AZ-400 Practice Test 16 — 15 Questions

Question 1

You have the YAML pipeline shown in the exhibit. What will be the output of the script in the Deploy stage?

Accepted Answer

Deploying to prod. The YAML pipeline defines a variable `environment` at the stage level with the value `prod`. The script in the Deploy stage references `$(environment)`, which resolves to `prod`, so the output is `Deploying to prod`. Stage-level variables override any pipeline-level or default variables for that stage.

Answer

The Deploy stage will be skipped

Answer

Deploying to dev

Answer

The script will fail because variable is not defined

Question 2

Which THREE options are valid strategies to reduce build times in Azure Pipelines? (Choose three.)

Accepted Answer

Enable incremental builds by using the 'Clean: false' option.. Setting 'Clean: false' enables incremental builds by retaining the workspace from the previous run. This means only changed files are rebuilt, significantly reducing build time by avoiding a full clean checkout and rebuild of unchanged code.

Answer

Break the pipeline into multiple stages running sequentially.

Answer

Increase the number of parallel jobs in the pipeline.

Question 3

Your team uses feature flags to manage feature releases. You need to ensure that a feature flag is automatically turned off for all users except the development team after a production incident. What is the best approach?

Accepted Answer

Use a feature management system like Azure App Configuration with a targeting filter to enable only for the dev team.. Azure App Configuration's feature management system provides a built-in targeting filter that allows you to dynamically enable a feature flag for specific users or groups (e.g., the development team) while disabling it for all others. This approach supports real-time, no-deployment changes, which is essential for quickly responding to a production incident without modifying code or redeploying.

Answer

Create a separate branch with the feature disabled and deploy it.

Answer

Set an environment variable in the production environment to disable the feature.

Answer

Manually toggle the feature flag off in the app configuration.

Question 4

Refer to the exhibit. You have an Azure Pipelines YAML file for a .NET Core application. The pipeline is triggered on changes to the main branch, but only for files under src/. After a push to main that modifies a file in src/, the pipeline does not start. What is the most likely reason?

Accepted Answer

The path filter 'src/*' does not match files in subdirectories of src/.. The path filter `src/*` uses a single asterisk, which only matches files directly within the `src/` directory, not files in subdirectories (e.g., `src/app/main.cs`). Azure Pipelines path filters require a double asterisk `src/**` to recursively match all files under `src/`. Since the modified file is in a subdirectory, the trigger condition is not met, and the pipeline does not start.

Answer

The branch filter is missing the 'refs/heads/' prefix.

Answer

The trigger configuration has a syntax error: 'include' should be 'includes'.

Answer

The variable 'buildConfiguration' is not defined at the top level.

Question 5

You run the Azure CLI command shown in the exhibit. What is the output?

Accepted Answer

A table showing VM names and resource groups for VMs in eastus. The Azure CLI command `az vm list --query "[?location=='eastus'].{Name:name, ResourceGroup:resourceGroup}" --output table` filters virtual machines to only those in the 'eastus' location, then projects the 'name' and 'resourceGroup' properties into a table. The `--query` parameter uses JMESPath syntax, which is correct here, and the `--output table` formats the result as a table. Therefore, the output is a table showing VM names and resource groups for VMs in eastus.

Answer

An error because the query syntax is incorrect

Answer

A list of all VMs in the subscription

Answer

A list of all VMs in the westus location

Question 6

You are designing a pipeline to build a .NET Core application. The build must run unit tests and publish code coverage results. Which task should you use to publish the code coverage results to Azure DevOps?

Accepted Answer

Use the 'PublishCodeCoverageResults@1' task.. The 'PublishCodeCoverageResults@1' task is the correct choice because it is specifically designed to publish code coverage results (e.g., Cobertura or JaCoCo XML reports) to Azure DevOps, making them visible in the build summary and pipeline artifacts. This task consumes the coverage data file generated by a previous test run (e.g., via 'DotNetCoreCLI@2' with '--collect "Code Coverage"') and uploads it to the Azure DevOps service for reporting.

Answer

Use the 'PublishTestResults@2' task.

Answer

Use the 'DotNetCoreCLI@2' task with the 'test' command.

Answer

Use the 'VSTest@2' task with the 'codeCoverageEnabled' option.

Question 7

Your team needs to automatically run a pipeline whenever a pull request is created in GitHub. Which trigger should you configure in Azure Pipelines?

Accepted Answer

Pull request trigger. Azure Pipelines provides a dedicated pull request trigger that automatically starts a pipeline when a pull request is created or updated in GitHub. This trigger validates proposed changes before merging, ensuring code quality and preventing broken builds from entering the main branch.

Answer

Pipeline completion trigger

Answer

Scheduled trigger

Answer

Continuous integration trigger

Question 8

Which THREE are valid deployment patterns for Kubernetes? (Choose three.)

Accepted Answer

Canary deployment. The correct deployment patterns in Kubernetes are canary, rolling update, and blue-green. A canary deployment releases a new version to a small subset of users first, allowing monitoring and gradual traffic shifting. A rolling update incrementally replaces old pods with new ones, ensuring zero downtime. A blue-green deployment runs two identical environments and switches traffic from the old (blue) to the new (green) environment after validation. Helm is a package manager, not a deployment pattern, and A/B testing is a traffic management technique rather than a core Kubernetes deployment strategy.

Answer

A/B testing deployment

Answer

Helm deployment

Question 9

Your team uses a multi-stage YAML pipeline. The 'Build' stage compiles the code and runs unit tests. The 'Deploy' stage deploys to a staging environment. You notice that if the 'Build' stage fails, the 'Deploy' stage still starts because it depends on a condition that always evaluates to true. How should you modify the pipeline to prevent the 'Deploy' stage from running if the 'Build' stage fails?

Accepted Answer

Add 'condition: succeeded()' to the Deploy stage.. The `succeeded()` function in Azure Pipelines evaluates whether all previous stages (or jobs, depending on context) have completed successfully. By adding `condition: succeeded()` to the Deploy stage, the stage will only run if the Build stage (its implicit or explicit dependency) succeeded. This directly prevents the Deploy stage from starting when the Build stage fails.

Answer

Add 'condition: eq(variables['Build.Succeeded'], 'true')' to the Deploy stage.

Answer

Add 'condition: and(succeeded(), eq(variables['Build.Succeeded'], 'true'))' to the Deploy stage.

Answer

Add 'dependsOn: Build' to the Deploy stage.

Question 10

You are designing a multi-stage YAML pipeline in Azure DevOps that builds, tests, and deploys a .NET Core application. The pipeline must use a self-hosted agent pool for compliance. You need to minimize agent idle time while ensuring that the agent is always available for builds. What should you do?

Accepted Answer

Deploy a scale set agent pool with autoscaling enabled. A scale set agent pool with autoscaling enabled dynamically provisions and deprovisions Azure virtual machines based on the pipeline's demand, minimizing idle time while ensuring agents are available when builds are triggered. This approach aligns with the requirement for a self-hosted agent pool for compliance and optimizes cost by scaling down when no jobs are pending.

Answer

Provision a virtual machine scale set with a fixed number of agents

Answer

Install multiple agents on a single VM to maximize utilization

Answer

Use a single persistent agent and queue builds when idle

Question 11

Your team uses GitHub Actions for CI/CD. Security policies require that secrets must be automatically rotated every 90 days. Which Azure DevOps feature should you integrate to enforce this requirement?

Accepted Answer

Azure Key Vault with rotation policy. Azure Key Vault supports automated secret rotation policies that can be configured to rotate secrets at a specified interval, such as every 90 days. By integrating Azure Key Vault with GitHub Actions, you can enforce the security policy that secrets must be automatically rotated without manual intervention. This is the correct choice because it directly meets the requirement for automated rotation within Azure's ecosystem.

Answer

Microsoft Purview Compliance Manager

Answer

GitHub Actions secrets with scheduled workflows

Answer

Azure Managed Identities

Question 12

Your team uses GitHub and wants to enforce that all commits to the main branch are signed with a GPG key. Which branch protection rule should you configure?

Accepted Answer

Require signed commits.. The 'Require signed commits' branch protection rule enforces that every commit pushed to the protected branch must be signed with a GPG key. This ensures cryptographic verification of the commit author's identity, directly addressing the requirement to enforce signed commits on the main branch.

Answer

Require pull request reviews before merging.

Answer

Require status checks to pass before merging.

Answer

Require linear history.

Question 13

You are designing a process for incident management. When a critical bug is reported, you need to automatically create a work item in Azure Boards and notify the on-call engineer via Microsoft Teams. Which Azure DevOps feature should you use?

Accepted Answer

Set up a service hook that sends a message to Teams when a bug is created.. Service hooks are used to notify external systems (like Microsoft Teams) when an event occurs in Azure DevOps, such as a work item being created. They do not create the work item itself; they react to its creation. To automatically create the work item when a critical bug is reported, you would use a separate mechanism such as the Azure Boards REST API or an external integration. Among the provided options, B is the correct feature for the Teams notification, but the explanation should clarify that the automated creation is handled outside the service hook.

Answer

Create a release pipeline that triggers on work item creation.

Answer

Configure a work item notification in Azure DevOps to email the on-call engineer.

Answer

Use a work item template to pre-populate the bug form.

Question 14

Your build pipeline fails intermittently with the error: 'The job running on agent 'Azure Pipelines' exceeded the maximum execution time of 60 minutes.' How can you resolve this issue?

Accepted Answer

Increase the 'timeoutInMinutes' property in the pipeline YAML for the job.. The error indicates the job exceeded the default 60-minute timeout for Azure Pipelines hosted agents. Increasing the 'timeoutInMinutes' property in the pipeline YAML for the job explicitly extends the maximum execution time, directly resolving the timeout issue. This property can be set at the job level to allow longer-running tasks without changing the pipeline structure.

Answer

Split the pipeline into multiple stages to reduce job duration.

Answer

Enable parallel jobs to run the pipeline faster.

Answer

Use a self-hosted agent with more CPU cores.

Question 15

Your organization uses Azure DevOps and Azure Key Vault to manage secrets. You have a pipeline that deploys a web app to Azure App Service. The pipeline uses a variable group linked to Key Vault to retrieve the database connection string. Recently, the build started failing with the error: 'Access to Key Vault is denied. Please ensure the service connection has Get and List permissions on secrets.' The service connection uses a service principal. You have verified that the service principal has the correct Key Vault access policy with Get and List permissions. What is the most likely cause of the failure?

Accepted Answer

The build service identity does not have Get and List permissions on the Key Vault secrets.. The error message indicates that the identity attempting to access Key Vault lacks the required permissions. Even though the service principal has the correct access policy, the pipeline may be using a different identity—the build service identity—to authenticate with Key Vault. In Azure DevOps, when a variable group is linked to Key Vault, the pipeline's build service identity (not the service connection's service principal) must have Get and List permissions on the Key Vault secrets. This is a common misconfiguration where the service principal is granted permissions but the build service identity is not.

Answer

The service connection is configured to use the wrong Azure subscription.

Answer

The secret name in the variable group does not match the secret name in Key Vault.

Answer

The service principal used by the service connection does not have Contributor role on the Key Vault.