AZ-400 Practice Test 20 — 15 Questions

Question 1

Your organization requires compliance with SOC 2 and needs to audit all changes to Azure Pipelines. What should you enable?

Accepted Answer

Azure DevOps audit logs. Azure DevOps audit logs capture all changes to pipelines and can be exported for compliance with SOC 2. Option A is incorrect because Azure Policy enforces governance rules on Azure resources, not pipeline changes. Option B is incorrect because Microsoft Purview is a data governance service, not for auditing DevOps changes. Option C is incorrect because Azure Blueprints (now deprecated) were used to define repeatable Azure environments, not for audit logging.

Answer

Azure Policy

Answer

Microsoft Purview

Answer

Azure Blueprints

Question 2

You receive a GitHub Dependabot alert as shown. The repository 'my-app' is internal. What is the best immediate action to mitigate the risk?

Accepted Answer

Update the lodash dependency to the latest patched version. The Dependabot alert indicates a known vulnerability in the lodash dependency. The best immediate action is to update lodash to the latest patched version, which directly resolves the security issue by applying the fix provided by the maintainers. This aligns with the principle of remediating vulnerabilities at the source rather than implementing workarounds.

Answer

Dismiss the alert as it is a false positive

Answer

Create a private fork of the repository

Answer

Enable secret scanning on the repository

Question 3

You have a release pipeline that deploys to multiple stages (Dev, QA, Prod). You want to automatically deploy to Dev and QA after a successful build, but require a manual approval for Prod. Which deployment strategy should you use?

Accepted Answer

Set pre-deployment approvals on the Prod stage.. Pre-deployment approvals control whether a release can start deploying to a stage. By setting a pre-deployment approval on the Prod stage only, Dev and QA will deploy automatically (since they have no approval requirement), while Prod requires manual sign-off before deployment begins. This matches the requirement exactly.

Answer

Set pre-deployment approvals on the Dev and QA stages.

Answer

Use a post-deployment approval on the QA stage.

Answer

Disable the automatic trigger for all stages.

Question 4

You are designing a multi-stage YAML pipeline that builds a Docker image and deploys it to Azure Kubernetes Service (AKS). You want to reuse the Docker build steps across multiple stages. What is the best approach?

Accepted Answer

Create a YAML template and reference it from each stage.. YAML templates in Azure Pipelines allow you to define reusable step, job, or stage definitions in a separate file and reference them using the `template` keyword. This approach promotes DRY (Don't Repeat Yourself) principles, simplifies maintenance, and ensures consistency when the same Docker build steps are needed across multiple stages in a multi-stage pipeline.

Answer

Use a stage template.

Answer

Define the steps as variables and reference them.

Answer

Create a separate job and call it from each stage.

Question 5

Refer to the exhibit. The YAML pipeline triggers on commits to main and develop branches, and pull requests targeting develop. A developer pushes a commit directly to main. What will happen?

Accepted Answer

The pipeline runs once for the CI trigger.. The pipeline is configured with a CI trigger for both main and develop branches, and a PR trigger only for pull requests targeting develop. When a developer pushes a commit directly to main, the CI trigger fires because the push matches the main branch, causing the pipeline to run once. The PR trigger does not activate because there is no pull request involved.

Answer

The pipeline does not run because the PR trigger requires a pull request.

Answer

The pipeline runs twice: once for the CI trigger and once for the PR trigger.

Answer

The pipeline runs once for the PR trigger only.

Question 6

You are implementing a secrets management strategy for a multi-cloud deployment. You need to securely store and rotate API keys for a third-party service. Which Azure service should you use?

Accepted Answer

Azure Key Vault. Azure Key Vault is the correct service because it is designed specifically for securely storing and managing secrets, including API keys, with built-in support for automatic rotation via integration with Azure Event Grid and Azure Functions. It provides hardware security module (HSM)-backed encryption, access policies, and auditing, making it ideal for multi-cloud secrets management.

Answer

Microsoft Entra ID

Answer

Azure App Configuration

Answer

Azure Storage Blob

Question 7

Your organization uses Microsoft Entra ID. You want to ensure that only users from specific countries can access Azure DevOps. Which security feature should you configure?

Accepted Answer

Microsoft Entra ID Conditional Access policies. Microsoft Entra ID Conditional Access policies allow you to enforce location-based access controls by specifying allowed countries or IP ranges. By configuring a Conditional Access policy that targets Azure DevOps (as a cloud app) and setting the condition to 'Locations' with 'Selected countries,' you can restrict sign-ins to only users from those countries. This is the correct approach because Azure DevOps relies on Entra ID for authentication, and Conditional Access is the native mechanism to control access based on geographic location.

Answer

Azure Network Security Group (NSG) rules

Answer

Azure DevOps security groups with allowed IP ranges

Answer

Microsoft Intune compliance policies

Question 8

Which THREE are benefits of using a monorepo vs multiple repositories?

Accepted Answer

Easier code sharing and refactoring across projects. A monorepo enables easier code sharing and refactoring across projects by allowing all code to reside in a single repository. This eliminates the need for cross-repository package publishing or versioning, as shared libraries can be directly referenced and refactored atomically across all dependent projects within the same commit.

Answer

Reduced risk of configuration drift

Answer

Faster clone times due to smaller repository size

Question 9

Your organization uses GitHub and wants to automatically assign pull request reviewers based on the files changed. Which three steps should you take?

Accepted Answer

Configure 'Code owner review requirement' in branch protection.. Configuring 'Code owner review requirement' in branch protection enforces that pull requests affecting files with defined code owners must be approved by those owners before merging. This ensures that changes to specific file patterns automatically require review from the designated teams or individuals, aligning with the goal of automatic assignment based on files changed.

Answer

Enable 'Protected branches' for the main branch.

Answer

Configure team synchronization for the organization.

Question 10

Your company is migrating to Microsoft Entra ID and needs to manage secrets used in Azure Pipelines. Which service should you use to securely store and rotate secrets?

Accepted Answer

Azure Key Vault. Azure Key Vault is the correct service to securely store and rotate secrets used in Azure Pipelines. It is natively integrated with Azure Pipelines via library variable groups, allowing secrets to be referenced in pipelines without exposing them. Option B, GitHub Secrets, is designed for GitHub Actions, not Azure Pipelines. Option C, Azure App Configuration, manages feature flags and configuration settings, not secrets. Option D, Microsoft Purview, is for data governance and compliance, not secret management.

Answer

GitHub Secrets

Answer

Azure App Configuration

Answer

Microsoft Purview

Question 11

Your YAML pipeline uses a self-hosted agent pool. You need to ensure that only the pipeline can trigger builds on that pool, preventing other projects from using it. What should you do?

Accepted Answer

Configure pipeline permissions in the agent pool security settings. Azure DevOps agent pool security settings allow you to restrict which pipelines or projects can use a specific agent pool. By configuring pipeline permissions, you can grant the 'Use' permission only to the intended pipeline, preventing other projects from triggering builds on that pool. This ensures exclusive access without disabling the pool for all other uses.

Answer

Set the agent pool to 'Disabled' for other projects

Answer

Use a deployment group instead of an agent pool

Answer

Create a separate agent pool for each project

Question 12

You are reviewing an Azure Policy assignment in a DevOps environment. The exhibit shows the policy assignment JSON. The policy set includes the built-in policy 'Allowed Locations' with effect Deny. During a pipeline deployment, a resource creation fails with a policy violation error. The resource being deployed is a storage account in the 'centralus' region. What is the most likely reason for the failure?

Accepted Answer

The resource being deployed is in a region that is not allowed by the policy assignment parameters.. The policy assignment includes the built-in 'Allowed Locations' policy with the Deny effect. The resource being deployed (a storage account) is in the 'centralus' region, but the policy assignment parameters likely specify a list of allowed regions that does not include 'centralus'. Since the Deny effect prevents any non-compliant resource creation, the deployment fails with a policy violation error. This is the most direct and common cause of such failures in Azure Policy.

Answer

The policy assignment is misconfigured because it does not specify a policy set definition.

Answer

The resource group is located in a region that overrides the policy assignment.

Answer

The policy set definition does not include the 'Allowed Locations' policy.

Question 13

Your company uses Azure DevOps and must enforce that all pipelines use approved agent pools. The security team wants to prevent the use of the default agent pool. What should you do?

Accepted Answer

Set agent pool permissions to deny the default pool for all projects. Setting agent pool permissions to deny the default pool for all projects explicitly blocks its use across the organization. This enforces the security policy by preventing any pipeline from selecting the default agent pool, while still allowing administrators to manage the pool if needed. In Azure DevOps, agent pool permissions control which users, teams, or projects can use a pool, and setting 'Deny' overrides any inherited 'Allow' permissions.

Answer

Use pipeline settings to require authorization for the default pool

Answer

Remove the default agent pool from the organization

Answer

Disable the default agent pool in project settings

Question 14

Which THREE are required to set up a self-hosted agent for Azure Pipelines?

Accepted Answer

Network connectivity to Azure DevOps services.. B is correct because the self-hosted agent must communicate with Azure Pipelines to receive job assignments and report status. This requires outbound HTTPS connectivity (port 443) to Azure DevOps services (e.g., dev.azure.com). Without network connectivity, the agent cannot register, poll for jobs, or send logs, making it non-functional.

Answer

A virtual machine running in Azure.

Answer

Docker installed on the agent machine.

Question 15

Refer to the exhibit. A developer pushes a new commit to an existing pull request targeting the main branch. What is the effect on the pull request?

Accepted Answer

All existing approvals are revoked, and the pull request must be re-approved.. The policy 'Reset code reviewer votes when new changes are pushed' is set to true. Therefore, when a new commit is pushed, all previous reviewer votes are reset. The required number of reviewers is 2, but minimum is 1, so at least one reviewer must approve again.

Answer

The pull request is automatically merged.

Answer

The existing approvals remain valid, and no re-review is needed.

Answer

The new commit is rejected because it was pushed without a code review.