Develop a security and compliance plan →mediumMultiple ChoiceObjective-mapped

AZ-400 Develop a security and compliance plan Practice Question

A company uses Azure DevOps for CI/CD. The security team requires that all pipeline runs must use a specific service connection (ServiceConnection-Prod) that has been approved for production deployments. However, developers are accidentally using unapproved connections. You need to enforce that only the approved service connection can be used in any pipeline that deploys to the production environment. What should you do?

⚠ Common exam trap

Watch out — candidates often confuse process-based controls (templates, approvals, branch policies) with runtime enforcement, overlooking that only a decorator can programmatically validate and block unauthorized service connections at execution time.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create an Azure Pipeline decorator that validates the service connection used in each task and fails the pipeline if it is not the approved one.

Azure Pipeline decorators inject custom validation logic at runtime, allowing you to inspect each task's service connection and fail the pipeline if it does not match the approved one. This enforces the security requirement centrally without relying on developer compliance or manual gates.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Define a required template for all pipelines that includes the service connection, and instruct developers to use it.
Why it's wrong here
A required template is at best a convention; Azure DevOps does not provide an enforce-template setting that blocks pipelines which do not call the template. The `extends` keyword can force a structured hierarchy if you also control repository permissions and prevent contributors from creating new pipelines or bypassing the template owner, but simply telling developers to use a shared template leaves room for ad-hoc YAML that references unapproved service connections directly. Because the template only runs when a pipeline actually invokes it, it cannot guarantee that the approved connection is used across all pipelines, and misconfiguration can easily go unnoticed. Thus, this approach relies on developer compliance rather than being a robust control.
✗
Set up a manual approval gate on the production environment stage in the pipeline.
Why it's wrong here
Manual approval gates on a production environment require human sign-off before deployment, but they do not evaluate or restrict which service connection is used by pipeline tasks; a pipeline could still reference an unapproved service connection while the gate only checks for authorization.
✗
Configure a branch policy on the main branch to require a successful build before merging.
Why it's wrong here
Branch policies on the main branch validate PRs and builds before merging, but they do not inspect the service connection references inside pipeline definitions, and they only protect the branch after the pipeline runs, leaving the actual connection usage ungoverned.
✓
Create an Azure Pipeline decorator that validates the service connection used in each task and fails the pipeline if it is not the approved one.
Why this is correct
A pipeline decorator is an extension-based mechanism that injects a custom task into every pipeline run at the specified point (pre-job, post-job, or around a task). By defining a post-task decorator, you can read the inputs of each executed task—such as the `connectedServiceName` or `azureSubscription` input—and compare the referenced service connection to the organization's approved list. If the connection is not approved, the decorator can set the task result to `Failed` and stop the pipeline, providing a hard enforcement that ordinary YAML conventions cannot achieve. This works for any pipeline that uses the task, regardless of whether the author referenced a shared template.

Go deeper

AZ-400 Develop a security and compliance plan Practice Question

Why each option matters

Option-by-option breakdown

Related to this question