Develop a security and compliance plan →hardMultiple SelectObjective-mapped

AZ-400 Develop a security and compliance plan Practice Question

Which TWO actions should you take to ensure that Azure Pipelines artifacts are securely stored and access is audited?

⚠ Common exam trap

A common mix-up: candidates confuse Azure Policy with pipeline governance (e.g., deployment gates) or assume that network-level controls like storage firewalls are the primary security mechanism for Azure Artifacts, when in fact Azure Artifacts is a PaaS service within Azure DevOps that does not expose a direct storage account endpoint for artifact downloads.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable Azure Artifacts retention policies to automatically delete old artifact versions

Azure Artifacts retention policies allow you to automatically delete older versions of packages, reducing the attack surface and ensuring that only current, approved artifacts are stored. This is a key security practice to prevent outdated or vulnerable artifacts from being accessed. Option E is correct because enabling audit logging for artifact downloads via Azure DevOps audit logs provides a detailed, immutable record of who accessed which artifact and when, which is essential for compliance and security investigations.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Configure the storage account firewall to only allow access from Azure Pipelines IP ranges
Why it's wrong here
Configuring a storage account firewall to only allow Azure Pipelines IP ranges is ineffective because Azure Artifacts are stored in Azure DevOps-managed storage, not a customer-controlled storage account. You cannot apply network-level controls to this service, so this action would not secure artifact access.
✗
Use Azure Policy to enforce that artifacts are only deployed to production storage accounts
Why it's wrong here
Using Azure Policy to enforce that artifacts are only deployed to production storage accounts is not relevant because Azure Artifacts are not deployed to storage accounts; they are consumed directly by pipeline tasks. Azure Policy governs Azure resource compliance, not the destinations of pipeline artifact deployments, so this does not mitigate artifact security risks.
✓
Enable Azure Artifacts retention policies to automatically delete old artifact versions
Why this is correct
Enabling Azure Artifacts retention policies automatically deletes old artifact versions, reducing the attack surface and limiting the window in which outdated or potentially vulnerable artifacts can be downloaded or exploited. This is a security best practice that ensures only recent, vetted versions remain available to the pipeline.
✗
Enable customer-managed keys (CMK) for artifact encryption
Why it's wrong here
Azure DevOps does not support customer-managed keys (CMK) for Azure Artifacts; encryption is handled with Microsoft-managed keys at rest. Therefore, attempting to enable CMK for artifact encryption is not a valid or actionable measure to secure artifacts in Azure Pipelines.
✓
Configure audit logging for artifact downloads via Azure DevOps audit logs
Why this is correct
Configuring audit logging for artifact downloads via Azure DevOps audit logs provides a detailed record of who accessed artifacts and when, enabling detection of unauthorized access or potential data exfiltration. This visibility is a critical control for maintaining a secure artifact management lifecycle in Azure Pipelines.

Go deeper

AZ-400 Develop a security and compliance plan Practice Question

Why each option matters

Option-by-option breakdown

Related to this question