Develop a security and compliance plan →mediumMultiple ChoiceObjective-mapped

AZ-400 Develop a security and compliance plan Practice Question

Exhibit

{
  "type": "Azure DevOps Pipeline Security",
  "settings": {
    "enforceRequiredTemplate": true,
    "requiredTemplate": "security-validation.yml",
    "scope": ["production", "staging"]
  }
}

Refer to the exhibit. Your organization has configured an Azure DevOps pipeline security setting that enforces a required template for all pipelines deploying to production and staging. The required template 'security-validation.yml' runs a series of security scans and compliance checks. A developer creates a new pipeline that deploys to a test environment, but the pipeline does not reference the required template. What will happen?

⚠ Common exam trap

The trap incorrectly claims that required template enforcement can be scoped to environments. In reality, the enforcement is global; once enabled, all pipelines must include the template.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The pipeline will fail because it does not reference the required template.

The Azure DevOps 'Required template' security setting is configured at the project or organization level and applies to all YAML pipelines, regardless of the deployment target environment. There is no native option to enforce it only for specific environments like production or staging. Therefore, a new pipeline deploying to test without referencing the required template would also fail.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The pipeline will run normally because the required template enforcement only applies to production and staging environments.
Why it's wrong here
The enforcement scope is limited to production and staging, so test pipelines are not affected.
✗
The pipeline will run but the security scans will be automatically injected.
Why it's wrong here
Incorrect. Required template enforcement does not automatically inject any templates or security scans; it only verifies that a pipeline references the required template when the deployment targets a scoped environment. The test pipeline, being outside the production/staging enforcement scope, runs exactly as defined without any automatic addition of security scan steps.
✓
The pipeline will fail because it does not reference the required template.
Why this is correct
Incorrect. The pipeline will not fail because the required template enforcement is restricted to production and staging environment scopes only. Since this pipeline targets a test environment, it is outside the enforcement scope, so omitting the required template does not trigger a policy failure and the pipeline executes normally.
✗
The pipeline will prompt the developer to add the required template before running.
Why it's wrong here
Incorrect. Azure DevOps does not prompt developers to modify pipeline definitions before a run; policy enforcement either blocks the run with an error (when in scope) or permits it without interaction (when out of scope). Because the test pipeline is outside the production/staging enforcement scope, no prompt or blocking occurs and the run proceeds as usual.

Go deeper

AZ-400 Develop a security and compliance plan Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question