AZ-400 Develop a security and compliance plan Practice Question
Your organization uses Azure DevOps with multiple teams. You are tasked with creating a security and compliance plan. The environment includes: Azure Repos for source control, Azure Pipelines for CI/CD, and Azure Artifacts for package management. Requirements: 1) All code changes to the main branch must be reviewed by at least one member of the security team. 2) Deployment to production requires approval from a manager. 3) Secrets must be stored securely and rotated every 90 days. 4) Pipeline logs must be retained for 1 year for audit purposes. You have configured branch policies requiring a minimum number of reviewers and mandatory security team review. For production deployments, you have added a manual approval gate. Secrets are stored in Azure Key Vault with automatic rotation. However, the audit team reports that pipeline logs are only retained for 30 days. You need to extend log retention to 1 year. What should you do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
In Azure DevOps project settings, navigate to Pipelines > Retention and releases, and set the retention policy to 365 days.
In Azure DevOps, pipeline retention policies for runs are configured at the project level under Project Settings > Pipelines > Retention and releases. Setting the retention to 365 days will keep pipeline run records and logs for one year. Option A is incorrect because exporting pipeline logs to Azure Blob Storage is not a built-in feature; pipeline logs are retained according to DevOps retention policies. Option B is incorrect because diagnostic settings in Azure Monitor stream Azure resource logs, not Azure DevOps pipeline logs. Option D is incorrect because audit logs capture events like changes to policies, not pipeline execution logs, and they have separate retention settings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Export pipeline logs to Azure Blob Storage and set a lifecycle policy to retain for 365 days.
Why it's wrong here
Pipeline logs are stored within Azure DevOps and cannot be automatically exported to Azure Blob Storage for retention; any custom export would require API-based tooling, but the native retention policy is what actually governs log storage.
- ✗
Configure diagnostic settings in Azure Monitor to stream pipeline logs to a Log Analytics workspace.
Why it's wrong here
Azure Monitor diagnostic settings capture platform diagnostics from Azure resources only; they do not ingest pipeline execution logs from Azure DevOps, so this approach cannot set or enforce a 365-day retention period for those logs.
- ✓
In Azure DevOps project settings, navigate to Pipelines > Retention and releases, and set the retention policy to 365 days.
Why this is correct
To retain pipeline logs for 365 days, use the project-level retention policy under Project Settings > Pipelines > Retention and releases, setting the maximum retention for pipeline runs and logs to the desired number of days.
- ✗
Enable Azure DevOps audit logs and export them to a Log Analytics workspace with a 365-day retention.
Why it's wrong here
Azure DevOps audit logs record user and administrative activity, distinct from pipeline execution logs; exporting them to a Log Analytics workspace does not affect pipeline log retention, so it does not meet the stated requirement.
Visual reference
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Azure Pipelines
Azure Pipelines is a cloud-based CI/CD service from Microsoft that automatically builds, tests, and deploys code to any platform or cloud.
Key term
Azure Monitor
Azure Monitor is a cloud service that collects, analyzes, and acts on telemetry data from your Azure and on-premises resources to help you understand performance and availability.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.