AZ-400 Practice Test 12 — 15 Questions

Question 1

Your YAML pipeline uses the 'AzureResourceManagerTemplateDeployment' task to deploy ARM templates. You need to handle incremental deployments and ensure that the task fails if any resource already exists and cannot be updated. Which deployment mode should you specify?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Incremental. The 'Incremental' deployment mode in the AzureResourceManagerTemplateDeployment task handles only changes specified in the template, leaving existing resources unchanged. If a resource already exists and cannot be updated (e.g., due to a property conflict or immutable resource), the deployment fails, meeting the requirement to fail on such conflicts. This mode is the standard for additive, non-destructive ARM template deployments.

Answer

Complete

Answer

Validate

Answer

CreateOrUpdate

Question 2

Refer to the exhibit. A developer commits code to the 'develop' branch. The pipeline does not trigger. What is the most likely reason?

Accepted Answer

The trigger is configured to only run on the 'main' branch.. The trigger is set to 'main' branch only. Commits to 'develop' will not trigger the pipeline.

Answer

The pipeline requires a manual trigger.

Answer

The pipeline has a CI trigger disabled.

Answer

The pool 'ubuntu-latest' is not available.

Question 3

Your team uses GitFlow with Azure Repos. You need to ensure that every commit to the 'main' branch is built and deployed to production automatically. Which trigger should you configure in your YAML pipeline?

Accepted Answer

trigger:
  branches:
    include:
    - main. A branch-specific trigger defined with `trigger: branches: include: - main` will automatically run the pipeline on every commit to the 'main' branch. Option A is wrong because `trigger: none` disables CI triggers entirely, so the pipeline will not start on any commits. Option C is wrong because a scheduled trigger (`schedules:`) runs the pipeline at specific times, not in response to commits. Option D is wrong because a PR trigger (`pr:`) runs the pipeline when a pull request is created or updated, not on direct commits to 'main'.

Answer

Trigger: none

Answer

schedules:
- cron: "0 0 * * *"
  branches:
    include:
    - main

Answer

pr:
  branches:
    include:
    - main

Question 4

Your release pipeline deploys to Azure App Service using slots. You need to ensure that after swapping, the warmup request is sent to the production slot before traffic is fully routed. What should you configure?

Accepted Answer

Enable auto swap for the deployment slot and configure a custom warmup path.. Enabling auto swap with a custom warmup path sends a warmup request to the target slot before the swap completes, ensuring the production slot is warmed up. Option B is incorrect because a health check is used for monitoring instance health, not for warmup before swap. Option C is incorrect because a manual swap does not include automatic warmup; you would need to implement custom logic. Option D is incorrect because slot-specific app settings are sticky and not swapped; they do not enable warmup.

Answer

Add a health check to the App Service.

Answer

Perform a manual swap and then send a warmup request via a script.

Answer

Configure slot-specific app settings to enable warmup.

Question 5

Refer to the exhibit. You are reviewing an ARM template used in an Azure Pipeline deployment. Which security concern should you address?

Accepted Answer

The admin password is hardcoded in the template. The admin password is hardcoded in plain text in the ARM template, which is a significant security vulnerability. Passwords should be stored securely using Azure Key Vault or referenced as secure parameters. Option A is incorrect because VM size is not a security concern. Option B is incorrect because the apiVersion is valid. Option D is incorrect because a default value for location is acceptable.

Answer

The VM size is too small for production

Answer

The apiVersion is outdated

Answer

The location parameter has a default value

Question 6

You need to automatically create a work item in Azure Boards when a GitHub issue is opened. What is the most efficient way to achieve this?

Accepted Answer

Install the GitHub + Azure Boards integration. The official GitHub + Azure Boards integration provides automatic two-way syncing between GitHub issues and Azure Boards work items. This requires minimal configuration and no custom code. Option B requires writing a GitHub Action and calling the Azure DevOps REST API, which is more complex. Option C involves using Azure Pipelines, which is not designed for this purpose. Option D involves manually configuring a webhook, which is less streamlined than the integration.

Answer

Create a GitHub Action that calls Azure DevOps REST API

Answer

Use Azure Pipelines with a GitHub trigger

Answer

Configure a webhook in GitHub to Azure DevOps

Question 7

You are responsible for a release pipeline that deploys a containerized application to Azure Kubernetes Service (AKS). The pipeline currently builds and pushes a Docker image to Azure Container Registry (ACR) and then updates the Kubernetes manifest. You need to implement a rollback strategy in case the deployment fails. The rollback should revert to the previous known good version of the application. Which approach should you use?

Accepted Answer

Use the Kubernetes task with the 'rollback' option, which runs 'kubectl rollout undo' on the deployment.. 'kubectl rollout undo' is a native Kubernetes feature that automatically reverts the deployment to the previous ReplicaSet, providing a simple and reliable rollback without manual intervention or additional tools. Option A is manual and not automated. Option B re-runs the entire pipeline, which may build a new image and not truly revert to the previous version. Option D uses Helm, which adds complexity when native rollback is sufficient.

Answer

Keep the previous Docker image tag in ACR and update the manifest to point to it manually.

Answer

Rerun the previous successful pipeline run.

Answer

Use Helm to manage releases and rollback using 'helm rollback' command.

Question 8

Refer to the exhibit. You have a YAML pipeline with the variables shown. What will be the value of $(Build.BuildNumber) on the first run?

Accepted Answer

20250101.1. The pipeline does not define a custom build number format, so Azure DevOps defaults to the date-based format 'yyyyMMdd.revision'. On the first run of the day, the revision starts at 1, resulting in a Build.BuildNumber like '20250101.1'. The counter expression (not shown in the exhibit) is a separate variable and does not affect Build.BuildNumber. Therefore, the correct answer is B.

Answer

1.0.0.0

Answer

1.0.0

Answer

1.0.1

Question 9

A company uses Azure Pipelines with YAML-based pipelines stored in a Git repository. The pipeline triggers on every push to the main branch, but the team wants to reduce unnecessary builds when only documentation files are changed. What is the best way to achieve this?

Accepted Answer

Use path filters in the trigger section to exclude 'docs/*' and '*.md' files.. Path filters in the trigger section allow you to specify include and exclude patterns. By using exclude patterns for 'docs/*' and '*.md', the pipeline will not trigger when only documentation files are changed. Option B is incorrect because branch policies do not affect the pipeline trigger; they govern pull request requirements. Option C is incorrect because conditions are evaluated at runtime, whereas we want to avoid triggering the pipeline altogether. Option D is incorrect because disabling CI trigger would require manual or scheduled builds, which is less efficient than using path filters.

Answer

Configure branch policy to require a pull request for documentation changes.

Answer

Add a 'condition' to the pipeline that checks if changed files are documentation.

Answer

Disable CI trigger and rely on scheduled builds.

Question 10

Match each Azure DevOps security concept to its purpose.

Accepted Answer

Azure Active Directory: Used for identity and access management, including authentication to Azure DevOps.. Azure AD manages user identities; PATs authenticate scripts; Service Principals authenticate automated services; Security Groups manage user permissions. Common confusions include mixing the roles of Azure AD and Service Principals, or PATs with Security Groups.

Answer

Azure Active Directory: Used to authenticate automated pipelines to Azure resources.

Answer

Personal Access Token (PAT): Used to manage permissions for groups of users.

Question 11

Which THREE steps should you take to implement a blue-green deployment strategy for an Azure App Service using Azure Pipelines? (Choose three.)

Accepted Answer

Create a deployment slot named 'staging' for the App Service.. In a blue-green deployment for Azure App Service using Azure Pipelines, the three key steps are: create a staging deployment slot (A), enable 'Auto swap' on the staging slot (B), and deploy the new version to the staging slot (C). Auto-swap ensures that after the new version is deployed and validated, the staging slot automatically swaps with the production slot, enabling zero-downtime updates. Option D (deleting the production slot after swapping) is incorrect because the production slot continues to hold the previous version for potential rollback. Option E (routing 100% of traffic to the staging slot) is incorrect because traffic routing is handled by the swap operation, not by manually directing traffic.

Answer

Delete the production slot after swapping.

Answer

Route 100% of traffic to the staging slot.

Question 12

Refer to the exhibit. A pipeline in repository 'MyProject/AppRepo' is configured to trigger when changes are pushed to 'SharedRepo'. A developer pushes a commit to the 'release/v1' branch of 'SharedRepo'. What will happen?

Accepted Answer

The pipeline will trigger because 'release/v1' matches the 'release/*' include pattern.. The trigger includes branches matching 'main' and 'release/*'. 'release/v1' matches the wildcard 'release/*', so the pipeline in AppRepo will be triggered.

Answer

The pipeline will trigger only if the commit also includes changes to 'main'.

Answer

The pipeline will fail because the trigger configuration is invalid.

Answer

The pipeline will not trigger because 'release/v1' is not explicitly listed.

Question 13

Your organization uses Azure DevOps and GitHub. You need to ensure that secrets such as API keys are not exposed in pipeline logs. What should you do?

Accepted Answer

Store the API key in Azure Key Vault and use a variable group linked to the vault. Both secret variables and variable groups linked to Azure Key Vault are masked in pipeline logs. Azure Pipelines automatically masks secret variables, and variables from Key Vault variable groups are also treated as secrets. Therefore, both B and C prevent exposure. The question asks 'what should you do?' without requiring a single best method, so both B and C should be considered correct.

Answer

Store the API key in a plain text variable and reference it as $(apiKey)

Answer

Use the Logging Command to suppress output

Question 14

Refer to the exhibit. You deploy this ARM template using Azure Pipelines. The deployment succeeds, but the storage account is created with a name that is not what you expected. What is the most likely reason?

Accepted Answer

The uniqueString function returns a hash based on the resource group ID, resulting in a non-meaningful name.. The uniqueString(resourceGroup().id) function generates a deterministic hash based on the resource group ID, resulting in a storage account name that is a hash rather than a human-readable name. Option B is incorrect because the parameter type 'string' can accept a default value that is a string, even if it looks like an object. Option C is incorrect because resourceGroup().location is a valid function that returns the location of the resource group. Option D is incorrect because the apiVersion '2022-09-01' is valid and does not cause naming conflicts; naming conflicts arise from the hash function, not the API version.

Answer

The storage account name parameter is of type 'string' but the default value is an object.

Answer

The location parameter uses resourceGroup().location which is not a valid function.

Answer

The apiVersion '2022-09-01' is too new and causes a naming conflict.

Question 15

Which THREE are valid strategies for managing configuration in a multi-environment CI/CD pipeline?

Accepted Answer

Store configuration in environment-specific YAML variable files.. Using variable groups, Key Vault references, and environment-specific YAML variable files are all valid. Storing config in the container image is not recommended because it couples the image to an environment. Hardcoding in scripts is bad practice.

Answer

Embed configuration values directly into the container image.

Answer

Hardcode configuration in pipeline scripts for each environment.