AZ-400 Practice Test 19 — 15 Questions

Question 1

You are designing a release pipeline for a Node.js application that deploys to Azure App Service. The pipeline must run integration tests against the deployed application. You want to use deployment slots to minimize downtime. What is the recommended approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy to a staging slot, run tests against the staging slot, then swap to production.. Deploying to a staging slot first allows you to validate the application by running integration tests against the staging slot without impacting production traffic. After successful testing, swapping the staging slot with the production slot ensures zero-downtime deployment, as Azure App Service swaps the underlying virtual directories and configuration settings instantly.

Answer

Deploy to the production slot directly and run tests after deployment.

Answer

Deploy to a staging slot, swap, then run tests.

Answer

Deploy to a staging slot, run tests, then delete the staging slot.

Question 2

Your team uses GitHub Actions to build and deploy a Node.js application to Azure App Service. The deployment succeeds, but the app crashes after startup with an error indicating a missing module. The build artifact includes the node_modules folder. What is the most likely cause?

Accepted Answer

The Node.js version on the runner differs from the App Service runtime, causing native module incompatibility.. The most likely cause is that the Node.js version on the GitHub Actions runner differs from the version on Azure App Service, leading to native module incompatibility. Native modules (e.g., those using node-gyp) are compiled against the specific Node.js ABI (Application Binary Interface) of the build environment. If the runtime version differs, the compiled .node binaries will fail to load, resulting in a 'missing module' error even though the node_modules folder is present in the artifact.

Answer

The .gitignore file excludes node_modules from the artifact.

Answer

The workflow YAML has an indentation error that causes the deploy step to fail silently.

Answer

The build step does not run npm ci, so the package-lock.json is ignored.

Question 3

Your team is using GitHub Actions for CI/CD. The workflow builds a container image and pushes it to Azure Container Registry (ACR). However, the workflow fails with an authentication error when pushing to ACR. What is the most likely cause?

Accepted Answer

The workflow does not include an 'azure/login' step to authenticate with Azure.. GitHub Actions workflows that push container images to Azure Container Registry (ACR) must first authenticate with Azure. Without an 'azure/login' step (using Azure CLI or Azure PowerShell actions), the workflow lacks the necessary OAuth2 tokens or service principal credentials to authorize the 'docker push' command against the ACR endpoint. The authentication error occurs because the Docker client cannot obtain a valid ACR access token without prior Azure authentication.

Answer

The repository name in the workflow is incorrect.

Answer

The Dockerfile is missing a required LABEL instruction.

Answer

The ACR allows anonymous pull access.

Question 4

A team uses Azure Pipelines to build a .NET Core application. The build pipeline runs successfully, but the release pipeline fails when deploying to Azure App Service with the error: 'ERROR_FILE_IN_USE'. What is the most likely cause?

Accepted Answer

The 'Take App Offline' setting is not enabled in the deployment task.. The 'ERROR_FILE_IN_USE' error occurs when the deployment process tries to overwrite files that are currently locked by the running application. Enabling the 'Take App Offline' setting in the Azure App Service deploy task places an app_offline.htm file in the wwwroot directory, which gracefully shuts down the application and releases all file locks before the new binaries are copied. Without this setting, the running process holds locks on the DLLs, causing the deployment to fail.

Answer

The deployment slot is not configured correctly.

Answer

The Azure App Service plan is not scaled appropriately.

Answer

The build configuration is set to Release instead of Debug.

Question 5

You have a multi-stage YAML pipeline that deploys to Azure App Service. The deployment to the production stage should only proceed if a manual approval is granted. How should you configure this?

Accepted Answer

Add an approval check on the production environment. Azure Pipelines supports approval checks on environments, which allow you to require manual approval before a deployment proceeds to a specific stage. By adding an approval check on the production environment, the pipeline will pause at that stage until an authorized user grants approval, meeting the requirement for manual sign-off before production deployment.

Answer

Use deployment gates with Azure Monitor metrics

Answer

Configure branch policies on the main branch

Answer

Add a pipeline decorator to require sign-off

Question 6

Refer to the exhibit. This is a deployment job definition in a multi-stage YAML pipeline. The deployment fails because the Kubernetes service connection 'aks-prod' cannot be found. What is the most likely cause?

Accepted Answer

The service connection 'aks-prod' does not exist in the Azure DevOps project.. The error message explicitly states that the Kubernetes service connection 'aks-prod' cannot be found. In Azure DevOps, a service connection is a stored credential set that must exist in the project before it can be referenced in a YAML pipeline. If the connection name is misspelled, deleted, or never created, the pipeline will fail at the deployment job stage regardless of other configurations.

Answer

The approval for production environment is blocking the deployment.

Answer

The agent pool does not have access to the AKS cluster.

Answer

The namespace 'prod' does not exist in the AKS cluster.

Question 7

You have a YAML pipeline that deploys to multiple environments. The pipeline uses environment approvals. You need to ensure that the pipeline waits for manual approval before deploying to the production environment. The production environment is named 'Production'. Which configuration should you add to the deployment job?

Accepted Answer

Add 'environment: Production' to the deployment job and configure approvals on the environment in the Azure DevOps portal. Environment approvals in Azure DevOps are configured on the environment resource itself, not in the pipeline YAML. By adding 'environment: Production' to the deployment job, the pipeline references the environment, and the manual approval gate is enforced by the approvals configured on that environment in the Azure DevOps portal. This ensures the pipeline waits for approval before proceeding to the production deployment job.

Answer

Add 'approvals: Production' to the deployment job

Answer

Add 'checks: Production' to the deployment job

Answer

Add 'dependsOn: ProductionApproval' and use a separate stage for approval

Question 8

Your team uses Azure Repos and wants to trigger a pipeline automatically when a pull request is created targeting the main branch. The pipeline should run validations and report the status to the PR. Which trigger type should you configure?

Accepted Answer

PR trigger. A PR trigger is the correct choice because it specifically initiates a pipeline when a pull request is created or updated against a target branch (main). This allows the pipeline to run validations (e.g., builds, tests, linting) and report the status back to the PR via the Azure Repos status API, enabling branch protection policies to block merging if checks fail.

Answer

Path filter

Answer

Scheduled trigger

Answer

CI trigger

Question 9

You need to ensure that only signed-in users can view Azure DevOps project wikis. Which setting should you configure?

Accepted Answer

Set project visibility to 'Private'. Setting the project visibility to 'Private' ensures that only authenticated users who are members of the Azure DevOps organization can access the project and its wikis. Anonymous or unauthenticated users are blocked entirely at the project level, which directly satisfies the requirement to restrict wiki viewing to signed-in users only.

Answer

Configure wiki permissions to deny anonymous users

Answer

Set repository visibility to 'Private'

Answer

Use Microsoft Entra ID Application Proxy

Question 10

You have an Azure Pipelines YAML file with the following trigger configuration:

```yaml
trigger:
  branches:
    include:
    - main
  paths:
    include:
    - /src/*
```

The team reports that the pipeline does not trigger when changes are pushed to the main branch that modify files outside the /src folder. What is the most likely reason?

Accepted Answer

The path filter restricts the trigger to only changes in /src/.. The most likely reason is that a path filter is configured in the trigger, restricting the pipeline to only trigger on changes under /src/. The other options are incorrect because they either refer to minor syntax issues or irrelevant details.

Answer

The trigger syntax is incorrect; 'branch' should be 'branches'.

Answer

The script step is missing a display name.

Answer

The pool vmImage is not specified correctly.

Question 11

Your organization uses GitHub Actions for CI/CD. You have a workflow that builds and deploys a containerized application to Azure Kubernetes Service (AKS). The workflow uses the 'azure/aks-set-context' action to connect to the AKS cluster. Recently, the workflow started failing with authentication errors. The service principal used has Contributor role on the AKS cluster. What is the most likely cause?

Accepted Answer

The service principal lacks the 'Azure Kubernetes Service Cluster Admin Role' on the AKS cluster.. The 'azure/aks-set-context' action requires the service principal to have the 'Azure Kubernetes Service Cluster Admin Role' (or 'Azure Kubernetes Service Cluster User Role') on the AKS cluster to authenticate and set the kubectl context. The Contributor role on the AKS cluster resource does not grant the necessary Kubernetes RBAC permissions to interact with the cluster's API server. Without the specific AKS role, the action fails with authentication errors.

Answer

The service principal must have 'Owner' role on the resource group containing the AKS cluster.

Answer

The workflow uses an incorrect Kubernetes version.

Answer

The AKS cluster has RBAC disabled, causing authentication failures.

Question 12

You are designing a pipeline that deploys to an Azure Kubernetes Service (AKS) cluster. You need to securely pass the Kubernetes cluster credentials to the pipeline without hardcoding them. Which approach should you use?

Accepted Answer

Use a variable group linked to Azure Key Vault.. Azure Key Vault provides a secure, centralized store for secrets like Kubernetes cluster credentials, and linking a variable group to Key Vault allows the pipeline to dynamically retrieve those secrets at runtime without exposing them in the pipeline definition or logs. This approach follows the principle of least privilege and ensures credentials are never hardcoded or stored in plaintext within the pipeline.

Answer

Store credentials in a pipeline variable with 'secret' type.

Answer

Hardcode the credentials in the pipeline YAML.

Answer

Use a secure file in the pipeline library.

Question 13

Your team uses Azure Boards to track work items. They want to automatically update the state of a work item when a pull request is merged in Azure Repos. What should you configure?

Accepted Answer

Define a branch policy to link work items and set automatic state transition.. Azure Repos branch policies allow you to require linked work items for pull requests and automatically transition the state of a linked work item (e.g., from 'Active' to 'Resolved') upon merge. This is configured in the branch policy settings under 'Automatically update work items' with a state transition rule, directly integrating Azure Boards with pull request completion.

Answer

Configure a work item template.

Answer

Create a service hook subscription.

Answer

Set pipeline variables in the YAML file.

Question 14

Your team uses Azure DevOps for CI/CD. You need to ensure that every build publishes telemetry to Application Insights, including build duration, test pass rate, and deployment frequency. Which approach should you use?

Accepted Answer

Use the Azure DevOps Analytics OData endpoint to query pipeline telemetry and send to Application Insights via a release task.. The Azure DevOps Analytics OData endpoint provides a standardized, queryable interface to pipeline telemetry data (build duration, test pass rate, deployment frequency). By using a release task to query this endpoint and forward the data to Application Insights, you can instrument your CI/CD pipeline to send custom telemetry without relying on manual scripting or unsupported commands. This approach aligns with the 'Implement an instrumentation strategy' domain by leveraging Azure DevOps Analytics and Application Insights integration.

Answer

Call the Azure DevOps REST API from a custom script in the pipeline to capture telemetry.

Answer

Run the Azure DevOps CLI command 'az devops telemetry publish' in a build task.

Answer

Use the built-in 'Pipeline Telemetry' dashboard in Azure DevOps.

Question 15

A development team wants to ensure that all code changes are reviewed by at least two senior developers before merging into the main branch. They use Azure Repos. What should they configure?

Accepted Answer

Configure a branch policy requiring a minimum number of reviewers.. Azure Repos branch policies allow you to enforce a minimum number of reviewers on pull requests. By setting the 'Minimum number of reviewers' policy to 2, the team ensures that at least two senior developers must approve any code change before it can be merged into the main branch. This directly meets the requirement without involving build validation, release pipelines, or external function calls.

Answer

Enable the build validation policy on the branch.

Answer

Set up a release pipeline with gated deployments.

Answer

Add a status check policy using Azure Functions.