AZ-400 Practice Test 16 — 15 Questions

Question 1

Your organization uses GitHub and wants to implement a policy that requires all pull requests to be approved by at least two members of the 'security-team' team before merging. The 'security-team' team is a child team of 'engineering'. Which branch protection rule setting should you use?

Accepted Answer

Use the 'Require pull request reviews before merging' rule and set 'Required reviewers' to the security team.. Option D is correct because the 'Require pull request reviews before merging' rule with 'Required reviewers' set to the team slug 'security-team' enforces approval from two members of that specific team. Option A (Require code owner review) would require a CODEOWNERS file and only enforce from listed owners. Option B (Dismiss stale reviews) is unrelated. Option C (Restrict who can dismiss reviews) does not set the reviewer requirement.

Answer

Enable 'Dismiss stale pull request approvals when new commits are pushed'.

Answer

Require a minimum number of reviewers and set it to 2.

Answer

Require code owner review and add the security team as code owners.

Question 2

You applied the above branch policy to a GitHub repository. A developer tries to push a commit to the main branch that is signed with an S/MIME signature. What will happen?

Accepted Answer

The commit is rejected because S/MIME is not in the allowed signature types.. The branch policy in question is configured to allow only GPG or SSH signatures. S/MIME is not listed as an allowed signature type, so the commit is rejected. GitHub's branch protection rules enforce signature requirements based on the allowed signature types specified in the policy.

Answer

The commit is accepted because S/MIME is implicitly allowed.

Answer

The commit is accepted because it is signed.

Answer

The commit is rejected because the policy is in 'block' mode, which blocks all pushes.

Question 3

Your team is migrating from on-premises TFS to Azure DevOps Services. You need to ensure that all existing work item history and attachments are preserved. Which migration approach should you use?

Accepted Answer

Use the Azure DevOps Migration Tools (open source). Option C is correct because the Azure DevOps Migration Tools (an open-source project) are specifically designed to migrate work items, including history, attachments, and links, from on-premises TFS to Azure DevOps Services. These tools handle the complex data transformations required to preserve the full fidelity of work item data, which is not possible with simpler export/import methods.

Answer

Export to Excel and import using Azure DevOps Office Integration

Answer

Manually recreate work items in Azure DevOps

Answer

Use the Azure DevOps REST API to migrate work items

Question 4

Which THREE elements are essential for an effective incident response process in a DevOps environment? (Choose three.)

Accepted Answer

Automated rollback or remediation capabilities.. Automated rollback or remediation capabilities are essential because they enable rapid, consistent recovery from incidents without manual intervention. In a DevOps environment, this is typically implemented through deployment pipelines (e.g., Azure Pipelines) that support automatic rollback to a previous known-good version when health checks fail, or through infrastructure-as-code tools like Terraform that can revert state. This minimizes mean time to recovery (MTTR) and reduces human error during high-pressure situations.

Answer

A blame-free culture that identifies the person at fault.

Answer

Manual approval gates for every change.

Question 5

Your organization is adopting Microsoft Entra ID for identity management. You need to configure Azure DevOps to trust tokens issued by Entra ID for service connections. Which authentication method should you use?

Accepted Answer

Managed identity. Managed identity (Option B) is correct because it allows Azure DevOps to authenticate to Microsoft Entra ID without storing any credentials, using an identity automatically managed by Azure. This is the recommended approach for service connections when the Azure DevOps agent runs on an Azure resource (e.g., a VM or App Service) that supports managed identities, as it eliminates the need for secret rotation and reduces security risk.

Answer

Service principal with client secret

Answer

OAuth 2.0 authorization code grant

Answer

Personal access token (PAT)

Question 6

Your organization uses GitHub Advanced Security. You need to ensure that secrets detected in pull requests automatically block the PR from merging. What should you configure?

Accepted Answer

Configure a custom secret scanning pattern and set the 'Block pull requests' property.. Option A is correct because GitHub Advanced Security allows you to create custom secret scanning patterns with a 'Block pull requests' property. When enabled, this property prevents a pull request from being merged if the custom pattern detects a secret in the PR's changes, directly meeting the requirement to automatically block merging on secret detection.

Answer

Configure a code scanning query to detect secrets.

Answer

Enable secret scanning and set the severity to critical.

Answer

Enable push protection for secret scanning.

Question 7

Your team wants to implement a policy that requires all pull requests to have at least one approval from a member of the 'Senior Developers' group before merging. Which mechanism should you use?

Accepted Answer

Create a branch policy on the target branch that requires a minimum number of reviewers from the 'Senior Developers' group.. Azure Repos branch policies allow you to enforce required reviewers on pull requests. By creating a branch policy on the target branch that requires a minimum number of reviewers from the 'Senior Developers' group, you ensure that no pull request can be completed without at least one approval from that group. This directly meets the requirement without relying on file-level ownership or external scripts.

Answer

Add a CODEOWNERS file that designates 'Senior Developers' as owners of all files.

Answer

Configure the pull request dashboard to display required reviewers.

Answer

Set up a build validation policy that runs a script to check approvals.

Question 8

Which TWO GitHub Actions features can be used to enforce deployment approvals for a production environment? (Choose two.)

Accepted Answer

Deployment protection rules that require approval.. Option A is correct because deployment protection rules in GitHub Actions allow you to define required approvals before a workflow job can deploy to an environment. These rules are configured at the environment level and can mandate that a specific number of reviewers approve the deployment, effectively enforcing a manual approval gate for production environments.

Answer

The 'deployment' event trigger in a workflow.

Answer

Branch protection rules that require pull request reviews.

Answer

OpenID Connect (OIDC) for cloud provider authentication.

Question 9

Your Azure DevOps pipeline uses a YAML template that includes a step to push a Docker image to Azure Container Registry. The pipeline fails with 'unauthorized: authentication required'. The service connection uses a workload identity federation. What is the most likely cause?

Accepted Answer

The service principal used by the workload identity does not have the 'acrPush' role. The error 'unauthorized: authentication required' indicates that the Docker client could not authenticate with Azure Container Registry. With workload identity federation, the service principal used by the federated credential must have the 'acrPush' role assigned on the ACR scope to push images. Without this role assignment, the authentication token lacks the necessary permissions, even if the identity itself is valid.

Answer

The Docker image tag contains invalid characters

Answer

The Azure Container Registry name is incorrect

Answer

The service connection secret has expired

Question 10

Which TWO actions are recommended practices for improving communication within a DevOps team?

Accepted Answer

Create a shared team charter with communication norms.. A shared team charter with communication norms establishes explicit expectations for how the team interacts, reducing ambiguity and fostering a culture of transparency and accountability. This practice aligns with DevOps principles of collaboration and shared ownership, ensuring all members understand preferred channels, response times, and escalation paths.

Answer

Use separate documentation repositories for each team.

Answer

Send monthly status reports via email.

Answer

Remove team chat channels to reduce noise.

Question 11

Your company uses Microsoft Teams for collaboration. You want to send notifications to a Teams channel whenever a build pipeline in Azure Pipelines fails. Which approach should you use?

Accepted Answer

Install the Azure Pipelines app for Microsoft Teams and subscribe the channel to pipeline notifications.. Option C is correct because the Azure Pipelines app for Microsoft Teams provides built-in integration to subscribe to pipeline events and send notifications to channels. Option A is incorrect because email subscriptions are separate. Option B is incorrect because webhooks require custom configuration. Option D is incorrect because the Teams connector is deprecated in favor of the app.

Answer

Configure an email subscription in Azure DevOps to send alerts to the Teams channel email address.

Answer

Set up a webhook in Azure DevOps to post to the Teams channel's incoming webhook URL.

Answer

Use the 'Post to a Microsoft Teams channel' task in the pipeline.

Question 12

Your team uses Azure DevOps and wants to automate the creation of a bug work item when a release pipeline fails. Which two actions should you take?

Accepted Answer

Configure a Service Hook to create a work item when a release stage fails.. Option B is correct because Service Hooks in Azure DevOps allow you to integrate with external services and trigger actions, such as creating a work item in Azure Boards, when a release stage fails. Option D is correct because the 'Create work item on failure' task can be added directly to a release pipeline to automatically generate a bug work item upon failure, providing a built-in automation mechanism without external dependencies.

Answer

Set a scheduled trigger for the release pipeline.

Answer

Add a build completion trigger to the release pipeline.

Answer

Configure a pre-deployment approval.

Question 13

You want to ensure that every commit message in your repository follows a specific format. Which GitHub feature can enforce this?

Accepted Answer

Required status checks with a commit lint action. Option D is correct because required status checks, when combined with a commit lint action in a GitHub Actions workflow, can enforce commit message formatting. The workflow runs on push or pull request events, and the status check must pass before a pull request can be merged, effectively rejecting commits that do not conform to the specified format.

Answer

Webhooks to validate and reject pushes

Answer

Branch protection rules

Answer

GitHub Actions workflow with push trigger

Question 14

Your team uses Azure Boards to track work items. They want to automatically update the 'Remaining Work' field on a task when a developer completes a pull request linked to that task. Which Azure DevOps feature should you configure?

Accepted Answer

Configure a branch policy to automatically update work items on PR completion.. Option A is correct because branch policies with automation can update work items when PRs are completed. Option B is wrong because service hooks are for external integrations, not internal work item updates. Option C is wrong because work item templates only set initial values. Option D is wrong because pipeline variables are for build/release, not work item updates.

Answer

Define a pipeline variable to update the field during build.

Answer

Use a service hook to trigger an Azure Function that updates the work item.

Answer

Create a work item template that sets remaining work.

Question 15

Your team uses trunk-based development with short-lived feature branches. You notice that code reviews often delay merging because reviewers are not available. What is the best way to reduce review latency while maintaining quality?

Accepted Answer

Encourage pair programming or mob programming to review code in real-time.. Option B is correct because pair programming or mob programming can reduce the need for asynchronous reviews as code is reviewed in real-time. Option A is incorrect because reducing reviewer count may lower quality. Option C is incorrect because automatic merging bypasses review. Option D is incorrect because a separate review team introduces bottlenecks.

Answer

Enable auto-merge for pull requests that have passed all checks.

Answer

Require only one reviewer instead of two.

Answer

Create a separate review team that only handles pull requests.