Microsoft AZ-400 Practice Test 86

Question 850

After the team applies this response: Enable vulnerability alerts and protected pull-request remediation workflow with release gates or reviewed exceptions. In the situation—A GitHub repository uses Dependabot alerts but developers never act on high-severity runtime dependency findings. Which evidence BEST demonstrates the response is effective?

Introduce a controlled vulnerable dependency and confirm a finding reaches an owner and blocks unsafe promotion.
Inspect all group memberships and verify prohibited operations are denied after the change.
Run allowed deployment operations and deliberately attempt unauthorized subscription-wide changes.
Inspect workflow token permissions and verify it can perform the required action but not unrelated repository writes.

Explanation

Correct Answer

The governing engineering principle is: Security alerts need accountable triage and enforcement before they reduce supply-chain risk.

Incorrect Answers

Effective authorization is the union of relevant role and group grants, not simply the most recent membership edit. The needed step here is to introduce a controlled vulnerable dependency and confirm a finding reaches an owner and blocks unsafe promotion.

Service connection use and Azure RBAC scope jointly define automation access boundaries. The appropriate remedy is to introduce a controlled vulnerable dependency and confirm a finding reaches an owner and blocks unsafe promotion.

Automation should rely on purpose-scoped integration identities rather than personal credentials. Instead, the response must introduce a controlled vulnerable dependency and confirm a finding reaches an owner and blocks unsafe promotion.

Question 851

Another company runs package scans weekly but keeps promoting builds with unreviewed critical vulnerabilities. Which engineering principle BEST explains the relevant requirement?

Sensitive deployment files require a security boundary distinct from ordinary source or artifact distribution.
Application integrations should receive only required repository access and authenticated event scope.
Sensitive information must remain outside redistributable build outputs even when securely retrieved earlier.
Security alerts need accountable triage and enforcement before they reduce supply-chain risk.

Explanation

Correct Answer

The second engineering situation illustrates the control boundary captured by this principle: Security alerts need accountable triage and enforcement before they reduce supply-chain risk. The scenario is not resolved by an unrelated pipeline or policy activity.

Incorrect Answers

Sensitive deployment files require a security boundary distinct from ordinary source or artifact distribution. That principle concerns design and implement a strategy for managing sensitive information in automation, whereas this specific incident is governed by: Security alerts need accountable triage and enforcement before they reduce supply-chain risk.

Application integrations should receive only required repository access and authenticated event scope. That principle concerns design and implement authentication and authorization methods, whereas this specific incident is governed by: Security alerts need accountable triage and enforcement before they reduce supply-chain risk.

Sensitive information must remain outside redistributable build outputs even when securely retrieved earlier. That principle concerns design and implement a strategy for managing sensitive information in automation, whereas this specific incident is governed by: Security alerts need accountable triage and enforcement before they reduce supply-chain risk.

Question 852

Another company runs package scans weekly but keeps promoting builds with unreviewed critical vulnerabilities. Which unsupported assumption should the engineer challenge FIRST?

A private repository does not guarantee all authorized readers should access production certificates.
Inviting someone to one repository does not justify exposing every private repository in the organization.
Enabling Dependabot alerts does not itself repair vulnerable dependencies in deployed applications.
Deleting a sensitive variable at the end of a script does not remove copies already embedded in artifacts.

Explanation

Correct Answer

Enabling Dependabot alerts does not itself repair vulnerable dependencies in deployed applications. This is the relevant unsupported assumption because security alerts need accountable triage and enforcement before they reduce supply-chain risk.

Incorrect Answers

This caution is valid in design and implement a strategy for managing sensitive information in automation, but it is not the failure assumption illustrated by this scenario. The directly relevant risk is: Enabling Dependabot alerts does not itself repair vulnerable dependencies in deployed applications.

This caution is valid in design and implement authentication and authorization methods, but it is not the failure assumption illustrated by this scenario. The directly relevant risk is: Enabling Dependabot alerts does not itself repair vulnerable dependencies in deployed applications.

Question 853

An Azure DevOps repository lacks secret scanning, and a newly committed API key appears in public package source. Which design or operational change MOST directly satisfies the requirement?

Enable supported GitHub Advanced Security for Azure DevOps secret scanning with appropriate alert and response policies.
Scope secrets to protected deployment environments with required reviewers and trusted branch policies.
Choose identity assignment based on intended reuse and lifetime, with separate least-privilege grants per application boundary.
Update credential consumers to reference the managed secret and invalidate exposed previous credentials during rotation.

Explanation

Correct Answer

Secret scanning complements preventive credential controls by finding exposures in committed content. The most directly responsive design or operational step is: Enable supported GitHub Advanced Security for Azure DevOps secret scanning with appropriate alert and response policies. Confirm the result by: Commit a safe secret-scanning test pattern and verify an alert and escalation without using a live secret.

Incorrect Answers

Secret availability should follow environment trust and job function, not global workflow visibility. The relevant control is to enable supported GitHub Advanced Security for Azure DevOps secret scanning with appropriate alert and response policies.

User-assigned identity reuse is a deliberate shared trust boundary, not merely a configuration convenience. The needed step here is to enable supported GitHub Advanced Security for Azure DevOps secret scanning with appropriate alert and response policies.

Credential rotation is effective only when every consumer transitions and stale credentials lose validity. The appropriate remedy is to enable supported GitHub Advanced Security for Azure DevOps secret scanning with appropriate alert and response policies.

Question 854

After the team applies this response: Enable supported GitHub Advanced Security for Azure DevOps secret scanning with appropriate alert and response policies. In the situation—An Azure DevOps repository lacks secret scanning, and a newly committed API key appears in public package source. Which evidence BEST demonstrates the response is effective?

Run allowed deployment operations and deliberately attempt unauthorized subscription-wide changes.
Audit effective inherited permissions and test required contribution versus restricted policy editing.
Commit a safe secret-scanning test pattern and verify an alert and escalation without using a live secret.
Request the intended secret as the managed identity and verify unrelated secrets remain inaccessible.

Explanation

Correct Answer

This evidence directly verifies the proposed control under the stated failure scenario: Commit a safe secret-scanning test pattern and verify an alert and escalation without using a live secret. The governing engineering principle is: Secret scanning complements preventive credential controls by finding exposures in committed content.

Incorrect Answers

Service connection use and Azure RBAC scope jointly define automation access boundaries. The appropriate comparison is: Commit a safe secret-scanning test pattern and verify an alert and escalation without using a live secret.

Source management privileges should distinguish day-to-day contribution from changing the enforcement rules. The relevant evidence instead is: Commit a safe secret-scanning test pattern and verify an alert and escalation without using a live secret.

Managed identity removes application-secret management when the target service supports Entra authentication. The acceptance criterion here is: Commit a safe secret-scanning test pattern and verify an alert and escalation without using a live secret.

Question 855

Another organization wants to detect exposed credentials in Git before deployment artifacts are distributed. Which engineering principle BEST explains the relevant requirement?

GITHUB_TOKEN rights should be declared to match each job's actual operations.
External collaboration should use the smallest repository and permission scope required for the role.
Secret scanning complements preventive credential controls by finding exposures in committed content.
Environment isolation includes credentials and data permissions as well as resource names.

Explanation

Correct Answer

The second engineering situation illustrates the control boundary captured by this principle: Secret scanning complements preventive credential controls by finding exposures in committed content. The scenario is not resolved by an unrelated pipeline or policy activity.

Incorrect Answers

GITHUB_TOKEN rights should be declared to match each job's actual operations. That principle concerns design and implement authentication and authorization methods, whereas this specific incident is governed by: Secret scanning complements preventive credential controls by finding exposures in committed content.

External collaboration should use the smallest repository and permission scope required for the role. That principle concerns design and implement authentication and authorization methods, whereas this specific incident is governed by: Secret scanning complements preventive credential controls by finding exposures in committed content.

Environment isolation includes credentials and data permissions as well as resource names. That principle concerns design and implement a strategy for managing sensitive information in automation, whereas this specific incident is governed by: Secret scanning complements preventive credential controls by finding exposures in committed content.

Question 856

Another organization wants to detect exposed credentials in Git before deployment artifacts are distributed. Which unsupported assumption should the engineer challenge FIRST?

Sharing one managed identity across services can unintentionally combine their effective privileges.
A scanner detecting a leaked credential does not remove the need to revoke the credential.
A private repository does not guarantee all authorized readers should access production certificates.
Calling a deployment staging does not protect production if the workflow still uses production credentials.

Explanation

Correct Answer

A scanner detecting a leaked credential does not remove the need to revoke the credential. This is the relevant unsupported assumption because secret scanning complements preventive credential controls by finding exposures in committed content.

Incorrect Answers

This caution is valid in design and implement authentication and authorization methods, but it is not the failure assumption illustrated by this scenario. The directly relevant risk is: A scanner detecting a leaked credential does not remove the need to revoke the credential.

This caution is valid in design and implement a strategy for managing sensitive information in automation, but it is not the failure assumption illustrated by this scenario. The directly relevant risk is: A scanner detecting a leaked credential does not remove the need to revoke the credential.

Question 857

A GitHub repository runs CodeQL code scanning but dismisses every high-severity alert as a false positive without review. Which design or operational change MOST directly satisfies the requirement?

Use a scoped Azure Resource Manager service connection based on workload identity federation or appropriate managed identity.
Use secure files or Key Vault-backed certificate delivery with protected pipeline authorization and short-lived access.
Scope service connections and Entra RBAC to specific environments or resource groups and authorize only intended pipelines.
Configure code scanning with severity-aware triage, review assignments and auditable exceptions.

Explanation

Correct Answer

Static code analysis supports security only when findings enter an accountable decision workflow. The most directly responsive design or operational step is: Configure code scanning with severity-aware triage, review assignments and auditable exceptions. Confirm the result by: Inject a known test finding and verify its alert, review history and release disposition.

Incorrect Answers

Automation credentials should use narrowly scoped non-personal identities and minimize long-lived secrets. Instead, the response must configure code scanning with severity-aware triage, review assignments and auditable exceptions.

Sensitive deployment files require a security boundary distinct from ordinary source or artifact distribution. The relevant control is to configure code scanning with severity-aware triage, review assignments and auditable exceptions.

Service connection use and Azure RBAC scope jointly define automation access boundaries. The needed step here is to configure code scanning with severity-aware triage, review assignments and auditable exceptions.

Question 858

After the team applies this response: Configure code scanning with severity-aware triage, review assignments and auditable exceptions. In the situation—A GitHub repository runs CodeQL code scanning but dismisses every high-severity alert as a false positive without review. Which evidence BEST demonstrates the response is effective?

Audit effective inherited permissions and test required contribution versus restricted policy editing.
Inject a known test finding and verify its alert, review history and release disposition.
Inspect produced ZIPs and container layers and verify a test secret causes release failure.
Test active secret-version access, old credential invalidation and application recovery after the rotation.

Explanation

Correct Answer

The governing engineering principle is: Static code analysis supports security only when findings enter an accountable decision workflow.

Incorrect Answers

Source management privileges should distinguish day-to-day contribution from changing the enforcement rules. What must be demonstrated is: Inject a known test finding and verify its alert, review history and release disposition.

Sensitive information must remain outside redistributable build outputs even when securely retrieved earlier. The appropriate comparison is: Inject a known test finding and verify its alert, review history and release disposition.

Credential rotation is effective only when every consumer transitions and stale credentials lose validity. The relevant evidence instead is: Inject a known test finding and verify its alert, review history and release disposition.

Question 859

Another team publishes SARIF reports but cannot show who triaged security findings before release. Which engineering principle BEST explains the relevant requirement?

Credential rotation is effective only when every consumer transitions and stale credentials lose validity.
Environment isolation includes credentials and data permissions as well as resource names.
Managed identity removes application-secret management when the target service supports Entra authentication.
Static code analysis supports security only when findings enter an accountable decision workflow.

Explanation

Correct Answer

The second engineering situation illustrates the control boundary captured by this principle: Static code analysis supports security only when findings enter an accountable decision workflow. The scenario is not resolved by an unrelated pipeline or policy activity.

Incorrect Answers

Credential rotation is effective only when every consumer transitions and stale credentials lose validity. That principle concerns design and implement a strategy for managing sensitive information in automation, whereas this specific incident is governed by: Static code analysis supports security only when findings enter an accountable decision workflow.

Environment isolation includes credentials and data permissions as well as resource names. That principle concerns design and implement a strategy for managing sensitive information in automation, whereas this specific incident is governed by: Static code analysis supports security only when findings enter an accountable decision workflow.

Managed identity removes application-secret management when the target service supports Entra authentication. That principle concerns design and implement authentication and authorization methods, whereas this specific incident is governed by: Static code analysis supports security only when findings enter an accountable decision workflow.

Question 860

Another team publishes SARIF reports but cannot show who triaged security findings before release. Which unsupported assumption should the engineer challenge FIRST?

Calling a deployment staging does not protect production if the workflow still uses production credentials.
A long-lived personal token becomes safe only because it is stored in a repository secret setting.
A generated SARIF file is not equivalent to an approved security risk disposition.
Having Contributor access to a resource group does not necessarily permit reading every Key Vault secret.

Explanation

Correct Answer

A generated SARIF file is not equivalent to an approved security risk disposition. This is the relevant unsupported assumption because static code analysis supports security only when findings enter an accountable decision workflow.

Incorrect Answers

This caution is valid in design and implement a strategy for managing sensitive information in automation, but it is not the failure assumption illustrated by this scenario. The directly relevant risk is: A generated SARIF file is not equivalent to an approved security risk disposition.

This caution is valid in design and implement authentication and authorization methods, but it is not the failure assumption illustrated by this scenario. The directly relevant risk is: A generated SARIF file is not equivalent to an approved security risk disposition.

This caution is valid in design and implement a strategy for managing sensitive information in automation, but it is not the failure assumption illustrated by this scenario. The directly relevant risk is: A generated SARIF file is not equivalent to an approved security risk disposition.

Designing and Implementing Microsoft DevOps Solutions (AZ-400) Practice Tests

Microsoft AZ-400 Practice Test 84 - 10 Questions (Last Reviewed 19-Oct-2026)
Microsoft AZ-400 Practice Test 85 - 10 Questions (Last Reviewed 18-Oct-2026)
Microsoft AZ-400 Practice Test 86 - 10 Questions (Last Reviewed 17-Oct-2026)
Microsoft AZ-400 Practice Test 87 - 10 Questions (Last Reviewed 16-Oct-2026)
Microsoft AZ-400 Practice Test 88 - 10 Questions (Last Reviewed 15-Oct-2026)

Pass Your Microsoft AZ-400 Exam Easy!

Question 850

Explanation

Correct Answer

Incorrect Answers

Question 851

Explanation

Correct Answer

Incorrect Answers

Question 852

Explanation

Correct Answer

Incorrect Answers

Question 853

Explanation

Correct Answer

Incorrect Answers

Question 854

Explanation

Correct Answer

Incorrect Answers

Question 855

Explanation

Correct Answer

Incorrect Answers

Question 856

Explanation

Correct Answer

Incorrect Answers

Question 857

Explanation

Correct Answer

Incorrect Answers

Question 858

Explanation

Correct Answer

Incorrect Answers

Question 859

Explanation

Correct Answer

Incorrect Answers

Question 860

Explanation

Correct Answer

Incorrect Answers

Designing and Implementing Microsoft DevOps Solutions (AZ-400) Practice Tests