Develop a security and compliance plan →hardMultiple ChoiceObjective-mapped

AZ-400 Develop a security and compliance plan Practice Question

Exhibit

Refer to the exhibit.

```json
{
  "id": "policy-secure-files",
  "type": "Microsoft.Authorization/policyAssignments",
  "properties": {
    "displayName": "Secure Files in Pipelines",
    "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/audit-secure-files",
    "parameters": {
      "allowedFileExtensions": {
        "value": [".pfx", ".p12", ".cer"]
      }
    },
    "scope": "/subscriptions/.../resourceGroups/.../providers/microsoft.devops/pipelines"
  }
}
```

You are evaluating an Azure Policy assignment for Azure Pipelines. What does this policy audit?

⚠ Common exam trap

It's easy for candidates to confuse the audit of file extensions with other security controls like encryption or rotation, leading them to select options that describe general best practices rather than the specific policy behavior.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Whether pipelines use secure files with extensions other than .pfx, .p12, or .cer

The Azure Policy for Azure Pipelines audits whether secure files have file extensions other than .pfx, .p12, or .cer. This policy is designed to enforce that only certificate-related secure files (which are typically used for code signing or TLS) are allowed, preventing the upload of arbitrary file types that could introduce security risks or misconfiguration.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Whether secure files are rotated within 90 days
Why it's wrong here
Azure Policy can audit resource properties, but there is no built-in or custom policy definition that tracks the age of secure files in Azure Pipelines. Rotation is typically enforced via pipeline tasks or organizational processes, not through Azure Policy assignments. Therefore, evaluating rotation frequency would not be the effect of the described policy.
✓
Whether pipelines use secure files with extensions other than .pfx, .p12, or .cer
Why this is correct
The policy is designed to audit which file extensions are allowed for secure files in Azure Pipelines, specifically restricting to .pfx, .p12, or .cer. Any secure file with a different extension (e.g., .txt, .key, .pem) would be non-compliant. This directly matches the policy's scope of validating file types used as secure inputs.
✗
Whether secure files are encrypted at rest
Why it's wrong here
Azure Policy can enforce encryption for many Azure resources, but secure files in Azure Pipelines are stored and encrypted by the Azure DevOps service itself, not as an auditable Azure resource. The policy assignment described does not target storage encryption attributes. Thus, encryption-at-rest status is not evaluated by this policy.
✗
Whether secure files are used in production pipelines
Why it's wrong here
The policy assignment applies to all pipelines within the scope, not only production pipelines. Its condition checks the file extension of every secure file used, regardless of the pipeline's purpose (dev, test, or production). Therefore, limiting the evaluation to production pipelines would incorrectly narrow the policy's scope.

Go deeper

AZ-400 Develop a security and compliance plan Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question