AZ-400 Develop a security and compliance plan Practice Question
You need to implement a compliance framework that ensures Azure Pipelines build agents are always patched with the latest security updates. What should you use?
⚠ Common exam trap
Many candidates confuse 'enforcing compliance' (Azure Policy) with 'actually performing the patching action' (Azure Update Management), or they mistake image creation (VM Image Builder) for ongoing patch management, leading them to select a tool that only audits or provisions rather than schedules updates.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Update Management to schedule patching
Azure Update Management is the correct choice because it provides a native, scheduled patching solution for Azure Pipelines build agents. It integrates with Azure Automation and Log Analytics to assess missing updates and deploy them on a recurring schedule, ensuring agents remain compliant with the latest security patches without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Update Management to schedule patching
Why this is correct
Azure Update Management, part of Azure Automation, is the appropriate solution here because it directly schedules and orchestrates the installation of OS updates on Azure VMs and on-premises servers, with compliance reporting and maintenance window control.
- ✗
Azure VM Image Builder to create patched images
Why it's wrong here
Azure VM Image Builder builds golden VM images from a source and customization scripts; it creates new, pre-patched images but does not patch existing deployed agents or schedule patching on running VMs, so it fails the requirement.
- ✗
Azure Policy to enforce that agents must be patched
Why it's wrong here
Azure Policy enforces governance rules and evaluates whether VMs are compliant with patch requirements, but it is a resource policy engine; it cannot install updates or run patch schedules, so it only flags noncompliant resources rather than fixing them.
- ✗
Azure Automation State Configuration to enforce desired state
Why it's wrong here
Azure Automation State Configuration (DSC) manages configuration drift by applying desired machine configurations, but patching is not its core strength; while you could script update installation within a DSC configuration, it lacks the built-in update orchestration, classification scanning, and scheduling features of Azure Update Management.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Log Analytics
Log Analytics is a cloud-based service that collects, analyzes, and visualizes machine-generated log data from various sources to help IT teams monitor systems and troubleshoot issues.
Key term
Azure Pipelines
Azure Pipelines is a cloud-based CI/CD service from Microsoft that automatically builds, tests, and deploys code to any platform or cloud.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.