Develop a security and compliance plan →hardMultiple SelectObjective-mapped

AZ-400 Develop a security and compliance plan Practice Question

Your organization is implementing a security compliance plan for Azure DevOps. Which TWO actions should you take to ensure that only authorized users can modify build pipelines?

⚠ Common exam trap

It's easy for candidates to confuse authentication mechanisms (PATs, OIDC) with authorization controls, or mistake auditing (detective) for prevention, leading them to select options that do not actually restrict who can modify pipelines.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Configure branch policies to require reviews for changes to pipeline YAML files

Branch policies in Azure Repos enforce required reviews for changes to YAML pipeline files stored in the repository. This ensures that any modification to the pipeline definition must be approved by authorized reviewers before merging, preventing unauthorized or accidental changes. Option C is correct because pipeline permissions in Azure DevOps allow you to restrict editing of a pipeline to specific security groups (e.g., 'Build Administrators'), directly controlling who can modify the pipeline through the web interface or API.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Require all users to use Personal Access Tokens (PATs)
Why it's wrong here
Personal Access Tokens (PATs) are an authentication mechanism that verifies a user's identity when calling Azure DevOps REST APIs, but they do not provide authorization workflows or approval gates. Requiring PATs does not enforce reviews or restrict who can edit pipeline definitions, so it fails to meet the security compliance objective.
✓
Configure branch policies to require reviews for changes to pipeline YAML files
Why this is correct
Configuring branch policies on the repository that contains your pipeline YAML files requires pull request reviews, successful builds, and approved changes before merging, directly enforcing mandatory peer review. This is a preventive control that ensures any change to pipeline definitions is vetted, making it the correct answer for a security compliance plan.
✓
Set pipeline permissions to restrict editing to specific security groups
Why this is correct
Setting pipeline permissions through Azure DevOps security groups restricts the 'Edit' and 'Manage' permissions to designated users, thereby preventing unauthorized accounts from modifying pipeline definitions. This is a valid preventive control to ensure only authorized security groups can alter build and release pipelines.
✗
Enable audit logging for all pipeline changes
Why it's wrong here
Enabling audit logging captures a tamper-evident record of pipeline changes for compliance and forensic investigation, but it only provides visibility after an action occurs. It is a detective control and does not block or prevent unauthorized modifications, so it is not sufficient on its own.
✗
Enable OpenID Connect (OIDC) for pipeline authentication
Why it's wrong here
OpenID Connect (OIDC) is an authentication protocol that eliminates secret-based credentials for pipeline connections, but it does not govern who may edit pipeline definitions or enforce approval workflows. It addresses identity and access for service principals, not change management, so it does not satisfy the compliance requirement.

Go deeper

AZ-400 Develop a security and compliance plan Practice Question

Why each option matters

Option-by-option breakdown

Related to this question