AZ-400 Practice Test 17 — 15 Questions

Question 1

Your organization uses Azure DevOps Services. The development team uses feature branches and pull requests to merge changes into the main branch. You need to implement a policy that ensures every pull request has at least two approvals from the 'Senior Developers' group, and the build must succeed before merging. Additionally, any comment on the pull request must be resolved before merging. The policy should apply to the main branch only. You have already created the 'Senior Developers' group in Azure DevOps. What should you do?

Accepted Answer

Add a branch policy on the main branch that requires a minimum of two reviewers from 'Senior Developers', a successful build, and that all comments are resolved.. Option B is correct because Azure DevOps branch policies allow you to enforce specific requirements on pull requests targeting a branch. By configuring a branch policy on the main branch, you can require a minimum number of reviewers from a specific group (e.g., 'Senior Developers'), a successful build, and that all comments are resolved before merging. This directly meets all the stated requirements.

Answer

Configure the team's settings to require approvals for all pull requests.

Answer

Set up a build validation policy on the main branch that runs the pipeline and fails if comments are unresolved.

Answer

Configure the repository's pull request settings to require approvals and comment resolution.

Question 2

Your Azure DevOps project has multiple teams. You need to ensure that each team's board only shows work items assigned to that team. What should you configure?

Accepted Answer

Configure team settings to set default area paths for each team.. Option B is correct because team configurations define which area paths and work items appear on the team board. Option A is wrong because work item queries are for custom views, not default board filtering. Option C is wrong because area paths are used in team configuration, not a separate setting. Option D is wrong because iteration paths control sprints, not board visibility.

Answer

Create a shared query for each team and pin it to the dashboard.

Answer

Assign each team a unique iteration path.

Answer

Set permissions on area paths to restrict access.

Question 3

Which TWO Azure DevOps features can be used to automate the process of updating work items when a build or release completes?

Accepted Answer

Pipeline task 'Update work item' from the Azure DevOps extension.. Options B and D are correct. Release gates can update work items based on release status, and the 'Update work item' task can set field values. Option A is wrong because service hooks are for external integrations. Option C is wrong because branch policies are for PRs, not builds. Option E is wrong because work item queries are read-only.

Answer

Service hooks to trigger an Azure function.

Answer

Work item query charts.

Answer

Branch policy with required reviewers.

Question 4

Which TWO actions should you take to ensure that your Azure DevOps pipeline securely manages secrets?

Accepted Answer

Use Azure Key Vault variable groups. Option A is correct because variable groups linked to Azure Key Vault allow secure storage. Option C is correct because secret variables should be set in the pipeline UI or variable groups, not YAML. Option B is wrong because checking secrets into the repository is insecure. Option D is wrong because logging secrets is a security risk. Option E is wrong because storing secrets in the YAML file exposes them in the repository.

Answer

Enable 'Allow scripts to access the system token' and print secrets in logs for debugging

Answer

Store secrets directly in the YAML pipeline file

Answer

Store secrets as plain text in the repository

Question 5

Your team uses Azure Boards and wants to automatically update the work item state when a pull request is merged. The policy should require a successful build before merging and update the work item to 'Resolved' on merge. Which branch policy should you configure?

Accepted Answer

Automatically update work items. The 'Automatically update work items' branch policy in Azure Repos is specifically designed to update the state of linked work items when a pull request is completed (merged). By configuring this policy, you can set the work item to transition to 'Resolved' upon merge, and you can also require a successful build as a prerequisite for merging. This directly meets the requirement to automatically update the work item state on merge while enforcing a build validation.

Answer

Require a minimum number of reviewers

Answer

Comment resolution

Answer

Check for linked work items

Question 6

Refer to the exhibit. You are reviewing an Azure DevOps YAML pipeline. The pipeline is configured with a webhook trigger from GitHub for pull request opened events. However, the pipeline does not trigger when a PR is opened. What is the most likely cause?

Accepted Answer

The webhook subscription is not configured in GitHub.. Option B is correct because the 'trigger' is set to 'none', which disables all triggers except the webhook? Actually, 'trigger: none' disables the CI trigger but does not affect resource triggers like webhooks? Wait, in Azure DevOps YAML, 'trigger: none' disables the CI trigger, but resource triggers (like webhooks) still work. However, the pipeline might not be set to use the correct webhook? Actually, the most likely cause is that the webhook is not properly configured in GitHub to send events to Azure DevOps. Option A (Incorrect filter) is possible but the filter looks correct. Option C (Missing agent pool) would cause a runtime error. Option D (Webhook name mismatch) would cause connection issue but the exhibit shows 'GitHubPR' as name.

Answer

The webhook name does not match the service connection.

Answer

The pipeline lacks an agent pool specification.

Answer

The webhook filter is incorrect; 'opened' should be 'created'.

Question 7

Your organization uses GitHub Flow with branch protections. Developers must link every pull request to an issue using a closing keyword (e.g., 'Fixes #123'). You need to enforce this linking automatically. What should you do?

Accepted Answer

Create a GitHub Actions workflow that validates the PR description contains a closing keyword.. Option A is correct because a GitHub Actions workflow can be configured to run on pull request events and parse the PR description for a closing keyword pattern (e.g., regex matching 'Fixes #\d+'). If the keyword is missing, the workflow can fail the check, blocking the merge via branch protection rules that require status checks to pass. This directly enforces the linking requirement without relying on human compliance or third-party tools.

Answer

Configure an issue template with a closing keyword prompt.

Answer

Add a branch protection rule requiring a linked issue.

Answer

Use a required status check from a third-party app.

Question 8

Which THREE practices are recommended for managing technical debt in a DevOps environment?

Accepted Answer

Allocate time for refactoring in each iteration. Option A is correct because allocating time for refactoring in each iteration is a core practice of managing technical debt in a DevOps environment. This ensures that code quality issues are addressed incrementally, preventing debt from accumulating and reducing future maintenance costs. In Agile and DevOps workflows, this is often implemented as a 'refactoring budget' within sprint planning, directly aligning with continuous improvement principles.

Answer

Defer unit tests until after deployment

Answer

Ignore low-priority code smells

Question 9

A developer reports that their Azure DevOps pipeline is failing with 'Access denied' when trying to push to a protected branch. The branch policy requires a successful build and approval from the 'Code Owners' group. The developer is a member of 'Contributors' but not 'Code Owners'. What is the most likely cause?

Accepted Answer

The developer is not in the 'Code Owners' group allowed to bypass the policy.. Option D is correct because the branch policy enforces that only members of the 'Code Owners' group can push directly to the branch; the developer lacks that membership. Option A (Insufficient permissions at project level) is less specific. Option B (Pipeline service principal missing) is unrelated. Option C (Incorrect branch name) would give a different error.

Answer

The branch name contains invalid characters.

Answer

The pipeline's service principal lacks 'Create Branch' permission.

Answer

The developer lacks 'Contribute' permissions at the project level.

Question 10

You are designing a process for incident management. When a critical bug is reported, you need to automatically create a work item in Azure Boards and notify the on-call engineer via Microsoft Teams. Which Azure DevOps feature should you use?

Accepted Answer

Set up a service hook that sends a message to Teams when a bug is created.. Service hooks in Azure DevOps allow you to integrate with external services like Microsoft Teams by triggering on specific events, such as the creation of a bug work item. This enables automatic notification to the on-call engineer via Teams without requiring a release pipeline or email configuration. The service hook listens for the 'Work item created' event and sends a customizable message to a Teams channel, directly addressing the requirement for automated notification.

Answer

Create a release pipeline that triggers on work item creation.

Answer

Configure a work item notification in Azure DevOps to email the on-call engineer.

Answer

Use a work item template to pre-populate the bug form.

Question 11

Your organization uses GitHub and wants to enforce that all commits to the main branch are signed with a GPG key that is verified against the user's GitHub account. Additionally, you want to block unsigned commits even if the committer is a repository admin. Which configuration should you use?

Accepted Answer

Enable 'Require signed commits' and set 'Include administrators' to true.. Option C is correct because enabling 'Require signed commits' in a GitHub branch protection rule, combined with setting 'Include administrators' to true, enforces that every commit pushed to the protected branch must be signed with a GPG key verified against the user's GitHub account, and this restriction applies even to repository administrators. This configuration blocks unsigned commits entirely, meeting the requirement to enforce signing for all users including admins.

Answer

Add a pre-receive hook that rejects unsigned commits.

Answer

Enable 'Require signed commits' and set 'Include administrators' to false.

Answer

Enable 'Require signed commits' and configure web commit signing.

Question 12

Your organization uses GitHub for source control and GitHub Actions for CI/CD. You need to implement a branching strategy where every commit to the main branch triggers a build and deployment to a staging environment, but only after a successful pull request review. Which GitHub Actions trigger should you use?

Accepted Answer

pull_request_target with branches: [main] and types: [closed]. Option A is correct because the `pull_request_target` trigger with `types: [closed]` and `branches: [main]` ensures the workflow runs only after a pull request targeting the main branch is closed (merged). This satisfies the requirement of deploying to staging only after a successful pull request review and merge, not on every push. The `pull_request_target` event runs in the context of the base repository, providing access to secrets, which is appropriate for deployment workflows.

Answer

push with branches: [main]

Answer

pull_request with branches: [main]

Answer

workflow_dispatch

Question 13

Your team uses GitHub Issues for tracking bugs and features. They want to automatically assign issues to the person who created the pull request that closes the issue. Which GitHub Actions workflow trigger and action should you use?

Accepted Answer

Use the 'issues' event with 'closed' type and an action that assigns the issue to the PR author.. Option D is correct because the 'issues' event with 'closed' type can trigger a workflow that uses the 'actions-ecosystem/action-add-assignees' action to assign the issue to the PR author. Option A is incorrect because 'pull_request' events do not directly close issues. Option B is incorrect because 'push' events are not related to issue closure. Option C is incorrect because 'schedule' events are time-based.

Answer

Use the 'pull_request' event and the 'actions/assign' action to assign the issue.

Answer

Use the 'push' event and call the GitHub API to assign the issue.

Answer

Use the 'schedule' event to periodically check for closed issues and assign them.

Question 14

Which TWO practices help improve the efficiency of code reviews? (Choose two.)

Accepted Answer

Keep pull requests small and focused on a single change.. Keeping pull requests small and focused on a single change (Option A) improves code review efficiency because it reduces cognitive load on reviewers, allowing them to understand and evaluate the change quickly without context-switching. Smaller PRs also enable faster feedback loops and easier rollback if issues are found, which aligns with DevOps principles of continuous integration and delivery.

Answer

Include multiple unrelated changes in a single pull request to reduce the number of PRs.

Answer

Assign as many reviewers as possible to ensure thoroughness.

Answer

Require that all team members review every pull request.

Question 15

Your team uses Azure DevOps and wants to automate the creation of work items when a build pipeline fails. The work item should be assigned to the last person who committed a change in the failed build. Which approach should you use?

Accepted Answer

Add the 'Create work item on failure' task to the build pipeline.. Option B is correct because the 'Create work item on failure' task in a build pipeline automatically creates a bug and assigns it to the person who triggered the build or the last committer. Option A (Service Hook) would require custom logic. Option C (YAML task with REST API) is more complex and not built-in. Option D (Release pipeline) is for deployments, not builds.

Answer

Create a release pipeline that triggers on build failure and creates a work item.

Answer

Configure a Service Hook to create a work item on build failure.

Answer

Use a PowerShell script in the pipeline to call Azure DevOps REST API.