Develop a security and compliance plan
Practise only this domain. 40 questions with explanations, 20 at a time.
Start this domainSample questions
- A governance team wants the policy to block creation or update of App Service resources whenever HTTPS-only is not enabled. Which Azure Policy effect should the definition use?Medium
- A logistics company wants every resource that supports diagnostic logs to send them to one central Log Analytics workspace. Existing resources that lack the setting, and any new ones, must be corrected without manual steps. Which Azure Policy effect should be used?Medium
- A payments company runs self-hosted pipeline agents that must reach an Azure Key Vault and a private storage account without crossing the public internet. The security team also wants the agent subnet's inbound and outbound flows tightly restricted. What is the best design?Hard
- A healthcare software vendor must keep pipeline run history and published build outputs for seven years to satisfy an audit rule. The platform team wants that enforced consistently for every pipeline in one Azure DevOps project. Where should the retention rule live?Easy
- A logistics firm runs a deployment job on a self-hosted agent VM, authenticating with a service principal whose client secret expires every few months. Lapses have caused outages when nobody noticed the expiry. The Azure team wants to eliminate the recurring manual secret handling. What change addresses the root problem best?Hard
- A platform team must guarantee that pods on an AKS cluster can only run container images pulled from the organization's approved registries. Which control enforces this at deployment time?Hard
- A team wants its CI pipeline to stop a build when someone commits an API key or a connection string into the repository. Which kind of tool should it add?Easy
- A company connects Azure DevOps pipelines to its Azure subscriptions and wants the safest way to authenticate those service connections. Which option is preferred?Hard
- A compliance program requires that every storage account in a subscription use customer-managed keys for encryption at rest, rather than the default Microsoft-managed keys. Which policy effect blocks non-compliant accounts from being created?Medium
- A public web application must only be reached over HTTPS, and browsers should refuse plain HTTP even if a user types it. Which combination provides this?Medium