AZ-400 Practice Test 15 — 15 Questions

Question 1

Your Azure DevOps pipeline deploys a web app to Azure App Service using a YAML pipeline. The deployment fails intermittently with the error 'Conflict' when updating deployment slots. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Another deployment or swap operation is already in progress on the slot.. The 'Conflict' error during an Azure App Service deployment slot update indicates that the slot is currently locked by another operation, such as an ongoing deployment or a swap. Azure App Service enforces mutual exclusion on slot operations to prevent race conditions, so if a previous deployment or swap has not completed, the new request is rejected with HTTP 409 Conflict.

Answer

The service connection is using expired credentials.

Answer

The slot name is misspelled in the pipeline configuration.

Answer

The web app is locked by a file handle from a previous deployment.

Question 2

Your team uses Git for source control. You want to maintain a clean commit history on the main branch by avoiding merge commits. Which TWO merge strategies in a pull request achieve this?

Accepted Answer

Rebase merge. A rebase merge (option A) rewrites the commit history of the feature branch onto the tip of the target branch, creating a linear sequence of commits without any merge commits. This maintains a clean, linear history on the main branch. A squash merge (option C) combines all commits from the feature branch into a single new commit on the target branch, also avoiding merge commits and keeping the history clean.

Answer

Merge commit

Answer

Three-way merge

Answer

Fast-forward merge

Question 3

A developer wants to automatically trigger a GitHub Actions workflow when a pull request is opened that targets the 'release' branch. Which trigger should they use?

Accepted Answer

pull_request: branches: [release]. The `pull_request` trigger fires when a pull request is opened, and the `branches: [release]` filter restricts it to PRs targeting the `release` branch. `pull_request_target` also fires on PR open events but runs in the base repository context and is intended for workflows requiring secrets or write access, not as the general PR-open trigger. `push` only fires on pushes to branches, not on PR opens. Therefore, D is correct.

Answer

pull_request_target: branches: [release]

Answer

push: branches: [release]

Answer

workflow_dispatch:

Question 4

A team is designing a release pipeline for a .NET Core web application. They want to deploy to Azure App Service using a blue-green deployment strategy to minimize downtime. Which Azure App Service feature should they use to implement this?

Accepted Answer

Use deployment slots with swap operation.. Deployment slots in Azure App Service support swap operations that enable blue-green deployment by swapping the production slot with a staging slot. This minimizes downtime because the swap is warm-up and validation is done in the staging slot before traffic is redirected, and the swap itself is instantaneous under the hood. No external load balancer or traffic manager is needed because the swap operation handles the routing internally.

Answer

Use Azure Load Balancer in front of two separate App Services.

Answer

Configure auto-scaling rules.

Answer

Use Azure Traffic Manager to route traffic between slots.

Question 5

Your team uses Azure Pipelines and needs to comply with SOC 2 requirements. Which TWO features should you use to meet audit log requirements? (Select TWO.)

Accepted Answer

Enable Azure DevOps audit logging. Azure DevOps audit logging (Option C) captures a detailed, immutable record of events such as pipeline runs, permission changes, and access attempts, which is essential for SOC 2 audit log requirements. Streaming these logs to Azure Monitor Log Analytics (Option E) enables long-term retention, advanced querying, and alerting, satisfying the need for secure log storage and monitoring.

Answer

Configure network security groups to block public access

Answer

Automate secret rotation for service connections

Answer

Create service principals for pipeline authentication

Question 6

Your organization uses Azure DevOps and requires that all pipelines enforce branch policy for pull requests. A developer creates a pipeline that builds and tests code on push to any branch. The security team wants to ensure that no code can be deployed to production without passing through a pull request with required reviewers. Which action should you take to meet this requirement?

Accepted Answer

Configure branch policy on the main branch to require a pull request with a minimum number of reviewers.. Azure DevOps branch policies enforce that all changes to the main branch must go through a pull request with required reviewers. This ensures no code can be deployed to production without passing through the defined review process, meeting the security team's requirement.

Answer

Disable CI triggers on the pipeline and require manual builds.

Answer

Modify the service connection to require admin approval.

Answer

Set the pipeline to require approval from the security team before running.

Question 7

Which THREE components are required to set up a self-hosted agent in Azure Pipelines? (Choose three.)

Accepted Answer

A personal access token (PAT) with Agent Pools (read, manage) scope. A personal access token (PAT) with Agent Pools (read, manage) scope is required because the self-hosted agent uses this token to authenticate with Azure DevOps during the configuration step. The agent registers itself into the specified agent pool, and the PAT must have the 'Agent Pools (read, manage)' scope to authorize this registration and subsequent communication.

Answer

An Azure Resource Manager service connection

Answer

An Azure Active Directory account for the agent

Question 8

You need to run unit tests in your build pipeline and publish the test results to Azure Pipelines. Which task should you use?

Accepted Answer

Visual Studio Test task. To run unit tests and publish the results in Azure Pipelines, use the Visual Studio Test task. It executes the tests and automatically publishes the test results to the pipeline, providing rich reporting and pass/fail analysis. The Publish Test Results task is only used when you already have test result files (e.g., JUnit, TRX) from a previous step and need to import them; it does not run any tests itself. The DotNetCoreCLI test command can also run and publish results, but the Visual Studio Test task is the standard framework-agnostic choice.

Answer

DotNetCoreCLI task with test command

Answer

Npm task

Answer

Publish Test Results task

Question 9

Refer to the exhibit. You are deploying this Bicep file using Azure Pipelines. The 'environment' parameter should be set to 'dev', 'qa', or 'prod' based on the release stage. How should you pass the parameter value?

Accepted Answer

Set a pipeline variable named 'environment' and reference it in the AzureResourceManagerTemplateDeployment task's overrideParameters.. The AzureResourceManagerTemplateDeployment task's `overrideParameters` property allows you to dynamically pass parameter values at deployment time. By setting a pipeline variable named `environment` (which can be scoped per stage) and referencing it as `$(environment)` in `overrideParameters`, you can inject the correct value ('dev', 'qa', or 'prod') based on the release stage without modifying the Bicep file or its defaults.

Answer

Define the parameter in the 'parameters:' section of the YAML pipeline.

Answer

Use a task to replace the string '${environment}' in the Bicep file before deployment.

Answer

Modify the Bicep file to include a default value for environment.

Question 10

You are using Azure Pipelines to deploy a function app. You need to automatically roll back the deployment if the post-deployment smoke tests fail. What should you do?

Accepted Answer

Add a stage that runs only when the previous stage fails, executing a rollback script.. Azure Pipelines supports conditional stage execution using expressions like `eq(variables['Build.Reason'], 'IndividualCI')` or `failed()`. By adding a stage that runs only when the previous deployment stage fails (e.g., `condition: failed()`), you can execute a rollback script that reverts the function app to its previous stable version. This ensures automatic rollback upon smoke test failure without manual intervention.

Answer

Configure the pipeline to retry the deployment on failure.

Answer

Use a pre-deployment approval gate to validate the build before deployment.

Answer

Set up a manual validation gate that requires operations to initiate a rollback.

Question 11

You are setting up a release pipeline that deploys to multiple environments (dev, test, prod) sequentially. Each environment requires approval before deployment. What is the best way to implement this in Azure Pipelines?

Accepted Answer

Define pipeline stages with environment resources and pre-deployment approvals.. Azure Pipelines supports multi-stage YAML pipelines where each stage can reference an environment resource. Pre-deployment approvals are configured on the environment itself, ensuring that before a stage deploys to that environment, the specified approvers must grant approval. This provides a native, auditable, and integrated approval gate without custom scripting or legacy tooling.

Answer

Use environment resources with 'auto' trigger and no approvals.

Answer

Use classic release pipelines with approval gates per environment.

Answer

Use a custom PowerShell script to pause and prompt for approval.

Question 12

You have an Azure DevOps pipeline that deploys to multiple environments. You need to ensure that approvals are required before production deployment. Which pipeline configuration should you use?

Accepted Answer

Define an environment with required approvers for the production stage. Azure DevOps environments allow you to define required approvers for a specific stage (e.g., production). When a pipeline deploys to that environment, it pauses and waits for manual approval before proceeding, ensuring that production deployments are gated by authorized personnel.

Answer

Set the pipeline trigger to 'Manual' only

Answer

Add a 'Manual Intervention' task in the pipeline

Answer

Configure branch policies on the main branch

Question 13

You have a GitHub repository with a GitHub Actions workflow that builds a .NET application. The workflow should only run when changes are pushed to the main branch, but it currently runs on every push to any branch. How should you fix the workflow trigger?

Accepted Answer

Add 'on: push: branches: [main]' to the workflow.. The GitHub Actions workflow syntax to restrict a push trigger to a specific branch uses `on: push: branches: [main]`. This ensures the workflow only executes when commits are pushed to the main branch, not on pushes to any other branch.

Answer

Add 'on: push: branch: [main]' to the workflow.

Answer

Add 'on: push: paths: [main]' to the workflow.

Answer

Add 'on: pull_request: branches: [main]' to the workflow.

Question 14

A company uses Microsoft Entra ID for identity. They want to enforce that all code changes in Azure Repos require a linked work item and a successful policy evaluation. Which branch policy should they configure?

Accepted Answer

Require work item linking in the branch policy.. Requiring work item linking in the branch policy ensures that every pull request (PR) in Azure Repos must be associated with a work item (e.g., user story, bug) before it can be completed. Combined with a successful policy evaluation (e.g., build validation, required reviewers), this enforces traceability and compliance for all code changes.

Answer

Set the merge strategy to squash merge.

Answer

Enable 'Automatically include reviewers'.

Answer

Enforce a minimum number of comments.

Question 15

Your release pipeline deploys to Azure App Service using a deployment slot. You need to ensure that after swapping slots, the staging slot retains the previous production configuration for rollback. Which deployment strategy should you use?

Accepted Answer

Swap with preview. Swap with preview (multi-phase swap) is the correct strategy because it uses Azure App Service deployment slots to validate the staged version before completing the swap. When the swap is completed, the staging slot receives the previous production code and configuration, preserving a rollback state. If a problem occurs, you can swap back to the staging slot. Note that a standard slot swap also preserves the previous production state in staging, but swap with preview adds the benefit of preview validation before finalizing the swap, which aligns with the requirement of maintaining rollback capability.

Answer

Rolling deployment

Answer

Blue-green deployment

Answer

Canary deployment