AZ-400 Practice Test 14 — 15 Questions

Question 1

A company uses Azure DevOps and needs to ensure that all pipelines use approved YAML templates from a central repository. The security team wants to prevent developers from referencing unapproved templates. What is the best way to enforce this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a pipeline decorator to check the template origin and fail the pipeline if unapproved.. The correct approach is to use a pipeline decorator that runs at the start of every pipeline, inspects the YAML for template references, and fails the pipeline if any template is not from the approved central repository. The 'Required template' setting forces inclusion of a template but does not block additional unapproved template references.

Answer

Create a branch policy on the repository that requires all pull requests to be approved by security team members.

Answer

Configure a variable group with the approved template repository and require it in all pipelines.

Answer

Set the 'Required template' repository setting in the Azure DevOps project to the approved central repository.

Question 2

Which TWO actions should you take to implement a secure CI/CD pipeline that uses Azure Pipelines and prevents unauthorized access to production? (Choose two.)

Accepted Answer

Configure deployment approvals and checks on the production stage.. Deployment approvals and checks in Azure Pipelines require manual sign-off or automated policy validation before a release proceeds to production, preventing unauthorized or unverified changes. Option D is correct because using a service connection with a managed identity eliminates the need to store static credentials, reducing the risk of credential exposure and unauthorized access to Azure resources during deployment.

Answer

Store production secrets as pipeline variables marked as 'Secret'.

Answer

Enable PR triggers for the production stage to validate changes.

Answer

Use self-hosted agents running on-premises for all pipelines.

Question 3

You are configuring a release pipeline in Azure DevOps to deploy to multiple environments (dev, test, prod). You need to ensure that the production deployment requires manual approval from the release manager. What should you configure?

Accepted Answer

Set pre-deployment approvals on the production stage.. Pre-deployment approvals on the production stage enforce manual sign-off before any deployment to that environment begins. This ensures the release manager must explicitly approve the deployment, meeting the requirement for manual approval on production. Azure DevOps stages support pre-deployment and post-deployment approval gates, with pre-deployment being the correct choice for controlling when a stage starts.

Answer

Add a manual intervention task before the production deployment.

Answer

Set post-deployment approvals on the test stage.

Answer

Use a condition on the production stage to check a variable.

Question 4

Your organization uses GitHub Actions with self-hosted runners on Azure virtual machines. You notice that some workflows are taking longer than expected because runners are busy. You need to improve the performance without adding more permanent runners. Which solution should you implement?

Accepted Answer

Implement auto-scaling for self-hosted runners using a scale set or Kubernetes-based runner controller.. Auto-scaling self-hosted runners using a scale set or a Kubernetes-based runner controller (e.g., actions-runner-controller) dynamically provisions and deprovisions runner instances based on workflow demand. This eliminates idle runner waste while ensuring sufficient capacity during peak loads, directly addressing the bottleneck without adding permanent infrastructure.

Answer

Migrate all workflows to GitHub-hosted runners.

Answer

Reduce the number of concurrent jobs in each workflow.

Answer

Increase the size of the existing self-hosted runner VMs to handle more jobs.

Question 5

Your organization uses GitHub Actions for CI/CD. You need to ensure that secrets stored in GitHub are not exposed in build logs. A developer accidentally printed a secret to the console in a workflow step. What built-in feature of GitHub Actions automatically prevents this?

Accepted Answer

Automatic log redaction. GitHub Actions includes a built-in feature that automatically redacts secrets from workflow run logs. When a secret is printed to the console, GitHub detects the secret value and replaces it with '***' in the log output, preventing accidental exposure. This redaction happens at the log rendering layer, not in the workflow execution, so the secret is never visible to users viewing the logs.

Answer

Audit log monitoring

Answer

Secret scanning alerts

Answer

Required reviewers on workflows

Question 6

Your release pipeline uses a multi-stage YAML with environments. You need to ensure that only one deployment runs at a time to a production environment to avoid conflicts. Which feature should you use?

Accepted Answer

Configure an exclusive lock policy on the production environment.. An exclusive lock policy on an environment ensures that only one deployment can run at a time to that environment. When a deployment starts, it acquires a lock on the environment; subsequent deployments are queued until the lock is released. This prevents conflicts from concurrent deployments to the same production environment.

Answer

Use a condition to check if a previous deployment is in progress.

Answer

Add a pre-deployment approval gate.

Answer

Set the 'parallel' deployment option to 1.

Question 7

You are designing a release pipeline for a .NET application. The pipeline must deploy to multiple environments (Dev, Test, Prod) with manual approval at each stage. Which release trigger should you configure for the production stage?

Accepted Answer

Manual trigger with pre-deployment approvals.. The requirement specifies manual approval at each stage, and for the production stage, a manual trigger with pre-deployment approvals ensures that deployments only occur after explicit human authorization. This aligns with the need for controlled, gated releases to production, preventing automatic or scheduled deployments that bypass approval.

Answer

Pull request trigger from the main branch.

Answer

Continuous deployment trigger after a successful build.

Answer

Scheduled trigger set to run nightly.

Question 8

A company deploys a web application to Azure App Service. They want to monitor application performance and detect anomalies using Application Insights. Which two components should be configured?

Accepted Answer

Configure sampling to reduce data volume. Sampling in Application Insights reduces the volume of telemetry data while preserving statistically correct analysis, which is essential for managing cost and performance in high-traffic applications. Option D is correct because the application-side SDK (e.g., Application Insights SDK for .NET, Java, or Node.js) is required to instrument the code and collect detailed telemetry such as requests, dependencies, and exceptions for performance monitoring and anomaly detection.

Answer

Deploy the Azure Monitor agent on the App Service instance

Answer

Create a Log Analytics workspace and configure data collection rules

Answer

Enable diagnostics settings to stream logs to Event Hubs

Question 9

Your release pipeline deploys to Azure App Service using a deployment slot strategy. After a successful deployment to the staging slot, you run smoke tests, then swap slots. Recently, a swap failed because the staging slot had an incorrect application setting. What is the BEST way to prevent this issue?

Accepted Answer

Mark the application setting as a deployment slot setting.. Marking the application setting as a deployment slot setting ensures that the setting stays with the slot and is not swapped between staging and production. This prevents the staging slot from having an incorrect value that could cause a swap failure, as the setting is pinned to the slot and not part of the swap payload.

Answer

Use a manual approval gate before swap.

Answer

Configure the App Service deployment center.

Answer

Add a task to verify settings before swap.

Question 10

A company deploys a .NET Core web application to Azure App Service. The application uses Application Insights for monitoring. The operations team reports that dependency tracking is missing for calls to a third-party REST API made using HttpClient. The application is instrumented with the Application Insights SDK. Which action should be taken to enable dependency tracking for HttpClient calls?

Accepted Answer

Ensure the SDK is configured using services.AddApplicationInsightsTelemetry(); in the Startup.cs file.. `services.AddApplicationInsightsTelemetry()` in `Startup.cs` automatically registers the `DependencyTrackingModule` for .NET Core applications. This module collects dependency telemetry for `HttpClient` calls made via `IHttpClientFactory` or typed `HttpClient` instances, provided the SDK is properly configured. Since the application already uses the Application Insights SDK, this single line enables automatic dependency tracking without additional packages or agents.

Answer

Install the Application Insights Agent on the App Service instance.

Answer

Add a reference to Microsoft.ApplicationInsights.DependencyCollector and call DependencyTrackingModule.Initialize().

Answer

Use the Application Insights Status Monitor to enable dependency tracking.

Question 11

Your pipeline builds a .NET application and runs unit tests. You notice that the pipeline takes too long because it restores NuGet packages on every run. You want to cache the NuGet packages to speed up subsequent builds. Which task should you use?

Accepted Answer

Cache@2 (CacheBeta). The Cache@2 (CacheBeta) task is specifically designed to cache folders or files between pipeline runs, such as NuGet packages, to reduce restore time. By caching the NuGet packages folder (e.g., $(UserProfile)/.nuget/packages), subsequent builds can skip the full restore and reuse previously downloaded packages, significantly speeding up the pipeline.

Answer

NuGetCommand@2 with the restore command

Answer

CopyFiles@2

Answer

PowerShell@2 to manually download and cache

Question 12

Your company has a large monorepo with multiple microservices. You have a single YAML-based Azure Pipeline that builds the entire solution on every commit to the main branch. The pipeline takes over an hour to complete, causing long feedback loops. Developers often submit changes to only one service, but the whole pipeline runs. You need to reduce build time while maintaining quality. You are considering splitting the pipeline into multiple pipelines, each for a service, and using path triggers. However, some services have dependencies on shared libraries that are updated infrequently. You also need to ensure that integration tests that span multiple services still run when necessary. What should you do?

Accepted Answer

Create separate pipelines for each service with path triggers, and create an additional comprehensive pipeline that triggers only when shared libraries change.. It uses path triggers to run only the pipeline for the changed service, drastically reducing build time. The additional comprehensive pipeline, triggered only when shared libraries change, ensures that integration tests spanning multiple services still run when dependencies are updated, maintaining quality.

Answer

Keep the single pipeline but add caching for dependencies.

Answer

Use a single pipeline but add conditional stages to skip unchanged services.

Answer

Create separate pipelines for each service with path triggers, and disable the comprehensive pipeline.

Question 13

Your organization uses GitHub Copilot for pull request summaries. A developer notices that the AI-generated summary is inaccurate. Which step should the developer take to improve the quality of future summaries?

Accepted Answer

Provide a detailed pull request description. Providing a detailed pull request description gives GitHub Copilot more context and structured input, which directly improves the accuracy of AI-generated summaries. Copilot's PR summary feature relies on the diff and any existing description to infer intent; a richer description reduces ambiguity and enhances the quality of the generated output.

Answer

Disable Copilot for pull requests

Answer

Edit the description after generation

Answer

Ignore the inaccuracy

Question 14

You are configuring Application Insights for a .NET Core web application deployed to Azure App Service. The application must capture telemetry for all HTTP requests, exceptions, and dependency calls with minimal code changes. What should you do?

Accepted Answer

Enable the Application Insights site extension in the App Service 'Application Insights' blade.. Enabling the Application Insights site extension via the App Service 'Application Insights' blade automatically instruments the .NET Core application without requiring any code changes. This extension injects the necessary telemetry modules to capture HTTP requests, exceptions, and dependency calls at the runtime level, leveraging the Azure App Service integration for zero-code instrumentation.

Answer

Configure diagnostics logging in the App Service and stream logs to Application Insights.

Answer

Install the Microsoft.ApplicationInsights.AspNetCore NuGet package and add services.AddApplicationInsightsTelemetry() in Startup.cs.

Answer

Add the Application Insights JavaScript SDK to each page.

Question 15

Which TWO are valid reasons to use a monorepo?

Accepted Answer

Simplifies code sharing and reuse across multiple projects.. A monorepo centralizes all code in a single repository, making it straightforward to share common libraries, utilities, and components across multiple projects without needing separate package feeds or submodule references. Option E is correct because with all projects in one repo, dependency versions are unified and managed in a single set of manifest files (e.g., package.json, requirements.txt), eliminating cross-repo version drift and simplifying coordinated updates.

Answer

Smaller clone size compared to multiple repositories.

Answer

Allows independent CI/CD pipelines for each project.

Answer

Improves security by isolating each project.