Develop a security and compliance plan →easyMultiple SelectObjective-mapped

AZ-400 Develop a security and compliance plan Practice Question

Your team uses Azure Pipelines and needs to comply with SOC 2 requirements. Which TWO features should you use to meet audit log requirements? (Select TWO.)

⚠ Common exam trap

A common mix-up: candidates confuse security controls (like network security groups or secret rotation) with audit logging features, mistakenly thinking any security measure fulfills audit log requirements, when only dedicated logging and log export features satisfy SOC 2 audit trail mandates.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable Azure DevOps audit logging

Azure DevOps audit logging (Option C) captures a detailed, immutable record of events such as pipeline runs, permission changes, and access attempts, which is essential for SOC 2 audit log requirements. Streaming these logs to Azure Monitor Log Analytics (Option E) enables long-term retention, advanced querying, and alerting, satisfying the need for secure log storage and monitoring.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Configure network security groups to block public access
Why it's wrong here
Network security groups (NSGs) are Azure networking constructs that filter inbound and outbound traffic to subnets or NICs; they do not capture or retain user-level action logs for Azure DevOps, so they have no bearing on SOC audit evidence collection.
✗
Automate secret rotation for service connections
Why it's wrong here
Automating secret rotation for service connections is a crucial credential-hygiene practice that reduces the risk of compromised pipeline authentication, but it does not generate or preserve an audit trail of who performed which DevOps actions, so it fails the SOC logging requirement.
✓
Enable Azure DevOps audit logging
Why this is correct
Enabling Azure DevOps audit logging records user and service principal actions across the organization, such as pipeline creation, permission changes, and policy edits, into the Audit log, which is the foundational mechanism for meeting SOC compliance evidence requirements.
✗
Create service principals for pipeline authentication
Why it's wrong here
Creating service principals for pipeline authentication establishes secure, non-interactive identities for service connections or scripts, but service principals themselves do not emit audit events; only enabling audit logging captures their actions, so this measure alone does not satisfy SOC logging obligations.
✓
Stream audit logs to Azure Monitor Log Analytics
Why this is correct
Streaming Azure DevOps audit logs to Azure Monitor Log Analytics via a diagnostic setting enables long-term retention, centralized querying, alerting, and correlation with other Azure resources, which transforms raw audit data into the persistent, analyzable evidence that SOC audits require.

Go deeper

AZ-400 Develop a security and compliance plan Practice Question

Why each option matters

Option-by-option breakdown

Related to this question