AZ-400 Practice Test 21 — 15 Questions

Question 1

Your team wants to implement automated testing in the build pipeline. You need to ensure that tests run and results are published. Which TWO tasks should you include?

Accepted Answer

Visual Studio Test task. The correct tasks are Visual Studio Test task (option C) which runs the tests, and Publish Test Results task (option D) which publishes the test results to Azure Pipelines. Option A (Publish Build Artifacts) publishes build outputs but not test results. Option B (Copy Files) copies files between locations and does not run tests. Option E (Azure PowerShell) runs PowerShell scripts and is not for testing.

Answer

Publish Build Artifacts task

Answer

Copy Files task

Answer

Azure PowerShell task

Question 2

Which two actions can you use to validate that a deployment to a staging environment is successful before promoting to production? (Choose two.)

Accepted Answer

Configure gates on the staging environment to check health metrics.. Gates with health checks can monitor metrics like error rates before allowing promotion. Manual intervention with a post-deployment approval also allows a human to validate before proceeding. Both are valid methods.

Answer

Add a manual intervention task in the pipeline.

Answer

Use a pull request to validate the deployment.

Answer

Run a load test as part of the pipeline.

Question 3

Your team uses GitHub Actions to build a multi-container application. The build must produce container images that are scanned for vulnerabilities and signed. Which THREE actions are required in the workflow?

Accepted Answer

Add a step to run a container scan tool like Trivy.. To produce container images that are scanned for vulnerabilities and signed, the workflow must include steps to scan the image (e.g., using Trivy), sign the image (e.g., using cosign), and build and push the image (e.g., using docker/build-push-action). Option A is not required because authenticating to Docker Hub specifically is not necessary if the target registry is not Docker Hub. Option D is not strictly required; checking out the code is a common first step but could be done differently or may already be available.

Answer

Use the docker/login-action to authenticate with Docker Hub.

Answer

Use the actions/checkout action to checkout the code.

Question 4

You are designing a release pipeline for a mission-critical application. The pipeline must deploy to multiple environments (dev, test, prod) in sequence, with manual approval required before production deployment. Which Azure Pipelines feature should you use?

Accepted Answer

Pre-deployment approvals. Pre-deployment approvals are the correct feature because they allow you to require manual sign-off before a release proceeds to a specific stage. In this scenario, you need a manual approval gate before production deployment, which is exactly what pre-deployment approvals enforce—the release pauses at the production stage until an authorized user approves it.

Answer

Variable groups

Answer

Pipeline triggers

Answer

Deployment gates

Question 5

Your team uses GitHub Flow and wants to enforce that all pull requests require at least one approval before merging to the main branch. Which branch protection rule should you configure?

Accepted Answer

Require a pull request before merging with at least 1 approval. It directly enforces the requirement for at least one approval before merging. 'Require a pull request before merging' must be enabled, and within that, 'Required approvals' should be set to 1. Option A (status checks) verifies CI passes, not approvals. Option B restricts who can push to branches, which is unrelated to approval requirements. Option D (linear history) enforces a linear commit history but does not mandate approvals.

Answer

Require status checks to pass before merging

Answer

Restrict who can push to matching branches

Answer

Require linear history

Question 6

Your organization uses Azure Repos for source control and Azure Pipelines for CI/CD. You need to implement a policy that ensures every commit to the main branch is built and passes all tests before it can be merged. The team uses feature branches for development. What is the most efficient way to enforce this?

Accepted Answer

Configure a branch policy on the main branch that requires a successful build from a pull request trigger.. Configuring a branch policy on the main branch that requires a successful build from a pull request trigger ensures that every commit to main must be built and pass tests before merging. This is the most efficient automated enforcement. Option A is incorrect because relying on manual builds does not enforce the policy automatically. Option B is incorrect because a pre-merge validation that does not block merging fails to prevent unvalidated commits. Option D is incorrect because a CI trigger on main runs after merge, not before, so it does not enforce pre-merge validation.

Answer

Require developers to manually run the pipeline before merging.

Answer

Use a pre-merge validation pipeline that runs on pull requests but does not block merging.

Answer

Set up a CI trigger on the main branch to run the pipeline on every commit.

Question 7

Your organization is adopting GitHub Actions for CI/CD. You need to ensure that only approved actions from your enterprise can be used in workflows. What should you configure?

Accepted Answer

Set the enterprise policy to 'Allow only specific actions' and add approved actions.. GitHub Enterprise allows administrators to restrict which actions can be used in workflows by setting the enterprise policy to 'Allow only specific actions' and then explicitly approving a curated list of actions. This ensures that only trusted, pre-approved actions (e.g., from verified publishers or your own organization) can be referenced, preventing the execution of unapproved or malicious actions. This policy is enforced at the enterprise level and applies to all repositories within the enterprise, providing centralized control over CI/CD supply chain security.

Answer

Use a third-party tool to scan workflows for disallowed actions after each commit.

Answer

Set the enterprise policy to 'Allow all actions' and rely on code review.

Answer

Configure repository permissions to restrict actions to only those created by your organization.

Question 8

Your build pipeline uses a self-hosted agent that runs on a Windows machine. The pipeline fails with the error: 'The task 'DotNetCoreCLI' is not supported on this agent.' What is the most likely cause?

Accepted Answer

The agent does not have the required capabilities (e.g., .NET Core SDK installed).. The error 'The task 'DotNetCoreCLI' is not supported on this agent' indicates that the agent lacks the required capabilities to execute the task. In Azure Pipelines, self-hosted agents must have the necessary software (e.g., .NET Core SDK) installed and declared as capabilities for the task to be considered supported. Option B correctly identifies this missing capability as the root cause.

Answer

The agent's execution policy is restricted.

Answer

The agent is not authorized to run the pipeline.

Answer

The agent cannot connect to the internet to download the task.

Question 9

You are designing a build pipeline for a Python application that uses Anaconda environments. The pipeline must create a Conda environment, install dependencies, and run tests. The pipeline should also cache the Conda environment to speed up subsequent builds. Which configuration should you use?

Accepted Answer

Use the 'CondaEnvironment' task to create the environment, and use the 'Cache' task to cache the Conda packages folder.. The 'CondaEnvironment' task is purpose-built for creating and updating Conda environments from an environment.yml file, and combining it with the 'Cache' task to cache the Conda packages folder (typically `$(Pipeline.Workspace)/conda_pkgs`) significantly reduces build time by avoiding re-downloading packages on subsequent runs. This approach aligns with Azure DevOps best practices for dependency caching and Conda environment management.

Answer

Use the 'UsePythonVersion' task with a version spec, and add a script to create the Conda environment.

Answer

Use a Docker container with Anaconda pre-installed and run the pipeline inside the container.

Answer

Use a script to run 'conda create' and 'conda install', and manually cache the environment by specifying a path.

Question 10

Which THREE elements are essential for an effective incident response process in a DevOps environment? (Choose three.)

Accepted Answer

Automated rollback or remediation capabilities.. Automated rollback or remediation capabilities are essential because they enable rapid, consistent recovery from incidents without manual intervention. In a DevOps environment, this is typically implemented through deployment pipelines (e.g., Azure Pipelines) that support automatic rollback to a previous known-good version when health checks fail, or through infrastructure-as-code tools like Terraform that can revert state. This minimizes mean time to recovery (MTTR) and reduces human error during high-pressure situations.

Answer

A blame-free culture that identifies the person at fault.

Answer

Manual approval gates for every change.

Question 11

Your team uses Azure Repos Git and wants to enforce a policy that all pushes to the main branch must pass a build validation pipeline. The pipeline runs unit tests and code analysis. You need to configure this in the branch policy. Which setting should you enable?

Accepted Answer

Build validation. The Build validation policy in Azure Repos Git enforces that a specified pipeline must succeed before a pull request can be merged into the target branch. This directly meets the requirement to run unit tests and code analysis on all pushes to the main branch, blocking merges if the build fails.

Answer

Require comment resolution

Answer

Linked work items

Answer

Limit merge types

Question 12

Which THREE practices are recommended when implementing a Git branching strategy for a team using Azure Repos?

Accepted Answer

Delete branches after they are merged.. The three recommended practices are: A) Delete branches after they are merged to keep the repository clean; C) Use short-lived feature branches that are merged within a day to reduce merge conflicts and promote continuous integration; E) Require build validation on pull requests to the main branch to ensure code quality. B is incorrect because force pushes should be avoided on shared branches as they can rewrite history and disrupt collaboration. D is incorrect because keeping feature branches alive for the entire sprint increases complexity and delays integration.

Answer

Allow force pushes to shared branches to clean up history.

Answer

Keep feature branches alive for the entire sprint.

Question 13

You are designing a release pipeline for a microservices application deployed to Azure Kubernetes Service (AKS). Each microservice has its own build pipeline that produces a container image. You need a single release pipeline that can deploy multiple microservices in a coordinated manner, but you want to avoid rebuilding the deployment pipeline for each microservice. The deployment should use Helm charts. What should you do?

Accepted Answer

Create a single release pipeline that consumes multiple build artifacts (one per microservice) and uses a Helm chart per microservice, deploying them in stages.. A single release pipeline can consume multiple build artifacts (one per microservice) and use Helm charts to deploy each microservice in stages. This allows coordinated deployment without duplicating the pipeline logic. Option A is incorrect because creating separate release pipelines for each microservice and triggering them sequentially lacks a single orchestration point and can lead to coordination failures. Option B is incorrect because creating a single build pipeline that produces all container images couples the builds and prevents independent microservice development. Option D is incorrect because a single multi-stage YAML pipeline that builds and deploys all microservices together also couples the build and deploy stages, and does not allow each microservice to have its own independent build pipeline.

Answer

Create a separate release pipeline for each microservice and trigger them in sequence using pipeline completion triggers.

Answer

Create a single build pipeline that produces all container images, then a release pipeline that deploys the single artifact.

Answer

Create a single multi-stage YAML pipeline that builds and deploys all microservices together.

Question 14

Your team uses Azure DevOps and wants to enforce that all changes to the main branch go through a pull request process with at least two approvals. They also want to prevent contributors from approving their own pull requests. Which branch policy settings should they use?

Accepted Answer

Enable 'Require a minimum number of reviewers' set to 2, and enable 'Allow users to approve their own changes' unchecked (or set to false).. It directly addresses both requirements: setting 'Require a minimum number of reviewers' to 2 enforces at least two approvals, and unchecking 'Allow users to approve their own changes' prevents contributors from approving their own pull requests. These are branch policy settings within Azure Repos that control the pull request workflow on the main branch.

Answer

Enable 'Check for linked work items' and 'Require a minimum number of reviewers' set to 2, and enable 'Reset code reviewer votes when new changes are pushed'.

Answer

Add the 'main' branch to the 'Required reviewers' list and add all developers as required reviewers.

Answer

Enable 'Require a minimum number of reviewers' set to 2, and enable 'Build validation' with a required build.

Question 15

Your release pipeline uses a 'Run Azure CLI' task to execute a script. The script authenticates using a service principal. However, the deployment fails with 'insufficient privileges to complete the operation'. What is the most likely cause?

Accepted Answer

The service principal lacks the necessary RBAC role on the target resource.. The error 'insufficient privileges to complete the operation' indicates that the service principal successfully authenticated but lacks the required Azure RBAC role on the target resource. Even with a valid secret and a logged-in Azure CLI session, the service principal must have an assigned role (e.g., Contributor, Owner, or a custom role) that grants the specific permissions needed for the deployment operation.

Answer

The Azure CLI task is not logged in.

Answer

The service principal secret has expired.

Answer

The service principal does not have a secret.