AZ-400 Implement an instrumentation strategy Practice Question
You are the DevOps lead for a fintech company. The organization uses a multi-tenant Azure DevOps environment with hundreds of pipelines. The compliance team requires that every pipeline run must be auditable with the following attributes captured: who triggered the run, what code changes were included, which artifacts were produced, and whether any secrets (e.g., Azure Key Vault references) were accessed during the run. Additionally, all audit data must be retained for 7 years and be queryable within 5 minutes of a pipeline completion. Current state: pipelines use Azure Key Vault for secrets, and YAML pipelines are defined with variables referencing Key Vault. You need to design an instrumentation strategy to meet these requirements. What should you do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Azure DevOps Audit Streams to send audit events to a Log Analytics workspace. Configure a Log Analytics workspace with 7-year retention. Create a dashboard and alert rules for compliance.
Using Azure DevOps Audit Streams to send events to a Log Analytics workspace provides long-term retention and near real-time querying. Azure DevOps Audit logs capture all required attributes including pipeline runs, secret access, and user identity. Option B is incorrect because Azure Event Grid subscription to pipeline run events does not provide long-term retention and querying capabilities; it is event-driven delivery. Option C is incorrect because adding a step to upload pipeline logs as artifacts does not capture the audit trail of who triggered the run or whether secrets were accessed. Option D is incorrect because instrumenting pipelines with custom tasks sending telemetry to Application Insights is for application telemetry, not pipeline audit, and does not capture all required attributes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable Azure DevOps Audit Streams to send audit events to a Log Analytics workspace. Configure a Log Analytics workspace with 7-year retention. Create a dashboard and alert rules for compliance.
Why this is correct
Azure DevOps Audit Streams is the native mechanism that pushes every audit event from the organization, including user/group changes, permissions, service connection modifications, and pipeline run events, to a Log Analytics workspace via a diagnostic setting. Configuring the workspace with interactive retention plus a seven-year archive provides durable, long-term compliance storage, and KQL queries can power dashboards and alert rules to detect anomalous behavior. This matches the compliance requirement because it captures who did what, when, and from where, with near real-time delivery.
- ✗
Use Azure Event Grid to subscribe to pipeline run events and store them in Azure Cosmos DB with TTL for 7 years.
Why it's wrong here
An Event Grid subscription reacts to specific pipeline run state changes, such as run completed, and does not receive the full Azure DevOps audit event stream containing user identity, IP address, permission changes, and secret access details. Even if you persist those sparse events into Cosmos DB, TTL will automatically purge documents after 7 years, so you have no long-term queryable archive and no compliance-grade alerting. This approach is event-driven plumbing, not an audit trail.
- ✗
Add a step at the end of each pipeline to upload pipeline logs as pipeline artifacts with a retention policy of 7 years.
Why it's wrong here
Uploading pipeline logs as artifacts preserves only the raw console output, but omits the metadata that proves compliance: the actor, source IP, triggering mechanism, approval decisions, and whether pipeline secrets or service connections were accessed during a run. Artifact retention policies apply to build files, not to Azure DevOps audit records, so you cannot query these files for suspicious activity or build dashboards across all organizations. Artifacts are opaque blobs, not structured audit events.
- ✗
Instrument each pipeline with custom tasks that send telemetry to Application Insights. Set Application Insights to 7-year retention.
Why it's wrong here
Instrumenting pipeline tasks to send custom telemetry to Application Insights captures only the application metrics you explicitly code, not the Azure DevOps audit trail, and it is blind to administrative actions that occur outside a pipeline run. Application Insights is designed for application diagnostics, and its standard retention is far below seven years, so you would need additional data export and still cannot reassemble a complete, tamper-proof audit record. This confuses application monitoring with organizational auditing.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Azure DevOps
Azure DevOps is a Microsoft service that provides development tools for planning, building, testing, and deploying software applications using automated pipelines and collaboration features.
Key term
Application Insights
Application Insights is an Azure monitoring service that helps developers detect, diagnose, and understand issues in live web applications by collecting telemetry data like requests, exceptions, and performance counters.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.