Develop a security and compliance plan →mediumMultiple Choice

AZ-400 Develop a security and compliance plan Practice Question

Your company uses Microsoft Sentinel for security monitoring. Azure DevOps pipelines deploy resources to production. You need to create an automated response that triggers when Sentinel detects a high-severity alert related to unauthorized pipeline changes. The response should temporarily disable the service connection used by the pipeline and notify the security team. What should you do?

⚠ Common exam trap

AZ-400 often tests the confusion between notification-only responses and actual remediation actions; candidates may pick email alerts thinking they satisfy 'automated response' when the question requires disabling a resource.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create a Sentinel playbook using Azure Logic Apps that calls the Azure DevOps REST API to update the service connection status.

A Sentinel playbook built with Azure Logic Apps can be triggered by a Sentinel alert and execute custom actions, such as calling the Azure DevOps REST API to disable a service connection and sending notifications. This provides the automated response required. The playbook integrates with Sentinel's automation rules to run when the high-severity alert fires.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Configure a Sentinel analytics rule with the alert and use automated response to send an email.
Why it's wrong here
A Sentinel analytics rule with an automated response can only trigger an email or other notification channel; it cannot invoke the Azure DevOps REST API or change the state of a service connection. While this addresses the alerting requirement, it fails the core need to proactively disable the compromised connection, leaving it active for potential misuse.
✗
Set up an Azure DevOps service hook that triggers on pipeline events.
Why it's wrong here
Azure DevOps service hooks are designed to react to events occurring within Azure DevOps (e.g., pipeline runs, work item changes) by sending notifications or triggering external processes, not to consume security alerts from Microsoft Sentinel. There is no built-in trigger for Sentinel incidents, so this approach would never initiate the response required to disable a service connection.
✗
Use Azure Policy to deny changes to service connections.
Why it's wrong here
Azure Policy can enforce or deny configuration changes on Azure resources, but it cannot modify the status or disable an existing Azure DevOps service connection, which is a non-Azure artifact managed via the Azure DevOps REST API. Even if policy denied changes, an already compromised connection would remain active, so this does not provide the necessary automated remediation.
✓
Create a Sentinel playbook using Azure Logic Apps that calls the Azure DevOps REST API to update the service connection status.
Why this is correct
This is correct because a Sentinel playbook is an Azure Logic Apps workflow specifically designed to automate incident response to Sentinel alerts. By calling the Azure DevOps REST API endpoint for service endpoints (e.g., PUT https://dev.azure.com/{organization}/{project}/_apis/serviceendpoint/endpoints/{endpointId}?api-version=7.1) and setting the `isReady` field to false or updating the service endpoint status to disabled, the playbook can immediately revoke access. It can also send a notification email afterwards, satisfying both the disable and notify requirements in a single automated response.

Go deeper

AZ-400 Develop a security and compliance plan Practice Question

Why each option matters

Option-by-option breakdown

Related to this question