AZ-400 Practice Test 22 — 15 Questions

Question 1

Your team uses GitHub Issues to track work. You want to enforce that all new issues include a specific set of labels based on the issue type (bug, feature, task). What is the most efficient way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create YAML-based issue forms in the .github/ISSUE_TEMPLATE folder.. GitHub issue forms, defined as YAML files in the .github/ISSUE_TEMPLATE folder, allow you to create structured templates that can enforce required fields, including mandatory label assignments. When a user submits an issue via a form, the labels specified in the template are automatically applied, ensuring consistency without manual intervention or additional automation.

Answer

Configure branch protection rules to require label assignments.

Answer

Use a CODEOWNERS file to auto-assign labels.

Answer

Set up a repository ruleset to restrict label modifications.

Question 2

You are setting up a new GitHub repository for a project that requires strict access control. Only specific team members should be able to push to the main branch, but all team members should be able to create branches and open pull requests. What is the best way to achieve this?

Accepted Answer

Use a branch protection rule to restrict pushes to the main branch to specific users or teams.. Branch protection rules in GitHub allow you to enforce restrictions on specific branches, such as requiring pull request reviews or restricting who can push directly. By configuring a rule for the main branch that limits push access to only designated users or teams, you ensure that all team members can create branches and open PRs, but only authorized members can merge into main. This directly meets the requirement without over-provisioning permissions or blocking collaboration.

Answer

Add all team members as administrators of the repository.

Answer

Remove write permissions for non-core team members and give them read-only access.

Answer

Set the repository to private and invite only core team members.

Question 3

You are analyzing Azure DevOps audit logs with the KQL query above. Your security team wants to ensure that only approved service connections are used. After running the query, you find multiple service connections created by a user who is not on the approved list. What should you do next?

Accepted Answer

Review each unapproved service connection's permissions and usage.. The immediate priority is to assess the risk of each unapproved service connection before taking action. Service connections in Azure DevOps can have varying permissions and may be used by pipelines, so blindly deleting them could break critical deployments. The correct next step is to review each connection's permissions (e.g., who can use it, which service principals are linked) and its usage history (e.g., which pipelines reference it) to determine whether it is malicious or simply an oversight.

Answer

Immediately delete all service connections created by that user.

Answer

Disable the user's account in Microsoft Entra ID.

Answer

Modify the query to also include the user's email address.

Question 4

Refer to the exhibit. A build pipeline fails with this error. What is the most likely cause?

Accepted Answer

The build agent does not have the 'ASP.NET and web development' workload installed.. The error indicates that the MSBuild targets file for Web Applications is missing. This typically occurs when the build agent does not have the required Visual Studio workload installed, specifically the Web development build tools.

Answer

The build agent is out of disk space.

Answer

The pipeline is using the wrong version of MSBuild.

Answer

The solution file is corrupted.

Question 5

Your organization uses Microsoft Entra ID (formerly Azure AD) for identity management. You need to ensure that only authorized users can access the Azure DevOps organization. What is the most secure way to manage access?

Accepted Answer

Require all users to use multi-factor authentication (MFA) and enable Conditional Access policies.. Requiring multi-factor authentication (MFA) and enabling Conditional Access policies provides the most secure access control. MFA adds an extra layer of security beyond passwords, and Conditional Access allows granular policy enforcement based on user, device, location, and risk, ensuring only authorized users under secure conditions can access Azure DevOps. Option B is less secure as it does not enforce additional authentication. Option C only restricts access by network location but does not prevent unauthorized access if an attacker is on the corporate network. Option D only grants basic access without security controls.

Answer

Disable external user access and only allow internal users.

Answer

Use IP address restrictions to limit access to the corporate network.

Answer

Add users to the Azure DevOps organization and assign them to the 'Basic' access level.

Question 6

You are designing a release pipeline for a microservices application. Which two strategies can you use to manage configuration across different environments? (Choose two.)

Accepted Answer

Use variable groups linked to Azure Key Vault.. Options A and B are correct because variable groups provide a centralized and secure way to manage configuration across multiple environments and pipelines. Option A uses Azure Key Vault for secrets, integrating with access policies and rotation, while option B stores non-sensitive environment-specific settings. Option C is incorrect because XML transformation targets web.config files, which are legacy .NET artifacts and not typical for modern microservices that use JSON, YAML, or environment variables. Option D is incorrect because stage-level variables are scoped to a single pipeline definition and do not offer a reusable, centralized configuration mechanism across different environments or pipelines; variable groups are designed for that purpose.

Answer

Use XML transformation tasks for web.config.

Answer

Use multi-stage YAML pipelines with stage-level variables.

Question 7

Your company uses Microsoft Teams for collaboration. You want to send notifications to a Teams channel whenever a build pipeline in Azure Pipelines fails. Which approach should you use?

Accepted Answer

Install the Azure Pipelines app for Microsoft Teams and subscribe the channel to pipeline notifications.. The Azure Pipelines app for Microsoft Teams provides built-in integration to subscribe to pipeline events and send notifications to channels. Option A is incorrect because email subscriptions are separate. Option B is incorrect because webhooks require custom configuration. Option D is incorrect because the Teams connector is deprecated in favor of the app.

Answer

Configure an email subscription in Azure DevOps to send alerts to the Teams channel email address.

Answer

Set up a webhook in Azure DevOps to post to the Teams channel's incoming webhook URL.

Answer

Use the 'Post to a Microsoft Teams channel' task in the pipeline.

Question 8

Your organization is adopting a trunk-based development strategy with short-lived feature branches. Which branch policy should you enforce to ensure that code is integrated frequently and conflicts are minimized?

Accepted Answer

Require a minimum number of reviewers and enforce a squash merge strategy. In a trunk-based development strategy with short-lived feature branches, the goal is to integrate code frequently and minimize merge conflicts. Requiring a minimum number of reviewers ensures code quality and team awareness, while enforcing a squash merge strategy collapses all feature branch commits into a single commit on the main branch, keeping the history linear and clean. This approach reduces the risk of complex merge conflicts and supports continuous integration by encouraging small, frequent merges.

Answer

Allow direct pushes to main branch for senior developers

Answer

Create release branches for each production deployment

Answer

Require all merges to be fast-forward only

Question 9

You are designing a build pipeline that must be triggered only when changes are made to specific folders in the repository. The pipeline should ignore documentation changes. Which trigger configuration should you use?

Accepted Answer

Configure a path trigger with include paths for source code and exclude paths for docs.. Azure Pipelines path triggers allow you to specify include and exclude filters on file paths. By including only source code folders and excluding the docs folder, the pipeline will only run when relevant code changes are made, ignoring documentation updates.

Answer

Configure a scheduled trigger to run the pipeline daily.

Answer

Configure a branch trigger with an include filter for the main branch.

Answer

Configure a tag trigger with a pattern that matches release tags.

Question 10

You are evaluating an Azure Policy assignment for Azure Pipelines. What does this policy audit?

Accepted Answer

Whether pipelines use secure files with extensions other than .pfx, .p12, or .cer. The Azure Policy for Azure Pipelines audits whether secure files have file extensions other than .pfx, .p12, or .cer. This policy is designed to enforce that only certificate-related secure files (which are typically used for code signing or TLS) are allowed, preventing the upload of arbitrary file types that could introduce security risks or misconfiguration.

Answer

Whether secure files are rotated within 90 days

Answer

Whether secure files are encrypted at rest

Answer

Whether secure files are used in production pipelines

Question 11

You are troubleshooting an intermittent performance issue in a web application. Application Insights shows a high number of failed dependency calls to Azure SQL Database. The errors are SqlException with error code -2 (timeout). What is the most likely cause and recommended fix?

Accepted Answer

The application is exhausting the connection pool; increase Max Pool Size in the connection string.. A is correct because SqlException with error code -2 indicates a connection timeout, which in a high-traffic scenario is most commonly caused by the application exhausting the connection pool. When all connections in the pool are in use and the wait time for a free connection exceeds the Connect Timeout (default 15 seconds), new requests fail with this error. Increasing Max Pool Size in the connection string (e.g., Max Pool Size=200) allows more concurrent connections, reducing contention.

Answer

The SQL Server firewall is blocking the application IP; add a firewall rule.

Answer

The database is experiencing deadlocks; enable read committed snapshot isolation.

Answer

The database DTU limit is being exceeded; scale up the service tier.

Question 12

Which TWO actions should you take to implement Git-based source control for a large enterprise with multiple teams and a single repository (monorepo)? (Select TWO.)

Accepted Answer

Configure path-based branch policies. Using sparse checkout reduces clone size. Path-based branch policies enforce team-specific reviews. Forking is not typical for monorepos. Submodules introduce complexity. Single branch for all teams causes conflicts.

Answer

Require all teams to work on a single branch

Answer

Use Git submodules to separate team code

Answer

Use forking workflow for each team

Question 13

Your team uses Azure Pipelines for CI/CD. The pipeline builds a Docker image and pushes it to Azure Container Registry (ACR). You need to ensure that only the main branch triggers a build of the Docker image. What should you configure in the pipeline YAML?

Accepted Answer

Set 'trigger: branches: include: - main'. Setting `trigger: branches: include: - main` in the pipeline YAML configures a CI trigger that only starts a new pipeline run when changes are pushed to the `main` branch. This ensures that the Docker image build and push to ACR occurs exclusively for the main branch, meeting the requirement.

Answer

Set 'pr: branches: include: - main'

Answer

Add a condition: 'eq(variables['Build.SourceBranch'], 'refs/heads/main')' to the job.

Answer

Set 'trigger: branches: include: - *'

Question 14

Your organization requires that all code changes must be built and tested before merging to the main branch. You plan to use branch policies in Azure Repos. Which policy enforcement will ensure that a pull request cannot be completed unless the build succeeds?

Accepted Answer

Add a build validation policy that triggers a build on each PR update.. Azure Repos branch policies include a 'Build validation' policy that triggers a specified build pipeline on each pull request (PR) update. The policy enforces that the PR cannot be completed unless the build succeeds, directly meeting the requirement that all code changes must be built and tested before merging to the main branch.

Answer

Require a linked work item in the pull request.

Answer

Require a minimum number of reviewers.

Answer

Reset code reviewer votes when new changes are pushed.

Question 15

Your company is migrating from on-premises Jenkins to Azure Pipelines. You have a Jenkins pipeline that builds a C++ application using MSBuild. The build environment requires specific Visual Studio components and SDKs. You need to set up a build agent in Azure Pipelines that matches the Jenkins environment. You want to minimize administrative overhead and ensure the agent is always up to date with the latest patches. What should you do?

Accepted Answer

Use a Microsoft-hosted agent with the 'windows-2022' image that includes Visual Studio Build Tools.. Microsoft-hosted agents include Visual Studio Build Tools and are automatically updated, minimizing administrative overhead. Option A is incorrect because using a custom image on a self-hosted agent still requires maintaining the image and applying updates. Option B is incorrect because container-based agents require building and managing a custom Docker image that includes Visual Studio and SDKs, which adds overhead. Option D is incorrect because a self-hosted agent on an Azure VM requires manual installation of required components and ongoing patching, increasing administrative effort.

Answer

Use a self-hosted agent on an Azure VM with a custom image that includes Visual Studio and SDKs.

Answer

Deploy a container-based agent using a Docker image that includes Visual Studio.

Answer

Provision a self-hosted agent on an Azure VM and install required components manually.