AZ-400 Practice Test 5 — 10 Questions

Question 1

A team is implementing a release pipeline for a Node.js application. They want to run integration tests against a temporary environment that is destroyed after the tests complete. Which strategy should they use?

Accepted Answer

Use a release pipeline that deploys to a new Azure App Service instance, runs tests, and then removes the instance.. Option D is correct because it provisions a dedicated, isolated Azure App Service instance for integration testing, runs the tests against the real environment, and then destroys the instance to avoid ongoing costs. This aligns with the ephemeral environment pattern, ensuring tests validate actual deployment behavior without contaminating shared resources.

Answer

Use a separate release pipeline that deploys to a production environment for testing.

Answer

Use a single release pipeline that deploys to a staging slot and runs tests on the slot.

Answer

Run integration tests in the build pipeline using a mock environment.

Question 2

Which TWO actions should be taken to secure secrets in Azure Pipelines? (Choose two.)

Accepted Answer

Use secret variables with the 'secret' input type to mask them in logs.. Option A is correct because Azure Pipelines allows you to mark variables as 'secret' by using the 'secret' input type in the pipeline settings UI or by setting `isSecret: true` in YAML. This ensures the variable's value is masked with asterisks in all logs and output, preventing accidental exposure during build or release execution.

Answer

Use a variable group without Key Vault integration for easier management.

Answer

Store secrets directly in the YAML pipeline file.

Answer

Disable CI triggers to reduce exposure.

Question 3

You have a release pipeline that deploys to multiple environments. You need to ensure that a manual approval is required before deploying to production. What should you configure?

Accepted Answer

Set a pre-deployment approval on the production stage. Pre-deployment approvals are configured on a stage in Azure Pipelines to require manual sign-off before any deployment to that stage begins. Since the question specifies that approval is needed before deploying to production, a pre-deployment approval on the production stage enforces that gate before the release pipeline executes any deployment tasks in that environment.

Answer

Add a manual intervention task in the production stage

Answer

Set a post-deployment approval on the production stage

Answer

Set a branch policy on the release branch

Question 4

Which two of the following are valid strategies to implement conditional deployment in a YAML pipeline? (Choose 2)

Accepted Answer

Use the 'condition' property on a stage. Option A is correct because the 'condition' property in Azure DevOps YAML pipelines allows you to specify custom conditions (e.g., `eq(variables['Build.SourceBranch'], 'refs/heads/main')`) that control whether a stage, job, or step runs. This is a native, declarative way to implement conditional deployment without scripting, evaluating the condition at runtime based on variables or expressions.

Answer

Configure stage filters in the triggers section

Answer

Use dependency conditions like 'succeededOrFailed'

Answer

Add a PowerShell script to check environment

Question 5

You are designing a release pipeline that must deploy to Azure App Service across multiple regions. Which two practices should you implement to minimize downtime during deployments? (Choose 2)

Accepted Answer

Use Azure App Service deployment slots and perform a swap. Option A is correct because Azure App Service deployment slots allow you to deploy a new version of your application to a staging slot, perform validation, and then swap it into production with zero downtime. The swap operation warms up the target slot and smoothly transitions traffic, ensuring no requests are dropped during the update.

Answer

Stop the web app before deploying, then start it after

Answer

Deploy to all regions simultaneously

Answer

Use a single deployment slot for all regions

Question 6

A development team uses Git for source control. They want to enforce a branching strategy where all feature work is done in short-lived branches that are merged to main via pull requests. The team also requires that every commit on main builds successfully. Which TWO practices should the team implement?

Accepted Answer

Configure a branch policy on main that requires a successful build before merging.. Option A is correct because configuring a branch policy on main that requires a successful build before merging ensures that every commit merged into main has passed a validation build. This enforces the team's requirement that every commit on main builds successfully, as the pull request cannot be completed until the build pipeline reports success.

Answer

Use squash merge when completing pull requests to main.

Answer

Create feature branches from main and keep them long-lived for stability.

Answer

Allow developers to commit directly to main for urgent fixes.

Question 7

The exhibit shows a draft Azure Monitor alert rule for Key Vault secret expiry. However, the query fails to return results for secrets that have already expired. What is the most likely reason?

Accepted Answer

The condition `DaysToExpiry > 0` excludes secrets that have already expired.. Option B is correct because the query filters on `DaysToExpiry > 0`, which only returns secrets with a positive number of days remaining until expiry. Once a secret has expired, its `DaysToExpiry` becomes zero or negative, so it is excluded from the results. This is a logical filter error: the condition should be `DaysToExpiry <= 0` or remove the filter entirely to include expired secrets.

Answer

The query does not include secrets that have no expiry date set.

Answer

The query only checks secrets that are enabled.

Answer

The `limit 10` clause restricts to only 10 secrets, which may miss expired ones.

Question 8

Refer to the exhibit. The pipeline is configured as shown. A developer pushes a change to the `main` branch that modifies a file under `src/Controllers/HomeController.cs` and also adds a new file under `docs/readme.md`. Which of the following best describes what happens?

Accepted Answer

The pipeline triggers because the change to `src/Controllers/HomeController.cs` is not in an excluded path.. Option B is correct because the pipeline's trigger configuration uses path filters that exclude `docs/*` but include `src/*`. Since the developer's push includes a change to `src/Controllers/HomeController.cs`, which is not in an excluded path, the pipeline triggers. The addition of `docs/readme.md` does not prevent triggering because the trigger evaluates the union of all changed files; as long as at least one changed file matches an included path (or is not excluded), the pipeline runs.

Answer

The pipeline does not trigger because the `docs/` path is excluded and includes a change.

Answer

The pipeline triggers only if the change is on a branch matching `release/*`.

Answer

The pipeline triggers but runs only tests because the build is skipped due to excluded paths.

Question 9

A company uses Azure Monitor and Application Insights to monitor a microservices application deployed on Azure Kubernetes Service (AKS). The development team wants to implement distributed tracing to correlate requests across services. They currently have Application Insights SDKs instrumented in each service. Which TWO configurations are required to enable end-to-end distributed tracing?

Accepted Answer

Ensure all services use the same Application Insights instrumentation key or connection string.. Option B is correct because all services must share the same Application Insights instrumentation key or connection string to ensure that telemetry from different microservices is correlated into a single application map and trace. Without a common instrumentation key, the distributed trace data would be siloed across separate Application Insights resources, preventing end-to-end correlation.

Answer

Enable the Live Metrics Stream feature in Application Insights.

Answer

Configure adaptive sampling in the Application Insights SDK.

Answer

Enable Application Map in the Azure portal for each service.

Question 10

You have a multi-stage YAML pipeline that deploys to Azure Kubernetes Service (AKS). The pipeline uses a deployment job with a strategy of 'runOnce'. You need to ensure that if the deployment fails, the pipeline automatically redeploys the previous successful version. Which strategy should you use instead?

Accepted Answer

Use the 'rolling' strategy and configure 'on:failure: always'. Option B is correct because the 'rolling' strategy in Azure DevOps deployment jobs supports an 'on:failure' hook that can be configured to run actions like 'always', which can trigger a rollback to the previous successful version. This ensures automatic redeployment of the last stable release upon failure, meeting the requirement without manual intervention.

Answer

Use the 'canary' strategy with manual intervention

Answer

Use the 'blueGreen' strategy and configure automatic swap

Answer

Use the 'runOnce' strategy with a rollback task