AZ-400 Practice Test 10 — 10 Questions

Question 1

Which TWO actions are recommended practices for improving communication within a DevOps team?

Accepted Answer

Create a shared team charter with communication norms.. A shared team charter with communication norms establishes explicit expectations for how the team interacts, reducing ambiguity and fostering a culture of transparency and accountability. Daily stand-up meetings promote regular, synchronous communication, enabling quick updates, identification of blockers, and alignment on priorities. Both practices align with DevOps principles of collaboration and shared ownership. In contrast, separate documentation repositories, monthly email reports, and removing chat channels hinder real-time collaboration and transparency.

Answer

Use separate documentation repositories for each team.

Answer

Send monthly status reports via email.

Answer

Remove team chat channels to reduce noise.

Question 2

Your organization uses Azure DevOps and wants to enforce that all pipelines use a specific set of approved tasks. How can you achieve this?

Accepted Answer

Use the task restrictions feature in Azure DevOps to block unapproved tasks. Use the task restrictions feature in Azure DevOps to block unapproved tasks. Azure DevOps provides a 'Task restrictions' policy under Organization Settings > Policies > Add new policy, where you can specify which tasks are allowed or blocked across all pipelines. This enforces that only approved tasks are used. Option B is incorrect because assigning permissions to a task group only controls who can modify the group, not which tasks are used in pipelines. Option C is incorrect because while YAML templates can standardize tasks, they do not enforce mandatory usage; pipelines can still be created without the template. Option D is incorrect because service hooks only trigger notifications when an unapproved task is used, but do not block its usage.

Answer

Assign permissions to the task group to limit who can add tasks

Answer

Create a YAML template with the approved tasks and require all pipelines to use it

Answer

Configure a service hook to notify when an unapproved task is used

Question 3

You configured a multi-stage YAML pipeline with a deployment job that uses a deployment strategy like 'runOnce' or 'rolling'. You need to ensure that the deployment target is marked as 'succeeded' only after the deployment job completes successfully, and that any previous deployment to the same environment is preserved for rollback. Which setting must you configure?

Accepted Answer

Set the environment's 'retain' property to 1 or more. Setting the environment's 'retain' property to 1 or more ensures that the previous deployment (e.g., the last successful run) is preserved as a 'retained' revision in the environment. This allows you to redeploy that specific revision for rollback purposes. The deployment job marks the environment target as 'succeeded' only after the job completes successfully, and retaining previous revisions prevents them from being automatically cleaned up.

Answer

Set the deployment job's 'continueOnError' to true

Answer

Use the 'deployment' job with 'strategy: rolling'

Answer

Set the 'deploymentStrategy' to 'blueGreen'

Question 4

Your YAML pipeline uses the 'AzureResourceManagerTemplateDeployment' task to deploy ARM templates. You need to handle incremental deployments and ensure that the task fails if any resource already exists and cannot be updated. Which deployment mode should you specify?

Accepted Answer

Incremental. The 'Incremental' deployment mode in the AzureResourceManagerTemplateDeployment task handles only changes specified in the template, leaving existing resources unchanged. If a resource already exists and cannot be updated (e.g., due to a property conflict or immutable resource), the deployment fails, meeting the requirement to fail on such conflicts. This mode is the standard for additive, non-destructive ARM template deployments.

Answer

Complete

Answer

Validate

Answer

CreateOrUpdate

Question 5

Match each Azure DevOps security concept to its purpose.

Accepted Answer

Azure Active Directory: Used for identity and access management, including authentication to Azure DevOps.. Microsoft Entra ID manages user identities; PATs authenticate scripts; Service Principals authenticate automated services; Security Groups manage user permissions. Common confusions include mixing the roles of Microsoft Entra ID and Service Principals, or PATs with Security Groups.

Answer

Azure Active Directory: Used to authenticate automated pipelines to Azure resources.

Answer

Personal Access Token (PAT): Used to manage permissions for groups of users.

Question 6

Your team uses Azure Repos with a Git branching strategy. You need to ensure that all changes to the release branch are reviewed by at least two approvers and that builds succeed before merging. Which TWO branch policy settings should you enable?

Accepted Answer

Build validation. Option A, Build validation, is correct because it enforces that a build pipeline runs and succeeds against the pull request before the changes can be merged into the release branch, satisfying the requirement that builds succeed before merging. Option C, Minimum number of reviewers set to 2, is correct because it requires at least two approvers to sign off on each pull request targeting the release branch, satisfying the two-approver review requirement. Option B, Work item linking, only enforces association of work items to commits or PRs and does not address reviewer counts or build success. Option D, Require a clean fast-forward merge, only controls merge history shape and does not enforce reviews or builds. Option E, Require a merge commit, likewise only dictates the merge strategy and does not provide approval or build gating.

Answer

Work item linking

Answer

Require a clean fast-forward merge

Answer

Require a merge commit

Question 7

Which THREE are valid Git merge strategies available in Azure Repos pull requests?

Accepted Answer

Semi-linear merge. Among the given options, the valid merge strategies are: 'Merge commit (no fast-forward)' (Option B), 'Semi-linear merge' (Option A), and 'Squash merge' (Option D). 'Merge commit (no fast-forward)' preserves the full history of both branches. 'Semi-linear merge' rebases the source branch onto the target before creating a merge commit, ensuring linear history. 'Squash merge' combines all source branch commits into a single commit on the target. Note that Azure Repos also supports 'Rebase and fast-forward' as a valid merge strategy, but it is not among the options. Options C and E are not valid merge strategies in Azure Repos pull requests.

Answer

Fast-forward only

Answer

Rebase only

Question 8

Your organization uses GitHub Actions for CI/CD. The security team requires that all workflows are stored in a central repository and that only approved actions can be used. What should you implement?

Accepted Answer

In the organization settings, configure the 'Actions permissions' to 'Allow specified actions' and add the approved actions to the allow list.. The security team's requirement to restrict workflows to only approved actions is directly met by configuring 'Actions permissions' in the organization settings to 'Allow specified actions' and then populating the allow list with the approved actions. This enforces a policy where any workflow, regardless of where it is stored, can only reference actions that have been explicitly allowed, preventing the use of unverified or malicious third-party actions.

Answer

Configure the repository to use only self-hosted runners.

Answer

Store all workflows in a central repository and use branch protection rules.

Answer

Enable 'Allow GitHub Actions to create and approve pull requests' in the repository settings.

Question 9

You are designing a release pipeline for a containerized application deployed to Azure Kubernetes Service (AKS). You want to implement a strategy where the new version is deployed to a small subset of pods first, and if healthy, gradually rolled out to all pods. Which Kubernetes deployment strategy should you use?

Accepted Answer

Canary deployment. A canary deployment is the correct strategy because it allows you to route a small percentage of traffic (e.g., 5%) to the new version of the application running on a subset of pods in AKS. If the canary is healthy (e.g., passes liveness and readiness probes), you can gradually increase the traffic percentage until 100% of pods run the new version, providing controlled rollout and rollback capabilities.

Answer

Rolling update

Answer

Blue-green deployment

Answer

Recreate deployment

Question 10

A company uses Azure Pipelines to deploy microservices to Azure Kubernetes Service (AKS). They want to implement a canary deployment strategy. What should they use?

Accepted Answer

Use Kubernetes native deployment strategies with multiple replica sets and traffic splitting. Kubernetes natively supports canary deployments by running multiple replica sets of the same application and using a service mesh or ingress controller (e.g., Istio, NGINX Ingress) to split traffic between the stable and canary versions. Azure Pipelines can orchestrate this by updating the canary deployment and adjusting traffic weights gradually, enabling controlled rollouts and rollbacks without external routing services.

Answer

Use Azure Front Door to route traffic between clusters

Answer

Use deployment slots in Azure App Service

Answer

Use Azure Container Instances as a staging environment