AZ-400 Practice Test 12 — 15 Questions

Question 1

Refer to the exhibit. A developer creates a pipeline with this YAML. When a commit is pushed to the 'main' branch of the repository 'MyProject/MyRepo', the pipeline does NOT trigger. Which is the most likely cause?

Accepted Answer

The 'internal' repository trigger requires a pipeline trigger to be enabled in the UI.. The pipeline's own repository (self) triggers only when its own default branch receives commits. The repository resource 'internal' is configured with a trigger, but the pipeline itself may not have CI triggers enabled, or the trigger for the repository resource might be disabled by default unless explicitly enabled.

Answer

The 'checkout: internal' step should use a different syntax.

Answer

The 'ref' property should be set to a commit SHA, not a branch name.

Answer

The branch specification 'main' is case-sensitive and should be 'Main'.

Question 2

Refer to the exhibit. You queue a build in Azure Pipelines. The build status remains 'notStarted' for an extended period. What is the most likely reason?

Accepted Answer

The build is waiting for an available agent that meets the demands.. The build demands specify 'Agent.OS -equals Linux' and 'Agent.Version -gtVersion 2.170.1'. If no agent in the Azure Pipelines pool satisfies these demands, the build will remain queued until an appropriate agent becomes available.

Answer

The build priority is set to normal, causing delay.

Answer

The build definition has a syntax error in the YAML file.

Answer

The build definition is not authorized to use the Azure Pipelines pool.

Question 3

Refer to the exhibit. A build pipeline produces the above logs. Which change would resolve the build failure?

Accepted Answer

Add a definition for 'MyMethod' in the 'MyClass' class.. The build fails with a CSC error CS0117 indicating that 'MyClass' does not contain a definition for 'MyMethod'. This is a compilation error. The 'dotnet test' step runs with '--no-build' which skips building and relies on the build output, but the build step fails, so the test step produces no results. The fix is to correct the code in the source file to include the definition for 'MyMethod'.

Answer

Change the build configuration from Release to Debug.

Answer

Remove the '--no-build' flag from the test step.

Answer

Add the '--no-restore' flag to the build step.

Question 4

Refer to the exhibit. You have an availability set with two VMs. One VM shows a degraded availability state. What is the most likely impact on application availability?

Accepted Answer

The application will be vulnerable to unplanned hardware failures that affect the degraded VM's host.. The availability set provides fault tolerance by distributing VMs across fault domains. A degraded state indicates one VM is on a host with potential issues, making it susceptible to unplanned hardware failures. The other VM remains healthy, but the application may not be fully resilient.

Answer

The application will be fully resilient to both planned and unplanned maintenance events.

Answer

The application will experience downtime during planned maintenance events.

Answer

The application will continue to run without any impact because the other VM is healthy.

Question 5

Refer to the exhibit. You apply this Azure Policy to a subscription. A developer attempts to deploy a VM with SKU Standard_D2s_v3. What is the result?

Accepted Answer

The deployment is denied because the SKU matches the pattern.. The policy definition uses a deny effect when the VM type is Microsoft.Compute/virtualMachines and the SKU name starts with 'Standard_D'. Since Standard_D2s_v3 matches that pattern, the deployment is denied.

Answer

The deployment is denied only if the VM is in a specific resource group.

Answer

The deployment is allowed because the SKU matches the pattern.

Answer

The deployment is allowed and a non-compliance event is logged.

Question 6

Refer to the exhibit. You monitor an Azure App Service web app. At 10:30 AM, you observe a spike in HTTP 5xx errors and response time. Based on the metrics, what is the most likely cause?

Accepted Answer

The web app reached its scaling limit and could not handle the increased load.. The request count increased gradually from 1200 to 2500 before the errors started at 10:30 AM. The sharp rise in errors and response time coinciding with peak load indicates the app reached its capacity limit (e.g., instance count or plan limits).

Answer

A deployment of new code at 10:30 AM introduced a bug.

Answer

A DDoS attack started at 10:30 AM.

Answer

A database outage caused the errors and slow responses.

Question 7

A company's Azure DevOps project uses a custom agent pool with self-hosted agents. The security team discovers that pipeline runs can access secrets stored in Azure Key Vault, but the team wants to ensure that secrets are only accessible to approved pipelines. Which configuration should the team implement?

Accepted Answer

Use a library variable group linked to Key Vault and enable 'Approval checks' on the variable group with branch control.. Option A is correct because linking a library variable group to Azure Key Vault and enabling 'Approval checks' on that variable group with branch control ensures that only approved pipelines (and specific branches) can access the secrets. This provides a granular, pipeline-scoped approval gate that prevents unauthorized pipeline runs from retrieving secrets from Key Vault, directly addressing the security requirement.

Answer

Store secrets directly in pipeline variables and use 'Make secrets available to all pipelines' setting.

Answer

Assign pipeline-level permissions to the Key Vault using Azure RBAC.

Answer

Limit the number of agents in the custom agent pool.

Question 8

A development team is designing a build pipeline for a microservices application. They want to ensure that each service is built and tested independently, but they also need to run integration tests that span multiple services. What is the recommended approach?

Accepted Answer

Create individual build pipelines for each service, and a separate release pipeline that deploys all services to an integration environment for testing.. Option C is correct because it aligns with microservices best practices: each service has its own build pipeline for independent compilation, unit testing, and artifact generation, while a separate release pipeline orchestrates deployment of all services to a shared integration environment for cross-service testing. This decouples build concerns from deployment concerns, enabling parallel development and faster feedback loops.

Answer

Use a single release pipeline that triggers manual deployment for each service.

Answer

Create a single build pipeline that builds all services together to ensure consistency.

Answer

Build each service separately, but skip integration tests to avoid complexity.

Question 9

Your team manages a large monorepo in Azure Repos containing multiple projects. Developers frequently complain that cloning the entire repository takes too long and that they only need a subset of the code. The team uses Git LFS for large binary files. The repository currently has 50,000 commits and is 5 GB in size. You want to improve clone performance without sacrificing the ability to contribute to any part of the repo. What should you do?

Accepted Answer

Configure sparse checkout so developers can clone only the directories they need.. Sparse checkout allows developers to clone only the specific directories they need from the monorepo, significantly reducing the amount of data transferred and stored locally. Since the team already uses Git LFS for large binaries, the primary bottleneck is the sheer size of the full commit history and working tree. Sparse checkout, combined with a shallow clone if needed, directly addresses the complaint without breaking the ability to contribute to any part of the repo.

Answer

Instruct developers to use a shallow clone with depth 1 to reduce clone time.

Answer

Move all large binary files to Git LFS to reduce repository size.

Answer

Split the monorepo into multiple repositories and use submodules to aggregate them.

Question 10

Which TWO actions should a DevOps engineer take to ensure that Azure DevOps pipelines comply with the principle of least privilege for service connections?

Accepted Answer

Create a service principal with permissions scoped to the minimum required Azure resources.. Option A is correct because creating a service principal with permissions scoped to the minimum required Azure resources directly implements the principle of least privilege. By assigning only the necessary roles (e.g., Contributor on a specific resource group) to the service principal used in the service connection, you ensure that the pipeline can only perform actions on those resources, reducing the attack surface. This aligns with Azure RBAC best practices for securing automated deployments.

Answer

Use the Project Collection Build Service account for all pipeline runs.

Answer

Use Workload identity federation to avoid managing secrets.

Answer

Use the same service connection for both build and release pipelines.

Question 11

You are designing a build pipeline for a .NET Core application. You need to ensure that the pipeline restores NuGet packages from both an Azure Artifacts feed and the public NuGet gallery. The pipeline must fail if a package is not found in either source. Which two actions must you take? (Select two.)

Accepted Answer

Create a NuGet.config file that includes both feeds as package sources and reference it in the restore task.. Option A is correct because a NuGet.config file explicitly defines the package sources (both the Azure Artifacts feed and the public NuGet gallery) that the restore task will query. By referencing this file in the restore task, the pipeline ensures it searches both sources. Option D is correct because setting the 'CheckConsistency' flag to true in the restore task enforces that the restore operation fails if any package cannot be resolved from the configured sources, meeting the requirement to fail on missing packages.

Answer

Set the 'NoWarn' property to NU1603 to ignore warnings about missing packages.

Answer

Use the 'dotnet restore' task with the '--no-cache' flag.

Answer

Configure the Azure Artifacts feed to use the public NuGet gallery as an upstream source.

Question 12

A company recently migrated its CI/CD pipelines from Jenkins to Azure Pipelines. The development team is experiencing frequent build failures due to conflicting changes when multiple developers push code simultaneously. The team wants to maintain a linear history and avoid merge commits. Which strategy should you recommend?

Accepted Answer

Use Team Foundation Version Control (TFVC) with exclusive checkout enabled.. Option C is correct because Team Foundation Version Control (TFVC) with exclusive checkout enforces a lock on a file when a developer checks it out, preventing simultaneous edits. This eliminates conflicting changes that cause build failures when multiple developers push code concurrently, and since TFVC does not use merge commits, it maintains a linear history. The scenario explicitly requires avoiding merge commits and resolving conflicts from simultaneous pushes, which TFVC’s exclusive checkout directly addresses.

Answer

Switch to Git with a central repository and require merge commits.

Answer

Enforce a rebase strategy for all pull requests in the branch policy.

Answer

Configure Azure Repos to use squash merge when completing pull requests.

Question 13

A team is migrating from TFVC to Git in Azure Repos. They have a large repository with a history of 10,000+ commits. They want to preserve the full history while minimizing migration time. Which approach should they recommend?

Accepted Answer

Use git-tfs to clone the TFVC repository with full history, then push to Azure Repos.. Option A is correct because git-tfs is a specialized bridge tool that can clone a TFVC repository with full history into a local Git repository, preserving all commits, branches, and metadata. This approach minimizes migration time by performing the conversion locally without network overhead, after which the Git repo can be pushed to Azure Repos. Other methods either lose history or are not supported for TFVC-to-Git migration.

Answer

Check out the latest version from TFVC, initialize a new Git repo, and push.

Answer

Use the Azure Repos import repository feature to import from TFVC.

Answer

Clone the TFVC repository using Git and push to Azure Repos.

Question 14

You are designing the communication strategy for a large team using Azure DevOps. The team uses a Kanban board and wants to automatically notify stakeholders when work items are moved to 'Done'. Which Azure DevOps feature should you use?

Accepted Answer

Create a service hook subscription to send events to a webhook.. Option D is correct because service hook subscriptions in Azure DevOps allow you to send real-time notifications to external systems (like webhooks) when specific events occur, such as a work item moving to 'Done'. This is the appropriate feature for automatically notifying stakeholders outside of Azure DevOps, as it integrates with custom endpoints or third-party services.

Answer

Use the built-in email subscription for work item changes.

Answer

Set up a pipeline notification for the work item.

Answer

Configure team alerts in the project settings.

Question 15

Your team uses Azure Boards and has several work item types (Epic, Feature, User Story, Bug, Issue). They want to enforce a rule that bugs can only be linked to Features, not directly to Epics. Which TWO actions should you perform?

Accepted Answer

Customize the Epic work item type to remove the 'Child' link to Bug.. Option A is correct because by customizing the Epic work item type to remove the 'Child' link type to Bug, you prevent any Bug from being linked as a child of an Epic. This enforces the rule that Bugs can only be linked to Features. Option E is correct because by customizing the Bug work item type to remove the 'Parent' link type to Epic, you prevent a Bug from having an Epic as its parent, which directly enforces the desired linking restriction.

Answer

Configure the Epic work item type to require a link to a Bug.

Answer

Use a work item rule to set the parent type to Feature when a Bug is created.

Answer

Add a rule to the Bug work item type that prohibits linking to Epics.

AZ-400 Practice Test 12 — 15 Questions

Exhibit

AZ-400 Practice Test 12 — 15 Questions

Exhibit