DRAG DROP (Drag and Drop is not supported)You have a Microsoft Entra tenant. The tenant contains three groups named Group1, Group2, and Group3.You create a new project in Azure DevOps named Project1.You need to secure the service connections for Project1. The solution must meet the following requirements:The members of Group1 must be able to share and unshare a service connection with other projects. The members of Group2 must be able to rename a service connection and update the description. The members of Group3 must be able to use the service connection within build or release pipelines.The principle of least privilege must be followed.Which permission should you grant to each group? To answer, drag the appropriate permissions to the correct groups. Each permission may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.Note: Each correct selection is worth one point.Select and Place:
Answer(s): A
Box 1: Organization-level AdministratorThe members of Group1 must be able to share and unshare a service connection with other projects.Add members to the Project Collection Administrators groupWhen you create an organization, you become a member of the Project Collection Administrators group. This group has the authority to manage the organization's settings, policies, and processes. It can also create and manage all the projects and extensions in the organization.Incorrect:* Project-level AdministratorsAdd members to the Project Administrators groupThe person who creates a project is automatically added as a member to the Project Administrators group. Members of this group have permissions to manage project configuration, repositories, pipeline resources, teams, and all project-level permissions.It's always a good idea to have more than one person who has administrative privileges. To add a user to this group, see Change permissions at the project level, Add members to the Project Administrators group.Grant or restrict permissionsPermissions are managed at the following three levels and through role-based assignments.object project organization or collectionAs a member of the Project Administrators group, you can grant or restrict permissions for all objects and at the project-level. To delegate specific tasks to others, we recommend that you add them to a built-in or custom security group, or add them to a specific role.Box 2: CreatorThe members of Group2 must be able to rename a service connection and update the description.You can create, view, use, and manage a service connection based on your assigned user roles.Role CreatorMembers of this role can create the service connection in the project. Contributors are added as members by defaultBox 3: UserThe members of Group3 must be able to use the service connection within build or release pipelines.Role UserMembers of this role can use the service connection when authoring build or release pipelines or authorize yaml pipelines.Note: User permissions on service connections
https://learn.microsoft.com/en-us/azure/devops/user-guide/manage-organization-collection https://learn.microsoft.com/en-us/azure/devops/pipelines/library/service-endpoints https://learn.microsoft.com/en-us/azure/devops/user-guide/project-admin-tutorial
You are building a Microsoft ASP.NET application that requires authentication.You need to authenticate users by using Microsoft Entra ID.What should you do first?
Answer(s): B
Register your application to use Microsoft Entra ID. Registering the application means that your developers can use Microsoft Entra ID to authenticate users and request access to user resources such as email, calendar, and documents.
https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/developer-guidance-for-integrating- applications
You have an Azure DevOps organization named Contoso.You need to recommend an authentication mechanism that meets the following requirements:Supports authentication from GitMinimizes the need to provide credentials during authenticationWhat should you recommend?
Personal access tokens (PATs) give you access to Azure DevOps and Team Foundation Server (TFS), without using your username and password directly. These tokens have an expiration date from when they're created.You can restrict the scope of the data they can access. Use PATs to authenticate if you don't already have SSH keys set up on your system or if you need to restrict the permissions that are granted by the credential.Incorrect Answers:B: Azure DevOps no longer supports Alternate Credentials authentication since the beginning of March 2, 2020. If you're still using Alternate Credentials, we [Microsoft] strongly encourage you to switch to a more secure authentication method (for example, personal access tokens).
https://docs.microsoft.com/en-us/azure/devops/repos/git/auth-overview
You have an application that consists of several Azure App Service web apps and Azure functions.You need to assess the security of the web apps and the functions.Which Azure feature can you use to provide a recommendation for the security of the application?
Answer(s): D
Monitor compute and app services: Compute & apps include the App Services tab, which App services: list of your App service environments and current security state of each.RecommendationsThis section has a set of recommendations for each VM and computer, web and worker roles, Azure App Service Web Apps, and Azure App Service Environment that Security Center monitors. The first column lists the recommendation. The second column shows the total number of resources that are affected by that recommendation. The third column shows the severity of the issue.Note: Microsoft Defender for Cloud was formerly known as the Azure Security Center.Incorrect Answers:C: Smart Detection automatically warns you of potential performance problems, not security problems in your web application.
https://docs.microsoft.com/en-us/azure/azure-monitor/app/proactive-diagnostics
HOTSPOT (Drag and Drop is not supported)You have a GitHub organization.You configure the personal access token (PAT) policy shown in the following exhibit.Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.Note: Each correct selection is worth one point.Hot Area:
Box 1: canClassic PATs ______ access the public resources of the organization.Setting a personal access token policy for your organization Organization owners can control whether to allow fine-grained personal access tokens and personal access tokens (classic), and can require approval for fine-grained personal access tokens.*-> Restricting access by personal access tokens (classic)Organization owners can prevent personal access tokens (classic) from accessing resources owned by the organization. Personal access tokens (classic) will still be able to read public resources within the organization. This setting only controls access by personal access tokens (classic), not fine-grained personal access tokens.Box 2: canSSH keys created by using classic PATs ________ access the resources of the organization.Under Personal access token (classic), select the option that meets your needs:* Allow access via personal access tokens (classic): Personal access tokens (classic) can access resources owned by the organization.*-> Restrict access via personal access tokens (classic): Personal access tokens (classic) cannot access resources owned by the organization. SSH keys created by personal access tokens (classic) will continue to work.
https://docs.github.com/en/organizations/managing-programmatic-access-to-your-organization/setting-a- personal-access-token-policy-for-your-organization
Post your Comments and Discuss Microsoft AZ-400 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-400 content, but please register or login to continue.