AZ-400 Compliance & Governance 2 — Questions and Answers
Question 1: Which Azure Pipelines feature allows platform teams to define reusable, standardized pipeline definitions that other teams must extend from to enforce organizational compliance?
- Pipeline artifacts
- Pipeline templates (Correct answer)
- Pipeline triggers
- Pipeline variables
Correct answer: Pipeline templates
Pipeline templates allow organizations to define reusable, standardized pipeline stages or jobs that teams must use, enforcing consistent security and compliance controls across projects.
Question 2: In the context of AZ-400, what does 'Shift Left' security mean in a DevOps pipeline?
- Moving security staff physically closer to development teams
- Integrating security testing and checks earlier in the development lifecycle, starting at coding and CI (Correct answer)
- Applying security controls only to the leftmost pipeline stages
- Shifting security budget allocation from operations to development
Correct answer: Integrating security testing and checks earlier in the development lifecycle, starting at coding and CI
'Shift Left' security means introducing security testing and vulnerability scanning as early as possible — during coding and CI — rather than only validating security at the end of the pipeline.
Question 3: Which Azure DevOps feature allows teams to require specific external validation checks (such as SonarQube or security scans) to pass before a pull request can be completed?
- Work item states
- Branch policies with status checks (Correct answer)
- Release gates
- Deployment slots
Correct answer: Branch policies with status checks
Branch policies with status checks allow teams to require external tools to report a passing status before a PR can be merged, enforcing quality and compliance gates.
Question 4: What is the purpose of 'Protected Resources' in Azure Pipelines?
- To encrypt pipeline variable values at rest
- To control which pipelines are authorized to use sensitive resources like environments and service connections (Correct answer)
- To prevent unauthorized users from viewing pipeline logs
- To restrict how frequently a pipeline can be triggered
Correct answer: To control which pipelines are authorized to use sensitive resources like environments and service connections
Protected Resources allow administrators to control which specific pipelines are authorized to use sensitive resources like environments, service connections, agent pools, and variable groups.
Question 5: In Azure DevOps, where would you configure mandatory human approvals before deploying to a production environment in a YAML pipeline?
- In the pipeline YAML file's trigger section
- In the Environment settings under Approvals and Checks (Correct answer)
- In the repository branch policies
- In the project's security settings under Permissions
Correct answer: In the Environment settings under Approvals and Checks
Production deployment approvals are configured in the Environment settings within Azure Pipelines under 'Approvals and Checks,' where specific approvers can be assigned per environment.
Question 6: Which Azure service provides a Secure Score and a regulatory compliance dashboard to help organizations track adherence to standards like PCI DSS and ISO 27001?
- Azure Advisor
- Microsoft Defender for Cloud (Correct answer)
- Azure Monitor
- Azure Service Health
Correct answer: Microsoft Defender for Cloud
Microsoft Defender for Cloud (formerly Azure Security Center) provides Secure Score and a built-in regulatory compliance dashboard to assess posture against frameworks like PCI DSS, ISO 27001, and NIST.
Question 7: What does Azure DevOps' SOC 2 Type II attestation primarily provide to enterprise customers?
- Proof that individual customer pipelines meet security requirements
- Third-party assurance that Azure DevOps service controls meet security, availability, and confidentiality criteria (Correct answer)
- Verification that all customer code repositories are encrypted
- Certification that Azure networks are secure
Correct answer: Third-party assurance that Azure DevOps service controls meet security, availability, and confidentiality criteria
Azure DevOps' SOC 2 Type II attestation provides third-party assurance that Microsoft's service controls for security, availability, processing integrity, confidentiality, and privacy meet the AICPA Trust Services Criteria.
AZ-400 Compliance & Governance 2
Which Azure Pipelines feature allows platform teams to define reusable, standardized pipeline definitions that other teams must extend from to enforce organizational compliance?