20+ practice questions focused on Develop a security and compliance plan — one of the most tested topics on the Microsoft Azure DevOps Engineer Expert AZ-400 exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Develop a security and compliance plan PracticeA company uses Azure DevOps and requires that all pipeline runs are audited and that sensitive information (e.g., passwords, keys) is never exposed in logs. Which TWO actions should you take? (Choose TWO.)
Explanation: Secret pipeline variables are the primary method to prevent sensitive information from being exposed in logs; Azure DevOps automatically masks their values. Option A is incorrect because setting 'Logging command' to 'ignore' only disables processing of special logging commands like ##vso[task.setvariable]; script output is still captured and could contain secrets. Option B is incorrect because variable groups do not automatically mask secrets; you must use secret variables. Option C is incorrect because read-only scope does not protect secrets in logs. Enabling Azure DevOps audit logging and sending logs to a SIEM (Option E) is a best practice for monitoring and auditing pipeline runs, allowing detection of potential exposures.
You are a DevOps engineer at a healthcare company that must comply with HIPAA. The company uses Azure DevOps with YAML pipelines to deploy a multi-tier application to Azure Kubernetes Service (AKS). The application stores sensitive patient data. The security team requires that all secrets (e.g., database passwords, API keys) must be stored in Azure Key Vault and never hardcoded in the pipeline. The pipeline currently uses a service principal (SP1) for AKS deployments. The pipeline has a variable group 'VG-Prod' linked to Key Vault 'KV-Prod' with secrets: 'DbPassword', 'ApiKey'. The pipeline runs successfully in non-production environments. However, when you run the pipeline for production, it fails at the stage that deploys to AKS with the error: 'Error: failed to get secret 'DbPassword' from Key Vault: Forbidden'. You have verified that the secret exists and the variable group is correctly linked. The service principal SP1 has the 'Get' and 'List' permissions on KV-Prod secrets. The AKS cluster is in a different subscription than the Key Vault. What is the most likely cause and how should you fix it?
Explanation: The pipeline fails because the service principal used by the Azure DevOps service connection that links the variable group to Key Vault (not SP1, which is used for AKS deployments) does not have 'Get' and 'List' permissions on KV-Prod. When a variable group is linked to a Key Vault, Azure Pipelines fetches secrets using the Azure Resource Manager service connection configured for that variable group. That service principal must be explicitly granted Get and List permissions in the Key Vault access policy. SP1's permissions are irrelevant because it is not the identity used for secret retrieval.
A financial services company uses Azure DevOps to manage CI/CD pipelines for a critical application. The security team requires that all production deployments be approved by two different managers, and that the build artifacts are immutable and signed. Currently, the pipeline uses a manual approval gate with one approver and stores artifacts in Azure Artifacts. What should the DevOps engineer implement to meet the security requirements?
Explanation: The requirements are two approvals, immutable artifacts, and signed artifacts. Option C supplies two approval gates and an immutable feed but omits code signing. Option D only validates signing, not performs it. Branch policies (B) apply to pull requests, not deployment approvals. Key Vault (A) is for secrets, not artifacts. Therefore, a correct solution would require combining C with an explicit code-signing step, which is not offered. The question should be revised to include an option that covers all three requirements.
You are reviewing a compliance policy for Azure Pipelines. What does this policy enforce?
Explanation: The question prompt only states 'You are reviewing a compliance policy for Azure Pipelines' but does not describe what the policy enforces. Without the policy details, it is impossible to choose any of the options. Furthermore, Azure DevOps does not have a native feature that requires MFA specifically for approving secret variable usage; MFA is generally enforced through Azure AD Conditional Access. Therefore, the question is invalid as written.
You are reviewing an Azure DevOps permissions JSON. What access does the user 'user@contoso.com' have?
Explanation: The question as presented lacks the critical JSON snippet. Without it, it is impossible to verify any of the options. To make this question valid, the full permissions JSON must be provided in the stem, showing the explicit assignment for user@contoso.com. With that JSON, one could then determine whether they have Contributor to Build-1, Reader, etc.
+15 more Develop a security and compliance plan questions available
Practice all Develop a security and compliance plan questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Develop a security and compliance plan. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Develop a security and compliance plan questions on the AZ-400 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Develop a security and compliance plan is tested as part of the Microsoft Azure DevOps Engineer Expert AZ-400 blueprint. Practicing with targeted Develop a security and compliance plan questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free AZ-400 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Develop a security and compliance plan is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Develop a security and compliance plan practice session with instant scoring and detailed explanations.
Start Develop a security and compliance plan Practice →