AZ-400 Practice Test 18 — 15 Questions

Question 1

Which TWO actions should you take to implement a CI/CD pipeline for a microservices application using Azure Pipelines? (Choose two.)

Accepted Answer

Publish build artifacts and use them in the release stages.. Options B and D are correct. B: Publishing build artifacts and using them in release stages ensures consistency between build and deploy. D: Using a multi-stage YAML pipeline allows you to define build, test, and deploy stages in a single file. Option A is wrong because classic release pipelines are not recommended; YAML is preferred for CI/CD. Option C is wrong because credentials should not be stored in YAML; use variable groups or Azure Key Vault. Option E is wrong because a single multi-stage pipeline can handle multiple microservices using matrix strategies; separate pipelines increase complexity.

Answer

Use a classic release pipeline instead of YAML for the deployment stages.

Answer

Store deployment credentials directly in the YAML file.

Answer

Create a separate pipeline for each microservice.

Question 2

Which TWO actions should be taken to secure secrets in Azure Pipelines? (Choose two.)

Accepted Answer

Use secret variables with the 'secret' input type to mask them in logs.. Azure Pipelines allows you to mark variables as secret by using the 'secret' input type in the pipeline settings UI or by setting `secret: true` in YAML. This ensures the variable's value is masked with asterisks in all logs and output, preventing accidental exposure during build or release execution. Additionally, storing secrets in a variable group linked to Azure Key Vault provides a secure, centralized way to manage secrets, with access control, versioning, and auditability, making it a best practice for protecting sensitive data.

Answer

Use a variable group without Key Vault integration for easier management.

Answer

Store secrets directly in the YAML pipeline file.

Answer

Disable CI triggers to reduce exposure.

Question 3

You are designing a build pipeline for a Java application that uses Maven. The build must run unit tests and integration tests separately. You want to publish test results to Azure Pipelines. Which task configuration should you use?

Accepted Answer

Use two Maven tasks with goals 'test' and 'verify', and configure the Publish Test Results task to publish results from both runs.. It uses two separate Maven tasks with the 'test' and 'verify' goals, which allows unit tests and integration tests to run independently. The Publish Test Results task is then configured to consume the test result files (typically JUnit XML reports) from both runs, enabling Azure Pipelines to display a unified test summary. This approach aligns with the requirement to run unit and integration tests separately while still publishing all results.

Answer

Use two Gradle tasks, one for unit tests and one for integration tests.

Answer

Use a single Maven task with goals 'test verify', and configure the task to publish test results.

Answer

Use two Visual Studio Test tasks, one for unit tests and one for integration tests.

Question 4

Which THREE practices help ensure that work item tracking is effective in Azure Boards?

Accepted Answer

Link work items to code changes and pull requests.. Linking work items to code changes and pull requests creates a traceable path from requirements to implementation, enabling teams to understand the context of changes and automatically update work item status (e.g., via GitHub integration or Azure Repos). Keeping work items small and granular allows for accurate estimation, faster delivery, and meaningful progress tracking; large items hide complexity and make it difficult to measure velocity. Regularly updating fields such as Remaining Work ensures that burndown charts and sprint reports reflect reality, supporting accurate forecasting and early detection of issues.

Answer

Avoid customizing work item types to maintain consistency.

Answer

Create large work items that cover multiple features.

Question 5

Your pipeline has the following YAML trigger configuration:

trigger:
  paths:
    include:
    - src/app/**

A developer pushes changes to a file in 'src/app/config.json' on a branch named 'release/v1'. Which statement is true about the build trigger?

Accepted Answer

The build will be triggered.. The provided YAML trigger includes a path filter that matches 'src/app/**'. The push to 'src/app/config.json' matches that include pattern, so the build triggers. No branch filter is specified, so the trigger applies to all branches including 'release/v1'. Therefore, option B is correct.

Answer

The build will be triggered but only if no other builds are running.

Answer

The build will not be triggered because the path filter is too restrictive.

Answer

The build will not be triggered because the branch is not 'main'.

Question 6

Which THREE of the following are valid considerations when designing a release pipeline to deploy to multiple environments (dev, test, prod) using Azure Pipelines YAML?

Accepted Answer

Use variable groups scoped to environments to override variables per stage.. Variable groups can be reused across pipelines and stages. In a multi-stage YAML pipeline, you can use different variable groups for each environment by referencing them in the `variables` section of each stage (e.g., a variable group for dev, test, and prod). This allows you to override values such as connection strings per environment without duplicating pipeline code. For production deployments, you should configure approvals and checks on the Azure Pipelines environment resource (e.g., 'prod') to require manual sign-off before the deployment job runs. Stage-level approvals do not exist in Azure Pipelines; approvals are always attached to an environment or a service connection. For branch-based filtering, you can use stage `condition` expressions, such as `and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))`, to control which stages run based on the source branch. To reduce duplication, use YAML templates with parameters to define a single deployment template that is reused across environments rather than creating separate templates per environment.

Answer

Use stage-level approvals to gate each stage.

Answer

Use YAML templates to define each environment's deployment steps.

Question 7

Which THREE factors should you consider when designing a release pipeline for a critical production application? (Choose three.)

Accepted Answer

Rollback strategy. A release pipeline for a critical production application must include a rollback strategy (e.g., deployment slots or redeploying a previous artifact) to recover quickly from failed releases, deployment health monitoring (e.g., Application Insights, Azure Monitor) to detect issues early and trigger rollbacks or alerts, and approval gates before production deployment to ensure manual or automated checks are passed. These three factors together minimize downtime and ensure controlled, safe releases.

Answer

Use of service principal with least privilege

Answer

Single environment deployment

Question 8

Which TWO practices should you follow to ensure compliance with regulatory requirements (e.g., PCI DSS) when using Azure DevOps? (Choose two.)

Accepted Answer

Enable Azure DevOps audit logging to track changes to pipelines and policies.. Azure DevOps audit logging captures a detailed, immutable record of changes to pipelines, policies, and other critical resources, which is essential for demonstrating compliance with frameworks like PCI DSS that require evidence of who made what change and when. Audit logs can be exported to SIEM tools or retained for forensic analysis, satisfying the 'audit trail' requirement without manual intervention. Additionally, using branch policies enforces mandatory code reviews and approvals for changes, ensuring that all modifications go through a controlled, auditable process. Together, these practices provide both the immutable audit trail and the controlled change management required for regulatory compliance.

Answer

Manually track changes to pipelines in a spreadsheet.

Answer

Allow all users to create and modify pipelines without restrictions.

Answer

Disable audit logging to reduce storage costs.

Question 9

Which THREE are true about using deployment groups in Azure Pipelines? (Choose 3)

Accepted Answer

Each machine in a deployment group must have the Azure Pipelines agent installed.. Each target machine in a deployment group requires the Azure Pipelines agent (either the Windows or Linux agent) to be installed and configured. The agent is responsible for executing the deployment tasks on that machine, and without it, the deployment group cannot communicate with or deploy to the machine.

Answer

Deployment groups can only be used with Windows-based machines.

Answer

Deployment groups are tied to a specific environment.

Question 10

Your team uses Azure Repos and needs to prevent secrets from being committed to the repository. Which built-in feature should you enable?

Accepted Answer

Enable push protection in Azure Repos. Push protection in Azure Repos is a built-in feature that scans commits for high-confidence secrets (e.g., Azure service connection strings, SSH keys, and other credential patterns) and blocks the push if a secret is detected. This prevents secrets from ever reaching the remote repository, enforcing security at the server side without requiring client-side configuration.

Answer

Enable GitHub secret scanning

Answer

Enable Azure Policy to scan repositories

Answer

Configure a pre-commit hook with a secret scanning tool

Question 11

Your organization uses Azure DevOps. You have a classic release pipeline that deploys to multiple stages: Dev, QA, and Prod. Each stage has a pre-deployment approval gate. Recently, the QA team complained that they are not receiving approval notifications. You have verified that the approval configuration is correct and the approvers are members of the 'QA Approvers' group. The release pipeline is set to send email notifications to the approvers. However, the QA approvers report they do not receive any emails when a release is pending their approval. What should you check first?

Accepted Answer

Verify that the organization-level notification settings allow email notifications for approvals.. The correct first step. Even if the pipeline's approval configuration is correct and the approvers are in the correct group, the organization-level notification settings in Azure DevOps can override individual pipeline settings. If email notifications for approvals are disabled at the organization level, no emails will be sent regardless of the pipeline configuration. Therefore, checking the organization-level notification settings should be the first troubleshooting step. Option A is not the first step because while spam filters could cause missed emails, the issue is more likely a system-level configuration problem. Option C is incorrect because Azure DevOps automatically sends approval notifications; adding a manual 'Send email' task is unnecessary and not a standard fix. Option D is incorrect because checking release pipeline logs might reveal delivery failures, but the most efficient first step is to verify the notification settings at the organization level.

Answer

Ask the QA team to check their spam folder.

Answer

Add a 'Send email' task in the pipeline before the approval gate.

Answer

Check the 'Release Pipeline' logs for a warning about email delivery failure.

Question 12

Your team uses Azure Pipelines for CI/CD. You need to enforce that all builds sign the assemblies with a code signing certificate stored in Azure Key Vault. What is the recommended approach?

Accepted Answer

Use the 'Azure Key Vault' task to download secrets and then a 'PowerShell' task to sign.. Use the Azure Key Vault task to download the certificate as a secure secret, then use a PowerShell task to sign the assemblies with that certificate.

Answer

Store the certificate as a secure file in the pipeline library and use the 'Download Secure File' task.

Answer

Embed the certificate in the repository and use a script to sign.

Answer

Use the 'Azure CLI' task to retrieve the certificate and then sign.

Question 13

You are configuring a continuous integration (CI) trigger for your YAML pipeline. The trigger should run the pipeline when changes are pushed to the 'main' branch or any release branch matching 'release/*'. Which TWO trigger configurations are valid? (Choose two.)

Accepted Answer

trigger:
  branches:
    include:
      - main. The `trigger` section with `branches: include: - main` explicitly specifies that the pipeline should run on pushes to the `main` branch. Option E is correct because `trigger: branches: include: - release/*` uses the wildcard pattern `release/*` to include all branches matching that pattern, such as `release/v1.0` or `release/2.0`. Both configurations are valid YAML trigger definitions for Azure Pipelines.

Answer

trigger:
  branches:
    exclude:
      - main

Answer

branches:
  include:
    - main

Answer

trigger:
  branches:
    main

Question 14

Which TWO options are valid ways to communicate build status from Azure Pipelines to external stakeholders?

Accepted Answer

Configure a Service Hook to post to a Slack channel.. Service Hooks in Azure Pipelines allow integration with external services like Slack by triggering HTTP POST requests containing build status payloads. Additionally, Azure Pipelines provides built-in email notifications for specific events, such as build completion or failure, which can be configured to send status updates to stakeholders. Both are standard, officially supported features. Options like using a release pipeline to call Twilio are possible but are not standard built-in methods, so they are not considered 'valid ways' in this context.

Answer

Create a work item in Azure Boards for each build.

Answer

Export pipeline logs to Power BI for reporting.

Answer

Use a release pipeline to send SMS via Twilio.

Question 15

Your team is adopting a shift-left security approach in Azure Pipelines. They want to automatically detect secrets, such as API keys or connection strings, in source code before code is committed. Which Azure DevOps feature should be configured to scan pull requests for secrets and block the PR if any are found?

Accepted Answer

Secret Scanning. Azure DevOps Secret Scanning is the built-in feature that automatically detects secrets in Azure Repos and can block pull requests when secrets are found. While a Credential Scanner task can also be added to a pipeline, Secret Scanning is the native feature designed for this purpose and is the correct answer. Options A and C are unrelated, and B is a pipeline task, not the primary Azure DevOps feature.

Answer

Azure Policy for Repos

Answer

Credential Scanner task in pipeline

Answer

Dependency Scanning