AZ-400 Exam Questions and Answers

Add a work item rule in the process template to require a code review for the 'Done' transition.

A process template rule is the correct mechanism in Azure Boards because rules can enforce conditions on state transitions, such as requiring a custom 'Code Review' field to be completed before a work item is allowed to move to 'Done'.

The subscription's 'Deliver to' filter excludes stakeholders.

The 'Deliver to' filter in an Azure DevOps notification subscription controls exactly which roles, groups, or individuals receive the alert. If stakeholders are omitted from that filter, they will not get any notifications from this subscription even though the subscription itself is active and functioning, which directly explains the symptom.

Use the same process and configure working days in the team settings for each team.

Azure DevOps allows each team in a shared project to have its own working days and non-working days under Team Settings, so teams in different time zones can use the same process while reflecting local calendars. This per-team calendar feeds backlog, sprint, and capacity views, making it the correct approach for a multinational company using a single project.

Enable 'Automatically delete source branch' in the branch policy.

This deletes the source branch after the PR is completed.

Create a new branch policy on main that requires a minimum number of reviewers from a separate CAB group.

A branch policy on main can require a minimum number of reviewers from a specific Azure DevOps group, such as a separate CAB. This ensures automated enforcement of the approval requirement, so pull requests cannot be completed without the mandated CAB reviews.

Maintain a shared wiki with project documentation and decisions.

Maintaining a shared wiki centralizes project documentation and decisions in a single source of truth, with versioning and searchability that reduce redundant questions and ensure all team members, regardless of location or role, can access consistent, up-to-date information.

Schedule daily stand-up meetings at a time that works for all time zones.

Scheduling daily stand-up meetings at a time that accommodates all time zones maximizes participation and ensures the team maintains a consistent sync cadence, which is critical for quickly surfacing blockers and aligning on priorities across distributed teams.

Use a build validation policy to check commit messages

A build validation policy runs a configured pipeline (e.g., a script that greps commit messages) and can fail the build if a message lacks a work item ID, but this is an indirect, custom workaround. It does not natively enforce work item linking in the pull request metadata, is prone to bypass via malformed commit messages, and is not the designated Azure DevOps policy for this requirement.

Add a task in the CI pipeline that checks if the README was modified

Adding a CI pipeline task that checks if the README was modified automatically verifies that any code changes are accompanied by a corresponding README update, ensuring the README remains accurate.

Remove the 'Create Fork' permission from all users except the required group

The 'Create Fork' permission is a repository-level security permission in Azure Repos, stored separately from branch permissions. To allow only a specific group to create forks, you remove the 'Create Fork' permission from all other users and groups (for example, Contributors and Readers) in the repository's Security page, then explicitly set it to 'Allow' for the required group. This is the only per-repository mechanism that enforces the requirement precisely, since it leaves fork creation available to the approved group while denying everyone else.

Squash commit

Squash commit is correct because it merges the feature branch by combining all of its changes into a single new commit on the target branch. This collapses the entire commit history of the feature into one commit, exactly matching the requirement to combine all changes into a single commit.

Set minimum number of reviewers to 2, but allow policy override for urgent fixes

This allows the two-reviewer policy to be applied normally, while still permitting urgent fixes to be merged without two approvals; the override requires a justification and is logged for audit, balancing policy enforcement with operational flexibility.

Use the --filter=blob:none option when cloning

This partial clone defers downloading LFS blobs until they are accessed.

Create an Azure Pipeline decorator that validates the service connection used in each task and fails the pipeline if it is not the approved one.

A pipeline decorator is an extension-based mechanism that injects a custom task into every pipeline run at the specified point (pre-job, post-job, or around a task). By defining a post-task decorator, you can read the inputs of each executed task—such as the `connectedServiceName` or `azureSubscription` input—and compare the referenced service connection to the organization's approved list. If the connection is not approved, the decorator can set the task result to `Failed` and stop the pipeline, providing a hard enforcement that ordinary YAML conventions cannot achieve. This works for any pipeline that uses the task, regardless of whether the author referenced a shared template.

The build service identity does not have Get and List permissions on the Key Vault secrets.

The build service identity (project collection or project level) must be granted access to Key Vault for variable group resolution.

Use a pipeline decorator to check the template origin and fail the pipeline if unapproved.

A custom pipeline decorator could technically inspect template origins and fail the build, but it requires you to write, publish, and maintain a private extension, which is complex and error-prone. The built-in 'Required template' repository setting provides the same enforcement more simply and reliably without custom code.

Define a 'production' environment in Azure DevOps and configure an approval check that requires the security lead. Have the pipeline deploy to that environment.

Environment approval checks in YAML pipelines create a standardized, auditable manual gate before any deployment to the production environment. This integrates directly with pipeline runs, ensures the security lead explicitly approves each release, and provides full traceability, fulfilling the compliance requirement.

The variable name in the variable group does not exactly match the secret name in Key Vault (case-sensitive).

Azure DevOps maps variable names to secret names, and the match is case-sensitive.

Create an Azure Policy with the 'deny' effect that requires the tags to be present at resource creation.

Deny policy blocks deployment of non-compliant resources.

Add a pipeline task after resource creation that applies the required tags using Azure CLI or PowerShell.

This remediates missing tags post-deployment.

Enable the Application Insights site extension in the App Service 'Application Insights' blade.

The Application Insights site extension in the App Service 'Application Insights' blade is the correct choice because it attaches the Application Insights agent directly to the App Service runtime, automatically collecting server-side telemetry such as requests, dependencies, exceptions, and performance counters without requiring any code changes, recompilation, or redeployment.

Use the Azure DevOps Analytics OData endpoint to query pipeline telemetry and send to Application Insights via a release task.

The Analytics Service exposes pipeline run, test, and work item data as OData entities, allowing you to run rich queries. You can then use a release pipeline task (e.g., a PowerShell script) to call the OData endpoint, transform the results, and send them to Application Insights using its TrackEvent or TrackMetric APIs for custom monitoring and alerting. This is the recommended integration path.

Enable Container Insights in Azure Monitor to collect stdout/stderr logs and metrics into a Log Analytics workspace.

Container Insights is the native Azure Monitor solution for AKS: it deploys a Log Analytics agent as a DaemonSet to collect stdout/stderr logs, performance metrics, and container inventory into a Log Analytics workspace. This enables rich Kusto Query Language (KQL) queries, alerting, and correlation with other Azure Monitor data, making it the correct centralized logging approach for AKS workloads.

Application Dashboard

The Application Dashboard is a built-in analytics view in Application Insights that can be customized with metric tiles to display deployment frequency and change failure rate.

The application is exhausting the connection pool; increase Max Pool Size in the connection string.

Connection pool exhaustion occurs when the application requests more connections than the configured Max Pool Size, forcing new requests to wait for a free connection until the connection timeout threshold is reached, which manifests as intermittent timeouts under load; increasing Max Pool Size or ensuring connections are properly disposed can resolve this.

Change Failure Rate

Change Failure Rate is the percentage of deployments that cause a failure in production, such as a service impairment or rollback. It is a core DORA reliability metric because it directly quantifies how often changes disrupt service, making it essential for evaluating system stability.

Mean Time to Restore (MTTR)

Mean Time to Restore (MTTR) measures the average time it takes to recover from a production failure, from detection to full service restoration. It is a key reliability metric because it indicates how quickly a team can respond to incidents and minimize downtime, complementing failure rate by assessing recovery effectiveness.

The 'Take App Offline' setting is not enabled in the deployment task.

The 'Take App Offline' setting instructs the Web App to place an app_offline.htm file in the site root, which gracefully shuts down the app and releases any locks on its assemblies and files. Without this, the running process holds the DLLs, causing 'file in use' errors when the pipeline tries to overwrite them.

Create individual build pipelines for each service, and a separate release pipeline that deploys all services to an integration environment for testing.

Individual build pipelines per service enable each team to build, version, and test independently, while a dedicated release pipeline that deploys all services to an integration environment validates cross-service contracts and interactions in a realistic environment, combining independence with necessary integration assurance.

Use path filters in the trigger section to exclude 'docs/*' and '*.md' files.

Path filters in the trigger section use `trigger.paths.exclude` to prevent pipeline execution when only files under `docs/*` or matching `*.md` are changed; any other changed file will still trigger the pipeline, making this the correct, event-driven way to avoid documentation commits.

Use a release pipeline that deploys to a new Azure App Service instance, runs tests, and then removes the instance.

Using a release pipeline that deploys to a new Azure App Service instance, runs tests, and then removes the instance is correct because it provides an ephemeral, isolated environment that closely mirrors production, enabling realistic integration validation and automatic teardown, which avoids lingering state and reduces cost.

Use secret variables with the 'secret' input type to mask them in logs.

In Azure Pipelines, defining variables with the `secret` input type (e.g., via the pipeline UI or YAML `${{ variables.secret }}`) ensures they are encrypted at rest and automatically masked in all pipeline logs, preventing accidental exposure. This is a fundamental practice for handling sensitive data in CI/CD, as it protects against log leakage while still allowing tasks to reference the variable securely.

Store secrets in a variable group linked to Azure Key Vault.

By linking a variable group to Azure Key Vault, the pipeline retrieves secret values at runtime via a securely authenticated connection, ensuring secrets are never stored in plaintext within the pipeline definition or logs. This approach leverages Key Vault's access policies and audit capabilities, providing a centralized, secure way to manage and rotate secrets across pipelines.

The policy audits the pipeline but does not enforce any mandatory reviewers.

The audit effect logs compliance without blocking.

Use trunk-based development with feature flags to merge small, frequent changes.

Trunk-based development with feature flags enables developers to merge small, frequent changes directly into the trunk behind a flag, keeping branches short-lived and integration burden low, which minimizes merge conflicts and supports continuous integration and delivery.

Use Git LFS to track binary files.

Git LFS stores binary files in a separate remote store and replaces them in Git with small text pointers, so cloning fetches only the pointers and downloads actual binaries on demand (via `git lfs fetch` or by checking out the working tree). This keeps the .git directory and clone time small, and Azure Repos fully supports Git LFS for repos, making it the correct solution for large binary files.

Add 'on: push: branches: [main]' to the workflow.

This correctly configures the 'push' trigger with the 'branches' filter set to 'main', using the proper plural key. As a result, the workflow will execute only when commits are pushed directly to the 'main' branch, ignoring pushes to other branches.

git rebase main feature/login then git merge --ff-only

Rebase creates linear history; fast-forward merge preserves it.

Require signed commits.

Requiring signed commits is a branch protection rule that rejects any commit not cryptographically signed with a verified GPG or S/MIME key, authenticating the committer and ensuring content integrity. This directly enforces that every commit must be signed, exactly as the requirement demands.

Enable 'Require a minimum number of reviewers' and 'Build validation'.

Combining 'Require a minimum number of reviewers' and 'Build validation' enforces both peer review and a successful build pipeline. This ensures that changes are approved by the required reviewers and meet the build quality gate before merging, delivering comprehensive branch protection.