QUESTION: 165 Exam Topic: Develop a security and compliance plan Questions

DRAG DROP (Drag and Drop is not supported)
You have an Azure Key Vault that contains an encryption key named key1.
You plan to create a Log Analytics workspace that will store logging data.
You need to encrypt the workspace by using key1.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:

See Explanation section for answer.

Answer(s): A

Explanation:

Customer-Managed key provisioning steps (assuming there already is an Azure Key Vault):

Step 1: Enable soft delete for the key vault.
The Azure Key Vault must be configured as recoverable, to protect your key and the access to your data in Azure Monitor. You can verify this configuration under properties in your Key Vault, both Soft delete and Purge protection should be enabled.

Step 2: Create a Log Analytics cluster.
Clusters uses managed identity for data encryption with your Key Vault. Configure identity type property to SystemAssigned when creating your cluster to allow access to your Key Vault for "wrap" and "unwrap" operations.

Step 3: Grant permissions to the key vault.
Grant Key Vault permissions.
Create Access Policy in Key Vault to grants permissions to your cluster. These permissions are used by the underlay cluster storage. Open your Key Vault in
Azure portal and click Access Policies then + Add Access Policy to create a policy with these settings:
Key permissions" select Get, Wrap Key and Unwrap Key.
Etc.

1. Creating cluster
2. Granting permissions to your Key Vault
3. Updating cluster with key identifier details
4. Linking workspaces

Step 4: Link workspace
Link workspace to cluster.
This step should be performed only after the cluster provisioning. If you link workspaces and ingest data prior to the provisioning, ingested data will be dropped and won't be recoverable.

Reference:

https://docs.microsoft.com/en-us/azure/azure-monitor/logs/customer-managed-keys

Reveal Solution Next Question

QUESTION: 166 Exam Topic: Develop a security and compliance plan Questions

You use release pipelines in Azure Pipelines to deploy an app. Secrets required be the pipeline are stored as pipeline variables. Logging of commands is enabled for the Azure Pipelines agent.
You need to prevent the values of the secrets from being logged.
What should you do?

Store the secrets in the environment variables instead of the pipeline variables.
Pass the secrets on the command line instead of in the pipeline variables.
Apply a prefix of secret to the name of the variables.
Echo the values of the secrets to the command line.

Answer(s): A

Explanation:

Don't set secret variables in your YAML file. Operating systems often log commands for the processes that they run, and you wouldn't want the log to include a secret that you passed in as an input. Use the script's environment or map the variable within the variables block to pass secrets to your pipeline.
Incorrect Answers:
B: Never pass secrets on the command line.
C: Adding a prefix does not make the variable a secret. The issecret property makes it secret but does not prevent logging of the secret.
D: Never echo secrets as output.

Reference:

https://docs.microsoft.com/en-us/azure/devops/pipelines/process/variables?view=azure-devops&tabs=yaml%2Cbatch https://docs.microsoft.com/en-us/azure/devops/pipelines/scripts/logging-commands?view=azure-devops&tabs=bash
Community vote distribution

Reveal Solution Next Question

QUESTION: 167 Exam Topic: Develop a security and compliance plan Questions

DRAG DROP (Drag and Drop is not supported)
You need to deploy a new project in Azure DevOps that has the following requirements:
-The lead developer must be able to create repositories, manage permissions, manage policies, and contribute to the repository.
-Developers must be able to contribute to the repository and create branches, but NOT bypass policies when pushing builds.
-Project managers must only be able to view the repository.
-The principle of least privilege must be used.

You create a new Azure DevOps project team for each role.
To which Azure DevOps groups should you add each team? To answer, drag the appropriate groups to the correct teams. Each group may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.
Select and Place:

See Explanation section for answer.

Answer(s): A

Explanation:

Box 1: Readers
Project managers must only be able to view the repository.
Only read permission necessary.

Box 2: Project Administrators
The lead developer must be able to create repositories, manage permissions, manage policies, and contribute to the repository.
Add to the Project Collection Administrators security group users tasked with managing organization or collection resources.

Box 3: Contributors
Developers must be able to contribute to the repository and create branches, but NOT bypass policies when pushing builds.
Add to the Contributors security group full-time workers who contribute to the code base or manage projects.

Reference:

https://docs.microsoft.com/en-us/azure/devops/organizations/security/look-up-project-collection-administrators

Reveal Solution Next Question

QUESTION: 168 Exam Topic: Develop a security and compliance plan Questions

DRAG DROP (Drag and Drop is not supported)
You have an Azure subscription that contains a project in Azure DevOps named Project1. You have three Azure Active Directory (Azure AD) users that require access to Project1 as shown in the following table.

You need to ensure that the users have the appropriate permissions. The solution must use the principle of least privilege.

To which permission group in Azure DevOps should you add each user? To answer, drag the appropriate permission groups to the correct users. Each permission group may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.