AZ-400 Compliance & Governance 3

Question 1

What is the primary benefit of integrating Azure Key Vault with Azure Pipelines for secrets management?

Accepted Answer

It allows pipelines to retrieve sensitive values at runtime without hardcoding them in pipeline code or plain-text variables

Answer

It compresses pipeline artifacts before storage

Answer

It encrypts communication between pipeline agents

Answer

It manages encryption keys for Azure Blob Storage only

Question 2

In compliance-focused Azure DevOps implementations, why should service connections used for development environments be kept separate from those used for production?

Accepted Answer

Separation enforces least-privilege access and prevents development pipelines from accidentally modifying production resources

Answer

Production service connections operate faster than development ones

Answer

Azure requires separate service connections for billing cost allocation

Answer

Development connections cannot authenticate to Azure Resource Manager

Question 3

What Azure DevOps capability enables end-to-end traceability from requirements to deployment by linking commits, builds, and releases to specific work items?

Accepted Answer

Work item traceability through linked commits, builds, and deployments

Answer

Pipeline caching for artifact reuse

Answer

Deployment slot swapping

Answer

Pipeline environment variables

Question 4

What does the concept of 'immutable artifacts' ensure in a compliance-focused DevOps pipeline?

Accepted Answer

The exact binary tested in one environment is promoted and deployed to all subsequent environments unchanged

Answer

Artifacts are automatically deleted after each deployment to save storage

Answer

Artifacts are stored in read-only Azure Blob containers with no download access

Answer

Artifacts require multi-factor authentication to access

Question 5

What Azure DevOps setting controls which users can create, manage, and run pipelines within a project?

Accepted Answer

Pipeline permissions combined with Azure DevOps RBAC roles

Answer

Branch policies on the default branch

Answer

Agent pool size configurations

Answer

Repository visibility and fork settings

Question 6

Which Azure service or tooling can scan Infrastructure as Code (IaC) templates such as ARM, Bicep, or Terraform files for security misconfigurations before deployment?

Accepted Answer

Microsoft Defender for DevOps with IaC scanning

Answer

Azure Cost Management and Billing

Answer

Azure Advisor cost recommendations

Answer

Azure Update Management

Question 7

Which Azure DevOps governance mechanism ensures that only pipelines explicitly listed in a resource's approval list can consume that resource, such as a production environment or shared service connection?

Accepted Answer

Pipeline resource authorization (allowlist-based access control)

Answer

Branch protection rules

Answer

Work item area path restrictions

Answer

Project-level visibility settings