Develop a security and compliance plan →easyMultiple ChoiceObjective-mapped

AZ-400 Develop a security and compliance plan Practice Question

A company uses Azure DevOps and needs to ensure that all pipelines use approved YAML templates from a central repository. The security team wants to prevent developers from referencing unapproved templates. What is the best way to enforce this?

⚠ Common exam trap

The trap is that candidates may assume 'Required template' blocks all unapproved templates. In reality, it only enforces inclusion of a mandatory template. Pipeline decorators are a valid and robust way to enforce template origin restrictions.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use a pipeline decorator to check the template origin and fail the pipeline if unapproved.

The correct approach is to use a pipeline decorator that runs at the start of every pipeline, inspects the YAML for template references, and fails the pipeline if any template is not from the approved central repository. The 'Required template' setting forces inclusion of a template but does not block additional unapproved template references.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Create a branch policy on the repository that requires all pull requests to be approved by security team members.
Why it's wrong here
Branch policies govern pull request validation and merge gates on a repository, but they cannot restrict which external repositories or template sources are referenced in YAML pipeline definitions. Templates are resolved at pipeline compile time, outside the branch policy scope, so this approach would not enforce template origin.
✗
Configure a variable group with the approved template repository and require it in all pipelines.
Why it's wrong here
Variable groups store variables and secrets for use in pipelines, but they are not a governance mechanism for validating or restricting the source of YAML templates. Referencing a variable group does not block a pipeline from loading templates from unapproved repositories, so this cannot enforce the approved template source.
✓
Use a pipeline decorator to check the template origin and fail the pipeline if unapproved.
Why this is correct
A custom pipeline decorator could technically inspect template origins and fail the build, but it requires you to write, publish, and maintain a private extension, which is complex and error-prone. The built-in 'Required template' repository setting provides the same enforcement more simply and reliably without custom code.
✗
Set the 'Required template' repository setting in the Azure DevOps project to the approved central repository.
Why it's wrong here
In Azure DevOps, under Project Settings > Pipelines > Settings, the 'Required template' repository setting restricts YAML pipeline templates to a single approved repository. Any pipeline that references a template from outside that repository fails automatically, making this the native, built-in mechanism for centralizing template governance.

Go deeper

AZ-400 Develop a security and compliance plan Practice Question

Why each option matters

Option-by-option breakdown

Related to this question