Develop a security and compliance plan →hardMultiple ChoiceObjective-mapped

AZ-400 Develop a security and compliance plan Practice Question

Exhibit

Refer to the exhibit.

```json
{
  "name": "service-connection-audit",
  "query": "AzureDevOpsAuditing | where OperationName == 'ServiceConnectionCreated' | project TimeGenerated, ServiceConnectionId, ServiceConnectionName, CreatedBy"
}
```

You are analyzing Azure DevOps audit logs with the KQL query above. Your security team wants to ensure that only approved service connections are used. After running the query, you find multiple service connections created by a user who is not on the approved list. What should you do next?

⚠ Common exam trap

The trap here is that candidates often jump to a punitive action (deleting connections or disabling accounts) instead of following a structured incident response process that first investigates and validates the risk before taking corrective measures.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Review each unapproved service connection's permissions and usage.

The immediate priority is to assess the risk of each unapproved service connection before taking action. Service connections in Azure DevOps can have varying permissions and may be used by pipelines, so blindly deleting them could break critical deployments. The correct next step is to review each connection's permissions (e.g., who can use it, which service principals are linked) and its usage history (e.g., which pipelines reference it) to determine whether it is malicious or simply an oversight.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Immediately delete all service connections created by that user.
Why it's wrong here
Deleting all service connections created by the user without investigating each one is a destructive action that could immediately break running pipelines and legitimate automation, especially if some connections are shared or repurposed. You should first inspect the audit trail to understand the context and risk associated with each connection before taking any irreversible steps.
✗
Disable the user's account in Microsoft Entra ID.
Why it's wrong here
Disabling the user's account in Microsoft Entra ID is an overreaction that would revoke all of the user's access, not just the service connections, and could deny access to other necessary resources while the investigation is still ongoing. This broad action should only be taken if there is clear evidence of account compromise affecting a wider scope, not based purely on unapproved service connections.
✓
Review each unapproved service connection's permissions and usage.
Why this is correct
Reviewing each unapproved service connection's permissions and usage is the correct response because it enables you to determine whether the connection is malicious, misconfigured, or a legitimate access grant that requires tracking. By examining scopes, used-by pipelines, and activity logs, you can assess risk and decide which connections to revoke, modify, or leave in place with proper oversight.
✗
Modify the query to also include the user's email address.
Why it's wrong here
Modifying the query to include the user's email address is unnecessary because the audit logs and the existing query already identify the principal via CreatedBy, and adding an email field would not change the investigation or remediation steps. The core issue is not missing data but the need to evaluate and act on the discovered service connections.

Go deeper

AZ-400 Develop a security and compliance plan Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question