AZ-400 Practice Exam 3 — 20 Questions

Question 1

A team is implementing a release pipeline for a Node.js application. They want to run integration tests against a temporary environment that is destroyed after the tests complete. Which strategy should they use?

Accepted Answer

Use a release pipeline that deploys to a new Azure App Service instance, runs tests, and then removes the instance.. Option D is correct because it provisions a dedicated, isolated Azure App Service instance for integration testing, runs the tests against the real environment, and then destroys the instance to avoid ongoing costs. This aligns with the ephemeral environment pattern, ensuring tests validate actual deployment behavior without contaminating shared resources.

Answer

Use a separate release pipeline that deploys to a production environment for testing.

Answer

Use a single release pipeline that deploys to a staging slot and runs tests on the slot.

Answer

Run integration tests in the build pipeline using a mock environment.

Question 2

Which TWO actions should be taken to secure secrets in Azure Pipelines? (Choose two.)

Accepted Answer

Use secret variables with the 'secret' input type to mask them in logs.. Option A is correct because Azure Pipelines allows you to mark variables as 'secret' by using the 'secret' input type in the pipeline settings UI or by setting `isSecret: true` in YAML. This ensures the variable's value is masked with asterisks in all logs and output, preventing accidental exposure during build or release execution.

Answer

Use a variable group without Key Vault integration for easier management.

Answer

Store secrets directly in the YAML pipeline file.

Answer

Disable CI triggers to reduce exposure.

Question 3

You have a release pipeline that deploys to multiple environments. You need to ensure that a manual approval is required before deploying to production. What should you configure?

Accepted Answer

Set a pre-deployment approval on the production stage. Pre-deployment approvals are configured on a stage in Azure Pipelines to require manual sign-off before any deployment to that stage begins. Since the question specifies that approval is needed before deploying to production, a pre-deployment approval on the production stage enforces that gate before the release pipeline executes any deployment tasks in that environment.

Answer

Add a manual intervention task in the production stage

Answer

Set a post-deployment approval on the production stage

Answer

Set a branch policy on the release branch

Question 4

Which two of the following are valid strategies to implement conditional deployment in a YAML pipeline? (Choose 2)

Accepted Answer

Use the 'condition' property on a stage. Option A is correct because the 'condition' property in Azure DevOps YAML pipelines allows you to specify custom conditions (e.g., `eq(variables['Build.SourceBranch'], 'refs/heads/main')`) that control whether a stage, job, or step runs. This is a native, declarative way to implement conditional deployment without scripting, evaluating the condition at runtime based on variables or expressions.

Answer

Configure stage filters in the triggers section

Answer

Use dependency conditions like 'succeededOrFailed'

Answer

Add a PowerShell script to check environment

Question 5

You are designing a release pipeline that must deploy to Azure App Service across multiple regions. Which two practices should you implement to minimize downtime during deployments? (Choose 2)

Accepted Answer

Use Azure App Service deployment slots and perform a swap. Option A is correct because Azure App Service deployment slots allow you to deploy a new version of your application to a staging slot, perform validation, and then swap it into production with zero downtime. The swap operation warms up the target slot and smoothly transitions traffic, ensuring no requests are dropped during the update.

Answer

Stop the web app before deploying, then start it after

Answer

Deploy to all regions simultaneously

Answer

Use a single deployment slot for all regions

Question 6

A development team uses Git for source control. They want to enforce a branching strategy where all feature work is done in short-lived branches that are merged to main via pull requests. The team also requires that every commit on main builds successfully. Which TWO practices should the team implement?

Accepted Answer

Configure a branch policy on main that requires a successful build before merging.. Option A is correct because configuring a branch policy on main that requires a successful build before merging ensures that every commit merged into main has passed a validation build. This enforces the team's requirement that every commit on main builds successfully, as the pull request cannot be completed until the build pipeline reports success.

Answer

Use squash merge when completing pull requests to main.

Answer

Create feature branches from main and keep them long-lived for stability.

Answer

Allow developers to commit directly to main for urgent fixes.

Question 7

The exhibit shows a draft Azure Monitor alert rule for Key Vault secret expiry. However, the query fails to return results for secrets that have already expired. What is the most likely reason?

Accepted Answer

The condition `DaysToExpiry > 0` excludes secrets that have already expired.. Option B is correct because the query filters on `DaysToExpiry > 0`, which only returns secrets with a positive number of days remaining until expiry. Once a secret has expired, its `DaysToExpiry` becomes zero or negative, so it is excluded from the results. This is a logical filter error: the condition should be `DaysToExpiry <= 0` or remove the filter entirely to include expired secrets.

Answer

The query does not include secrets that have no expiry date set.

Answer

The query only checks secrets that are enabled.

Answer

The `limit 10` clause restricts to only 10 secrets, which may miss expired ones.

Question 8

Refer to the exhibit. The pipeline is configured as shown. A developer pushes a change to the `main` branch that modifies a file under `src/Controllers/HomeController.cs` and also adds a new file under `docs/readme.md`. Which of the following best describes what happens?

Accepted Answer

The pipeline triggers because the change to `src/Controllers/HomeController.cs` is not in an excluded path.. Option B is correct because the pipeline's trigger configuration uses path filters that exclude `docs/*` but include `src/*`. Since the developer's push includes a change to `src/Controllers/HomeController.cs`, which is not in an excluded path, the pipeline triggers. The addition of `docs/readme.md` does not prevent triggering because the trigger evaluates the union of all changed files; as long as at least one changed file matches an included path (or is not excluded), the pipeline runs.

Answer

The pipeline does not trigger because the `docs/` path is excluded and includes a change.

Answer

The pipeline triggers only if the change is on a branch matching `release/*`.

Answer

The pipeline triggers but runs only tests because the build is skipped due to excluded paths.

Question 9

A company uses Azure Monitor and Application Insights to monitor a microservices application deployed on Azure Kubernetes Service (AKS). The development team wants to implement distributed tracing to correlate requests across services. They currently have Application Insights SDKs instrumented in each service. Which TWO configurations are required to enable end-to-end distributed tracing?

Accepted Answer

Ensure all services use the same Application Insights instrumentation key or connection string.. Option B is correct because all services must share the same Application Insights instrumentation key or connection string to ensure that telemetry from different microservices is correlated into a single application map and trace. Without a common instrumentation key, the distributed trace data would be siloed across separate Application Insights resources, preventing end-to-end correlation.

Answer

Enable the Live Metrics Stream feature in Application Insights.

Answer

Configure adaptive sampling in the Application Insights SDK.

Answer

Enable Application Map in the Azure portal for each service.

Question 10

You have a multi-stage YAML pipeline that deploys to Azure Kubernetes Service (AKS). The pipeline uses a deployment job with a strategy of 'runOnce'. You need to ensure that if the deployment fails, the pipeline automatically redeploys the previous successful version. Which strategy should you use instead?

Accepted Answer

Use the 'rolling' strategy and configure 'on:failure: always'. Option B is correct because the 'rolling' strategy in Azure DevOps deployment jobs supports an 'on:failure' hook that can be configured to run actions like 'always', which can trigger a rollback to the previous successful version. This ensures automatic redeployment of the last stable release upon failure, meeting the requirement without manual intervention.

Answer

Use the 'canary' strategy with manual intervention

Answer

Use the 'blueGreen' strategy and configure automatic swap

Answer

Use the 'runOnce' strategy with a rollback task

Question 11

You have a release pipeline that deploys to multiple stages (Dev, QA, Prod). You want to automatically deploy to Dev and QA after a successful build, but require a manual approval for Prod. Which deployment strategy should you use?

Accepted Answer

Set pre-deployment approvals on the Prod stage.. Pre-deployment approvals control whether a release can start deploying to a stage. By setting a pre-deployment approval on the Prod stage only, Dev and QA will deploy automatically (since they have no approval requirement), while Prod requires manual sign-off before deployment begins. This matches the requirement exactly.

Answer

Set pre-deployment approvals on the Dev and QA stages.

Answer

Use a post-deployment approval on the QA stage.

Answer

Disable the automatic trigger for all stages.

Question 12

You need to trigger a pipeline whenever changes are pushed to the 'main' branch of a GitHub repository. Which trigger should you configure in the YAML pipeline?

Accepted Answer

trigger:
  branches:
    include:
    - main. Option A is correct because the `trigger` keyword at the root of a YAML pipeline defines the CI trigger that automatically starts a pipeline run when changes are pushed to the specified branch. By including `main` under `branches.include`, the pipeline will trigger on any push to the `main` branch of the GitHub repository, which is the standard way to set up a CI trigger for a single branch.

Answer

pr:
  branches:
    include:
    - main

Answer

resources:
  repositories:
  - repository: self
    trigger:
      branches:
        include:
        - main

Answer

schedules:
- cron: "0 0 * * *"
  branches:
    include:
    - main

Question 13

You have a YAML pipeline that deploys to multiple environments. The pipeline uses environment approvals. You need to ensure that the pipeline waits for manual approval before deploying to the production environment. The production environment is named 'Production'. Which configuration should you add to the deployment job?

Accepted Answer

Add 'environment: Production' to the deployment job and configure approvals on the environment in the Azure DevOps portal. Option A is correct because environment approvals in Azure DevOps are configured on the environment resource itself, not in the pipeline YAML. By adding 'environment: Production' to the deployment job, the pipeline references the environment, and the manual approval gate is enforced by the approvals configured on that environment in the Azure DevOps portal. This ensures the pipeline waits for approval before proceeding to the production deployment job.

Answer

Add 'approvals: Production' to the deployment job

Answer

Add 'checks: Production' to the deployment job

Answer

Add 'dependsOn: ProductionApproval' and use a separate stage for approval

Question 14

You are configuring a YAML pipeline that deploys to multiple environments. The pipeline should automatically trigger when changes are pushed to the main branch, but only if the build artifact changes. Which trigger configuration should you use?

Accepted Answer

trigger: paths: include: - src/*. Option B is correct because the `trigger: paths: include: - src/*` configuration specifies that the pipeline should only trigger when changes are pushed to the `main` branch AND those changes affect files under the `src/` directory. This ensures that the pipeline runs only when the build artifact (source code) changes, not for other changes like documentation or configuration files. The `paths` filter works in conjunction with the branch filter to provide fine-grained control over pipeline triggers.

Answer

trigger: branches: include: - main

Answer

pr: branches: include: - main

Answer

resources: containers: - container: myContainer

Question 15

You are designing a release pipeline that uses Azure App Service deployment slots. The pipeline must perform a swap after deployment to the staging slot. Which three tasks or actions should you include in the pipeline? (Select all that apply.)

Accepted Answer

Azure App Service deploy: Deploy to staging slot. Option A is correct because the Azure App Service deploy task with the 'Deploy to staging slot' action is the standard method to deploy an application to a staging slot before a swap. This ensures the new release is validated in an isolated environment without affecting the production slot.

Answer

Azure App Service manage: Delete staging slot

Answer

Azure CLI: Run az webapp deployment slot swap

Question 16

You have a multi-stage YAML pipeline with stages: Build, Test, and Deploy. The Deploy stage requires approval from a specific user group. You want to ensure that the approval request is sent only after the Test stage completes successfully. Which configuration should you use?

Accepted Answer

Define an environment with required approvers and reference it in the Deploy stage.. Option B is correct because Azure Pipelines environments allow you to define required approvers (user groups) that must approve a deployment before it proceeds. By referencing the environment in the Deploy stage, the approval request is automatically triggered only after the preceding Test stage completes successfully, since stages execute sequentially by default.

Answer

Add a manual validation task in the Deploy stage.

Answer

Use the 'condition' keyword: condition: eq(variables['Build.SourceBranch'], 'refs/heads/main')

Answer

Configure branch policies on the main branch.

Question 17

You are designing a pipeline that must run tasks in a container. The container needs access to Azure resources using a managed identity. Which two configurations are required? (Choose two.)

Accepted Answer

Enable a system-assigned managed identity on the agent VM.. Option A is correct because a system-assigned managed identity on the agent VM allows the container to authenticate to Azure resources without storing credentials. Option D is correct because setting the 'identity' field in the container resource definition explicitly assigns that managed identity to the container, enabling it to request tokens from Azure AD for resource access.

Answer

Use the 'docker login' command in the pipeline.

Answer

Add a service principal connection to the pipeline.

Answer

Use the Azure CLI task with '–identity' flag.

Question 18

You are creating a YAML pipeline that builds a .NET Core application. The pipeline must use a multi-stage build with separate stages for 'Build', 'Test', and 'Deploy'. The 'Deploy' stage should only run if both 'Build' and 'Test' succeed. Which two conditions can you use to achieve this? (Select all that apply.)

Accepted Answer

In the Deploy stage, set 'dependsOn: [Build, Test]'. Option A is correct because setting 'dependsOn: [Build, Test]' in the Deploy stage ensures that the Deploy stage only starts after both the Build and Test stages have completed. By default, a stage runs only if all its dependencies succeed, so this alone meets the requirement without needing an explicit condition. This is the standard way to enforce sequential execution in multi-stage YAML pipelines.

Answer

In the Deploy stage, set 'condition: and(succeeded('Build'), succeeded('Test'))'

Answer

In the Deploy stage, set 'dependsOn: [Build, Test]' and 'condition: stageDependencies.Build.result == 'Succeeded''

Question 19

Your pipeline runs on a Microsoft-hosted agent. You need to securely reference an Azure Key Vault secret in a pipeline variable without exposing the value in logs. Which variable group type should you use and how should you reference the secret?

Accepted Answer

Create a variable group linked to Key Vault, then reference as $(KeyVaultName.SecretName). Option A is correct because linking a variable group to Azure Key Vault allows you to securely reference secrets as pipeline variables without exposing their values in logs. The $(KeyVaultName.SecretName) syntax retrieves the secret value at runtime from Key Vault, and the value is automatically masked in any output.

Answer

Use the 'Azure Key Vault' task to download secrets and assign to variables

Answer

Store the secret as a plain text variable and mark it as 'secret'

Answer

Reference the secret directly as $(SecretName) from a library variable group

Question 20

A team uses a monorepo with multiple projects in one Git repository. They want to enforce that each commit message must reference a work item from Azure Boards. Which branch policy should they configure?

Accepted Answer

Require a work item linking policy in branch policies. The 'Require a work item linking policy' in Azure Repos branch policies enforces that every pull request must be associated with at least one Azure Boards work item before it can be completed. This policy directly meets the requirement to ensure each commit message references a work item, as the linking is validated at merge time.

Answer

Automatically include work items in pull request descriptions

Answer

Configure a minimum number of reviewers policy

Answer

Use a build validation policy to check commit messages