Develop a security and compliance plan →hardMultiple ChoiceObjective-mapped

AZ-400 Develop a security and compliance plan Practice Question

Your company uses Microsoft Defender for Cloud to monitor Azure DevOps environments. You receive an alert that a service principal has excessive permissions. What is the first step you should take to investigate and remediate?

⚠ Common exam trap

The trap here is that candidates often jump to immediate remediation (reducing permissions or deleting the principal) without first performing a forensic investigation, failing to recognize that the first step in incident response is always to gather evidence via audit logs to understand the scope and impact.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Review the Microsoft Entra ID audit logs for the service principal.

Reviewing the Microsoft Entra ID audit logs is the correct first step because it allows you to investigate the service principal's activity, such as which resources it accessed, when, and from where, before taking any remediation action. This forensic analysis is essential to understand the scope of the excessive permissions and to ensure that reducing permissions or other actions do not inadvertently disrupt legitimate operations. Without this step, you risk breaking functionality or missing evidence of misuse.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Reduce the service principal's permissions to the minimum required.
Why it's wrong here
Reducing the service principal's permissions prematurely may break legitimate functionality and should only follow a thorough review of the Microsoft Entra ID audit logs to determine actual usage and required scope, not as an immediate response to a security alert.
✓
Review the Microsoft Entra ID audit logs for the service principal.
Why this is correct
Reviewing the Microsoft Entra ID audit logs is the correct first step because these logs provide a detailed trail of the service principal's sign-ins, granted permissions, and activities, allowing you to determine whether the alert indicates a real threat or normal operation before taking any corrective action.
✗
Immediately delete the service principal.
Why it's wrong here
Immediately deleting the service principal without first confirming it is malicious can break applications and automated workflows that depend on it, causing broader service disruption; instead, investigate the audit logs and, if needed, disable or revoke suspicious grants to contain potential risk.
✗
Reset the service principal's credentials.
Why it's wrong here
Resetting the service principal's credentials may deny access to legitimate services and does not address the underlying permissions or activity that triggered the alert, so it should be done only after reviewing audit logs to confirm compromise and to understand the full scope of the issue.

Go deeper

AZ-400 Develop a security and compliance plan Practice Question

Why each option matters

Option-by-option breakdown

Related to this question