100% Latest & Updated Microsoft AZ-400 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 790
A third-party release integration asks for full organization repository access even though it needs only one repository's issues. Which risk is directly created by the described failure?
- An unsuitable identity method can produce failed deployments or long-lived credential leakage.
- Excess collaborator authority can enable source tampering, secret access, or unauthorized governance changes.
- Personal credential dependence can interrupt automation or overexpose source repositories.
- Excessive roles create unnecessary risk while misapplied access levels block legitimate collaboration.
Explanation
Correct Answer
C:Personal credential dependence can interrupt automation or overexpose source repositories. This is the directly relevant business or security consequence of github apps versus personal access tokens for automation. Root cause: GitHub Apps support app-scoped installation identity instead of inheriting all of a person's broad permissions.
Incorrect Answers
A:An unsuitable identity method can produce failed deployments or long-lived credential leakage. That risk is relevant to managed identity versus entra service principal for azure deployment, but the specific unresolved condition here concerns github apps versus personal access tokens for automation and has a different direct consequence.
B:Excess collaborator authority can enable source tampering, secret access, or unauthorized governance changes. That risk is relevant to github organization roles and external collaborator access, but the specific unresolved condition here concerns github apps versus personal access tokens for automation and has a different direct consequence.
D:Excessive roles create unnecessary risk while misapplied access levels block legitimate collaboration. That risk is relevant to azure devops stakeholder access and team security groups, but the specific unresolved condition here concerns github apps versus personal access tokens for automation and has a different direct consequence.
Question 791
A YAML pipeline in a low-trust project uses a service connection that can deploy to every production subscription. What change should the DevOps engineer implement FIRST for the stated Azure DevOps requirement?
- Configure narrowly scoped Azure DevOps service connections with explicit pipeline authorization and controlled identity roles.
- Grant repository-level read or triage roles as appropriate and keep organization administration separate from contributions.
- Use a GitHub App with narrowly scoped permissions and installation boundaries when suitable, avoiding unnecessary standing user tokens.
- Choose managed identity for supported Azure-hosted workloads and scoped federated service principals for appropriate external workflows.
Explanation
Correct Answer
A:Configure narrowly scoped Azure DevOps service connections with explicit pipeline authorization and controlled identity roles. Service connections delegate cloud authority, and access should be limited by both pipeline resource authorization and Azure identity role. Overbroad service connections create a path from untrusted CI jobs to sensitive production resources.
Incorrect Answers
B:Grant repository-level read or triage roles as appropriate and keep organization administration separate from contributions. That applies to github organization roles and external collaborator access, not azure devops service connection authorization and scope.
C:Use a GitHub App with narrowly scoped permissions and installation boundaries when suitable, avoiding unnecessary standing user tokens.
D:Choose managed identity for supported Azure-hosted workloads and scoped federated service principals for appropriate external workflows. That applies to managed identity versus entra service principal for azure deployment, not azure devops service connection authorization and scope.
Question 792
A YAML pipeline in a low-trust project uses a service connection that can deploy to every production subscription. What check would most directly verify this Microsoft DevOps control?
- Exercise token acquisition in each environment and validate intended roles, resource scope, and secretless authentication.
- Log in as a test business stakeholder and verify work item access without unintended repository or pipeline privileges.
- Attempt deployment through approved and unapproved pipelines and inspect effective Azure RBAC and service connection authorization.
- Inspect effective permissions under a sample collaborator identity and test denial of organization settings access.
Explanation
Correct Answer
C:Attempt deployment through approved and unapproved pipelines and inspect effective Azure RBAC and service connection authorization. Service connections delegate cloud authority, and access should be limited by both pipeline resource authorization and Azure identity role.
Incorrect Answers
A:Exercise token acquisition in each environment and validate intended roles, resource scope, and secretless authentication. That applies to managed identity versus entra service principal for azure deployment, not azure devops service connection authorization and scope.
B:Log in as a test business stakeholder and verify work item access without unintended repository or pipeline privileges. That applies to azure devops stakeholder access and team security groups, not azure devops service connection authorization and scope.
D:Inspect effective permissions under a sample collaborator identity and test denial of organization settings access. That applies to github organization roles and external collaborator access, not azure devops service connection authorization and scope.
Question 793
A YAML pipeline in a low-trust project uses a service connection that can deploy to every production subscription. What is the underlying reason the existing approach fails?
- Service connections delegate cloud authority, and access should be limited by both pipeline resource authorization and Azure identity role.
- GitHub Apps support app-scoped installation identity instead of inheriting all of a person's broad permissions.
- Azure DevOps licensing and security permissions are separate controls that should reflect the user's responsibility.
- Identity method selection depends on where the workload runs and whether its platform can issue managed identity tokens.
Explanation
Correct Answer
A:Service connections delegate cloud authority, and access should be limited by both pipeline resource authorization and Azure identity role. Overbroad service connections create a path from untrusted CI jobs to sensitive production resources.
Incorrect Answers
B:GitHub Apps support app-scoped installation identity instead of inheriting all of a person's broad permissions. That applies to github apps versus personal access tokens for automation, not controlling principle for azure devops service connection authorization and scope.
C:Azure DevOps licensing and security permissions are separate controls that should reflect the user's responsibility. That applies to azure devops stakeholder access and team security groups, not controlling principle for azure devops service connection authorization and scope.
D:Identity method selection depends on where the workload runs and whether its platform can issue managed identity tokens. That applies to managed identity versus entra service principal for azure deployment, not controlling principle for azure devops service connection authorization and scope.
Question 794
A YAML pipeline in a low-trust project uses a service connection that can deploy to every production subscription. Which recurring control most directly sustains the required behavior?
- Audit service connection usage and restrict credential changes when projects and teams are reorganized.
- Periodically recertify external collaborators and restrict who can add owners or change SSO requirements.
- Review role assignments, token audiences, and unused client credentials as pipeline hosting changes.
- Review project group memberships and access levels after team reorganizations or role changes.
Explanation
Correct Answer
A:Audit service connection usage and restrict credential changes when projects and teams are reorganized. Overbroad service connections create a path from untrusted CI jobs to sensitive production resources.
Incorrect Answers
B:Periodically recertify external collaborators and restrict who can add owners or change SSO requirements. This helps sustain a control for github organization roles and external collaborator access; it does not directly stop recurrence of azure devops service connection authorization and scope described in this case.
C:Review role assignments, token audiences, and unused client credentials as pipeline hosting changes.
D:Review project group memberships and access levels after team reorganizations or role changes. This helps sustain a control for azure devops stakeholder access and team security groups; it does not directly stop recurrence of azure devops service connection authorization and scope described in this case.
Question 795
A YAML pipeline in a low-trust project uses a service connection that can deploy to every production subscription. What is the MOST important consequence if this issue remains unresolved?
- An unsuitable identity method can produce failed deployments or long-lived credential leakage.
- Personal credential dependence can interrupt automation or overexpose source repositories.
- Excessive roles create unnecessary risk while misapplied access levels block legitimate collaboration.
- Overbroad service connections create a path from untrusted CI jobs to sensitive production resources.
Explanation
Correct Answer
D:Overbroad service connections create a path from untrusted CI jobs to sensitive production resources. This is the directly relevant business or security consequence of azure devops service connection authorization and scope. Root cause: Service connections delegate cloud authority, and access should be limited by both pipeline resource authorization and Azure identity role.
Incorrect Answers
A:An unsuitable identity method can produce failed deployments or long-lived credential leakage. That risk is relevant to managed identity versus entra service principal for azure deployment, but the specific unresolved condition here concerns azure devops service connection authorization and scope and has a different direct consequence.
B:Personal credential dependence can interrupt automation or overexpose source repositories. That risk is relevant to github apps versus personal access tokens for automation, but the specific unresolved condition here concerns azure devops service connection authorization and scope and has a different direct consequence.
C:Excessive roles create unnecessary risk while misapplied access levels block legitimate collaboration. That risk is relevant to azure devops stakeholder access and team security groups, but the specific unresolved condition here concerns azure devops service connection authorization and scope and has a different direct consequence.
Question 796
An Azure release fails because its service principal has contributor rights only to a staging resource group, not the intended production scope. What action is MOST appropriate given these constraints?
- Grant repository-level read or triage roles as appropriate and keep organization administration separate from contributions.
- Configure narrowly scoped Azure DevOps service connections with explicit pipeline authorization and controlled identity roles.
- Use a GitHub App with narrowly scoped permissions and installation boundaries when suitable, avoiding unnecessary standing user tokens.
- Choose managed identity for supported Azure-hosted workloads and scoped federated service principals for appropriate external workflows.
Explanation
Correct Answer
B:Configure narrowly scoped Azure DevOps service connections with explicit pipeline authorization and controlled identity roles. Service connections delegate cloud authority, and access should be limited by both pipeline resource authorization and Azure identity role. Overbroad service connections create a path from untrusted CI jobs to sensitive production resources.
Incorrect Answers
A:Grant repository-level read or triage roles as appropriate and keep organization administration separate from contributions. That applies to github organization roles and external collaborator access, not azure devops service connection authorization and scope.
C:Use a GitHub App with narrowly scoped permissions and installation boundaries when suitable, avoiding unnecessary standing user tokens.
D:Choose managed identity for supported Azure-hosted workloads and scoped federated service principals for appropriate external workflows. That applies to managed identity versus entra service principal for azure deployment, not azure devops service connection authorization and scope.
Question 797
An Azure release fails because its service principal has contributor rights only to a staging resource group, not the intended production scope. Which test MOST directly confirms the solution?
- Exercise token acquisition in each environment and validate intended roles, resource scope, and secretless authentication.
- Log in as a test business stakeholder and verify work item access without unintended repository or pipeline privileges.
- Attempt deployment through approved and unapproved pipelines and inspect effective Azure RBAC and service connection authorization.
- Inspect effective permissions under a sample collaborator identity and test denial of organization settings access.
Explanation
Correct Answer
C:Attempt deployment through approved and unapproved pipelines and inspect effective Azure RBAC and service connection authorization. Service connections delegate cloud authority, and access should be limited by both pipeline resource authorization and Azure identity role.
Incorrect Answers
A:Exercise token acquisition in each environment and validate intended roles, resource scope, and secretless authentication. That applies to managed identity versus entra service principal for azure deployment, not azure devops service connection authorization and scope.
B:Log in as a test business stakeholder and verify work item access without unintended repository or pipeline privileges. That applies to azure devops stakeholder access and team security groups, not azure devops service connection authorization and scope.
D:Inspect effective permissions under a sample collaborator identity and test denial of organization settings access. That applies to github organization roles and external collaborator access, not azure devops service connection authorization and scope.
Question 798
An Azure release fails because its service principal has contributor rights only to a staging resource group, not the intended production scope. What is the underlying reason the existing approach fails?
- Azure DevOps licensing and security permissions are separate controls that should reflect the user's responsibility.
- GitHub Apps support app-scoped installation identity instead of inheriting all of a person's broad permissions.
- Service connections delegate cloud authority, and access should be limited by both pipeline resource authorization and Azure identity role.
- Identity method selection depends on where the workload runs and whether its platform can issue managed identity tokens.
Explanation
Correct Answer
C:Service connections delegate cloud authority, and access should be limited by both pipeline resource authorization and Azure identity role. Overbroad service connections create a path from untrusted CI jobs to sensitive production resources.
Incorrect Answers
A:Azure DevOps licensing and security permissions are separate controls that should reflect the user's responsibility. That applies to azure devops stakeholder access and team security groups, not controlling principle for azure devops service connection authorization and scope.
B:GitHub Apps support app-scoped installation identity instead of inheriting all of a person's broad permissions. That applies to github apps versus personal access tokens for automation, not controlling principle for azure devops service connection authorization and scope.
D:Identity method selection depends on where the workload runs and whether its platform can issue managed identity tokens. That applies to managed identity versus entra service principal for azure deployment, not controlling principle for azure devops service connection authorization and scope.
Question 799
An Azure release fails because its service principal has contributor rights only to a staging resource group, not the intended production scope. Which recurring control most directly sustains the required behavior?
- Audit service connection usage and restrict credential changes when projects and teams are reorganized.
- Review project group memberships and access levels after team reorganizations or role changes.
- Review role assignments, token audiences, and unused client credentials as pipeline hosting changes.
- Periodically recertify external collaborators and restrict who can add owners or change SSO requirements.
Explanation
Correct Answer
A:Audit service connection usage and restrict credential changes when projects and teams are reorganized. Overbroad service connections create a path from untrusted CI jobs to sensitive production resources.
Incorrect Answers
B:Review project group memberships and access levels after team reorganizations or role changes. This helps sustain a control for azure devops stakeholder access and team security groups; it does not directly stop recurrence of azure devops service connection authorization and scope described in this case.
C:Review role assignments, token audiences, and unused client credentials as pipeline hosting changes.
D:Periodically recertify external collaborators and restrict who can add owners or change SSO requirements. This helps sustain a control for github organization roles and external collaborator access; it does not directly stop recurrence of azure devops service connection authorization and scope described in this case.
Question 800
An Azure release fails because its service principal has contributor rights only to a staging resource group, not the intended production scope. Choose THREE measures that implement and verify an effective Azure DevOps response to this specific situation. (Choose THREE.)
- Declare azure devops service connection authorization and scope successful solely from a green pipeline status and skip checking its actual control outcome.
- Attempt deployment through approved and unapproved pipelines and inspect effective Azure RBAC and service connection authorization.
- Dismiss the known risk for azure devops service connection authorization and scope and keep no evidence or accountable owner after deployment.
- Audit service connection usage and restrict credential changes when projects and teams are reorganized.
- Bypass review and testing for azure devops service connection authorization and scope whenever the release deadline is urgent, applying the change to production immediately.
- Configure narrowly scoped Azure DevOps service connections with explicit pipeline authorization and controlled identity roles.
Explanation
Correct Answers
B:Attempt deployment through approved and unapproved pipelines and inspect effective Azure RBAC and service connection authorization. Service connections delegate cloud authority, and access should be limited by both pipeline resource authorization and Azure identity role.
D:Audit service connection usage and restrict credential changes when projects and teams are reorganized. Overbroad service connections create a path from untrusted CI jobs to sensitive production resources.
F:Configure narrowly scoped Azure DevOps service connections with explicit pipeline authorization and controlled identity roles. Service connections delegate cloud authority, and access should be limited by both pipeline resource authorization and Azure identity role. Overbroad service connections create a path from untrusted CI jobs to sensitive production resources.
Incorrect Answers
A:Declare azure devops service connection authorization and scope successful solely from a green pipeline status and skip checking its actual control outcome. It conflicts with the stated operating condition: Service connections delegate cloud authority, and access should be limited by both pipeline resource authorization and Azure identity role.
C:Dismiss the known risk for azure devops service connection authorization and scope and keep no evidence or accountable owner after deployment. It conflicts with the stated operating condition: Service connections delegate cloud authority, and access should be limited by both pipeline resource authorization and Azure identity role.
E:Bypass review and testing for azure devops service connection authorization and scope whenever the release deadline is urgent, applying the change to production immediately. It conflicts with the stated operating condition: Service connections delegate cloud authority, and access should be limited by both pipeline resource authorization and Azure identity role.
Designing and Implementing Microsoft DevOps Solutions (AZ-400) Practice Tests
