AZ-400 Practice Test 18 — 15 Questions

Question 1

Which TWO options are benefits of using Git LFS (Large File Storage) in a team environment? (Select TWO.)

Accepted Answer

Prevents large files from being stored in the Git history. Git LFS replaces large files in the repository with text pointer files, while the actual file content is stored in a separate remote store. This prevents the large files from bloating the Git history, which would otherwise permanently increase repository size for all clones and fetches.

Answer

Automatically detects and tracks all binary files in the repository

Answer

Works only with GitHub and Azure Repos

Answer

Eliminates the need for Git when working with large binary files

Question 2

You are implementing a release pipeline that deploys a web app to Azure App Service. The deployment must be approved by a manager before proceeding to the production slot. However, the manager is on leave and the deployment is critical. What should you do to ensure the deployment can proceed without delaying the release?

Accepted Answer

Add an additional approver in the pre-deployment approval settings.. Adding an additional approver in the pre-deployment approval settings allows another authorized user (e.g., a backup manager or team lead) to approve the deployment while the primary manager is unavailable. This maintains the required governance and security controls without blocking the critical release. Azure Pipelines supports multiple approvers, and any one of them can approve to proceed.

Answer

Skip the approval for this deployment by overriding the settings.

Answer

Configure the approval to time out after 24 hours and automatically approve.

Answer

Remove the approval requirement from the pipeline.

Question 3

Your Azure DevOps project contains a Git repository with multiple branches. You need to ensure that code reviews are mandatory for all pull requests targeting the 'release' branch. Additionally, the build pipeline must pass before merging. How should you configure branch policies?

Accepted Answer

Enable 'Require a minimum number of reviewers' and 'Build validation'.. The requirement specifies two distinct conditions: mandatory code reviews (enforced by 'Require a minimum number of reviewers') and a passing build pipeline before merge (enforced by 'Build validation'). In Azure Repos, branch policies allow you to combine multiple checks; enabling only one of these would leave the other requirement unmet. Therefore, both policies must be enabled to satisfy the full criteria.

Answer

Enable 'Build validation' only.

Answer

Enable 'Require a minimum number of reviewers' only.

Answer

Enable 'Require a minimum number of reviewers' and 'Comment resolution'.

Question 4

Your Azure DevOps project has multiple teams. You need to ensure that each team's board only shows work items assigned to that team. What should you configure?

Accepted Answer

Configure team settings to set default area paths for each team.. Team settings allow you to configure default area paths for each team, which ensures that the team board only displays work items assigned to those area paths. This effectively scopes the board to the team's work. Option A is wrong because shared queries are custom views and do not affect the default board filtering; they are used for reporting or dashboards, not for team board visibility. Option B is wrong because iteration paths control sprint scheduling and timeboxes, not the visibility of work items on the board; area paths are used for team assignment. Option C is wrong because permissions on area paths control access levels (who can view or edit), not which work items appear on a team board; area path permissions do not filter the board content by team.

Answer

Create a shared query for each team and pin it to the dashboard.

Answer

Assign each team a unique iteration path.

Answer

Set permissions on area paths to restrict access.

Question 5

Your team uses GitHub Actions for CI/CD. You need to enforce that all workflows use approved actions from a private marketplace. Which GitHub feature should you configure?

Accepted Answer

Set the Actions permissions to 'Allow only specified actions'.. The 'Allow only specified actions' setting in GitHub Actions permissions allows you to restrict workflow execution to a curated list of actions from a private marketplace or specific verified publishers. This enforces governance by preventing the use of unapproved actions, which is critical for compliance and security in enterprise CI/CD pipelines.

Answer

Use environment secrets to store allowed action names.

Answer

Require self-hosted runners.

Answer

Configure OpenID Connect (OIDC) for Actions.

Question 6

You are designing a multi-stage YAML pipeline for an application that requires approval for production deployment. The pipeline must run automatically for non-production stages. Which TWO configurations should you use?

Accepted Answer

Set the pipeline trigger to include branches used for non-production stages.. Options A and B are correct. Option A: Setting the pipeline trigger to include branches used for non-production stages enables automatic CI triggers for those branches, so non-production stages run automatically. Option B: Adding an 'approvals' block to the production stage enforces manual approval before deployment to production. Options C, D, and E are incorrect: C suggests using a release pipeline which is unnecessary; D would require manual approval for every stage, not just production; E describes a single-stage pipeline, which doesn't fit the multi-stage requirement.

Answer

Use a release pipeline instead of a YAML pipeline.

Answer

Set the pipeline to require manual approval for every stage.

Answer

Use a single-stage pipeline with conditional approval.

Question 7

Refer to the exhibit. You have this GitHub Actions workflow YAML. The workflow does not trigger when you push to the main branch. What is the most likely issue?

Accepted Answer

The correct keyword is 'on', not 'triggers'.. GitHub Actions workflows use the `on` keyword to define triggers, not `triggers`. The YAML snippet incorrectly uses `triggers`, which is not a valid key in GitHub Actions syntax; the workflow engine ignores it, so no push event on `main` will start the workflow. This is a common syntax error where the candidate confuses Azure Pipelines (which uses `trigger`) with GitHub Actions (which uses `on`).

Answer

The branch name should be in a list under 'branches' inside 'push'.

Answer

The 'vmImage' should be 'windows-latest' for scripts.

Answer

The 'triggers' keyword is misspelled; it should be 'trigger'.

Question 8

Which TWO of the following are benefits of using Infrastructure as Code (IaC) over manual infrastructure management?

Accepted Answer

Consistent environment provisioning. Options A and B are correct. Option A is correct because IaC enables consistent and repeatable provisioning, reducing manual errors. Option B is correct because IaC helps prevent configuration drift by maintaining desired state configurations. Option C is incorrect because IaC does not remove the need for testing; testing is still required to validate infrastructure code. Option D is incorrect because IaC still requires documentation for design and operations. Option E is incorrect because while IaC can optimize costs, it does not inherently guarantee lower costs; cost depends on resource choices.

Answer

Removes the need for testing

Answer

Eliminates the need for documentation

Answer

Lower infrastructure costs

Question 9

Your team uses GitHub. You need to automatically remove a user's access to all repositories when they leave the company. What is the most efficient approach?

Accepted Answer

Enable SCIM provisioning from Microsoft Entra ID to GitHub. SCIM (System for Cross-domain Identity Management) provisioning from Microsoft Entra ID to GitHub automates user lifecycle management. When a user is disabled or removed from Entra ID, SCIM automatically deprovisions their access across all GitHub resources, including repositories, without manual intervention. This is the most efficient approach because it is event-driven and scales to thousands of users.

Answer

Assign the user to a 'Leaver' team and remove all repository permissions

Answer

Manually remove the user from each repository

Answer

Configure SAML single sign-on (SSO) with Microsoft Entra ID

Question 10

A company uses Azure Pipelines to deploy a web app to Azure App Service. They want to ensure that the deployment is first validated in a staging slot before swapping to production. What should they configure?

Accepted Answer

Use deployment slots in the App Service and configure auto-swap. Azure App Service deployment slots allow you to deploy a web app to a staging slot, validate it, and then swap it to production with zero downtime. Auto-swap automates this process by swapping the staging slot into production after a successful deployment, ensuring validation occurs before the production slot receives the new code.

Answer

Create two separate pipelines for staging and production

Answer

Use Azure Traffic Manager to route traffic

Answer

Use an App Service plan with multiple instances

Question 11

Which TWO actions should you take to protect sensitive information (e.g., API keys, passwords) in Azure Pipelines? (Choose two.)

Accepted Answer

Define secrets as pipeline secret variables and reference them as $(secretName).. Azure Pipelines allows you to define secret variables in the pipeline UI or YAML, which are encrypted at rest and never exposed in logs. Referencing them as $(secretName) ensures they are securely injected at runtime without being stored in plaintext. Option E is correct because Azure Key Vault provides a centralized, audited, and encrypted store for secrets, and variable groups linked to Key Vault allow pipelines to fetch secrets dynamically without embedding them in pipeline definitions.

Answer

Store secrets in environment variables on the agent machine.

Answer

Store secrets in a YAML file and include the file in the repository.

Answer

Use plain text variables in the pipeline and mask them using the 'Logging Command' feature.

Question 12

A team uses Git for source control. They want to automatically squash all commits in a feature branch into a single commit when merging to the main branch. Which merge type should they use?

Accepted Answer

Squash commit. B is correct because the squash commit merge type collapses all commits in a feature branch into a single new commit on the target branch. This satisfies the requirement to automatically squash all commits when merging to main, as it creates a clean, linear history with one combined commit that contains all changes from the feature branch.

Answer

Rebase and fast-forward

Answer

Merge commit (no fast-forward)

Answer

Semi-linear merge

Question 13

Which TWO strategies can you use to manage secrets in Azure Pipelines securely?

Accepted Answer

Use a variable group linked to Azure Key Vault.. Options A and C are correct. Variable groups can be linked to Azure Key Vault to fetch secrets, and you can mark variables as secret in the pipeline UI to prevent them from being displayed in logs. Option B is wrong because storing secrets in YAML files exposes them in source control. Option D is wrong because using environment variables on the build agent is not inherently secure; they can be accessed by other processes and may be logged. Option E is wrong because printing secrets in scripts exposes them in the pipeline logs, which is a security risk.

Answer

Store secrets directly in the YAML pipeline file.

Answer

Use environment variables in the build agent.

Answer

Print the secret in a script to verify it is correct.

Question 14

You need to implement a compliance framework that ensures Azure Pipelines build agents are always patched with the latest security updates. What should you use?

Accepted Answer

Azure Update Management to schedule patching. Azure Update Management is the correct choice because it provides a native, scheduled patching solution for Azure Pipelines build agents. It integrates with Azure Automation and Log Analytics to assess missing updates and deploy them on a recurring schedule, ensuring agents remain compliant with the latest security patches without manual intervention.

Answer

Azure VM Image Builder to create patched images

Answer

Azure Policy to enforce that agents must be patched

Answer

Azure Automation State Configuration to enforce desired state

Question 15

You are reviewing a pipeline YAML file. The variable 'prod-db-password' is stored in a variable group linked to Azure Key Vault. However, the pipeline fails with an error that the secret cannot be accessed. What is the most likely cause?

Accepted Answer

The pipeline's authorized service principal lacks 'Get' permission on the Key Vault.. The most likely cause is that the pipeline's authorized service principal lacks 'Get' permission on the Key Vault. When a variable group is linked to Azure Key Vault, Azure Pipelines uses a service principal (the pipeline's identity) to retrieve secrets. Even if the variable group and secret name are correct, the pipeline will fail if the service principal does not have the 'Get' secret permission in the Key Vault access policy. This is a common misconfiguration because the variable group link only establishes the mapping, not the actual access rights.

Answer

The YAML syntax for referencing the variable is incorrect.

Answer

The variable group 'prod-variables' does not exist.

Answer

The secret name in Key Vault does not match 'prod-db-password'.