Develop a security and compliance plan →easyMultiple SelectObjective-mapped

AZ-400 Develop a security and compliance plan Practice Question

Which TWO practices should you follow to ensure compliance with regulatory requirements (e.g., PCI DSS) when using Azure DevOps? (Choose two.)

⚠ Common exam trap

Test-takers frequently confuse 'audit logging' with a cost-saving measure (Option D) or think manual tracking (Option A) is acceptable, while the exam expects you to recognize that automated, immutable audit trails and enforced branch policies are the only reliable ways to meet regulatory compliance in a DevOps context.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable Azure DevOps audit logging to track changes to pipelines and policies.

Azure DevOps audit logging captures a detailed, immutable record of changes to pipelines, policies, and other critical resources, which is essential for demonstrating compliance with frameworks like PCI DSS that require evidence of who made what change and when. Audit logs can be exported to SIEM tools or retained for forensic analysis, satisfying the 'audit trail' requirement without manual intervention. Additionally, using branch policies enforces mandatory code reviews and approvals for changes, ensuring that all modifications go through a controlled, auditable process. Together, these practices provide both the immutable audit trail and the controlled change management required for regulatory compliance.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Manually track changes to pipelines in a spreadsheet.
Why it's wrong here
Manually tracking pipeline changes in a spreadsheet is error-prone, lacks an immutable timestamped audit trail, and cannot be programmatically verified, so it fails to satisfy compliance requirements for traceability and evidence of change control.
✗
Allow all users to create and modify pipelines without restrictions.
Why it's wrong here
Allowing every user to create and modify pipelines without restrictions violates the principle of least privilege and separation of duties, introduces unauthorized change risk, and undermines compliance controls such as change approval and traceability.
✓
Enable Azure DevOps audit logging to track changes to pipelines and policies.
Why this is correct
Enabling Azure DevOps audit logging captures an immutable, timestamped record of pipeline and policy changes, which is essential evidence for compliance audits, enables detection of unauthorized modifications, and supports security investigations.
✗
Disable audit logging to reduce storage costs.
Why it's wrong here
Disabling audit logging to save storage costs eliminates the immutable evidence required for compliance audits, blinds security teams to unauthorized changes, and contradicts regulatory requirements for monitoring and auditing high-impact resources like pipelines.
✓
Use branch policies to enforce code reviews and approvals for all changes.
Why this is correct
Using branch policies to enforce code reviews and required approvals ensures every change to protected branches is peer-reviewed and authorized, providing a controlled change management process that is critical for compliance with regulatory standards.

Go deeper

AZ-400 Develop a security and compliance plan Practice Question

Why each option matters

Option-by-option breakdown

Related to this question