AZ-400 Practice Test 13 — 15 Questions

Question 1

You are deploying a Java application to Azure App Service using Azure Pipelines. You want to automatically capture JVM metrics (heap usage, garbage collection) and correlate them with deployment events. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Application Insights Java agent in the App Service.. The Application Insights Java agent automatically captures JVM metrics such as heap usage and garbage collection, and it integrates with Azure Pipelines to correlate deployment events with these metrics. Option A is incorrect because Azure Monitor diagnostic settings capture Azure platform logs, not application-level JVM metrics. Option C is incorrect because the Visual Studio profiler is designed for local or development debugging, not for automatic production monitoring. Option D is incorrect because diagnostic logs for stdout/stderr capture application output, not JVM internals.

Answer

Use Azure Monitor diagnostic settings for the App Service.

Answer

Attach a profiler from Visual Studio to the App Service process.

Answer

Configure App Service diagnostic logs to capture stdout/stderr.

Question 2

Which THREE are valid Git merge strategies available in Azure Repos pull requests?

Accepted Answer

Semi-linear merge. Among the given options, the valid merge strategies are: 'Merge commit (no fast-forward)' (Option B), 'Semi-linear merge' (Option A), and 'Squash merge' (Option D). 'Merge commit (no fast-forward)' preserves the full history of both branches. 'Semi-linear merge' rebases the source branch onto the target before creating a merge commit, ensuring linear history. 'Squash merge' combines all source branch commits into a single commit on the target. Note that Azure Repos also supports 'Rebase and fast-forward' as a valid merge strategy, but it is not among the options. Options C and E are not valid merge strategies in Azure Repos pull requests.

Answer

Fast-forward only

Answer

Rebase only

Question 3

A team uses a monorepo with multiple projects in one Git repository. They want to enforce that each commit message must reference a work item from Azure Boards. Which branch policy should they configure?

Accepted Answer

Use a build validation policy to check commit messages. The 'Require a work item linking policy' in Azure Repos ensures each pull request is linked to a work item, but it does not validate that each commit message contains a reference. To enforce that commit messages themselves reference an Azure Boards work item, a build validation policy can run a script to verify the commit message format. Therefore, option D is the correct choice.

Answer

Automatically include work items in pull request descriptions

Answer

Require a work item linking policy in branch policies

Answer

Configure a minimum number of reviewers policy

Question 4

Your organization uses GitHub Actions for CI/CD. The security team requires that all workflows are stored in a central repository and that only approved actions can be used. What should you implement?

Accepted Answer

In the organization settings, configure the 'Actions permissions' to 'Allow specified actions' and add the approved actions to the allow list.. The security team's requirement to restrict workflows to only approved actions is directly met by configuring 'Actions permissions' in the organization settings to 'Allow specified actions' and then populating the allow list with the approved actions. This enforces a policy where any workflow, regardless of where it is stored, can only reference actions that have been explicitly allowed, preventing the use of unverified or malicious third-party actions.

Answer

Configure the repository to use only self-hosted runners.

Answer

Store all workflows in a central repository and use branch protection rules.

Answer

Enable 'Allow GitHub Actions to create and approve pull requests' in the repository settings.

Question 5

Your team uses a monorepo in Azure Repos containing multiple projects. You want to set up CI/CD so that only the projects affected by a commit are built and deployed. Which approach should you use?

Accepted Answer

Create separate Azure Pipelines for each project, each configured to trigger on changes to that project's folder.. In a monorepo, to build and deploy only affected projects, create one Azure Pipeline per project and configure each with path-based triggers that include only that project's folder. This way, a commit touching a specific project triggers only that project's pipeline. While a single pipeline can use path filters and conditions to skip steps, the straightforward and recommended approach is separate pipelines.

Answer

Use Git hooks to detect changes and run only the relevant build scripts locally.

Answer

Use a single YAML pipeline that includes all projects, and use the 'condition' keyword to skip steps based on changed files.

Answer

Use a single YAML pipeline with path-based triggers and path filters in the 'trigger' section for each project's folder.

Question 6

Your team uses Azure DevOps and wants to enforce branch protection policies for all repositories in a GitHub Advanced Security-enabled organization. Which approach should you use to ensure that pull requests require a successful status check from a required workflow?

Accepted Answer

Define a repository rule in GitHub that requires a successful status check from a required workflow.. GitHub repository rules (also known as repository rulesets) allow organizations to centrally enforce policies like required status checks across multiple repositories. To require a successful status check from a specific workflow on all pull requests, create an organization-level repository ruleset that includes the 'Require status checks to pass' rule and specify the workflow's check name. This applies to all selected repositories without per-repository configuration. GitHub Advanced Security is not required for this feature; it is a separate security add-on.

Answer

Use GitHub Actions secrets to store the required status check name.

Answer

Create a branch protection rule in each repository's settings.

Answer

Configure branch policies in Azure DevOps project settings.

Question 7

You are designing a release pipeline for a containerized application deployed to Azure Kubernetes Service (AKS). You want to implement a strategy where the new version is deployed to a small subset of pods first, and if healthy, gradually rolled out to all pods. Which Kubernetes deployment strategy should you use?

Accepted Answer

Canary deployment. A canary deployment is the correct strategy because it allows you to route a small percentage of traffic (e.g., 5%) to the new version of the application running on a subset of pods in AKS. If the canary is healthy (e.g., passes liveness and readiness probes), you can gradually increase the traffic percentage until 100% of pods run the new version, providing controlled rollout and rollback capabilities.

Answer

Rolling update

Answer

Blue-green deployment

Answer

Recreate deployment

Question 8

A company uses Azure Pipelines to deploy microservices to Azure Kubernetes Service (AKS). They want to implement a canary deployment strategy. What should they use?

Accepted Answer

Use Kubernetes native deployment strategies with multiple replica sets and traffic splitting. Kubernetes natively supports canary deployments by running multiple replica sets of the same application and using a service mesh or ingress controller (e.g., Istio, NGINX Ingress) to split traffic between the stable and canary versions. Azure Pipelines can orchestrate this by updating the canary deployment and adjusting traffic weights gradually, enabling controlled rollouts and rollbacks without external routing services.

Answer

Use Azure Front Door to route traffic between clusters

Answer

Use deployment slots in Azure App Service

Answer

Use Azure Container Instances as a staging environment

Question 9

You are implementing a release pipeline for a containerized application using Azure Kubernetes Service (AKS). The pipeline should use canary deployments to gradually shift traffic from the stable version to the new version. Which strategy should you use to manage the traffic shift?

Accepted Answer

Canary deployment using a service mesh (e.g., Istio). A service mesh like Istio provides fine-grained traffic management capabilities (e.g., using VirtualService and DestinationRule resources) that allow you to route a specific percentage of traffic to the new canary version while the rest goes to the stable version. This enables gradual traffic shifting without modifying application code, and supports advanced routing rules based on headers or weights, which is essential for canary deployments in AKS.

Answer

Blue-green deployment strategy

Answer

Rolling update strategy

Answer

A/B testing with feature flags

Question 10

A team wants to automatically destroy a temporary test environment after a pull request is merged or closed. What Azure DevOps feature should they use?

Accepted Answer

Service hook to Azure Functions. To automatically destroy a temporary test environment after a pull request is merged or closed, a service hook can subscribe to pull request lifecycle events (e.g., 'Pull request merged' or 'Pull request updated') and invoke an Azure Function to perform the cleanup. Environments with post-deployment approvals are used for controlling manual approvals before or after deployment, not for triggering resource destruction on PR events. Branch policies and branch deletion triggers do not inherently respond to PR merge/close events with environment management.

Answer

Environment with post-deployment approvals

Answer

Branch policy with required reviewers

Answer

Pipeline trigger on branch deletion

Question 11

Your organization uses GitHub for source control and Azure Pipelines for CI/CD. You need to implement a policy that requires all pull requests to pass a status check before merging. The status check should be provided by a pipeline that runs when a pull request is created. Which type of trigger should you configure in the pipeline YAML?

Accepted Answer

PR trigger. A PR trigger (pr:) in Azure Pipelines YAML automatically runs the pipeline when a pull request is created or updated against a specified branch. This allows the pipeline to produce a status check that GitHub enforces as a required check before merging, fulfilling the policy requirement.

Answer

Push trigger

Answer

Manual trigger

Answer

Scheduled trigger

Question 12

Your team uses Azure Pipelines and wants to automatically create a release every time a build succeeds on the main branch. Which trigger should you configure?

Accepted Answer

Build completion trigger in the release pipeline. A build completion trigger in the release pipeline allows you to automatically create a release whenever a specific build pipeline succeeds on the main branch. This trigger monitors the build pipeline for successful completions and initiates the release process, which directly matches the requirement of creating a release after every successful build on main.

Answer

Pull request trigger in the build pipeline

Answer

Continuous integration (CI) trigger in the release pipeline

Answer

Scheduled trigger in the release pipeline

Question 13

Refer to the exhibit. You run a KQL query in Microsoft Sentinel to audit Azure Container Registry login failures. The result shows 15 failed push attempts to the 'contoso/webapp' repository and 3 failed pull attempts to 'contoso/api'. What is the most likely security implication?

Accepted Answer

An attacker is attempting to push malicious images to the 'contoso/webapp' repository.. The query shows 15 failed push attempts to 'contoso/webapp' and 3 failed pull attempts to 'contoso/api'. Repeated failed push attempts to a specific repository are a classic indicator of an attacker trying to upload malicious images, as push operations require authentication and authorization. The high number of failures suggests a brute-force or credential-stuffing attack targeting the push operation, which is the most direct path to compromising the registry with unauthorized content.

Answer

The audit logs are not enabled for the container registry.

Answer

The container registry is misconfigured and allowing anonymous pushes.

Answer

The 'contoso/api' repository has been successfully pulled by an unauthorized user.

Question 14

You have a multi-stage YAML pipeline that builds and deploys a Java application. The pipeline runs on a Microsoft-hosted agent. The build stage fails intermittently with 'OutOfMemoryError: Java heap space'. What should you do to resolve this issue?

Accepted Answer

Set the environment variable 'MAVEN_OPTS' to '-Xmx2048m'.. The 'OutOfMemoryError: Java heap space' in a Maven build indicates that the JVM running Maven needs more heap memory. Setting the environment variable 'MAVEN_OPTS' to '-Xmx2048m' increases the maximum heap size for the Maven JVM process to 2048 MB, which resolves the memory issue. This is the standard and correct approach for Maven-based builds.

Answer

Use a self-hosted agent with more memory.

Answer

Set the environment variable 'GRADLE_OPTS' to '-Xmx2048m'.

Answer

Use the 'Maven@3' task with the 'jdkVersion' option set to 'jdk11'.

Question 15

A team uses Azure Pipelines to build a .NET application. The build takes 30 minutes, and developers complain that the pipeline runs slowly. The pipeline uses the 'windows-latest' agent and installs the .NET SDK in each run. Which action would MOST reduce the build time?

Accepted Answer

Enable pipeline caching for the .NET SDK.. Enabling pipeline caching for the .NET SDK allows the SDK to be restored from a cache instead of being downloaded and installed on every run. This eliminates the recurring overhead of SDK installation, which is a significant portion of the 30-minute build time, directly addressing the slow pipeline complaint.

Answer

Deploy a self-hosted agent in Azure.

Answer

Increase the number of parallel jobs.

Answer

Change the agent pool to 'ubuntu-latest'.