AZ-400 Develop a security and compliance plan Practice Test 9 — 15 Questions

Question 1

Your organization requires compliance with SOC 2 and needs to audit all changes to Azure Pipelines. What should you enable?

Accepted Answer

Azure DevOps audit logs. Azure DevOps audit logs capture all changes to pipelines and can be exported for compliance with SOC 2. Option A is incorrect because Azure Policy enforces governance rules on Azure resources, not pipeline changes. Option B is incorrect because Microsoft Purview is a data governance service, not for auditing DevOps changes. Option C is incorrect because Azure Blueprints (now deprecated) were used to define repeatable Azure environments, not for audit logging.

Answer

Azure Policy

Answer

Microsoft Purview

Answer

Azure Blueprints

Question 2

Your team uses GitHub and wants to automatically detect exposed credentials in code. Which GitHub feature should you enable?

Accepted Answer

Secret scanning. Secret scanning is the correct answer because it is the GitHub feature specifically designed to automatically detect exposed credentials, such as API keys, tokens, and passwords, in code repositories. It scans for known patterns of secrets and can alert both the repository owner and the partner service (e.g., AWS, Azure) to revoke the compromised credential. This directly addresses the requirement to automatically detect exposed credentials in code.

Answer

Dependabot alerts

Answer

GitHub Copilot

Answer

Code scanning

Question 3

Your organization is implementing a security compliance plan for Azure DevOps. Which TWO actions should you take to ensure that only authorized users can modify build pipelines?

Accepted Answer

Configure branch policies to require reviews for changes to pipeline YAML files. Branch policies in Azure Repos enforce required reviews for changes to YAML pipeline files stored in the repository. This ensures that any modification to the pipeline definition must be approved by authorized reviewers before merging, preventing unauthorized or accidental changes. Option C is correct because pipeline permissions in Azure DevOps allow you to restrict editing of a pipeline to specific security groups (e.g., 'Build Administrators'), directly controlling who can modify the pipeline through the web interface or API.

Answer

Require all users to use Personal Access Tokens (PATs)

Answer

Enable audit logging for all pipeline changes

Answer

Enable OpenID Connect (OIDC) for pipeline authentication

Question 4

Your team uses Azure DevOps and needs to ensure that secrets are not exposed in pipeline logs. Which THREE practices should you implement?

Accepted Answer

Use logging commands to mask secrets in scripts. Azure DevOps provides a logging command, `##vso[task.setvariable variable=mySecret;isSecret=true]value`, which masks the variable's value in pipeline logs. This ensures that even if a script echoes the secret, it is replaced with asterisks, preventing accidental exposure during execution.

Answer

Enable pipeline log encryption

Answer

Store secrets in YAML variable files

Question 5

Your organization is adopting GitHub Advanced Security. Which THREE features should you enable to improve security?

Accepted Answer

Secret scanning. Secret scanning (Option C) is a GitHub Advanced Security feature that automatically detects exposed secrets (e.g., API keys, tokens, private keys) in repositories by matching against known patterns and partner-defined signatures. It helps prevent credential leaks from reaching production or being exploited, directly improving the security posture of your codebase.

Answer

GitHub Pages

Answer

Branch protection rules

Question 6

Your organization uses Azure DevOps with multiple teams. You are tasked with creating a security and compliance plan. The environment includes: Azure Repos for source control, Azure Pipelines for CI/CD, and Azure Artifacts for package management. Requirements: 1) All code changes to the main branch must be reviewed by at least one member of the security team. 2) Deployment to production requires approval from a manager. 3) Secrets must be stored securely and rotated every 90 days. 4) Pipeline logs must be retained for 1 year for audit purposes. You have configured branch policies requiring a minimum number of reviewers and mandatory security team review. For production deployments, you have added a manual approval gate. Secrets are stored in Azure Key Vault with automatic rotation. However, the audit team reports that pipeline logs are only retained for 30 days. You need to extend log retention to 1 year. What should you do?

Accepted Answer

In Azure DevOps project settings, navigate to Pipelines > Retention and releases, and set the retention policy to 365 days.. In Azure DevOps, pipeline retention policies for runs are configured at the project level under Project Settings > Pipelines > Retention and releases. Setting the retention to 365 days will keep pipeline run records and logs for one year. Option A is incorrect because exporting pipeline logs to Azure Blob Storage is not a built-in feature; pipeline logs are retained according to DevOps retention policies. Option B is incorrect because diagnostic settings in Azure Monitor stream Azure resource logs, not Azure DevOps pipeline logs. Option D is incorrect because audit logs capture events like changes to policies, not pipeline execution logs, and they have separate retention settings.

Answer

Export pipeline logs to Azure Blob Storage and set a lifecycle policy to retain for 365 days.

Answer

Configure diagnostic settings in Azure Monitor to stream pipeline logs to a Log Analytics workspace.

Answer

Enable Azure DevOps audit logs and export them to a Log Analytics workspace with a 365-day retention.

Question 7

Your team uses GitHub Enterprise and GitHub Actions for CI/CD. You need to implement a security compliance plan. The organization has the following requirements: 1) All code pushed to the main branch must be scanned for secrets and vulnerabilities. 2) Developers must use signed commits. 3) Only approved GitHub Actions can be used. 4) Dependencies must be scanned for vulnerabilities. You have enabled secret scanning and code scanning (CodeQL) on all repositories. You have configured branch protection rules to require signed commits using GPG keys. To restrict actions, you have set an allowed list of actions in the organization settings. You have enabled Dependabot alerts. However, during an audit, a reviewer notes that secret scanning alerts are not being reviewed within 30 days. You need to ensure that secret scanning alerts are triaged within 30 days. What should you do?

Accepted Answer

Assign secret scanning alerts to the security team using the 'Assign to' feature in the alerts view.. GitHub secret scanning allows you to assign alerts to specific team members using the 'Assign to' feature in the alerts view. This ensures that alerts are explicitly owned and triaged within the 30-day requirement. Option B is incorrect because webhooks merely send notifications; they do not guarantee that someone will review and triage the alert. Option C is incorrect because disabling secret scanning on any repository would violate the requirement to scan all code pushed to main branch. Option D is incorrect because automatically closing alerts after 30 days could hide legitimate secrets that require investigation, which fails the security compliance goal.

Answer

Set up a webhook to send secret scanning alerts to a security team's email.

Answer

Disable secret scanning on repositories that do not contain secrets.

Answer

Configure secret scanning to automatically close alerts after 30 days.

Question 8

Your team is adopting a shift-left security approach in Azure Pipelines. They want to automatically detect secrets, such as API keys or connection strings, in source code before code is committed. Which Azure DevOps feature should be configured to scan pull requests for secrets and block the PR if any are found?

Accepted Answer

Secret Scanning. Azure DevOps Secret Scanning is the built-in feature that automatically detects secrets in Azure Repos and can block pull requests when secrets are found. While a Credential Scanner task can also be added to a pipeline, Secret Scanning is the native feature designed for this purpose and is the correct answer. Options A and C are unrelated, and B is a pipeline task, not the primary Azure DevOps feature.

Answer

Azure Policy for Repos

Answer

Credential Scanner task in pipeline

Answer

Dependency Scanning

Question 9

Your organization uses Microsoft Defender XDR to secure Azure DevOps pipelines. You need to ensure that any build pipeline triggered by a pull request automatically runs a security scan and fails if critical vulnerabilities are found. What should you configure?

Accepted Answer

Branch protection rule with required status check. Branch protection rules in Azure Repos or GitHub can require a status check from a build pipeline. By configuring a required status check that runs a security scan, the pull request cannot be merged if the scan fails. Option A (Code scanning alerts in GitHub) is for identifying vulnerabilities in code, not blocking merges based on pipeline results. Option B (Azure Policy for Pipelines) enforces governance on Azure resources, not pipeline security scans. Option D (Pipeline security gate) is not a feature in Azure DevOps.

Answer

Code scanning alerts in GitHub

Answer

Azure Policy for Pipelines

Answer

Pipeline security gate

Question 10

Your team uses GitHub Copilot for code suggestions. To comply with your organization's data protection policies, you need to ensure that code snippets and prompts sent to Copilot are not stored or used by Microsoft for service improvement. What should you configure?

Accepted Answer

Enable the 'Data Exclusion' setting in Copilot's enterprise settings. GitHub Copilot's enterprise settings include a 'Data Exclusion' feature that, when enabled, prevents Microsoft from storing or using your code snippets and prompts for service improvement. This directly addresses the data protection policy requirement by ensuring that your organization's code is not retained or analyzed by Microsoft beyond the immediate suggestion generation.

Answer

Set a compliance grade in Microsoft Defender for Cloud

Answer

Apply a Microsoft Purview Data Loss Prevention policy

Answer

Configure Azure OpenAI Service content filtering

Question 11

Your team is using GitHub Enterprise and wants to ensure that every pull request includes a link to a work item in Azure Boards. Which GitHub Apps or Azure DevOps Services integration should you configure?

Accepted Answer

GitHub-Azure Boards integration. The GitHub-Azure Boards integration is the correct choice because it connects GitHub repositories to Azure Boards, automatically linking commits and pull requests to work items when they mention an Azure Boards ID (e.g., 'AB#1234'). However, it does not enforce that every PR must include such a link. To enforce this, you would need an additional validation tool or branch protection rule, but among the given options, this is the only integration that provides the linking capability.

Answer

Azure Repos branch policy

Answer

Azure DevOps OAuth app

Answer

Azure Pipelines GitHub App

Question 12

Which TWO actions should you take to ensure that Azure Pipelines artifacts are securely stored and access is audited?

Accepted Answer

Enable Azure Artifacts retention policies to automatically delete old artifact versions. Azure Artifacts retention policies allow you to automatically delete older versions of packages, reducing the attack surface and ensuring that only current, approved artifacts are stored. This is a key security practice to prevent outdated or vulnerable artifacts from being accessed. Option E is correct because enabling audit logging for artifact downloads via Azure DevOps audit logs provides a detailed, immutable record of who accessed which artifact and when, which is essential for compliance and security investigations.

Answer

Configure the storage account firewall to only allow access from Azure Pipelines IP ranges

Answer

Use Azure Policy to enforce that artifacts are only deployed to production storage accounts

Answer

Enable customer-managed keys (CMK) for artifact encryption

Question 13

Which THREE measures should you implement to protect secrets (e.g., API keys, passwords) used in Azure Pipelines?

Accepted Answer

Mark variables as 'Secret' in pipeline YAML or UI definitions. To protect secrets like API keys and passwords in Azure Pipelines, you should implement three key measures. First, mark variables as 'Secret' in pipeline YAML or UI definitions (Option B). This prevents the secret from being displayed in logs or output. Second, use service connections with managed identity instead of personal access tokens (Option D). Managed identities eliminate the need to store credentials and reduce secret exposure. Third, store secrets in Azure Key Vault and reference them via a Key Vault task (Option E). This centralizes secret management and allows fine-grained access control. Option A is incorrect because storing secrets as plain text in a Git repo, even with restricted access, is insecure—secrets should never be committed to source control. Option C is incorrect because environment variables are not encrypted by default and can be exposed in logs or to other pipeline tasks, making them unsafe for secret passing.

Answer

Store secrets as plain text in a secure Git repo with restricted access

Answer

Use environment variables in the pipeline to pass secrets at runtime

Question 14

Which TWO compliance frameworks are directly supported by Microsoft Purview Compliance Manager for Azure DevOps?

Accepted Answer

ISO 27001. Microsoft Purview Compliance Manager directly supports ISO 27001 and SOC 2 as built-in compliance templates for Azure DevOps. These frameworks are pre-configured with control mappings, assessment templates, and automated testing actions that align with Azure DevOps security and audit capabilities. This allows organizations to continuously monitor and manage compliance posture against these standards without manual configuration.

Answer

HIPAA

Answer

PCI DSS

Answer

FedRAMP High

Question 15

Refer to the exhibit. You are reviewing the branch policies for the main branch in Azure Repos. The team reports that while the branch naming policy works, the approval policy does not block pull requests when only one person approves. What is the most likely cause?

Accepted Answer

The policy is not applied to the main branch. Option B is correct. If the minimum approver count policy is configured for a branch other than `main` (or is scoped to a different branch pattern), it will not apply to pull requests targeting `main`. The branch naming policy works because that is a repository-level setting that applies to all branches. There is no 'project-level' branch policy override in Azure Repos; branch policies are scoped to specific branches or patterns, and if multiple policies apply, all must be satisfied. A separate policy on main that allows one approval would not override an all-branches policy requiring two approvals — the stricter policy would still block. Therefore, the cause must be that the approval policy simply does not apply to main.

Answer

The policy is disabled in the settings

Answer

The main branch has a separate branch policy override that allows one approval

Answer

The 'creatorVoteCounts' setting is false, so the creator's approval is not counted