AZ-400 Develop a security and compliance plan Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a Data Loss Prevention (DLP) policy in Microsoft 365.

  Why it's wrong here

  Microsoft 365 DLP policies are scoped to Microsoft 365 workloads such as Exchange, SharePoint, OneDrive, and Teams, and cannot scan or classify content stored in Azure DevOps repositories. Azure DevOps is not a valid location for DLP content matching, so this option does not address source code classification.

• ✗

  Set up Microsoft Sentinel to monitor Azure DevOps logs.

  Why it's wrong here

  Microsoft Sentinel is a cloud-native SIEM/SOAR tool that ingests and correlates security logs for threat detection and incident response; it does not perform content-based data classification on Azure DevOps repositories. While it can ingest Azure DevOps activity logs, it lacks the ability to scan source code for sensitive data.

• ✓

  Configure a Microsoft Purview Data Classification scan for Azure DevOps repositories.

  Why this is correct

  Microsoft Purview provides data governance and classification capabilities, and its data map can register and scan Azure DevOps repositories to automatically classify sensitive data such as credentials, connection strings, and personal information. This directly aligns with the requirement to classify and protect sensitive information in your organization's code repositories.

• ✗

  Enable Microsoft Defender for Cloud to scan repositories.

  Why it's wrong here

  Microsoft Defender for Cloud is a cloud security posture management (CSPM) solution that assesses Azure resources for misconfigurations, vulnerabilities, and regulatory compliance, but it does not scan repository contents to classify sensitive data. Its workload protection and recommendations focus on security hardening, not data classification within code.

Go deeper

Related to this question