Develop a security and compliance plan →mediumMultiple ChoiceObjective-mapped

AZ-400 Develop a security and compliance plan Practice Question

Exhibit

Refer to the exhibit.

```json
{
  "properties": {
    "policyRule": {
      "if": {
        "field": "type",
        "equals": "Microsoft.DevOps/Pipelines"
      },
      "then": {
        "effect": "deny",
        "details": {
          "field": "Microsoft.DevOps/Pipelines/yamlFilePath",
          "notEquals": "/pipeline-templates/secure-pipeline.yml"
        }
      }
    }
  }
}
```

You are reviewing an Azure Policy definition that denies pipeline creation if the pipeline template path is not '/pipeline-templates/my-template.yml'. What does this policy do?

⚠ Common exam trap

It's easy for candidates to confuse 'deny' with 'audit' or 'allow' effects, or misinterpret the condition as restricting folder paths instead of template references, leading them to select options that describe permissive or location-based policies.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Denies any pipeline that does not use a specific YAML template.

This Azure Policy definition uses a 'deny' effect with a condition that checks whether the pipeline references a specific YAML template. If the pipeline does not reference that template, the policy denies the pipeline creation or update. Option D is correct because the policy explicitly denies any pipeline that does not use the specified YAML template, enforcing compliance by blocking non-compliant pipelines.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Denies pipelines that use an outdated template version.
Why it's wrong here
This option misinterprets the policy's evaluation criteria. Azure Policy definitions for pipelines inspect the YAML file path, not the version of a template referenced inside that file; to compare versions, the policy would need to parse template content or a version property. An outdated template at the exact expected path would still be allowed, so the policy does not address versioning at all.
✗
Allows only pipelines that use a specific YAML template.
Why it's wrong here
The policy's effect is deny, not allow, so it does not positively grant permission to use a specific template. Instead, it blocks any pipeline whose YAML template path differs from the configured value, meaning the only visible action is preventing non-conforming pipelines rather than explicitly enabling one template.
✗
Allows only pipelines in the pipeline-templates folder.
Why it's wrong here
The policy evaluates and requires an exact match on the full YAML file path, not just a folder name or prefix. A pipeline that contains the 'pipeline-templates' folder but uses a different subpath or filename would still be denied, because the condition compares the entire path string to the specified template location.
✓
Denies any pipeline that does not use a specific YAML template.
Why this is correct
This is correct because the policy definition uses a deny effect that triggers when the pipeline's YAML template path does not equal the specified value. As a result, any pipeline creation or update that references a different template or a non-matching path is blocked, effectively forcing all pipelines to use that exact YAML template.

Go deeper

AZ-400 Develop a security and compliance plan Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question