AZ-400 Practice Test 15 — 15 Questions

Question 1

You are configuring a YAML build pipeline for a .NET Core application. Which task should you use to restore NuGet packages?

Accepted Answer

DotNetCoreCLI task with 'restore' command. The DotNetCoreCLI task with the 'restore' command is the recommended approach for restoring NuGet packages in a YAML build pipeline for a .NET Core application. It directly invokes 'dotnet restore', which is the native .NET CLI command that handles package restoration efficiently and integrates seamlessly with the .NET SDK, ensuring compatibility with project files and dependency resolution.

Answer

NuGetCommand task

Answer

PowerShell task with dotnet restore

Answer

NuGetAuthenticate task

Question 2

You have a release pipeline that deploys to multiple stages. You want to ensure that a manual approval is required before deploying to the production stage. Which approach should you use?

Accepted Answer

Add a pre-deployment approval on the production stage.. Pre-deployment approvals in Azure Pipelines allow you to require manual sign-off before a release proceeds to a specific stage. By adding a pre-deployment approval on the production stage, the pipeline will pause and wait for designated approvers to approve the deployment, ensuring that no code reaches production without explicit authorization.

Answer

Add a post-deployment approval on the staging stage.

Answer

Configure a deployment gate with a manual intervention task.

Answer

Use a pipeline decorator to inject approval step.

Question 3

Your organization requires that all code changes be signed using a valid code signing certificate before they can be merged. Which feature in GitHub should you enable to enforce this?

Accepted Answer

Commit signature verification.. GitHub's commit signature verification uses GPG, SSH, or S/MIME keys to cryptographically sign commits and tags, and branch protection/rulesets can require signed commits before merging. This enforces that all code changes carry a verified signature tied to a trusted identity.

Answer

Dependabot.

Answer

Code scanning.

Answer

Secret scanning.

Question 4

Your organization uses GitHub Actions. You need to create a reusable workflow that builds and tests a Node.js application. Which approach should you use to define the workflow?

Accepted Answer

Define a reusable workflow with 'on: workflow_call'. A reusable workflow in GitHub Actions is defined by placing a workflow file in .github/workflows/ and adding the 'on: workflow_call' trigger. This allows the workflow to be called from other workflows in the same repository or organization, enabling centralized build and test logic. Unlike composite actions, reusable workflows can contain multiple jobs and run on their own runners, making them ideal for orchestrating complex CI/CD pipelines like building and testing a Node.js app.

Answer

Define a standard workflow in .github/workflows/build.yml

Answer

Use a composite action to encapsulate the build steps

Answer

Create a custom action and reference it in multiple workflows

Question 5

Match each Azure Repos policy to its enforcement.

Accepted Answer

Require a minimum number of reviewers: At least two reviewers must approve the pull request before it can be completed.. The correct matches are A, B, C, D. Policy A requires at least two reviewers. Policy B requires linked work items. Policy C requires a successful build. Policy D limits merge types. Policies E and F are incorrect because they swap the descriptions: E describes merge types but is labeled as reviewer count, and F describes reviewer count but is labeled as work item linking.

Answer

Require a minimum number of reviewers: Specify which merge strategies are allowed, such as squash merge or rebase.

Answer

Check for linked work items: At least two reviewers must approve the pull request before it can be completed.

Question 6

You are designing a release pipeline for a mission-critical application. The pipeline must deploy to multiple environments (dev, test, prod) in sequence, with manual approval required before production deployment. Which Azure Pipelines feature should you use?

Accepted Answer

Pre-deployment approvals. Pre-deployment approvals are the correct feature because they allow you to require manual sign-off before a release proceeds to a specific stage. In this scenario, you need a manual approval gate before production deployment, which is exactly what pre-deployment approvals enforce—the release pauses at the production stage until an authorized user approves it.

Answer

Variable groups

Answer

Pipeline triggers

Answer

Deployment gates

Question 7

Your organization uses Azure Repos for source control and Azure Pipelines for CI/CD. You need to implement a policy that ensures every commit to the main branch is built and passes all tests before it can be merged. The team uses feature branches for development. What is the most efficient way to enforce this?

Accepted Answer

Configure a branch policy on the main branch that requires a successful build from a pull request trigger.. Azure Repos branch policies on main can require a build validation that runs on pull requests and blocks completion until the build succeeds. This enforces that every PR is built and tested before merge, which is exactly the requirement. Manual runs, non-blocking pipelines, and post-merge CI triggers do not prevent merging of failing code.

Answer

Require developers to manually run the pipeline before merging.

Answer

Use a pre-merge validation pipeline that runs on pull requests but does not block merging.

Answer

Set up a CI trigger on the main branch to run the pipeline on every commit.

Question 8

Your organization is adopting GitHub Actions for CI/CD. You need to ensure that only approved actions from your enterprise can be used in workflows. What should you configure?

Accepted Answer

Set the enterprise policy to 'Allow only specific actions' and add approved actions.. GitHub Enterprise allows administrators to restrict which actions can be used in workflows by setting the enterprise policy to 'Allow only specific actions' and then explicitly approving a curated list of actions. This ensures that only trusted, pre-approved actions (e.g., from verified publishers or your own organization) can be referenced, preventing the execution of unapproved or malicious actions. This policy is enforced at the enterprise level and applies to all repositories within the enterprise, providing centralized control over CI/CD supply chain security.

Answer

Use a third-party tool to scan workflows for disallowed actions after each commit.

Answer

Set the enterprise policy to 'Allow all actions' and rely on code review.

Answer

Configure repository permissions to restrict actions to only those created by your organization.

Question 9

Your build pipeline uses a self-hosted agent that runs on a Windows machine. The pipeline fails with the error: 'The task 'DotNetCoreCLI' is not supported on this agent.' What is the most likely cause?

Accepted Answer

The agent does not have the required capabilities (e.g., .NET Core SDK installed).. The error 'The task 'DotNetCoreCLI' is not supported on this agent' indicates that the agent lacks the required capabilities to execute the task. In Azure Pipelines, self-hosted agents must have the necessary software (e.g., .NET Core SDK) installed and declared as capabilities for the task to be considered supported. Option B correctly identifies this missing capability as the root cause.

Answer

The agent's execution policy is restricted.

Answer

The agent is not authorized to run the pipeline.

Answer

The agent cannot connect to the internet to download the task.

Question 10

You are designing a build pipeline for a Python application that uses Anaconda environments. The pipeline must create a Conda environment, install dependencies, and run tests. The pipeline should also cache the Conda environment to speed up subsequent builds. Which configuration should you use?

Accepted Answer

Use the 'CondaEnvironment' task to create the environment, and use the 'Cache' task to cache the Conda packages folder.. The 'CondaEnvironment' task is purpose-built for creating and updating Conda environments from an environment.yml file, and combining it with the 'Cache' task to cache the Conda packages folder (typically `$(Pipeline.Workspace)/conda_pkgs`) significantly reduces build time by avoiding re-downloading packages on subsequent runs. This approach aligns with Azure DevOps best practices for dependency caching and Conda environment management.

Answer

Use the 'UsePythonVersion' task with a version spec, and add a script to create the Conda environment.

Answer

Use a Docker container with Anaconda pre-installed and run the pipeline inside the container.

Answer

Use a script to run 'conda create' and 'conda install', and manually cache the environment by specifying a path.

Question 11

Which THREE elements are essential for an effective incident response process in a DevOps environment? (Choose three.)

Accepted Answer

Automated rollback or remediation capabilities.. Automated rollback or remediation capabilities are essential because they enable rapid, consistent recovery from incidents without manual intervention. In a DevOps environment, this is typically implemented through deployment pipelines (e.g., Azure Pipelines) that support automatic rollback to a previous known-good version when health checks fail, or through infrastructure-as-code tools like Terraform that can revert state. This minimizes mean time to recovery (MTTR) and reduces human error during high-pressure situations.

Answer

A blame-free culture that identifies the person at fault.

Answer

Manual approval gates for every change.

Question 12

Your team uses Azure Repos Git and wants to enforce a policy that all pushes to the main branch must pass a build validation pipeline. The pipeline runs unit tests and code analysis. You need to configure this in the branch policy. Which setting should you enable?

Accepted Answer

Build validation. The Build validation policy in Azure Repos Git enforces that a specified pipeline must succeed before a pull request can be merged into the target branch. This directly meets the requirement to run unit tests and code analysis on all pushes to the main branch, blocking merges if the build fails.

Answer

Require comment resolution

Answer

Linked work items

Answer

Limit merge types

Question 13

Your team uses Azure DevOps and wants to enforce that all changes to the main branch go through a pull request process with at least two approvals. They also want to prevent contributors from approving their own pull requests. Which branch policy settings should they use?

Accepted Answer

Enable 'Require a minimum number of reviewers' set to 2, and enable 'Allow users to approve their own changes' unchecked (or set to false).. It directly addresses both requirements: setting 'Require a minimum number of reviewers' to 2 enforces at least two approvals, and unchecking 'Allow users to approve their own changes' prevents contributors from approving their own pull requests. These are branch policy settings within Azure Repos that control the pull request workflow on the main branch.

Answer

Enable 'Check for linked work items' and 'Require a minimum number of reviewers' set to 2, and enable 'Reset code reviewer votes when new changes are pushed'.

Answer

Add the 'main' branch to the 'Required reviewers' list and add all developers as required reviewers.

Answer

Enable 'Require a minimum number of reviewers' set to 2, and enable 'Build validation' with a required build.

Question 14

Your release pipeline uses a 'Run Azure CLI' task to execute a script. The script authenticates using a service principal. However, the deployment fails with 'insufficient privileges to complete the operation'. What is the most likely cause?

Accepted Answer

The service principal lacks the necessary RBAC role on the target resource.. The error 'insufficient privileges to complete the operation' indicates that the service principal successfully authenticated but lacks the required Azure RBAC role on the target resource. Even with a valid secret and a logged-in Azure CLI session, the service principal must have an assigned role (e.g., Contributor, Owner, or a custom role) that grants the specific permissions needed for the deployment operation.

Answer

The Azure CLI task is not logged in.

Answer

The service principal secret has expired.

Answer

The service principal does not have a secret.

Question 15

Your team uses GitHub Issues to track work. You want to enforce that all new issues include a specific set of labels based on the issue type (bug, feature, task). What is the most efficient way to achieve this?

Accepted Answer

Create YAML-based issue forms in the .github/ISSUE_TEMPLATE folder.. GitHub issue forms, defined as YAML files in the .github/ISSUE_TEMPLATE folder, allow you to create structured templates that can enforce required fields, including mandatory label assignments. When a user submits an issue via a form, the labels specified in the template are automatically applied, ensuring consistency without manual intervention or additional automation.

Answer

Configure branch protection rules to require label assignments.

Answer

Use a CODEOWNERS file to auto-assign labels.

Answer

Set up a repository ruleset to restrict label modifications.