AZ-400 Practice Test 11 — 15 Questions

Question 1

You are implementing a release pipeline for a containerized application using Azure Kubernetes Service (AKS). The pipeline should use canary deployments to gradually shift traffic from the stable version to the new version. Which strategy should you use to manage the traffic shift?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Canary deployment using a service mesh (e.g., Istio). A service mesh like Istio provides fine-grained traffic management capabilities (e.g., using VirtualService and DestinationRule resources) that allow you to route a specific percentage of traffic to the new canary version while the rest goes to the stable version. This enables gradual traffic shifting without modifying application code, and supports advanced routing rules based on headers or weights, which is essential for canary deployments in AKS.

Answer

Blue-green deployment strategy

Answer

Rolling update strategy

Answer

A/B testing with feature flags

Question 2

Your organization uses GitHub for source control and Azure Pipelines for CI/CD. You need to implement a policy that requires all pull requests to pass a status check before merging. The status check should be provided by a pipeline that runs when a pull request is created. Which type of trigger should you configure in the pipeline YAML?

Accepted Answer

PR trigger. A PR trigger (pr:) in Azure Pipelines YAML automatically runs the pipeline when a pull request is created or updated against a specified branch. This allows the pipeline to produce a status check that GitHub enforces as a required check before merging, fulfilling the policy requirement.

Answer

Push trigger

Answer

Manual trigger

Answer

Scheduled trigger

Question 3

Your team uses Azure Pipelines and wants to automatically create a release every time a build succeeds on the main branch. Which trigger should you configure?

Accepted Answer

Build completion trigger in the release pipeline. A build completion trigger in the release pipeline allows you to automatically create a release whenever a specific build pipeline succeeds on the main branch. This trigger monitors the build pipeline for successful completions and initiates the release process, which directly matches the requirement of creating a release after every successful build on main.

Answer

Pull request trigger in the build pipeline

Answer

Continuous integration (CI) trigger in the release pipeline

Answer

Scheduled trigger in the release pipeline

Question 4

Refer to the exhibit. You run a KQL query in Microsoft Sentinel to audit Azure Container Registry login failures. The result shows 15 failed push attempts to the 'contoso/webapp' repository and 3 failed pull attempts to 'contoso/api'. What is the most likely security implication?

Accepted Answer

An attacker is attempting to push malicious images to the 'contoso/webapp' repository.. The query shows 15 failed push attempts to 'contoso/webapp' and 3 failed pull attempts to 'contoso/api'. Repeated failed push attempts to a specific repository are a classic indicator of an attacker trying to upload malicious images, as push operations require authentication and authorization. The high number of failures suggests a brute-force or credential-stuffing attack targeting the push operation, which is the most direct path to compromising the registry with unauthorized content.

Answer

The audit logs are not enabled for the container registry.

Answer

The container registry is misconfigured and allowing anonymous pushes.

Answer

The 'contoso/api' repository has been successfully pulled by an unauthorized user.

Question 5

You have a multi-stage YAML pipeline that builds and deploys a Java application. The pipeline runs on a Microsoft-hosted agent. The build stage fails intermittently with 'OutOfMemoryError: Java heap space'. What should you do to resolve this issue?

Accepted Answer

Set the environment variable 'MAVEN_OPTS' to '-Xmx2048m'.. The 'OutOfMemoryError: Java heap space' in a Maven build indicates that the JVM running Maven needs more heap memory. Setting the environment variable 'MAVEN_OPTS' to '-Xmx2048m' increases the maximum heap size for the Maven JVM process to 2048 MB, which resolves the memory issue. This is the standard and correct approach for Maven-based builds.

Answer

Use a self-hosted agent with more memory.

Answer

Set the environment variable 'GRADLE_OPTS' to '-Xmx2048m'.

Answer

Use the 'Maven@3' task with the 'jdkVersion' option set to 'jdk11'.

Question 6

A team uses Azure Pipelines to build a .NET application. The build takes 30 minutes, and developers complain that the pipeline runs slowly. The pipeline uses the 'windows-latest' agent and installs the .NET SDK in each run. Which action would MOST reduce the build time?

Accepted Answer

Enable pipeline caching for the .NET SDK.. Enabling pipeline caching for the .NET SDK allows the SDK to be restored from a cache instead of being downloaded and installed on every run. This eliminates the recurring overhead of SDK installation, which is a significant portion of the 30-minute build time, directly addressing the slow pipeline complaint.

Answer

Deploy a self-hosted agent in Azure.

Answer

Increase the number of parallel jobs.

Answer

Change the agent pool to 'ubuntu-latest'.

Question 7

Which TWO actions should you take to implement a secure CI/CD pipeline that uses Azure Pipelines and prevents unauthorized access to production? (Choose two.)

Accepted Answer

Configure deployment approvals and checks on the production stage.. Deployment approvals and checks in Azure Pipelines require manual sign-off or automated policy validation before a release proceeds to production, preventing unauthorized or unverified changes. Option D is correct because using a service connection with a managed identity eliminates the need to store static credentials, reducing the risk of credential exposure and unauthorized access to Azure resources during deployment.

Answer

Store production secrets as pipeline variables marked as 'Secret'.

Answer

Enable PR triggers for the production stage to validate changes.

Answer

Use self-hosted agents running on-premises for all pipelines.

Question 8

You are configuring a release pipeline in Azure DevOps to deploy to multiple environments (dev, test, prod). You need to ensure that the production deployment requires manual approval from the release manager. What should you configure?

Accepted Answer

Set pre-deployment approvals on the production stage.. Pre-deployment approvals on the production stage enforce manual sign-off before any deployment to that environment begins. This ensures the release manager must explicitly approve the deployment, meeting the requirement for manual approval on production. Azure DevOps stages support pre-deployment and post-deployment approval gates, with pre-deployment being the correct choice for controlling when a stage starts.

Answer

Add a manual intervention task before the production deployment.

Answer

Set post-deployment approvals on the test stage.

Answer

Use a condition on the production stage to check a variable.

Question 9

Your organization uses GitHub Actions with self-hosted runners on Azure virtual machines. You notice that some workflows are taking longer than expected because runners are busy. You need to improve the performance without adding more permanent runners. Which solution should you implement?

Accepted Answer

Implement auto-scaling for self-hosted runners using a scale set or Kubernetes-based runner controller.. Auto-scaling self-hosted runners using a scale set or a Kubernetes-based runner controller (e.g., actions-runner-controller) dynamically provisions and deprovisions runner instances based on workflow demand. This eliminates idle runner waste while ensuring sufficient capacity during peak loads, directly addressing the bottleneck without adding permanent infrastructure.

Answer

Migrate all workflows to GitHub-hosted runners.

Answer

Reduce the number of concurrent jobs in each workflow.

Answer

Increase the size of the existing self-hosted runner VMs to handle more jobs.

Question 10

Your organization uses GitHub Actions for CI/CD. You need to ensure that secrets stored in GitHub are not exposed in build logs. A developer accidentally printed a secret to the console in a workflow step. What built-in feature of GitHub Actions automatically prevents this?

Accepted Answer

Automatic log redaction. GitHub Actions includes a built-in feature that automatically redacts secrets from workflow run logs. When a secret is printed to the console, GitHub detects the secret value and replaces it with '***' in the log output, preventing accidental exposure. This redaction happens at the log rendering layer, not in the workflow execution, so the secret is never visible to users viewing the logs.

Answer

Audit log monitoring

Answer

Secret scanning alerts

Answer

Required reviewers on workflows

Question 11

Your release pipeline uses a multi-stage YAML with environments. You need to ensure that only one deployment runs at a time to a production environment to avoid conflicts. Which feature should you use?

Accepted Answer

Configure an exclusive lock policy on the production environment.. An exclusive lock policy on an environment ensures that only one deployment can run at a time to that environment. When a deployment starts, it acquires a lock on the environment; subsequent deployments are queued until the lock is released. This prevents conflicts from concurrent deployments to the same production environment.

Answer

Use a condition to check if a previous deployment is in progress.

Answer

Add a pre-deployment approval gate.

Answer

Set the 'parallel' deployment option to 1.

Question 12

You are designing a release pipeline for a .NET application. The pipeline must deploy to multiple environments (Dev, Test, Prod) with manual approval at each stage. Which release trigger should you configure for the production stage?

Accepted Answer

Manual trigger with pre-deployment approvals.. The requirement specifies manual approval at each stage, and for the production stage, a manual trigger with pre-deployment approvals ensures that deployments only occur after explicit human authorization. This aligns with the need for controlled, gated releases to production, preventing automatic or scheduled deployments that bypass approval.

Answer

Pull request trigger from the main branch.

Answer

Continuous deployment trigger after a successful build.

Answer

Scheduled trigger set to run nightly.

Question 13

A company deploys a web application to Azure App Service. They want to monitor application performance and detect anomalies using Application Insights. Which two components should be configured?

Accepted Answer

Configure sampling to reduce data volume. Sampling in Application Insights reduces the volume of telemetry data while preserving statistically correct analysis, which is essential for managing cost and performance in high-traffic applications. Option D is correct because the application-side SDK (e.g., Application Insights SDK for .NET, Java, or Node.js) is required to instrument the code and collect detailed telemetry such as requests, dependencies, and exceptions for performance monitoring and anomaly detection.

Answer

Deploy the Azure Monitor agent on the App Service instance

Answer

Create a Log Analytics workspace and configure data collection rules

Answer

Enable diagnostics settings to stream logs to Event Hubs

Question 14

Your release pipeline deploys to Azure App Service using a deployment slot strategy. After a successful deployment to the staging slot, you run smoke tests, then swap slots. Recently, a swap failed because the staging slot had an incorrect application setting. What is the BEST way to prevent this issue?

Accepted Answer

Mark the application setting as a deployment slot setting.. Marking the application setting as a deployment slot setting ensures that the setting stays with the slot and is not swapped between staging and production. This prevents the staging slot from having an incorrect value that could cause a swap failure, as the setting is pinned to the slot and not part of the swap payload.

Answer

Use a manual approval gate before swap.

Answer

Configure the App Service deployment center.

Answer

Add a task to verify settings before swap.

Question 15

A company deploys a .NET Core web application to Azure App Service. The application uses Application Insights for monitoring. The operations team reports that dependency tracking is missing for calls to a third-party REST API made using HttpClient. The application is instrumented with the Application Insights SDK. Which action should be taken to enable dependency tracking for HttpClient calls?

Accepted Answer

Ensure the SDK is configured using services.AddApplicationInsightsTelemetry(); in the Startup.cs file.. `services.AddApplicationInsightsTelemetry()` in `Startup.cs` automatically registers the `DependencyTrackingModule` for .NET Core applications. This module collects dependency telemetry for `HttpClient` calls made via `IHttpClientFactory` or typed `HttpClient` instances, provided the SDK is properly configured. Since the application already uses the Application Insights SDK, this single line enables automatic dependency tracking without additional packages or agents.

Answer

Install the Application Insights Agent on the App Service instance.

Answer

Add a reference to Microsoft.ApplicationInsights.DependencyCollector and call DependencyTrackingModule.Initialize().

Answer

Use the Application Insights Status Monitor to enable dependency tracking.