AZ-400 Practice Test 17 — 15 Questions

Question 1

You are configuring a release pipeline to deploy to Azure App Service. You want to use the 'Deploy Azure App Service' task. Which authentication method should you use to securely connect Azure DevOps to the Azure subscription?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Resource Manager service connection using a service principal.. The 'Deploy Azure App Service' task requires a secure, non-interactive connection between Azure DevOps and Azure. An Azure Resource Manager service connection using a service principal is the recommended and supported method because it uses Microsoft Entra ID authentication with a client secret or certificate, enabling automated, credential-free deployments without user interaction or token expiry issues.

Answer

Azure CLI authentication with a user account.

Answer

Use a SAS token for the App Service.

Answer

Managed Identity assigned to the Azure DevOps agent.

Question 2

Which TWO metrics should you monitor to evaluate the reliability of a web application according to the DORA metrics?

Accepted Answer

Change Failure Rate. The DORA metrics define four key measures for software delivery performance: Deployment Frequency, Lead Time for Changes, Mean Time to Restore (MTTR), and Change Failure Rate. For evaluating the reliability of a web application, the two most directly relevant metrics are Change Failure Rate (B), which measures the percentage of deployments causing a failure in production, and Mean Time to Restore (MTTR) (C), which measures the time it takes to recover from a failure. These two metrics directly quantify stability and resilience, whereas Deployment Frequency and Lead Time for Changes focus on throughput and speed.

Answer

Lead Time for Changes

Answer

CPU Usage

Answer

Deployment Frequency

Question 3

Your team is adopting Infrastructure as Code (IaC) using Bicep. You have a multi-stage YAML pipeline that deploys Azure resources to dev, test, and prod environments. You need to ensure that the Bicep files are validated and deployed consistently, and that any changes to the infrastructure are approved for production. You also want to use the latest version of the Azure CLI task. What is the recommended approach?

Accepted Answer

Use the AzureCLI task with inline script to run 'az deployment group validate' and 'az deployment group create'. Add environments with approval gates for production.. It uses the AzureCLI task with the 'az deployment group validate' and 'az deployment group create' commands, which natively support Bicep files. This approach integrates with multi-stage YAML pipelines and allows adding approval gates for production environments. Option A is incorrect because the Azure Resource Manager Template Deployment task requires a compiled ARM JSON file, adding an unnecessary compilation step and not leveraging Bicep's native capabilities. Option B is incorrect because creating separate pipelines for each environment duplicates effort and does not take advantage of the multi-stage YAML pipeline structure with environment approvals. Option D is incorrect because using a PowerShell task with 'New-AzResourceGroupDeployment' cmdlet lacks native Bicep support and may require manual compilation.

Answer

Use the Azure Resource Manager Template Deployment task with the 'templateLocation' parameter pointing to the compiled ARM JSON.

Answer

Create three separate pipelines for each environment, each using the ARM Template Deployment task.

Answer

Use a PowerShell task with the 'New-AzResourceGroupDeployment' cmdlet.

Question 4

Your organization uses GitHub Actions for CI/CD. You have a workflow that builds a .NET application and runs tests. The workflow uses a self-hosted runner on an on-premises Windows server. Recently, builds started failing with 'Access to the path is denied' errors when the runner tries to restore NuGet packages. The runner has been working for months. What is the most likely cause?

Accepted Answer

The runner service account's permissions have changed, and it no longer has write access to the working directory or cache.. The 'Access to the path is denied' error during NuGet restore on a self-hosted runner typically indicates a file system permission issue. Since the runner has been working for months, the most likely cause is that the service account under which the runner runs no longer has write access to the working directory or the NuGet cache folder, often due to a group policy change, account modification, or folder permission drift.

Answer

The runner's authentication token to GitHub has expired.

Answer

The NuGet cache directory on the runner has been deleted.

Answer

The runner has been updated to a newer version that no longer supports NuGet restore.

Question 5

Your organization uses Azure DevOps with multiple teams. You are tasked with creating a security and compliance plan. The environment includes: Azure Repos for source control, Azure Pipelines for CI/CD, and Azure Artifacts for package management. Requirements: 1) All code changes to the main branch must be reviewed by at least one member of the security team. 2) Deployment to production requires approval from a manager. 3) Secrets must be stored securely and rotated every 90 days. 4) Pipeline logs must be retained for 1 year for audit purposes. You have configured branch policies requiring a minimum number of reviewers and mandatory security team review. For production deployments, you have added a manual approval gate. Secrets are stored in Azure Key Vault with automatic rotation. However, the audit team reports that pipeline logs are only retained for 30 days. You need to extend log retention to 1 year. What should you do?

Accepted Answer

In Azure DevOps project settings, navigate to Pipelines > Retention and releases, and set the retention policy to 365 days.. In Azure DevOps, pipeline retention policies for runs are configured at the project level under Project Settings > Pipelines > Retention and releases. Setting the retention to 365 days will keep pipeline run records and logs for one year. Option A is incorrect because exporting pipeline logs to Azure Blob Storage is not a built-in feature; pipeline logs are retained according to DevOps retention policies. Option B is incorrect because diagnostic settings in Azure Monitor stream Azure resource logs, not Azure DevOps pipeline logs. Option D is incorrect because audit logs capture events like changes to policies, not pipeline execution logs, and they have separate retention settings.

Answer

Export pipeline logs to Azure Blob Storage and set a lifecycle policy to retain for 365 days.

Answer

Configure diagnostic settings in Azure Monitor to stream pipeline logs to a Log Analytics workspace.

Answer

Enable Azure DevOps audit logs and export them to a Log Analytics workspace with a 365-day retention.

Question 6

Your release pipeline includes a 'Deploy to App Service' task for a Linux web app. The deployment fails with 'Error: Failed to deploy web package to App Service'. What should you check first?

Accepted Answer

Review the App Service diagnostic logs.. App Service diagnostic logs provide the most comprehensive and direct source of error details when a deployment fails. The 'Deploy to App Service' task uses Kudu (for Windows) or Oryx (for Linux) to process the deployment; reviewing the diagnostic logs (e.g., via the Azure portal under 'App Service logs' or the 'Log stream') will surface the exact failure reason, such as a missing startup command, incorrect runtime stack, or permission issues.

Answer

Verify that the deployment slot is correctly configured.

Answer

Check the Kudu console for errors.

Answer

Ensure the web.config file is present.

Question 7

Your organization is adopting DevSecOps and wants to integrate security scanning into the CI/CD pipeline. Which tool should you use to scan container images for vulnerabilities?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (Option C) is the correct tool for scanning container images for vulnerabilities in a CI/CD pipeline, as it integrates with Azure Container Registry to perform vulnerability assessments. Option A (Azure Monitor) is incorrect because it is a monitoring and observability service, not a security scanner. Option B (GitHub Copilot) is incorrect as it is an AI code completion tool. Option D (Azure Logic Apps) is incorrect because it is a workflow automation service, not a security scanning tool.

Answer

Azure Monitor

Answer

GitHub Copilot

Answer

Azure Logic Apps

Question 8

Your organization uses Azure Boards and requires that all changes to work items in the 'Security' area path be audited. Which solution ensures that any modification to a work item triggers an audit event in Microsoft Sentinel?

Accepted Answer

Configure Azure DevOps Audit Streaming to send logs to Microsoft Sentinel. Azure DevOps Audit Streaming is the correct solution because it natively streams audit events (including work item modifications) to Microsoft Sentinel via the Azure Event Hubs or Log Analytics workspace integration. This ensures real-time, continuous auditing without manual intervention, meeting the requirement for all changes in the 'Security' area path to trigger audit events in Sentinel.

Answer

Enable Microsoft Purview to scan Azure DevOps and detect changes

Answer

Export Azure DevOps audit logs to CSV and import to Sentinel daily

Answer

Create a service hook in Azure DevOps that calls a logic app to create incidents in Sentinel

Question 9

Which TWO benefits does using deployment groups provide in Azure Pipelines? (Choose two.)

Accepted Answer

You can deploy to a specific set of target servers (e.g., all web servers in a farm).. Deployment groups in Azure Pipelines allow you to define a logical set of target machines (e.g., all web servers in a farm) and deploy to them collectively. This enables targeted, multi-machine deployments without needing to manage individual agents per environment. Option B is correct because deployment groups support rolling deployments with built-in health validation, where the pipeline can monitor application health after each batch of updates and automatically roll back on failure.

Answer

You can assign multiple deployment groups to a single agent.

Answer

Each target server must have its own agent.

Answer

Deployment groups can only be used with classic release pipelines.

Question 10

Your organization uses GitHub Actions for CI/CD. You need to ensure that workflows are only triggered when changes are pushed to the main branch or when a pull request is opened against main. Which two trigger types should you specify in the workflow?

Accepted Answer

pull_request: branches: [ main ]. The `pull_request` trigger with `branches: [ main ]` ensures the workflow runs when a pull request is opened (or updated) targeting the main branch. Option B is correct because the `push` trigger with `branches: [ main ]` ensures the workflow runs when commits are pushed directly to the main branch. Together, these two triggers cover the exact requirement: changes pushed to main and pull requests opened against main.

Answer

release

Answer

workflow_dispatch

Answer

schedule

Question 11

Refer to the exhibit. You deploy this Bicep template to create an Azure App Service with a custom container. The deployment succeeds, but the container fails to start with an error 'Container didn't respond to HTTP pings'. What is the most likely missing configuration?

Accepted Answer

The template is missing the 'healthCheckPath' property in siteConfig.. The error 'Container didn't respond to HTTP pings' indicates that Azure App Service's built-in health check mechanism is failing to reach the container. By default, App Service pings the root path ('/') on the container's exposed port. If the container's application does not respond on that path, the health check fails. Adding the 'healthCheckPath' property in siteConfig allows you to specify a custom endpoint (e.g., '/health') that the container can respond to, resolving the issue.

Answer

The container image is not publicly accessible.

Answer

The WEBSITES_ENABLE_APP_SERVICE_STORAGE should be set to 'true'.

Answer

The template is missing the app setting 'WEBSITES_PORT'.

Question 12

A company uses Azure DevOps for CI/CD. They have a multi-stage YAML pipeline that builds a Java application, runs unit tests, and deploys to a test environment. The test environment uses an Azure SQL Database. The pipeline currently runs successfully but the team notices that the test database schema is not always up-to-date. They want to apply database migrations automatically as part of the pipeline. Which tool or task should they integrate?

Accepted Answer

Integrate Flyway or similar database migration tool in the pipeline.. Flyway is a dedicated database migration tool that integrates seamlessly with Azure DevOps pipelines, allowing you to version-control and apply schema changes automatically. Unlike ad-hoc scripts, Flyway tracks which migrations have been applied, ensuring the test database schema is always up-to-date without manual intervention.

Answer

Use the Azure SQL Database deployment task to run a SQL script manually.

Answer

Use Azure SQL Database backup and restore to update the schema.

Answer

Add a PowerShell task that runs SQLCMD.

Question 13

Which TWO are valid strategies for reducing build times in Azure Pipelines? (Choose two.)

Accepted Answer

Implement caching for package dependencies (e.g., npm, NuGet, Maven) to avoid restoring on every build.. Caching package dependencies (e.g., npm, NuGet, Maven) avoids restoring them on every build, reducing download time. Incremental builds (e.g., using 'dotnet build --no-restore' with appropriate flags or MSBuild's incremental building) skip projects that haven't changed, reducing compilation time. Option A is incorrect because reducing parallel jobs and adding steps increases build time. Option B is incorrect because removing unit tests compromises quality and is not a valid strategy. Option E is incorrect because increasing agents without parallelizing jobs or running all jobs on the same agent does not reduce build time.

Answer

Reduce the number of parallel jobs and increase the number of steps in a single job.

Answer

Remove unit tests from the build pipeline and run them only in the release pipeline.

Answer

Increase the number of agents in the pool and run all jobs on the same agent.

Question 14

Your team uses a monorepo in Azure Repos with multiple feature branches. You notice that merge conflicts frequently occur because developers are working on the same files. You want to reduce conflicts and improve collaboration. Which branching strategy should you recommend?

Accepted Answer

Use trunk-based development with feature flags to merge small, frequent changes.. Trunk-based development with feature flags is the correct approach because it encourages developers to merge small, frequent changes into the main branch, reducing the surface area for conflicts. Feature flags allow incomplete features to be hidden in production, enabling continuous integration without requiring long-lived feature branches. This strategy directly addresses the problem of frequent merge conflicts by minimizing divergence between branches.

Answer

Use release branches for each deployment and cherry-pick commits from main.

Answer

Use a single main branch and require all changes to be committed directly.

Answer

Use GitFlow with separate develop and release branches.

Question 15

Which THREE steps should you take to implement a secure CI/CD pipeline that uses secrets from Azure Key Vault?

Accepted Answer

Use the Azure Key Vault task to download secrets as variables. The Azure Key Vault task in Azure Pipelines can download secrets as pipeline variables at runtime, allowing the pipeline to securely reference them without exposing the secret values in logs or configuration. This task authenticates to Key Vault using a service connection or managed identity, ensuring secrets are never stored in the pipeline definition.

Answer

Store secrets as plain text variables in the pipeline library

Answer

Hardcode secrets in the YAML file and use variables to mask them