AZ-400 Exam Questions and Answers

Remove the 'Create Fork' permission from all users except the required group

The 'Create Fork' permission is a repository-level security permission in Azure Repos, stored separately from branch permissions. To allow only a specific group to create forks, you remove the 'Create Fork' permission from all other users and groups (for example, Contributors and Readers) in the repository's Security page, then explicitly set it to 'Allow' for the required group. This is the only per-repository mechanism that enforces the requirement precisely, since it leaves fork creation available to the approved group while denying everyone else.

Squash commit

Squash commit is correct because it merges the feature branch by combining all of its changes into a single new commit on the target branch. This collapses the entire commit history of the feature into one commit, exactly matching the requirement to combine all changes into a single commit.

Set minimum number of reviewers to 2, but allow policy override for urgent fixes

This allows the two-reviewer policy to be applied normally, while still permitting urgent fixes to be merged without two approvals; the override requires a justification and is logged for audit, balancing policy enforcement with operational flexibility.

Immediately notify the security team and rotate the password

Rotating/revoking the password is a critical remediation step to prevent unauthorized use, but it does not remove the secret from source control. You must also purge the secret from Git history using tools like git filter-branch or git filter-repo, or by amending the commit as described, to fully eliminate the exposure.

Use the git-tfs tool to clone the TFVC repository with changesets

git-tfs is the standard community-maintained bridge that clones a TFVC repository by replaying each TFVC changeset into a corresponding Git commit, preserving the original author, timestamp, commit message, branch structure, and merge topology. It handles the TFVC-to-Git ID mapping and can also fetch shelvesets, making it the preferred tool for a full-fidelity migration. Because it reconstructs the entire commit graph rather than just copying files, it maintains the historical context needed for auditing, bisecting, and code review — which is exactly what the team needs when moving from TFVC to Git.

Status check

Status check is a valid branch policy in Azure Repos that requires an external service (e.g., SonarQube, Jenkins) to post a successful status to the PR before it can be completed. The policy defines a context name, and the service must report 'succeeded' via the Status API; otherwise, the PR is blocked. This enforces quality gates from CI/CD or analysis tools.

Build validation

Build validation is a valid branch policy in Azure Repos that requires a designated build pipeline to run successfully against the merged result of the PR before it can be completed. It ensures the code compiles and passes automated tests, acting as a direct quality gate before merge. This is one of the two correct answers.

Add a work item rule in the process template to require a code review for the 'Done' transition.

A process template rule is the correct mechanism in Azure Boards because rules can enforce conditions on state transitions, such as requiring a custom 'Code Review' field to be completed before a work item is allowed to move to 'Done'.

The subscription's 'Deliver to' filter excludes stakeholders.

The 'Deliver to' filter in an Azure DevOps notification subscription controls exactly which roles, groups, or individuals receive the alert. If stakeholders are omitted from that filter, they will not get any notifications from this subscription even though the subscription itself is active and functioning, which directly explains the symptom.

Use the same process and configure working days in the team settings for each team.

Azure DevOps allows each team in a shared project to have its own working days and non-working days under Team Settings, so teams in different time zones can use the same process while reflecting local calendars. This per-team calendar feeds backlog, sprint, and capacity views, making it the correct approach for a multinational company using a single project.

Create a new branch policy on main that requires a minimum number of reviewers from a separate CAB group.

A branch policy on main can require a minimum number of reviewers from a specific Azure DevOps group, such as a separate CAB. This ensures automated enforcement of the approval requirement, so pull requests cannot be completed without the mandated CAB reviews.

Maintain a shared wiki with project documentation and decisions.

Maintaining a shared wiki centralizes project documentation and decisions in a single source of truth, with versioning and searchability that reduce redundant questions and ensure all team members, regardless of location or role, can access consistent, up-to-date information.

Schedule daily stand-up meetings at a time that works for all time zones.

Scheduling daily stand-up meetings at a time that accommodates all time zones maximizes participation and ensures the team maintains a consistent sync cadence, which is critical for quickly surfacing blockers and aligning on priorities across distributed teams.

Add custom fields to work item types.

Adding custom fields to work item types is essential because it enables teams to capture, query, and report on project-specific data that is not covered by the default system fields, supporting more tailored workflow and metrics.

Create an inherited process from an existing system process.

Creating an inherited process from an existing system process is required for customization because it creates a private, editable copy that preserves the original system process while allowing you to add fields and work item types without affecting other projects.

Add custom work item types to the process.

Adding custom work item types to the process is essential when the default set (e.g., bug, task, epic) does not fit your team's workflow, allowing you to define new types with their own custom fields, states, and rules to match your specific process.

Create an Azure Pipeline decorator that validates the service connection used in each task and fails the pipeline if it is not the approved one.

A pipeline decorator is an extension-based mechanism that injects a custom task into every pipeline run at the specified point (pre-job, post-job, or around a task). By defining a post-task decorator, you can read the inputs of each executed task—such as the `connectedServiceName` or `azureSubscription` input—and compare the referenced service connection to the organization's approved list. If the connection is not approved, the decorator can set the task result to `Failed` and stop the pipeline, providing a hard enforcement that ordinary YAML conventions cannot achieve. This works for any pipeline that uses the task, regardless of whether the author referenced a shared template.

Use a pipeline decorator to check the template origin and fail the pipeline if unapproved.

A custom pipeline decorator could technically inspect template origins and fail the build, but it requires you to write, publish, and maintain a private extension, which is complex and error-prone. The built-in 'Required template' repository setting provides the same enforcement more simply and reliably without custom code.

Define a 'production' environment in Azure DevOps and configure an approval check that requires the security lead. Have the pipeline deploy to that environment.

Environment approval checks in YAML pipelines create a standardized, auditable manual gate before any deployment to the production environment. This integrates directly with pipeline runs, ensures the security lead explicitly approves each release, and provides full traceability, fulfilling the compliance requirement.

The service principal used by the service connection does not have the required role assignment on the resource group.

The service connection's service principal lacks a role assignment (such as Contributor) scoped to the target resource group, so Azure RBAC denies access. Granting the required role on that resource group resolves the permission error.

The resource being deployed is in a region that is not allowed by the policy assignment parameters.

The allowedLocations parameter in the policy assignment restricts permissible deployment regions to eastus and westus only. Since the resource being deployed is in centralus, which is not included in those parameters, the 'Allowed Locations' policy denies the deployment as non-compliant.

Add a 'Credential Scanner' task to the Build pipeline and configure it to fail the build if any secrets are found. Also, move all secrets to Azure Key Vault and reference them via variable groups.

Adding a Credential Scanner task to the Build pipeline and configuring it to fail the build when secrets are found automatically blocks hardcoded credentials from being merged into the codebase. Moving secrets to Azure Key Vault and referencing them via variable groups centralizes secret management and removes the need to store sensitive values in source code.

Enable the Application Insights site extension in the App Service 'Application Insights' blade.

The Application Insights site extension in the App Service 'Application Insights' blade is the correct choice because it attaches the Application Insights agent directly to the App Service runtime, automatically collecting server-side telemetry such as requests, dependencies, exceptions, and performance counters without requiring any code changes, recompilation, or redeployment.

Use the Azure DevOps Analytics OData endpoint to query pipeline telemetry and send to Application Insights via a release task.

The Analytics Service exposes pipeline run, test, and work item data as OData entities, allowing you to run rich queries. You can then use a release pipeline task (e.g., a PowerShell script) to call the OData endpoint, transform the results, and send them to Application Insights using its TrackEvent or TrackMetric APIs for custom monitoring and alerting. This is the recommended integration path.

Enable Container Insights in Azure Monitor to collect stdout/stderr logs and metrics into a Log Analytics workspace.

Container Insights is the native Azure Monitor solution for AKS: it deploys a Log Analytics agent as a DaemonSet to collect stdout/stderr logs, performance metrics, and container inventory into a Log Analytics workspace. This enables rich Kusto Query Language (KQL) queries, alerting, and correlation with other Azure Monitor data, making it the correct centralized logging approach for AKS workloads.

The application is exhausting the connection pool; increase Max Pool Size in the connection string.

Connection pool exhaustion occurs when the application requests more connections than the configured Max Pool Size, forcing new requests to wait for a free connection until the connection timeout threshold is reached, which manifests as intermittent timeouts under load; increasing Max Pool Size or ensuring connections are properly disposed can resolve this.

Change Failure Rate

Change Failure Rate is the percentage of deployments that cause a failure in production, such as a service impairment or rollback. It is a core DORA reliability metric because it directly quantifies how often changes disrupt service, making it essential for evaluating system stability.

Mean Time to Restore (MTTR)

Mean Time to Restore (MTTR) measures the average time it takes to recover from a production failure, from detection to full service restoration. It is a key reliability metric because it indicates how quickly a team can respond to incidents and minimize downtime, complementing failure rate by assessing recovery effectiveness.

The threshold of 100 is too high; the rule should use a percentage-based condition on error rate.

The rule should use a percentage-based condition on the failed request rate rather than an absolute count of 100. In low-traffic applications, 100 failed requests may represent a very high error percentage and go undetected, while a percentage threshold would trigger alerts based on the rate of failures relative to total requests.

The 'Take App Offline' setting is not enabled in the deployment task.

The 'Take App Offline' setting instructs the Web App to place an app_offline.htm file in the site root, which gracefully shuts down the app and releases any locks on its assemblies and files. Without this, the running process holds the DLLs, causing 'file in use' errors when the pipeline tries to overwrite them.

Create individual build pipelines for each service, and a separate release pipeline that deploys all services to an integration environment for testing.

Individual build pipelines per service enable each team to build, version, and test independently, while a dedicated release pipeline that deploys all services to an integration environment validates cross-service contracts and interactions in a realistic environment, combining independence with necessary integration assurance.

Use path filters in the trigger section to exclude 'docs/*' and '*.md' files.

Path filters in the trigger section use `trigger.paths.exclude` to prevent pipeline execution when only files under `docs/*` or matching `*.md` are changed; any other changed file will still trigger the pipeline, making this the correct, event-driven way to avoid documentation commits.

Use a release pipeline that deploys to a new Azure App Service instance, runs tests, and then removes the instance.

Using a release pipeline that deploys to a new Azure App Service instance, runs tests, and then removes the instance is correct because it provides an ephemeral, isolated environment that closely mirrors production, enabling realistic integration validation and automatic teardown, which avoids lingering state and reduces cost.

Use secret variables with the 'secret' input type to mask them in logs.

In Azure Pipelines, defining variables with the `secret` input type (e.g., via the pipeline UI or YAML `${{ variables.secret }}`) ensures they are encrypted at rest and automatically masked in all pipeline logs, preventing accidental exposure. This is a fundamental practice for handling sensitive data in CI/CD, as it protects against log leakage while still allowing tasks to reference the variable securely.

Store secrets in a variable group linked to Azure Key Vault.

By linking a variable group to Azure Key Vault, the pipeline retrieves secret values at runtime via a securely authenticated connection, ensuring secrets are never stored in plaintext within the pipeline definition or logs. This approach leverages Key Vault's access policies and audit capabilities, providing a centralized, secure way to manage and rotate secrets across pipelines.

Create separate pipelines for each service with path triggers, and create an additional comprehensive pipeline that triggers only when shared libraries change.

This approach uses path-based triggers to run individual service pipelines only when their source changes, reducing build time and resource usage. The additional comprehensive pipeline, triggered only by modifications to shared libraries, ensures cross-service integration tests still run when dependencies change, preserving integration testing without unnecessary builds.

Use trunk-based development with feature flags to merge small, frequent changes.

Trunk-based development with feature flags enables developers to merge small, frequent changes directly into the trunk behind a flag, keeping branches short-lived and integration burden low, which minimizes merge conflicts and supports continuous integration and delivery.

Use Git LFS to track binary files.

Git LFS stores binary files in a separate remote store and replaces them in Git with small text pointers, so cloning fetches only the pointers and downloads actual binaries on demand (via `git lfs fetch` or by checking out the working tree). This keeps the .git directory and clone time small, and Azure Repos fully supports Git LFS for repos, making it the correct solution for large binary files.

Add 'on: push: branches: [main]' to the workflow.

This correctly configures the 'push' trigger with the 'branches' filter set to 'main', using the proper plural key. As a result, the workflow will execute only when commits are pushed directly to the 'main' branch, ignoring pushes to other branches.

Require signed commits.

Requiring signed commits is a branch protection rule that rejects any commit not cryptographically signed with a verified GPG or S/MIME key, authenticating the committer and ensuring content integrity. This directly enforces that every commit must be signed, exactly as the requirement demands.

Enable 'Require a minimum number of reviewers' and 'Build validation'.

Combining 'Require a minimum number of reviewers' and 'Build validation' enforces both peer review and a successful build pipeline. This ensures that changes are approved by the required reviewers and meet the build quality gate before merging, delivering comprehensive branch protection.

Create a central repository with reusable workflows and reference them using the 'uses' keyword in your workflows.

Reusable workflows are the official GitHub Actions pattern: you store a workflow file in a central repository and invoke it from other repositories using the `uses` keyword with a path like `owner/repo/.github/workflows/reusable.yml@ref`. This approach supports inputs, secrets, and version pinning, and is the recommended way to avoid duplicating CI/CD logic across many GitHub repositories.