AZ-400 Practice Test 21 — 15 Questions

Question 1

Refer to the exhibit. The YAML pipeline triggers on commits to main and develop branches, and pull requests targeting develop. A developer pushes a commit directly to main. What will happen?

Accepted Answer

The pipeline runs once for the CI trigger.. The trigger includes main, so a push to main triggers a build. The PR trigger includes develop, but since it's a push to main, not a PR, only the CI trigger applies. Option A is wrong because PR trigger only applies to PRs. Option C is wrong because the pipeline will run once for the CI trigger. Option D is wrong because the PR trigger does not cover pushes to main.

Answer

The pipeline does not run because the PR trigger requires a pull request.

Answer

The pipeline runs twice: once for the CI trigger and once for the PR trigger.

Answer

The pipeline runs once for the PR trigger only.

Question 2

Your organization uses GitHub Actions for CI/CD. You need to ensure that secrets stored in GitHub are not exposed in build logs. A developer accidentally printed a secret to the console in a workflow step. How can you prevent this from happening in the future?

Accepted Answer

Enable 'Secret scanning' and 'Push protection' for the repository.. Option D is correct because enabling 'Secret scanning' and 'Push protection' in the repository automatically blocks secrets from being committed or printed in logs. Option A would mask the secret but only after it's already been printed. Option B is impractical and error-prone. Option C is not a built-in feature.

Answer

Add the secret to the 'Secret scanning' exclusion list.

Answer

Instruct developers to avoid using 'echo' and use '::set-output' instead.

Answer

Use the 'actions/secrets' action to mask secrets automatically.

Question 3

Your release pipeline deploys to multiple environments sequentially: Dev, QA, Staging, Production. You need to implement manual approval gates before Staging and Production deployments. Which TWO configurations should you use? (Choose two.)

Accepted Answer

Use the 'Approvals and gates' settings in the release pipeline stage.. Option A is correct because pre-deployment approvals can be set on each stage. Option D is correct because approval gates are configured in the release pipeline editor. Option B is wrong because post-deployment approvals are after deployment. Option C is wrong because branch policies are for PRs, not releases. Option E is wrong because YAML pipelines use 'approvals' keyword, not a separate task.

Answer

Add a post-deployment approval gate to the Dev and QA stages.

Answer

Configure branch policy on the release branch to require approvals.

Answer

Add a 'Manual Validation' task in the YAML pipeline.

Question 4

Your organization uses Azure Pipelines to build a large monolithic application. The build takes over 60 minutes. Management wants to reduce the build time to under 30 minutes. The application has multiple independent modules that could be built in parallel. What is the most effective strategy to reduce build time?

Accepted Answer

Refactor the build pipeline to use multiple parallel jobs, each building a separate module.. Option C is correct because parallel jobs and multi-agent builds can significantly reduce build time by running independent modules concurrently. Option A is incorrect because larger VMs may have limited impact. Option B is incorrect because reducing code coverage is counterproductive. Option D is incorrect because using a self-hosted agent does not inherently reduce build time.

Answer

Reduce the number of unit tests run during the build.

Answer

Upgrade the build agent to a larger VM size with more CPU and memory.

Answer

Move the build to a self-hosted agent in the same network as the source code repository.

Question 5

You are designing a release pipeline in Azure Pipelines that deploys a web app to multiple environments (dev, test, prod). You want to ensure that the same build artifact is deployed to each environment without rebuilding. Which trigger type should you use?

Accepted Answer

Continuous deployment trigger on the release pipeline. Option A is correct because a release pipeline uses a build artifact trigger to start deployment after a build completes. Option B is wrong because continuous deployment trigger happens after a build artifact is available. Option C is wrong because schedule triggers are time-based. Option D is wrong because pull request triggers are for builds, not releases.

Answer

Pull request trigger

Answer

Schedule trigger

Answer

Build completion trigger

Question 6

Your team uses Azure Pipelines for CI/CD. You need to ensure that a secret variable stored in Azure Key Vault is available to a build pipeline without exposing it in logs. What should you do?

Accepted Answer

Use a Key Vault task to fetch the secret and map it to a pipeline variable marked 'secret'.. Option C is correct because mapping a Key Vault secret to a pipeline variable and marking it as 'secret' ensures it is not logged. Option A is wrong because inline secrets are logged. Option B is wrong because variable groups don't automatically mask secrets. Option D is wrong because secret variables are not available in checkout tasks.

Answer

Store the secret in a variable group linked to Key Vault and reference it without marking it secret.

Answer

Add the secret as a plain text variable in the pipeline YAML.

Answer

Add the secret to the repository's .env file and use a script to read it.

Question 7

Which THREE are required to set up a self-hosted agent for Azure Pipelines?

Accepted Answer

Network connectivity to Azure DevOps services.. Correct answers: A, C, D. A: agent must be registered with a PAT. C: agent machine needs network access to Azure DevOps. D: agent must be configured with the account. B is wrong because you don't need a VM in Azure; self-hosted can be on-premises. E is wrong because Docker is optional.

Answer

A virtual machine running in Azure.

Answer

Docker installed on the agent machine.

Question 8

You run the above Azure CLI command to deploy a Bicep template. The deployment fails with 'The resource 'Microsoft.Storage/storageAccounts/mystgaccount' already exists'. What is the most likely cause?

Accepted Answer

The storage account 'mystgaccount' already exists in the resource group.. Option D is correct because the storage account already exists. Option A is wrong because the command uses 'create' which is correct. Option B is wrong because the error mentions 'already exists', not resource group. Option C is wrong because 'create' mode fails if resource exists; 'incremental' would update.

Answer

The command should use 'az deployment group validate' instead.

Answer

The Bicep file uses 'complete' mode.

Answer

The resource group 'MyRG' does not exist.

Question 9

Your team uses Azure Pipelines with a YAML-based build pipeline. The pipeline builds a .NET application and runs unit tests. Recently, the unit tests are failing intermittently due to flaky tests. You need to ensure that the pipeline fails only if the same test fails in two consecutive runs. Which feature should you configure?

Accepted Answer

Configure the 'retry failed tests' setting in the pipeline's test tab.. The Test Retry feature in Azure Pipelines automatically retries a failed test a specified number of times. If the test passes on retry, the pipeline is marked as succeeded with warnings. Option A is correct because it allows retrying flaky tests. Option B is a preview feature for rerunning failed stages, not tests. Option C is for rerunning failed jobs, not individual tests. Option D is a GitHub feature, not Azure Pipelines.

Answer

Implement a GitHub Actions workflow with 're-run' trigger.

Answer

Use the 'Re-run failed stages' option in the pipeline run.

Answer

Enable 'Automatically rerun failed jobs' in the pipeline settings.

Question 10

Which THREE of the following are valid considerations when designing a release pipeline to deploy to multiple environments (dev, test, prod) using Azure Pipelines YAML?

Accepted Answer

Use variable groups scoped to environments to override variables per stage.. Approval gates are configured on environments, not stages. Stage filters with conditions can control deployment to specific branches. Variables can be overridden per stage using variable groups scoped to environments. Option A is correct because approvals are set on environments. Option C is correct because stage filters can restrict branches. Option D is correct because variable groups can be scoped to environments. Option B is incorrect because stages don't have approvals. Option E is incorrect because YAML templates are not required.

Answer

Use stage-level approvals to gate each stage.

Answer

Use YAML templates to define each environment's deployment steps.

Question 11

Which THREE are valid approaches to securely store secrets used in Azure Pipelines? (Choose three.)

Accepted Answer

Secret variables defined in the pipeline UI. Variable groups with Azure Key Vault integration, Azure Key Vault tasks, and Azure Pipelines secret variables are all secure ways to store secrets. Option B is wrong because storing secrets in YAML files is insecure. Option D is wrong because environment variables in build agents are not encrypted.

Answer

Inline secret variables defined in the YAML file

Answer

Environment variables set on the build agent

Question 12

Refer to the exhibit. You are deploying this Bicep file using Azure Pipelines. The 'environment' parameter should be set to 'dev', 'qa', or 'prod' based on the release stage. How should you pass the parameter value?

Accepted Answer

Set a pipeline variable named 'environment' and reference it in the AzureResourceManagerTemplateDeployment task's overrideParameters.. Option B is correct because you can set the 'environment' parameter as a pipeline variable and pass it to the Bicep deployment task. Option A is wrong because ARM template parameters are not set in the YAML file directly. Option C is wrong because the Bicep file does not have a default value. Option D is wrong because you cannot modify the Bicep file dynamically.

Answer

Define the parameter in the 'parameters:' section of the YAML pipeline.

Answer

Use a task to replace the string '${environment}' in the Bicep file before deployment.

Answer

Modify the Bicep file to include a default value for environment.

Question 13

Your Azure DevOps pipeline deploys a microservice to a Kubernetes cluster using Helm. The Helm chart requires a values file that contains environment-specific configurations. You want to store the values file securely and use it during deployment. What is the recommended approach?

Accepted Answer

Store the values file as a secure file in Azure Pipelines library.. Option C is correct because Azure Key Vault can securely store secrets and configuration files, and the HelmDeploy task can reference them. Option A is incorrect because storing values files in a separate branch is not secure. Option B is incorrect because checking secrets into the repo is a security risk. Option D is incorrect because variable groups are for simple key-value pairs, not files.

Answer

Store the values in a variable group and map them to Helm values.

Answer

Store the values file in Azure Key Vault and use the HelmDeploy task's 'overrideValues' parameter to set values.

Answer

Store the values file in a separate Git repository and clone it during the pipeline.

Question 14

You need to ensure that a release pipeline in Azure Pipelines automatically deploys to production only if the deployment to staging succeeds and all manual intervention checks pass. What is the best way to configure this?

Accepted Answer

Add a post-deployment approval gate on the staging stage. Option A is correct because a post-deployment approval gate can require manual sign-off after staging deployment. Option B is wrong because a pre-deployment approval is before staging. Option C is wrong because a branch policy is for repositories. Option D is wrong because a deployment group is for targets.

Answer

Add a pre-deployment approval gate on the production stage

Answer

Configure a branch policy on the main branch

Answer

Assign a deployment group to the production stage

Question 15

You are designing a release pipeline for a critical application. The pipeline must automatically roll back to the previous version if the deployment to staging fails health checks. Which deployment strategy should you implement?

Accepted Answer

Rolling update with health checks and automatic rollback.. Option C is correct because rolling updates can be configured with health probes and automatic rollback on failure. Option A is wrong because blue-green requires manual switch. Option B is wrong because canary routes traffic gradually but does not auto-rollback. Option D is wrong because redeploying the same version doesn't fix the issue.

Answer

Canary deployment with manual promotion.

Answer

Blue-green deployment with manual swap.

Answer

Recreate deployment by redeploying the same version.

AZ-400 Practice Test 21 — 15 Questions

Exhibit

AZ-400 Practice Test 21 — 15 Questions

Exhibit