AZ-400 Practice Test 16 — 15 Questions

Question 1

You are setting up a new GitHub repository for a project that requires strict access control. Only specific team members should be able to push to the main branch, but all team members should be able to create branches and open pull requests. What is the best way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a branch protection rule to restrict pushes to the main branch to specific users or teams.. Branch protection rules in GitHub allow you to enforce restrictions on specific branches, such as requiring pull request reviews or restricting who can push directly. By configuring a rule for the main branch that limits push access to only designated users or teams, you ensure that all team members can create branches and open PRs, but only authorized members can merge into main. This directly meets the requirement without over-provisioning permissions or blocking collaboration.

Answer

Add all team members as administrators of the repository.

Answer

Remove write permissions for non-core team members and give them read-only access.

Answer

Set the repository to private and invite only core team members.

Question 2

You are analyzing Azure DevOps audit logs with the KQL query above. Your security team wants to ensure that only approved service connections are used. After running the query, you find multiple service connections created by a user who is not on the approved list. What should you do next?

Accepted Answer

Review each unapproved service connection's permissions and usage.. The immediate priority is to assess the risk of each unapproved service connection before taking action. Service connections in Azure DevOps can have varying permissions and may be used by pipelines, so blindly deleting them could break critical deployments. The correct next step is to review each connection's permissions (e.g., who can use it, which service principals are linked) and its usage history (e.g., which pipelines reference it) to determine whether it is malicious or simply an oversight.

Answer

Immediately delete all service connections created by that user.

Answer

Disable the user's account in Microsoft Entra ID.

Answer

Modify the query to also include the user's email address.

Question 3

You are designing a release pipeline for a microservices application. Which two strategies can you use to manage configuration across different environments? (Choose two.)

Accepted Answer

Use variable groups linked to Azure Key Vault.. Options A and B are correct because variable groups provide a centralized and secure way to manage configuration across multiple environments and pipelines. Option A uses Azure Key Vault for secrets, integrating with access policies and rotation, while option B stores non-sensitive environment-specific settings. Option C is incorrect because XML transformation targets web.config files, which are legacy .NET artifacts and not typical for modern microservices that use JSON, YAML, or environment variables. Option D is incorrect because stage-level variables are scoped to a single pipeline definition and do not offer a reusable, centralized configuration mechanism across different environments or pipelines; variable groups are designed for that purpose.

Answer

Use XML transformation tasks for web.config.

Answer

Use multi-stage YAML pipelines with stage-level variables.

Question 4

Your organization is adopting a trunk-based development strategy with short-lived feature branches. Which branch policy should you enforce to ensure that code is integrated frequently and conflicts are minimized?

Accepted Answer

Require a minimum number of reviewers and enforce a squash merge strategy. In a trunk-based development strategy with short-lived feature branches, the goal is to integrate code frequently and minimize merge conflicts. Requiring a minimum number of reviewers ensures code quality and team awareness, while enforcing a squash merge strategy collapses all feature branch commits into a single commit on the main branch, keeping the history linear and clean. This approach reduces the risk of complex merge conflicts and supports continuous integration by encouraging small, frequent merges.

Answer

Allow direct pushes to main branch for senior developers

Answer

Create release branches for each production deployment

Answer

Require all merges to be fast-forward only

Question 5

You are designing a build pipeline that must be triggered only when changes are made to specific folders in the repository. The pipeline should ignore documentation changes. Which trigger configuration should you use?

Accepted Answer

Configure a path trigger with include paths for source code and exclude paths for docs.. Azure Pipelines path triggers allow you to specify include and exclude filters on file paths. By including only source code folders and excluding the docs folder, the pipeline will only run when relevant code changes are made, ignoring documentation updates.

Answer

Configure a scheduled trigger to run the pipeline daily.

Answer

Configure a branch trigger with an include filter for the main branch.

Answer

Configure a tag trigger with a pattern that matches release tags.

Question 6

You are evaluating an Azure Policy assignment for Azure Pipelines. What does this policy audit?

Accepted Answer

Whether pipelines use secure files with extensions other than .pfx, .p12, or .cer. The Azure Policy for Azure Pipelines audits whether secure files have file extensions other than .pfx, .p12, or .cer. This policy is designed to enforce that only certificate-related secure files (which are typically used for code signing or TLS) are allowed, preventing the upload of arbitrary file types that could introduce security risks or misconfiguration.

Answer

Whether secure files are rotated within 90 days

Answer

Whether secure files are encrypted at rest

Answer

Whether secure files are used in production pipelines

Question 7

You are troubleshooting an intermittent performance issue in a web application. Application Insights shows a high number of failed dependency calls to Azure SQL Database. The errors are SqlException with error code -2 (timeout). What is the most likely cause and recommended fix?

Accepted Answer

The application is exhausting the connection pool; increase Max Pool Size in the connection string.. A is correct because SqlException with error code -2 indicates a connection timeout, which in a high-traffic scenario is most commonly caused by the application exhausting the connection pool. When all connections in the pool are in use and the wait time for a free connection exceeds the Connect Timeout (default 15 seconds), new requests fail with this error. Increasing Max Pool Size in the connection string (e.g., Max Pool Size=200) allows more concurrent connections, reducing contention.

Answer

The SQL Server firewall is blocking the application IP; add a firewall rule.

Answer

The database is experiencing deadlocks; enable read committed snapshot isolation.

Answer

The database DTU limit is being exceeded; scale up the service tier.

Question 8

Your team uses Azure Pipelines for CI/CD. The pipeline builds a Docker image and pushes it to Azure Container Registry (ACR). You need to ensure that only the main branch triggers a build of the Docker image. What should you configure in the pipeline YAML?

Accepted Answer

Set 'trigger: branches: include: - main'. Setting `trigger: branches: include: - main` in the pipeline YAML configures a CI trigger that only starts a new pipeline run when changes are pushed to the `main` branch. This ensures that the Docker image build and push to ACR occurs exclusively for the main branch, meeting the requirement.

Answer

Set 'pr: branches: include: - main'

Answer

Add a condition: 'eq(variables['Build.SourceBranch'], 'refs/heads/main')' to the job.

Answer

Set 'trigger: branches: include: - *'

Question 9

Your organization requires that all code changes must be built and tested before merging to the main branch. You plan to use branch policies in Azure Repos. Which policy enforcement will ensure that a pull request cannot be completed unless the build succeeds?

Accepted Answer

Add a build validation policy that triggers a build on each PR update.. Azure Repos branch policies include a 'Build validation' policy that triggers a specified build pipeline on each pull request (PR) update. The policy enforces that the PR cannot be completed unless the build succeeds, directly meeting the requirement that all code changes must be built and tested before merging to the main branch.

Answer

Require a linked work item in the pull request.

Answer

Require a minimum number of reviewers.

Answer

Reset code reviewer votes when new changes are pushed.

Question 10

Which TWO features can you use to enforce quality gates before a production deployment in Azure Pipelines?

Accepted Answer

Approval checks on environments. Approval checks on environments allow you to require manual sign-off before a release proceeds to a production stage. This enforces a quality gate by ensuring that a designated approver reviews and authorizes the deployment. Option E is correct because deployment gates evaluate health metrics (e.g., from Azure Monitor or Application Insights) automatically, blocking or allowing the deployment based on predefined conditions such as error rates or performance thresholds.

Answer

Scheduled triggers

Answer

Branch policies on repositories

Answer

Pipeline decorators

Question 11

You are reviewing a Data Collection Rule (DCR) for an Azure virtual machine. The DCR is assigned to the VM, and the Azure Monitor Agent is installed. After one hour, no performance data appears in the Log Analytics workspace. What is the most likely cause?

Accepted Answer

The data flow streams property does not include 'Microsoft-Perf'.. The most likely cause is that the data flow streams property in the DCR does not include 'Microsoft-Perf'. The Azure Monitor Agent uses DCRs to define which data to collect and where to send it. Without the 'Microsoft-Perf' stream specified in the dataFlows section, performance counters are not collected, even if the counter specifiers are correctly defined. The workspace resource ID and counter format may be correct, but the missing stream prevents any performance data from being ingested.

Answer

The workspace resource ID is incorrectly formatted.

Answer

The counter specifier uses the wrong format for Windows performance counters.

Answer

The sampling frequency of 60 seconds is too low and data is being throttled.

Question 12

An Azure Policy is defined as shown in the exhibit. You attempt to create a storage account with HTTPS traffic only set to false. What will happen?

Accepted Answer

The creation will be denied with an error message. The Azure Policy in the exhibit uses a 'Deny' effect for the condition that storage accounts must have HTTPS traffic enabled. When you attempt to create a storage account with 'HTTPS traffic only' set to false, the policy evaluation detects a non-compliant resource and denies the creation request, returning an error message. This is because the 'Deny' effect blocks the resource deployment entirely, preventing the non-compliant configuration from being provisioned.

Answer

The policy will only apply if the storage account is in a specific resource group

Answer

The storage account will be created but HTTPS will be enforced

Answer

The storage account will be created and an audit event will be logged

Question 13

A company has a multi-region application deployed on Azure App Service (Windows) across three regions: West US, East US, and West Europe. The operations team uses Azure Monitor to collect application logs and metrics. Recently, they noticed that the application in West US is experiencing high CPU usage (sustained above 90%) during peak hours, while the other regions remain below 60%. The team has set up an autoscale rule on the App Service plan to scale out when CPU exceeds 80% for 10 minutes. However, autoscale is not triggering, and the application in West US is becoming slow. The team has verified that the autoscale rule is correctly configured, the instance count is below the maximum, and there are no scale-in rules interfering. The metric data appears in Azure Monitor. You suspect that the metric alert that triggers autoscale is not firing. What is the most likely cause?

Accepted Answer

The autoscale rule is using the wrong metric aggregation or namespace, such as 'CpuTime' instead of 'Percentage CPU'.. The autoscale rule must use the correct metric name and aggregation to evaluate scaling conditions. If the rule is configured with 'CpuTime' instead of 'Percentage CPU', it will not match the actual CPU utilization metric emitted by the Azure App Service plan. 'Percentage CPU' is the standard platform metric for CPU load, while 'CpuTime' measures total CPU time consumed, which does not trigger the same threshold logic. Since the team verified the rule is correctly configured but autoscale is not firing, the most likely cause is a mismatch in the metric name or namespace.

Answer

The autoscale rule was created less than 24 hours ago and needs a learning period.

Answer

The metric collection interval for CPU is set to 30 minutes, causing a delay in autoscale evaluation.

Answer

The autoscale rule is configured to use Log Analytics queries instead of platform metrics.

Question 14

Which TWO actions should you take to proactively protect your repository from accidentally committing secrets? (Choose two.)

Accepted Answer

Use pre-commit hooks with tools like detect-secrets. Pre-commit hooks, such as those using the detect-secrets tool, scan staged changes before a commit is finalized. This prevents secrets from ever entering the repository history, providing a proactive, client-side guard. Option C is correct because push protection in secret scanning blocks pushes that contain known secret patterns at the server side, preventing the secret from being stored in the remote repository.

Answer

Enable branch protection rules

Answer

Use signed commits

Answer

Configure secret scanning alerts

Question 15

You have a multi-stage YAML pipeline that deploys to multiple environments. You want to enforce that a manual approval is required before deploying to the production environment, but not for other environments. How should you configure the pipeline?

Accepted Answer

Create an environment named 'Production', add an approval check, and reference the environment in the deployment job.. Azure Pipelines allows you to add an approval check on a specific environment. By creating an environment named 'Production' and attaching an approval check to it, any deployment job that references that environment will require manual approval before proceeding. This ensures that only the production deployment is gated, while other environments deploy automatically.

Answer

Set a pipeline-level approval check that applies to all stages.

Answer

Add an approval gate on the 'Production' stage in the pipeline settings.

Answer

Configure branch policy on the main branch to require approval for all changes.