AZ-400 Develop a security and compliance plan Practice Question
A company uses Microsoft Defender for Cloud to assess the security posture of Azure Pipelines agents. They notice that self-hosted agents are flagged as having high-severity vulnerabilities. What is the recommended action to remediate these findings while minimizing downtime?
⚠ Common exam trap
It's easy for candidates to assume replacing agents with Microsoft-hosted agents is the only secure option, but the question specifically asks for remediation while minimizing downtime, and patching the existing VMs is the least disruptive and most direct action.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply the security updates recommended by Microsoft Defender for Cloud to the agent VMs.
Microsoft Defender for Cloud identifies vulnerabilities on the VMs hosting self-hosted Azure Pipelines agents and provides specific security update recommendations. Applying these updates directly remediates the high-severity findings without requiring agent replacement or disabling security monitoring, thus minimizing downtime by patching in-place.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable Microsoft Defender for Cloud for the agent pool.
Why it's wrong here
Disabling Microsoft Defender for Cloud for the agent pool merely hides the security findings and alerts from view; it does not fix the underlying vulnerabilities. This leaves the self-hosted agents exposed to known exploits, increasing the risk of compromise and potentially violating compliance requirements.
- ✗
Uninstall the self-hosted agents and use only Microsoft-hosted agents.
Why it's wrong here
Uninstalling the self-hosted agents and switching entirely to Microsoft-hosted agents is a drastic operational change that would require rewiring all pipelines and may not be permitted in regulated environments requiring private network access or custom build dependencies. It also leaves the original agent VMs unpatched and still exposed, because Defender for Cloud continues to flag the unresolved security recommendations on those resources. This approach treats the symptom by removing the pipeline from the environment, but it does not fix the underlying vulnerability management issue and can introduce significant downtime and migration overhead.
- ✓
Apply the security updates recommended by Microsoft Defender for Cloud to the agent VMs.
Why this is correct
Applying the security updates recommended by Microsoft Defender for Cloud directly remediates the identified vulnerabilities on the agent VMs by patching the operating system and installed software. This eliminates known exploit paths, reduces the attack surface, and aligns the environment with security best practices.
- ✗
Replace all self-hosted agents with Microsoft-hosted agents.
Why it's wrong here
Replacing all self-hosted agents with Microsoft-hosted agents might eliminate these specific build machines from the agent pool, but the vulnerable VMs remain untouched and Defender for Cloud will still report them as security risks. This option is often infeasible when Azure Pipelines must access on-premises resources, when custom software prerequisites are required, or when data residency and compliance policies prohibit using shared infrastructure. Moreover, the root cause is missing security updates on the VMs, not the agent software itself; simply swapping agents bypasses the remediation step and leaves the environment misconfigured.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Agent
An agent is a software component that runs on a local machine to perform automated tasks, collect data, or execute commands as part of a larger system like CI/CD or monitoring.
Key term
Azure Pipelines
Azure Pipelines is a cloud-based CI/CD service from Microsoft that automatically builds, tests, and deploys code to any platform or cloud.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.