AZ-400 Develop a security and compliance plan Practice Question
Your Azure DevOps organization has multiple projects. You need to ensure that only approved extension versions are installed across all projects. What is the most efficient way to enforce this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the Azure DevOps extension management settings to mark approved extensions and block others.
Azure DevOps provides extension management settings at the organization level where administrators can mark specific extensions as approved and block all others. This is the most efficient way to enforce approved extension versions across all projects. Option A is wrong because extensions cannot be restricted to specific pipelines via YAML; YAML can only reference tasks from installed extensions. Option C is wrong because Azure Policy does not manage Azure DevOps extensions; it manages Azure resources. Option D is wrong because uninstalling extensions per project is inefficient and does not enforce approved versions globally.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Restrict extension usage to specific pipelines via YAML.
Why it's wrong here
Extensions are installed and managed at the Azure DevOps organization or project collection level, not per pipeline. YAML pipeline definitions cannot restrict which extensions are available at runtime because the extension remains installed for all pipelines in the project/org, so this approach cannot approve or block extensions.
- ✓
Use the Azure DevOps extension management settings to mark approved extensions and block others.
Why this is correct
Organization administrators can use the built-in Extension management settings in the Azure DevOps admin UI to enable or disable specific extensions and control who can install them. Marking approved extensions and blocking others is the native governance mechanism for curating the extension catalog across all projects, making this the correct answer.
- ✗
Create an Azure Policy that audits extension installations.
Why it's wrong here
Azure Policy is a resource governance service for Azure resources such as VMs, storage, and subscriptions; it has no integration with the Azure DevOps extension marketplace or installation actions. There is no Azure Policy alias or audit event for Azure DevOps extensions, so it cannot be used to audit or govern their installation.
- ✗
Uninstall all extensions and only install them per project as needed.
Why it's wrong here
Uninstalling all extensions and reinstalling them per project is an operational workaround that does not enforce governance—users with extension installation permissions could still install unapproved extensions later. It also adds unnecessary overhead to every project setup and does not provide an approval workflow or blocking mechanism, so it is inefficient and ineffective.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
DevOps
DevOps is a set of practices that combines software development (Dev) and IT operations (Ops) to shorten the development lifecycle and deliver high-quality software continuously.
Key term
Azure DevOps
Azure DevOps is a Microsoft service that provides development tools for planning, building, testing, and deploying software applications using automated pipelines and collaboration features.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.