Develop a security and compliance plan →hardMultiple ChoiceObjective-mapped

AZ-400 Develop a security and compliance plan Practice Question

Your organization uses Azure Boards and requires that all changes to work items in the 'Security' area path be audited. Which solution ensures that any modification to a work item triggers an audit event in Microsoft Sentinel?

⚠ Common exam trap

Many candidates confuse service hooks (which are event-driven but require custom logic) with native audit streaming, or assume that manual CSV exports are sufficient for real-time auditing, missing the requirement for automated, continuous audit event ingestion into Sentinel.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Configure Azure DevOps Audit Streaming to send logs to Microsoft Sentinel

Azure DevOps Audit Streaming is the correct solution because it natively streams audit events (including work item modifications) to Microsoft Sentinel via the Azure Event Hubs or Log Analytics workspace integration. This ensures real-time, continuous auditing without manual intervention, meeting the requirement for all changes in the 'Security' area path to trigger audit events in Sentinel.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Configure Azure DevOps Audit Streaming to send logs to Microsoft Sentinel
Why this is correct
This is the native Azure DevOps integration that continuously streams audit events (such as project, pipeline, and permission changes) to your Log Analytics workspace for Microsoft Sentinel. It provides real-time, automatic ingestion with no custom code, enabling immediate security monitoring and alerting, which directly satisfies the requirement.
✗
Enable Microsoft Purview to scan Azure DevOps and detect changes
Why it's wrong here
Microsoft Purview is a data governance solution that scans metadata for classification, lineage, and discovery across Azure and other data sources. It does not monitor Azure DevOps operational audit logs or detect work item changes in real time, and it lacks the event-streaming pipeline needed to support Sentinel incident detection.
✗
Export Azure DevOps audit logs to CSV and import to Sentinel daily
Why it's wrong here
Exporting audit logs to CSV via the Auditing REST API or portal is a manual, point-in-time operation that captures a snapshot rather than a continuous feed. A daily import into Sentinel would introduce significant latency, leaving critical security events undetected for hours and defeating the real-time monitoring requirement.
✗
Create a service hook in Azure DevOps that calls a logic app to create incidents in Sentinel
Why it's wrong here
Service hooks are event-driven subscriptions that trigger actions on specific Azure DevOps events, such as work item updates or build completions, but they do not stream the full audit log. A logic app could receive those events and create Sentinel incidents, but it would require custom logic and would omit many audit events (like PAT creation or project deletion) that Audit Streaming natively captures.

Go deeper

AZ-400 Develop a security and compliance plan Practice Question

Why each option matters

Option-by-option breakdown

Related to this question