AZ-400 Security and Compliance 2 — Questions and Answers
Question 1: What does the OWASP Top 10 represent in the context of application security?
- The 10 most popular DevOps toolchains
- A list of the 10 most critical web application security risks (Correct answer)
- The 10 Azure compliance certification categories
- The 10 most expensive security breach incidents
Correct answer: A list of the 10 most critical web application security risks
The OWASP Top 10 is a standard awareness document published by the Open Web Application Security Project listing the 10 most critical security risks to web applications.
Question 2: In Azure Pipelines, what is the recommended way to prevent a secret variable's value from appearing in pipeline logs?
- Encrypt the entire pipeline YAML file with Azure Key Vault
- Mark the variable as secret in the pipeline variable settings (Correct answer)
- Store the secret in a plain-text config file committed to the repo
- Prepend an underscore to the variable name
Correct answer: Mark the variable as secret in the pipeline variable settings
Marking a pipeline variable as secret causes Azure Pipelines to mask its value in all logs, preventing accidental exposure of credentials.
Question 3: Which Microsoft security product integrates with Azure DevOps repositories to provide code scanning, secret scanning, and dependency review?
- Microsoft Defender for Cloud
- Microsoft Sentinel
- GitHub Advanced Security (Correct answer)
- Azure Security Center Classic
Correct answer: GitHub Advanced Security
GitHub Advanced Security (GHAS) provides code scanning (SAST), secret scanning, and dependency review and can be enabled on Azure DevOps repositories as well as GitHub.
Question 4: What is the purpose of a security gate configured in an Azure DevOps release pipeline?
- To block deployments during maintenance windows only
- To automatically pause or reject releases that fail security compliance checks (Correct answer)
- To encrypt all artifacts during transit between stages
- To authenticate end-users accessing the deployed application
Correct answer: To automatically pause or reject releases that fail security compliance checks
Security gates evaluate compliance conditions (e.g., calling a security API or checking Azure Policy compliance) and halt a release if the criteria are not met.
Question 5: Which Azure service provides unified security posture management and gives resources a 'Secure Score' to prioritize security improvements?
- Azure Monitor
- Microsoft Defender for Cloud (Correct answer)
- Microsoft Sentinel
- Azure Information Protection
Correct answer: Microsoft Defender for Cloud
Microsoft Defender for Cloud (formerly Azure Security Center) aggregates security recommendations across resources and surfaces them as a Secure Score to help teams prioritize improvements.
Question 6: What does the principle of least privilege require when configuring service connections and pipeline permissions in Azure DevOps?
- Granting pipelines owner-level access for simplicity
- Granting only the minimum permissions necessary to perform the required tasks (Correct answer)
- Sharing a single high-privilege service account across all projects
- Rotating passwords every 90 days regardless of permission scope
Correct answer: Granting only the minimum permissions necessary to perform the required tasks
Least privilege means each pipeline, service connection, and user should have only the permissions they need—nothing more—reducing the blast radius of a compromise.
Question 7: Which Azure DevOps settings allow administrators to restrict which users can queue builds, manage environments, and access pipeline secrets?
- Azure Active Directory conditional access policies
- Pipeline permissions and environment security settings (Correct answer)
- Work item area path restrictions
- Repository default branch settings
Correct answer: Pipeline permissions and environment security settings
Azure Pipelines and Environments each have their own permission settings where administrators can grant or restrict queue, manage, and use access per user or group.
AZ-400 Security and Compliance 2
What does the OWASP Top 10 represent in the context of application security?