHub Secrets, not in YAML files. (2) Workflows triggered from forked repositories must not have access to organization secrets. (3) Auditors must be able to see which workflows access which secrets.

Option A: Move all secrets to GitHub Secrets, configure the repository to require approval for all external contributions, and enable audit logging for secret usage.

Option B: Move all secrets to GitHub Secrets, and in the repository settings, disable 'Allow GitHub Actions to create and approve pull requests' and enable 'Fork pull request workflows from outside collaborators' to require approval.

Option C: Move all secrets to GitHub Secrets, and in the organization settings, enable 'Private repository fork policy' to only allow forks from within the organization, and use environment secrets with required reviewers.

Option D: Move all secrets to GitHub Secrets, and for each workflow that uses secrets, add a condition to check if the event is from a fork, and if so, skip the step.

Which option best satisfies all requirements?

Accepted Answer

Move all secrets to GitHub Secrets, configure the repository to require approval for all external contributions, and enable audit logging for secret usage. Option A is correct. By moving secrets to GitHub Secrets, they are not in YAML. Requiring approval for external contributions ensures forked repos do not get access to secrets (since secrets are not passed to workflows triggered by pull requests from forks unless explicitly approved). Audit logging tracks secret usage. Option B does not address fork access to secrets. Option C restricts forks but does not prevent secret exposure if a fork is made. Option D is a workaround but not a policy-level solution.

Answer

Move all secrets to GitHub Secrets, and for each workflow that uses secrets, add a condition to check if the event is from a fork, and if so, skip the step

Answer

Move all secrets to GitHub Secrets, and in the repository settings, disable 'Allow GitHub Actions to create and approve pull requests' and enable 'Fork pull request workflows from outside collaborators' to require approval

Answer

Move all secrets to GitHub Secrets, and in the organization settings, enable 'Private repository fork policy' to only allow forks from within the organization, and use environment secrets with required reviewers