AZ-400 Practice Test 23 — 15 Questions

Question 1

Which TWO features can you use to enforce quality gates before a production deployment in Azure Pipelines?

Accepted Answer

Approval checks on environments. Approval checks on environments allow you to require manual sign-off before a release proceeds to a production stage. This enforces a quality gate by ensuring that a designated approver reviews and authorizes the deployment. Option E is correct because deployment gates evaluate health metrics (e.g., from Azure Monitor or Application Insights) automatically, blocking or allowing the deployment based on predefined conditions such as error rates or performance thresholds.

Answer

Scheduled triggers

Answer

Branch policies on repositories

Answer

Pipeline decorators

Question 2

You are reviewing a Data Collection Rule (DCR) for an Azure virtual machine. The DCR is assigned to the VM, and the Azure Monitor Agent is installed. After one hour, no performance data appears in the Log Analytics workspace. What is the most likely cause?

Accepted Answer

The data flow streams property does not include 'Microsoft-Perf'.. The most likely cause is that the data flow streams property in the DCR does not include 'Microsoft-Perf'. The Azure Monitor Agent uses DCRs to define which data to collect and where to send it. Without the 'Microsoft-Perf' stream specified in the dataFlows section, performance counters are not collected, even if the counter specifiers are correctly defined. The workspace resource ID and counter format may be correct, but the missing stream prevents any performance data from being ingested.

Answer

The workspace resource ID is incorrectly formatted.

Answer

The counter specifier uses the wrong format for Windows performance counters.

Answer

The sampling frequency of 60 seconds is too low and data is being throttled.

Question 3

An Azure Policy is defined as shown in the exhibit. You attempt to create a storage account with HTTPS traffic only set to false. What will happen?

Accepted Answer

The creation will be denied with an error message. The Azure Policy in the exhibit uses a 'Deny' effect for the condition that storage accounts must have HTTPS traffic enabled. When you attempt to create a storage account with 'HTTPS traffic only' set to false, the policy evaluation detects a non-compliant resource and denies the creation request, returning an error message. This is because the 'Deny' effect blocks the resource deployment entirely, preventing the non-compliant configuration from being provisioned.

Answer

The policy will only apply if the storage account is in a specific resource group

Answer

The storage account will be created but HTTPS will be enforced

Answer

The storage account will be created and an audit event will be logged

Question 4

Your team is using Azure Pipelines to deploy a web application to Azure App Service. The application uses a configuration file (appsettings.json) that contains environment-specific settings. You need to manage these settings across development, staging, and production environments without exposing secrets in the source code. The pipeline should automatically replace the settings during deployment. What should you configure?

Accepted Answer

Use the 'File Transform' task in the release pipeline to replace tokens in the configuration file with variables defined in pipeline variable groups.. Use the 'File Transform' task to substitute variables from pipeline variables or variable groups. Option B is incorrect because build configuration transforms are for .NET projects and require specific setup. Option C is incorrect because environment variables are not directly used for file transforms. Option D is incorrect because Azure App Service application settings are for the runtime, not for transforming configuration files during deployment.

Answer

Create separate build configurations for each environment and use the 'Transform Web.config' task.

Answer

Use the 'Azure App Service Deploy' task with the 'Use Web Deploy' option and configure parameterization.

Answer

Set environment variables in the Azure App Service and read them in the application code.

Question 5

Your company uses Azure DevOps and must comply with SOC 2. The auditor requires proof that all production deployments went through a change management process with approval. What should you implement?

Accepted Answer

Configure release approval gates in Azure Pipelines. Release approval gates in Azure Pipelines enforce a formal approval process before deployment, providing the required change management and approval evidence for SOC 2 audits. Option A is incorrect because branch policies control code changes, not deployments. Option B is incorrect because pipeline retention policies only manage artifact storage, not approval process. Option C is incorrect because audit logging records events but does not enforce an approval process.

Answer

Use branch policies to require pull request approvals

Answer

Set pipeline retention policies to keep deployment records

Answer

Enable audit logging for all pipelines

Question 6

You have the above branch policy configuration for the main branch. A developer pushes a new commit to an existing pull request. What happens?

Accepted Answer

The existing approvals are reset, and a new build is automatically queued.. The branch policy has 'Reset code review votes when new changes are pushed' enabled (resetOnSourcePush: true) and 'Build validation' with 'Automatically queue a new build when new changes are pushed' enabled (queueOnSourceUpdateOnly: true). When a new commit is pushed to an existing pull request, the existing approvals are reset, and a new build is automatically queued. Therefore, option C is correct.

Answer

The existing approvals are reset, but no new build is queued.

Answer

The pull request is automatically completed.

Answer

The existing approvals remain valid, and the build is not requeued.

Question 7

A company has a multi-region application deployed on Azure App Service (Windows) across three regions: West US, East US, and West Europe. The operations team uses Azure Monitor to collect application logs and metrics. Recently, they noticed that the application in West US is experiencing high CPU usage (sustained above 90%) during peak hours, while the other regions remain below 60%. The team has set up an autoscale rule on the App Service plan to scale out when CPU exceeds 80% for 10 minutes. However, autoscale is not triggering, and the application in West US is becoming slow. The team has verified that the autoscale rule is correctly configured, the instance count is below the maximum, and there are no scale-in rules interfering. The metric data appears in Azure Monitor. You suspect that the metric alert that triggers autoscale is not firing. What is the most likely cause?

Accepted Answer

The autoscale rule is using the wrong metric aggregation or namespace, such as 'CpuTime' instead of 'Percentage CPU'.. The autoscale rule must use the correct metric name and aggregation to evaluate scaling conditions. If the rule is configured with 'CpuTime' instead of 'Percentage CPU', it will not match the actual CPU utilization metric emitted by the Azure App Service plan. 'Percentage CPU' is the standard platform metric for CPU load, while 'CpuTime' measures total CPU time consumed, which does not trigger the same threshold logic. Since the team verified the rule is correctly configured but autoscale is not firing, the most likely cause is a mismatch in the metric name or namespace.

Answer

The autoscale rule was created less than 24 hours ago and needs a learning period.

Answer

The metric collection interval for CPU is set to 30 minutes, causing a delay in autoscale evaluation.

Answer

The autoscale rule is configured to use Log Analytics queries instead of platform metrics.

Question 8

Which TWO actions should you take to proactively protect your repository from accidentally committing secrets? (Choose two.)

Accepted Answer

Use pre-commit hooks with tools like detect-secrets. Pre-commit hooks, such as those using the detect-secrets tool, scan staged changes before a commit is finalized. This prevents secrets from ever entering the repository history, providing a proactive, client-side guard. Option C is correct because push protection in secret scanning blocks pushes that contain known secret patterns at the server side, preventing the secret from being stored in the remote repository.

Answer

Enable branch protection rules

Answer

Use signed commits

Answer

Configure secret scanning alerts

Question 9

You have a multi-stage YAML pipeline that deploys to multiple environments. You want to enforce that a manual approval is required before deploying to the production environment, but not for other environments. How should you configure the pipeline?

Accepted Answer

Create an environment named 'Production', add an approval check, and reference the environment in the deployment job.. Azure Pipelines allows you to add an approval check on a specific environment. By creating an environment named 'Production' and attaching an approval check to it, any deployment job that references that environment will require manual approval before proceeding. This ensures that only the production deployment is gated, while other environments deploy automatically.

Answer

Set a pipeline-level approval check that applies to all stages.

Answer

Add an approval gate on the 'Production' stage in the pipeline settings.

Answer

Configure branch policy on the main branch to require approval for all changes.

Question 10

You are configuring a release pipeline to deploy to Azure App Service. You want to use the 'Deploy Azure App Service' task. Which authentication method should you use to securely connect Azure DevOps to the Azure subscription?

Accepted Answer

Azure Resource Manager service connection using a service principal.. The 'Deploy Azure App Service' task requires a secure, non-interactive connection between Azure DevOps and Azure. An Azure Resource Manager service connection using a service principal is the recommended and supported method because it uses Azure AD authentication with a client secret or certificate, enabling automated, credential-free deployments without user interaction or token expiry issues.

Answer

Azure CLI authentication with a user account.

Answer

Use a SAS token for the App Service.

Answer

Managed Identity assigned to the Azure DevOps agent.

Question 11

Which TWO metrics should you monitor to evaluate the reliability of a web application according to the DORA metrics?

Accepted Answer

Change Failure Rate. The DORA metrics define four key measures for software delivery performance: Deployment Frequency, Lead Time for Changes, Mean Time to Restore (MTTR), and Change Failure Rate. For evaluating the reliability of a web application, the two most directly relevant metrics are Change Failure Rate (B), which measures the percentage of deployments causing a failure in production, and Mean Time to Restore (MTTR) (C), which measures the time it takes to recover from a failure. These two metrics directly quantify stability and resilience, whereas Deployment Frequency and Lead Time for Changes focus on throughput and speed.

Answer

Lead Time for Changes

Answer

CPU Usage

Answer

Deployment Frequency

Question 12

Your team is adopting Infrastructure as Code (IaC) using Bicep. You have a multi-stage YAML pipeline that deploys Azure resources to dev, test, and prod environments. You need to ensure that the Bicep files are validated and deployed consistently, and that any changes to the infrastructure are approved for production. You also want to use the latest version of the Azure CLI task. What is the recommended approach?

Accepted Answer

Use the AzureCLI task with inline script to run 'az deployment group validate' and 'az deployment group create'. Add environments with approval gates for production.. It uses the AzureCLI task with the 'az deployment group validate' and 'az deployment group create' commands, which natively support Bicep files. This approach integrates with multi-stage YAML pipelines and allows adding approval gates for production environments. Option A is incorrect because the Azure Resource Manager Template Deployment task requires a compiled ARM JSON file, adding an unnecessary compilation step and not leveraging Bicep's native capabilities. Option B is incorrect because creating separate pipelines for each environment duplicates effort and does not take advantage of the multi-stage YAML pipeline structure with environment approvals. Option D is incorrect because using a PowerShell task with 'New-AzResourceGroupDeployment' cmdlet lacks native Bicep support and may require manual compilation.

Answer

Use the Azure Resource Manager Template Deployment task with the 'templateLocation' parameter pointing to the compiled ARM JSON.

Answer

Create three separate pipelines for each environment, each using the ARM Template Deployment task.

Answer

Use a PowerShell task with the 'New-AzResourceGroupDeployment' cmdlet.

Question 13

Your organization uses GitHub Actions for CI/CD. You have a workflow that builds a .NET application and runs tests. The workflow uses a self-hosted runner on an on-premises Windows server. Recently, builds started failing with 'Access to the path is denied' errors when the runner tries to restore NuGet packages. The runner has been working for months. What is the most likely cause?

Accepted Answer

The runner service account's permissions have changed, and it no longer has write access to the working directory or cache.. The 'Access to the path is denied' error during NuGet restore on a self-hosted runner typically indicates a file system permission issue. Since the runner has been working for months, the most likely cause is that the service account under which the runner runs no longer has write access to the working directory or the NuGet cache folder, often due to a group policy change, account modification, or folder permission drift.

Answer

The runner's authentication token to GitHub has expired.

Answer

The NuGet cache directory on the runner has been deleted.

Answer

The runner has been updated to a newer version that no longer supports NuGet restore.

Question 14

Your organization uses Azure DevOps with multiple teams. You are tasked with creating a security and compliance plan. The environment includes: Azure Repos for source control, Azure Pipelines for CI/CD, and Azure Artifacts for package management. Requirements: 1) All code changes to the main branch must be reviewed by at least one member of the security team. 2) Deployment to production requires approval from a manager. 3) Secrets must be stored securely and rotated every 90 days. 4) Pipeline logs must be retained for 1 year for audit purposes. You have configured branch policies requiring a minimum number of reviewers and mandatory security team review. For production deployments, you have added a manual approval gate. Secrets are stored in Azure Key Vault with automatic rotation. However, the audit team reports that pipeline logs are only retained for 30 days. You need to extend log retention to 1 year. What should you do?

Accepted Answer

In Azure DevOps project settings, navigate to Pipelines > Retention and releases, and set the retention policy to 365 days.. In Azure DevOps, pipeline retention policies for runs are configured at the project level under Project Settings > Pipelines > Retention and releases. Setting the retention to 365 days will keep pipeline run records and logs for one year. Option A is incorrect because exporting pipeline logs to Azure Blob Storage is not a built-in feature; pipeline logs are retained according to DevOps retention policies. Option B is incorrect because diagnostic settings in Azure Monitor stream Azure resource logs, not Azure DevOps pipeline logs. Option D is incorrect because audit logs capture events like changes to policies, not pipeline execution logs, and they have separate retention settings.

Answer

Export pipeline logs to Azure Blob Storage and set a lifecycle policy to retain for 365 days.

Answer

Configure diagnostic settings in Azure Monitor to stream pipeline logs to a Log Analytics workspace.

Answer

Enable Azure DevOps audit logs and export them to a Log Analytics workspace with a 365-day retention.

Question 15

Your release pipeline includes a 'Deploy to App Service' task for a Linux web app. The deployment fails with 'Error: Failed to deploy web package to App Service'. What should you check first?

Accepted Answer

Review the App Service diagnostic logs.. App Service diagnostic logs provide the most comprehensive and direct source of error details when a deployment fails. The 'Deploy to App Service' task uses Kudu (for Windows) or Oryx (for Linux) to process the deployment; reviewing the diagnostic logs (e.g., via the Azure portal under 'App Service logs' or the 'Log stream') will surface the exact failure reason, such as a missing startup command, incorrect runtime stack, or permission issues.

Answer

Verify that the deployment slot is correctly configured.

Answer

Check the Kudu console for errors.

Answer

Ensure the web.config file is present.