AZ-400 Compliance & Governance 1 — Questions and Answers
Question 1: Which Azure DevOps feature allows administrators to enforce code review requirements before merging to protected branches?
- Branch policies (Correct answer)
- Pipeline templates
- Work item tracking
- Release gates
Correct answer: Branch policies
Branch policies in Azure Repos allow administrators to enforce requirements such as minimum reviewer counts, work item linking, and build validation before code can be merged.
Question 2: What is the primary purpose of Azure Policy in a DevOps governance model?
- To monitor application performance metrics
- To enforce organizational standards and assess compliance at scale (Correct answer)
- To manage CI/CD pipeline configurations centrally
- To track code changes across repositories
Correct answer: To enforce organizational standards and assess compliance at scale
Azure Policy enforces organizational standards and helps assess compliance at scale by evaluating Azure resources against defined policy rules.
Question 3: Which Azure service provides a centralized hub for applying governance controls including policies, role assignments, and resource templates as a repeatable package?
- Azure Monitor
- Azure Security Center
- Azure Blueprints (Correct answer)
- Azure DevTest Labs
Correct answer: Azure Blueprints
Azure Blueprints allows organizations to define a repeatable set of governance tools — including policies, role assignments, and ARM templates — for consistent and compliant environment setup.
Question 4: In Azure DevOps, which feature provides an immutable audit log of all actions performed within an organization?
- Analytics views
- Audit Logs (Correct answer)
- Pipeline history
- Work item history
Correct answer: Audit Logs
Azure DevOps Audit Logs provide an immutable record of all events and changes within an organization, supporting compliance investigations and security reviews.
Question 5: What is the purpose of 'Environment Approvals and Checks' in Azure Pipelines?
- To automate deployment rollbacks when failures occur
- To require human approval or automated validation before deployments proceed to an environment (Correct answer)
- To configure auto-scaling rules for deployment targets
- To set up monitoring alerts for deployment environments
Correct answer: To require human approval or automated validation before deployments proceed to an environment
Environment approvals and checks require designated approvers or automated validations to complete before a deployment can proceed to a specific environment.
Question 6: Which Azure feature allows organizations to restrict which Azure regions resources can be deployed to for data residency compliance?
- Azure Resource Locks
- Azure RBAC role assignments
- Azure Policy with the Allowed Locations definition (Correct answer)
- Azure Resource Groups
Correct answer: Azure Policy with the Allowed Locations definition
Azure Policy's built-in 'Allowed locations' policy definition restricts where resources can be deployed, supporting data residency and regulatory compliance requirements.
Question 7: What is the role of Service Connections in Azure DevOps from a governance perspective?
- They provide direct SSH access to production servers
- They securely store credentials for external services, limiting direct credential exposure in pipeline code (Correct answer)
- They define network connectivity rules between Azure services
- They configure DNS settings for deployed applications
Correct answer: They securely store credentials for external services, limiting direct credential exposure in pipeline code
Service Connections securely store and manage credentials for accessing external services and resource managers, preventing direct credential embedding in pipeline code.
AZ-400 Compliance & Governance 1
Which Azure DevOps feature allows administrators to enforce code review requirements before merging to protected branches?