AZ-400 Develop a security and compliance plan Practice Question
Your organization uses Azure DevOps and wants to enforce that all pipelines use a specific set of approved tasks. How can you achieve this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the task restrictions feature in Azure DevOps to block unapproved tasks
Use the task restrictions feature in Azure DevOps to block unapproved tasks. Azure DevOps provides a 'Task restrictions' policy under Organization Settings > Policies > Add new policy, where you can specify which tasks are allowed or blocked across all pipelines. This enforces that only approved tasks are used. Option B is incorrect because assigning permissions to a task group only controls who can modify the group, not which tasks are used in pipelines. Option C is incorrect because while YAML templates can standardize tasks, they do not enforce mandatory usage; pipelines can still be created without the template. Option D is incorrect because service hooks only trigger notifications when an unapproved task is used, but do not block its usage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use the task restrictions feature in Azure DevOps to block unapproved tasks
Why this is correct
Use the task restrictions feature in Azure DevOps to block unapproved tasks: This organization-level policy lets you explicitly whitelist approved task IDs; any pipeline attempt to use a task outside the list is blocked or produces a warning, providing actual enforcement at the pipeline execution level rather than relying on user compliance.
- ✗
Assign permissions to the task group to limit who can add tasks
Why it's wrong here
Assign permissions to the task group to limit who can add tasks: Permissions on a task group control which users can create, edit, or delete that task group, but they do not govern which tasks an existing pipeline can reference; any authorized pipeline author can still add an unapproved task directly without restriction.
- ✗
Create a YAML template with the approved tasks and require all pipelines to use it
Why it's wrong here
Create a YAML template with the approved tasks and require all pipelines to use it: Requiring a YAML template is only a governance convention, not an enforcement mechanism; pipelines can bypass the template by using inline steps or referencing a different template, and Azure DevOps has no native capability to force a pipeline to extend a specific template.
- ✗
Configure a service hook to notify when an unapproved task is used
Why it's wrong here
Configure a service hook to notify when an unapproved task is used: A service hook can raise an external event or send a notification after an unapproved task has executed, but it is purely reactive and does not prevent the pipeline from running; enforcement must occur before or during task resolution, not via post-hoc alerts.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Azure DevOps
Azure DevOps is a Microsoft service that provides development tools for planning, building, testing, and deploying software applications using automated pipelines and collaboration features.
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.