AZ-400 Practice Exam 4 — 20 Questions

Question 1

You are implementing a CI pipeline for a Node.js application. The pipeline must run unit tests and generate code coverage reports. You want to publish the coverage results to Azure DevOps and enforce a minimum coverage threshold of 80%. Which tasks should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the Publish Code Coverage Results task and configure the threshold in the task settings.. The Publish Code Coverage Results task is specifically designed to publish code coverage data (e.g., Cobertura or JaCoCo XML reports) to Azure DevOps and supports configuring a minimum coverage threshold directly in its settings. This meets both requirements: publishing results and enforcing the 80% threshold. Other tasks like Publish Test Results or Publish Build Artifacts do not natively handle coverage threshold enforcement.

Answer

Use the Publish Test Results task to publish coverage data.

Answer

Use the Publish Build Artifacts task with coverage files.

Answer

Use the Copy Files task to copy coverage files and then the Publish Build Artifacts task.

Question 2

Which TWO features in Azure Pipelines allow you to enforce separation of duties between development and operations teams? (Choose two.)

Accepted Answer

Approvals and checks on environments. Approvals and checks on environments (B) enforce separation of duties by requiring designated approvers (e.g., operations team members) to approve a deployment before it proceeds, ensuring that development cannot directly push to production. Environment security roles (D) allow you to define who can create, view, or manage environments, restricting developers from modifying production environments without operations oversight.

Answer

Pipeline decorators

Answer

Service connections with different scopes

Answer

Branch policies on the main branch

Question 3

Your team uses GitHub repositories and wants to ensure that all code changes are signed by a verified contributor before merging. Which branch protection rule should you enable?

Accepted Answer

Require signed commits. Requiring signed commits ensures that each commit is cryptographically verified using a GPG or S/MIME key linked to the contributor's GitHub account. This enforces non-repudiation and confirms the identity of the author, directly addressing the requirement that all code changes be signed by a verified contributor before merging.

Answer

Require pull request reviews before merging

Answer

Require linear history

Answer

Restrict who can push to matching branches

Question 4

Refer to the exhibit. A developer pushes a commit to the main branch. Which stages will run?

Accepted Answer

Only the Build stage.. The exhibit shows that the Build stage has a trigger condition that matches the 'main' branch, and the Test stage does not have a trigger condition that is satisfied by the push (e.g., it is set to a different branch condition or to manual). Therefore, when a commit is pushed to main, only the Build stage is triggered automatically; the Test stage does not run.

Answer

Only the Test stage.

Answer

Neither stage.

Answer

Both Build and Test stages.

Question 5

You need to ensure that only specific branches can trigger a release to production in Azure Pipelines. What should you configure?

Accepted Answer

Add a branch filter to the release pipeline's artifact trigger.. A branch filter on the release pipeline's artifact trigger allows you to specify which branches of the source artifact (e.g., a build pipeline) should automatically trigger a release. By configuring this filter to only include branches like 'main' or 'release/*', you ensure that only builds from those specific branches can initiate a release to production, providing precise control over deployment triggers.

Answer

Add an approval gate that requires a manager to approve the release.

Answer

Add a deployment gate that checks the source branch.

Answer

Add a branch filter to the build pipeline trigger.

Question 6

You are creating a release pipeline that uses Azure Pipelines to deploy to multiple virtual machines. You need to ensure that the deployment runs on each machine in parallel. Which deployment strategy should you use?

Accepted Answer

Run once deployment with parallel execution. The requirement is to deploy to multiple virtual machines in parallel, which is achieved by configuring a 'run once' deployment strategy with parallel execution in Azure Pipelines. This strategy uses the deployment group's parallel execution settings to run the deployment job simultaneously on all target machines, ensuring each machine receives the deployment at the same time.

Answer

Blue-green deployment

Answer

Canary deployment

Answer

Rolling deployment

Question 7

You are the Azure DevOps administrator for a large enterprise with multiple projects using the Scrum process. The organization has recently adopted a new compliance policy requiring that all work items of type 'Epic' must be approved by a compliance officer before they can be moved to the 'Committed' state. The compliance officers are external to the development teams and should not have direct access to modify work items. You need to implement this requirement with minimal administrative overhead. The current process has the following states for Epics: New, Proposed, Committed, In Progress, Done. The desired flow is: from 'Proposed' to 'Committed', a compliance officer must approve the transition. Compliance officers are part of a security group named 'Compliance Officers'. They should be able to approve the transition without having to edit the work item directly. What should you do?

Accepted Answer

In the process template for Epic, add a work item rule on the transition from 'Proposed' to 'Committed' that requires approval from a member of the 'Compliance Officers' group.. Azure DevOps process templates allow you to add work item rules on state transitions. By adding a rule on the 'Proposed' to 'Committed' transition for the Epic work item type that requires approval from a member of the 'Compliance Officers' group, you enforce the compliance policy without granting those officers direct edit permissions. This leverages built-in approval gates within the work item tracking system, minimizing administrative overhead.

Answer

Use a service hook to send an email to the compliance officers when an Epic is moved to 'Proposed', and rely on them to manually approve the transition.

Answer

Modify the Epic work item type to add a field 'Compliance Approval' and set the compliance officer as a required reviewer in the field settings.

Answer

Configure a branch policy on the main branch that requires approval from the 'Compliance Officers' group for pull requests.

Question 8

During a sprint review, stakeholders complain that they don't receive notifications about completed work items. The team uses Azure Boards with a custom notification subscription. What is the most likely cause?

Accepted Answer

The subscription's 'Deliver to' filter excludes stakeholders.. The most likely cause is that the custom notification subscription's 'Deliver to' filter is configured to exclude stakeholders. In Azure Boards, notification subscriptions can have filters that restrict delivery to specific groups or roles, and if stakeholders are not included in the filter, they will not receive notifications even if the subscription is active. This directly addresses the complaint that stakeholders are not getting notified about completed work items.

Answer

Email notifications are disabled at the organization level.

Answer

The subscription is set to deliver only to the team members.

Answer

The subscription was automatically disabled after the first notification.

Question 9

Your team uses Git and wants to ensure that all commits follow a consistent message format. Which approach should you use?

Accepted Answer

Use a client-side Git hook (commit-msg) to validate the message. A client-side Git hook, specifically the commit-msg hook, runs locally on the developer's machine before the commit is finalized, allowing immediate validation of the commit message format. This ensures that every commit adheres to the team's convention at the point of creation, without relying on server-side enforcement or pipeline execution.

Answer

Add a step in Azure Pipelines to validate commit messages

Answer

Create a GitHub Actions workflow that checks commit messages on push

Answer

Configure a branch policy in Azure Repos to enforce commit message format

Question 10

Which TWO benefits does using Git LFS (Large File Storage) provide? (Select TWO.)

Accepted Answer

Prevents large files from being stored in the Git history. Git LFS (Large File Storage) prevents large files from being stored directly in the Git repository history (option B). Instead, it stores a small pointer file in the repo while the actual large file content is stored externally, which reduces the size of the Git repository (option E). Options A, C, and D are incorrect because LFS does not automatically compress all files, replace .gitignore, or speed up diff operations for binary files.

Answer

Automatically compresses all files in the repository

Answer

Replaces .gitignore for excluding large files

Answer

Speeds up diff operations for binary files

Question 11

Which TWO tasks can be used to deploy an Azure Web App using YAML pipelines in Azure DevOps?

Accepted Answer

AzureWebApp. The AzureWebApp task is correct because it is the dedicated Azure DevOps YAML pipeline task for deploying code to an Azure Web App (App Service). It supports deployment methods like Web Deploy (msdeploy), Kudu REST API, and ZIP deploy, making it the standard choice for web app deployments.

Answer

CopyFilesOverSSH

Answer

AzureFunctionApp

Answer

AzureVMAppDeployment

Question 12

Your team uses GitHub for source control and Azure Pipelines for CI/CD. You need to ensure that only pull requests from specific branches trigger a build pipeline. Which trigger configuration should you use?

Accepted Answer

pr:
  branches:
    include:
      - main
      - develop. The `pr` trigger in Azure Pipelines controls which pull requests trigger a pipeline. By using `branches` with `include`, you specify that only PRs targeting the `main` and `develop` branches should trigger the build. This directly meets the requirement to restrict PR triggers to specific branches.

Answer

pr:
  paths:
    include:
      - main
      - develop

Answer

pr:
  branches:
    only:
      - main

Answer

trigger:
  branches:
    include:
      - main
      - develop

Question 13

Your company uses Azure Key Vault to store secrets. Which TWO actions should you take to ensure secure access? (Select TWO.)

Accepted Answer

Restrict access using Key Vault access policies. Restricting access using Key Vault access policies (Option A) is correct because Azure Key Vault uses a granular permission model where you assign specific permissions (e.g., GET, LIST, SET) to individual security principals (users, groups, or service principals) at the vault level. This ensures that only authorized identities can read or manage secrets, keys, and certificates, following the principle of least privilege. Using managed identities (Option B) is correct because they provide an automatically managed identity in Azure AD for applications to authenticate to Key Vault without storing credentials in code or configuration, eliminating the risk of secret leakage.

Answer

Enable HTTP access for performance

Answer

Disable audit logging to reduce exposure

Answer

Enable soft-delete to recover deleted secrets

Question 14

Your team uses Azure Pipelines to build a React application. The build process runs npm install, npm test, and npm run build. The build succeeds, but the application loads slowly in the browser due to large bundle sizes. What should you add to the pipeline to optimize the build?

Accepted Answer

Add a step to run Webpack bundle analyzer and implement code splitting.. The issue is large bundle sizes causing slow load times. Running Webpack bundle analyzer identifies which modules contribute most to the bundle, and implementing code splitting (e.g., dynamic imports or React.lazy) allows splitting the bundle into smaller chunks loaded on demand, reducing initial payload size.

Answer

Add a step to cache the node_modules folder.

Answer

Add a step to minify JavaScript using Terser.

Answer

Add a step to run additional unit tests to catch performance issues.

Question 15

Your release pipeline uses Azure Kubernetes Service (AKS) and Helm charts. You need to roll back to a previous release quickly if the new release fails health checks. What is the BEST approach?

Accepted Answer

Use Helm rollback command.. Helm provides a built-in `helm rollback ` command that reverts a release to a previous revision in a single, atomic operation. This is the fastest and most reliable method for rolling back a failed Helm-based deployment on AKS, as it directly restores the exact Kubernetes manifests and configuration from the specified revision without manual intervention.

Answer

Manually redeploy the previous Helm chart version.

Answer

Use a canary deployment strategy.

Answer

Use a Kubernetes Deployment rollout undo.

Question 16

Your team uses GitHub and wants to automatically detect exposed credentials in code. Which GitHub feature should you enable?

Accepted Answer

Secret scanning.. Secret scanning is the correct GitHub feature because it is specifically designed to automatically detect exposed credentials, tokens, and other secrets in code repositories. It scans for known patterns of sensitive data, such as AWS keys, GitHub tokens, and private keys, and alerts repository administrators when a match is found. This directly addresses the requirement to detect exposed credentials without needing custom workflows or additional configuration.

Answer

Code scanning.

Answer

Dependabot.

Answer

GitHub Actions.

Question 17

Refer to the exhibit. An Azure DevOps pipeline has the YAML configuration shown. A developer creates a pull request from a feature branch to the develop branch. What will happen?

Accepted Answer

The pipeline does not run automatically. The YAML configuration does not include a `trigger` or `pr` trigger, so by default the pipeline only runs on pushes to branches that have a pipeline configured, not on pull requests. Since the developer creates a PR from a feature branch to develop, and no trigger is defined for the feature branch or PR validation, the pipeline does not run automatically.

Answer

The pipeline runs only if the PR is merged

Answer

The pipeline runs as a CI build on the feature branch

Answer

The pipeline runs as a PR validation build

Question 18

You need to create a pipeline that triggers only when changes are made to files in the 'src/api' folder. Which trigger configuration should you use?

Accepted Answer

trigger: paths: include: - 'src/api/*'. The `trigger: paths: include: - 'src/api/*'` configuration tells Azure Pipelines to only trigger the pipeline when changes are detected in files matching that path pattern. This is the standard way to scope pipeline triggers to specific folders or file patterns in YAML pipelines, ensuring that unrelated changes elsewhere in the repository do not start the pipeline.

Answer

trigger: branches: include: - 'main'

Answer

trigger: paths: exclude: - 'src/api/*'

Answer

trigger: tags: include: - 'v*'

Question 19

Your organization uses GitHub Advanced Security. You need to ensure that secrets detected in pull requests automatically block the PR from merging. What should you configure?

Accepted Answer

Configure a custom secret scanning pattern and set the 'Block pull requests' property.. GitHub Advanced Security allows you to create custom secret scanning patterns with a 'Block pull requests' property. When enabled, this property prevents a pull request from being merged if the custom pattern detects a secret in the PR's changes, directly meeting the requirement to automatically block merging on secret detection.

Answer

Configure a code scanning query to detect secrets.

Answer

Enable secret scanning and set the severity to critical.

Answer

Enable push protection for secret scanning.

Question 20

You are deploying an ARM template using the parameters file shown. The deployment fails with an error that the referenced secret cannot be found. What is the most likely cause?

Accepted Answer

The secret name in the parameters file does not match the actual secret name in Key Vault.. The error 'referenced secret cannot be found' directly indicates that the secret name specified in the parameters file does not match the actual secret name stored in Azure Key Vault. ARM template deployment uses the `reference()` function to retrieve the secret value at deployment time, and if the secret name is misspelled or incorrect, the deployment fails with this specific error.

Answer

The Key Vault does not have an access policy granting the deployment user 'Get' secret permission.

Answer

The resource group 'rg-kv' does not exist.

Answer

The Key Vault is in a different region than the deployment.