AZ-400 Practice Test 20 — 15 Questions

Question 1

Your team is using GitHub Flow for a web application. Developers create feature branches from main, make changes, and open pull requests. Recently, several pull requests were merged without required reviews because the branch protection rules were not enforced on the main branch. What should you do to ensure all pull requests to main require at least one reviewer?

Accepted Answer

Enable the 'Require a pull request before merging' rule in branch protection for main, and set 'Required approvals' to 1.. Option B is correct because branch protection rules in GitHub can enforce required pull request reviews before merging. Option A is incorrect because deleting the branch after merge does not enforce reviews. Option C is incorrect because require branches to be up to date is not the same as requiring reviews. Option D is incorrect because code owners are optional, not mandatory.

Answer

Configure the repository to automatically delete head branches after pull requests are merged.

Answer

Enable the 'Require branches to be up to date' rule in branch protection for main.

Answer

Add a CODEOWNERS file and configure it so that every file has at least one owner.

Question 2

Which THREE practices are recommended when implementing a Git branching strategy for a team using Azure Repos?

Accepted Answer

Delete branches after they are merged.. Options A, B, and D are correct. A: Short-lived branches reduce merge conflicts. B: Build validation in branch policies ensures quality. D: Deleting branches after merge keeps repository clean. C is wrong because long-lived feature branches increase complexity. E is wrong because force pushing can rewrite history and disrupt collaboration.

Answer

Allow force pushes to shared branches to clean up history.

Answer

Keep feature branches alive for the entire sprint.

Question 3

You are designing a Git branching strategy for a large enterprise with multiple Azure DevOps projects. The strategy must support hotfixes for production releases, feature development in isolated branches, and release branches for stabilization. The team uses CI/CD pipelines that trigger on branch creation. You need to minimize merge conflicts and ensure that hotfix changes are propagated to all active branches. Which branching model should you recommend and how should you configure branch policies?

Accepted Answer

Use GitFlow with main, develop, and hotfix branches. Configure branch policies on main and develop to enforce pull requests with required reviewers. Use a pipeline to automatically merge hotfix branches into both main and develop.. Option A is correct because GitFlow with branch policies on main and develop that enforce hotfix merges via pull request ensures propagation. Option B (GitHub Flow) does not have dedicated hotfix branches and release branches. Option C (Trunk-Based) lacks hotfix isolation. Option D (Forking) is for external contributions, not enterprise internal.

Answer

Use GitHub Flow with feature branches merging directly to main. Use a release branch for stabilization. Use pull requests for all merges.

Answer

Use trunk-based development with short-lived feature branches. Use feature toggles for incomplete work. No separate hotfix branch.

Answer

Use a forking workflow where each developer forks the repository and submits pull requests. Use branch policies on the upstream main branch.

Question 4

You are configuring a continuous integration (CI) trigger for your YAML pipeline. The trigger should run the pipeline when changes are pushed to the 'main' branch or any release branch matching 'release/*'. Which TWO trigger configurations are valid? (Choose two.)

Accepted Answer

trigger:
  branches:
    include:
      - main. Options A and B are correct. Option A uses exact branch name. Option B uses wildcard for release branches. Option C is wrong because 'include' should be a list. Option D is wrong because 'branches' is nested under 'trigger'. Option E is wrong because 'exclude' is not needed.

Answer

trigger:
  branches:
    exclude:
      - main

Answer

branches:
  include:
    - main

Answer

trigger:
  branches:
    main

Question 5

Your release pipeline deploys to Azure App Service using deployment slots. You need to ensure that traffic is gradually shifted to the new slot over 30 minutes, and if performance issues occur, it should automatically roll back. Which deployment strategy should you implement?

Accepted Answer

Use the 'Deploy to Azure App Service' task with the 'Deploy to Slot' option and configure auto-swap with monitoring.. Option A is correct because the rolling deployment with traffic shifting and automatic rollback is best achieved using Azure App Service deployment slots with auto-swap and monitoring. Option B is wrong because blue-green with manual swap does not provide gradual traffic shift. Option C is wrong because canary with manual approval does not automate rollback. Option D is wrong because A/B testing is not a native deployment strategy in Azure Pipelines.

Answer

Use two separate deployment slots (blue/green) and manually swap after validation.

Answer

Use a canary deployment with multiple slots and manual approval gate.

Answer

Use an A/B testing deployment by deploying to two different App Services and routing traffic via Traffic Manager.

Question 6

Your build pipeline uses a self-hosted agent. The agent is running low on disk space. You need to clean up the agent's working directory after each build. Which option should you configure in the pipeline?

Accepted Answer

Use the 'clean' parameter in the checkout step of the YAML pipeline.. Option C is correct because setting 'clean: true' in the checkout step ensures the working directory is cleaned before each build. Option A is wrong because the 'workspace' cleanup option in agent configuration is not a pipeline setting. Option B is wrong because 'Delete Files' task is manual and not automatic. Option D is wrong because 'Cleanup' task is not a built-in task.

Answer

Set the 'Clean' option to 'Sources' in the pipeline settings.

Answer

Add a 'Delete Files' task at the end of the pipeline to delete the sources directory.

Answer

Add a 'Cleanup' task from the marketplace to clean the agent.

Question 7

Your team uses Azure Pipelines for CI/CD. You need to enforce that all pipeline runs use approved agents from a specific agent pool with the latest security patches. The agents are self-hosted on Azure VMs. What should you implement?

Accepted Answer

Set the agent pool to use a specific agent queue with an isolation scope. Option C is correct because setting the agent pool to use a specific agent queue with an isolation scope ensures that only approved, security-patched agents from that queue are used for pipeline runs. This configuration restricts the pool to a designated set of self-hosted agents, preventing unauthorized or unpatched agents from executing jobs.

Answer

Configure pipeline permissions for the agent pool

Answer

Create a deployment pool and assign the agents to it

Answer

Add a demand on the agent for a custom capability that only approved agents have

Question 8

You need to create a pipeline that triggers only when changes are made to files in the 'src/api' folder. Which trigger configuration should you use?

Accepted Answer

trigger: paths: include: - 'src/api/*'. Option A is correct because the 'paths' filter with 'include' triggers only for changes in that path. Option B is wrong because 'exclude' would ignore that path. Option C is wrong because 'tags' filter by tag. Option D is wrong because 'branches' filter by branch.

Answer

trigger: branches: include: - 'main'

Answer

trigger: paths: exclude: - 'src/api/*'

Answer

trigger: tags: include: - 'v*'

Question 9

Your release pipeline uses a 'Run Azure CLI' task to execute a script. The script authenticates using a service principal. However, the deployment fails with 'insufficient privileges to complete the operation'. What is the most likely cause?

Accepted Answer

The service principal lacks the necessary RBAC role on the target resource.. Option C is correct because the service principal likely lacks the required RBAC role. Option A is wrong because the CLI task can use service principal authentication. Option B is wrong because service principal secret expiration would cause a different error. Option D is wrong because the error is about privileges, not token expiry.

Answer

The Azure CLI task is not logged in.

Answer

The service principal secret has expired.

Answer

The service principal does not have a secret.

Question 10

Your team uses Azure Pipelines to deploy a web app to Azure App Service. The deployment uses the 'AzureWebApp@1' task with a deployment slot. You need to ensure that after a successful deployment to the staging slot, the slot swap happens automatically and the staging slot is warmed up before the swap. Which configuration should you use?

Accepted Answer

Set the 'Slot' parameter to 'staging' and enable 'Swap with production' in the task.. Option B is correct because the 'AzureWebApp@1' task includes a 'Swap with production' checkbox that, when enabled, automatically performs a slot swap after the deployment to the specified slot (e.g., staging) completes. This ensures the staging slot is warmed up by the deployment process before the swap, as the swap operation respects the warm-up phase of the target slot, preventing downtime and ensuring the production slot receives a fully initialized application.

Answer

Use the 'Azure App Service manage' task to swap slots after deployment.

Answer

Use the 'Azure CLI' task to run 'az webapp deployment slot swap' after deployment.

Answer

Configure the deployment task to deploy to staging and then use a separate task to swap.

Question 11

Your build pipeline includes a task that runs unit tests. You want to ensure that if any test fails, the pipeline stops immediately and does not proceed to the next tasks. What should you configure in the pipeline?

Accepted Answer

Ensure the task control option 'Run this task' is set to 'Only when all previous tasks have succeeded'.. Setting the task control option 'Run this task' to 'Only when all previous tasks have succeeded' ensures that the pipeline stops on failure. Option A is wrong because 'Continue on error' allows the pipeline to continue even if the task fails. Option C is wrong because 'Always run' runs the task regardless of previous failures. Option D is wrong because 'Custom conditions' can be used but are not the simplest way to stop on failure.

Answer

Set the 'Continue on error' option to false for the test task.

Answer

Add a custom condition to the test task to only run if previous tasks succeeded.

Answer

Set the 'Always run' option for the test task.

Question 12

Which TWO triggers can start a release in Azure Pipelines?

Accepted Answer

Schedule. In Azure Pipelines, a release can be triggered by a schedule, which allows you to define a cron-based trigger to deploy at specific times (e.g., nightly builds). The 'Build completion' trigger starts a release when a specific build pipeline completes, enabling chained deployments. Both are native release triggers in classic release pipelines.

Answer

Continuous integration

Answer

Work item state change

Answer

Pull request

Question 13

Your team uses Microsoft-hosted agents for builds. Recently, builds are taking longer to start. What is the best way to reduce queue times?

Accepted Answer

Provision self-hosted agents.. Option A is correct because using self-hosted agents provides dedicated capacity. Option B is wrong because reducing parallel jobs doesn't help queue time. Option C is wrong because it increases parallelism but doesn't reduce queue time per job. Option D is wrong because more jobs would increase queue time.

Answer

Increase the number of parallel jobs in the organization.

Answer

Use more pipeline triggers.

Answer

Reduce the number of parallel jobs.

Question 14

Your release pipeline includes a 'Deploy to App Service' task for a Linux web app. The deployment fails with 'Error: Failed to deploy web package to App Service'. What should you check first?

Accepted Answer

Review the App Service diagnostic logs.. Option B is correct because App Service logs provide detailed error messages. Option A is wrong because Kudu is for Windows apps, not Linux. Option C is wrong because deployment slots are optional. Option D is wrong because the web.config is for IIS, not Linux.

Answer

Verify that the deployment slot is correctly configured.

Answer

Check the Kudu console for errors.

Answer

Ensure the web.config file is present.

Question 15

Which TWO of the following are valid strategies to securely store and use secrets in Azure Pipelines?

Accepted Answer

Link a variable group to Azure Key Vault and reference variables in the pipeline.. Variable groups can be linked to Azure Key Vault to store secrets securely. The 'AzureKeyVault@1' task can retrieve secrets from Key Vault at runtime. Option A is correct because variable groups support Key Vault integration. Option D is correct because the task can download secrets. Option B is not secure; Option C is not secure; Option E is not a pipeline feature.

Answer

Use the 'secret' variable type in YAML and hardcode the value.

Answer

Store secrets in a text file in the repository and use a script to read them.

Answer

Use encrypted environment variables in GitHub Actions.