AZ-400 Practice Test 24 — 15 Questions

Question 1

Your organization is adopting DevSecOps and wants to integrate security scanning into the CI/CD pipeline. Which tool should you use to scan container images for vulnerabilities?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (Option C) is the correct tool for scanning container images for vulnerabilities in a CI/CD pipeline, as it integrates with Azure Container Registry to perform vulnerability assessments. Option A (Azure Monitor) is incorrect because it is a monitoring and observability service, not a security scanner. Option B (GitHub Copilot) is incorrect as it is an AI code completion tool. Option D (Azure Logic Apps) is incorrect because it is a workflow automation service, not a security scanning tool.

Answer

Azure Monitor

Answer

GitHub Copilot

Answer

Azure Logic Apps

Question 2

Your organization uses Azure Boards and requires that all changes to work items in the 'Security' area path be audited. Which solution ensures that any modification to a work item triggers an audit event in Microsoft Sentinel?

Accepted Answer

Configure Azure DevOps Audit Streaming to send logs to Microsoft Sentinel. Azure DevOps Audit Streaming is the correct solution because it natively streams audit events (including work item modifications) to Microsoft Sentinel via the Azure Event Hubs or Log Analytics workspace integration. This ensures real-time, continuous auditing without manual intervention, meeting the requirement for all changes in the 'Security' area path to trigger audit events in Sentinel.

Answer

Enable Microsoft Purview to scan Azure DevOps and detect changes

Answer

Export Azure DevOps audit logs to CSV and import to Sentinel daily

Answer

Create a service hook in Azure DevOps that calls a logic app to create incidents in Sentinel

Question 3

Which TWO benefits does using deployment groups provide in Azure Pipelines? (Choose two.)

Accepted Answer

You can deploy to a specific set of target servers (e.g., all web servers in a farm).. Deployment groups in Azure Pipelines allow you to define a logical set of target machines (e.g., all web servers in a farm) and deploy to them collectively. This enables targeted, multi-machine deployments without needing to manage individual agents per environment. Option B is correct because deployment groups support rolling deployments with built-in health validation, where the pipeline can monitor application health after each batch of updates and automatically roll back on failure.

Answer

You can assign multiple deployment groups to a single agent.

Answer

Each target server must have its own agent.

Answer

Deployment groups can only be used with classic release pipelines.

Question 4

Your organization uses GitHub Actions for CI/CD. You need to ensure that workflows are only triggered when changes are pushed to the main branch or when a pull request is opened against main. Which two trigger types should you specify in the workflow?

Accepted Answer

pull_request: branches: [ main ]. The `pull_request` trigger with `branches: [ main ]` ensures the workflow runs when a pull request is opened (or updated) targeting the main branch. Option B is correct because the `push` trigger with `branches: [ main ]` ensures the workflow runs when commits are pushed directly to the main branch. Together, these two triggers cover the exact requirement: changes pushed to main and pull requests opened against main.

Answer

release

Answer

workflow_dispatch

Answer

schedule

Question 5

Refer to the exhibit. You deploy this Bicep template to create an Azure App Service with a custom container. The deployment succeeds, but the container fails to start with an error 'Container didn't respond to HTTP pings'. What is the most likely missing configuration?

Accepted Answer

The template is missing the 'healthCheckPath' property in siteConfig.. The error 'Container didn't respond to HTTP pings' indicates that Azure App Service's built-in health check mechanism is failing to reach the container. By default, App Service pings the root path ('/') on the container's exposed port. If the container's application does not respond on that path, the health check fails. Adding the 'healthCheckPath' property in siteConfig allows you to specify a custom endpoint (e.g., '/health') that the container can respond to, resolving the issue.

Answer

The container image is not publicly accessible.

Answer

The WEBSITES_ENABLE_APP_SERVICE_STORAGE should be set to 'true'.

Answer

The template is missing the app setting 'WEBSITES_PORT'.

Question 6

A company uses Azure DevOps for CI/CD. They have a multi-stage YAML pipeline that builds a Java application, runs unit tests, and deploys to a test environment. The test environment uses an Azure SQL Database. The pipeline currently runs successfully but the team notices that the test database schema is not always up-to-date. They want to apply database migrations automatically as part of the pipeline. Which tool or task should they integrate?

Accepted Answer

Integrate Flyway or similar database migration tool in the pipeline.. Flyway is a dedicated database migration tool that integrates seamlessly with Azure DevOps pipelines, allowing you to version-control and apply schema changes automatically. Unlike ad-hoc scripts, Flyway tracks which migrations have been applied, ensuring the test database schema is always up-to-date without manual intervention.

Answer

Use the Azure SQL Database deployment task to run a SQL script manually.

Answer

Use Azure SQL Database backup and restore to update the schema.

Answer

Add a PowerShell task that runs SQLCMD.

Question 7

Which TWO are valid strategies for reducing build times in Azure Pipelines? (Choose two.)

Accepted Answer

Implement caching for package dependencies (e.g., npm, NuGet, Maven) to avoid restoring on every build.. Caching package dependencies (e.g., npm, NuGet, Maven) avoids restoring them on every build, reducing download time. Incremental builds (e.g., using 'dotnet build --no-restore' with appropriate flags or MSBuild's incremental building) skip projects that haven't changed, reducing compilation time. Option A is incorrect because reducing parallel jobs and adding steps increases build time. Option B is incorrect because removing unit tests compromises quality and is not a valid strategy. Option E is incorrect because increasing agents without parallelizing jobs or running all jobs on the same agent does not reduce build time.

Answer

Reduce the number of parallel jobs and increase the number of steps in a single job.

Answer

Remove unit tests from the build pipeline and run them only in the release pipeline.

Answer

Increase the number of agents in the pool and run all jobs on the same agent.

Question 8

Your organization uses GitHub Actions and has a repository containing sensitive infrastructure code. You need to ensure that only approved actions are used in workflows. Which two settings should you configure? (Select two.)

Accepted Answer

Allow actions created by GitHub.. This is a select-two question. The correct answers are A and C. Option A is correct because enabling 'Allow actions created by GitHub' restricts workflows to only use first-party actions published by GitHub, establishing a baseline security posture. Option C is correct because further limiting actions to only those from specific approved repositories provides granular control over third-party actions that have been vetted by the organization. Together, these settings ensure that only approved actions can be used in workflows, meeting the compliance requirement.

Answer

Disable actions for the repository.

Answer

Use environment protection rules.

Answer

Store actions in encrypted secrets.

Question 9

Your team uses a monorepo in Azure Repos with multiple feature branches. You notice that merge conflicts frequently occur because developers are working on the same files. You want to reduce conflicts and improve collaboration. Which branching strategy should you recommend?

Accepted Answer

Use trunk-based development with feature flags to merge small, frequent changes.. Trunk-based development with feature flags is the correct approach because it encourages developers to merge small, frequent changes into the main branch, reducing the surface area for conflicts. Feature flags allow incomplete features to be hidden in production, enabling continuous integration without requiring long-lived feature branches. This strategy directly addresses the problem of frequent merge conflicts by minimizing divergence between branches.

Answer

Use release branches for each deployment and cherry-pick commits from main.

Answer

Use a single main branch and require all changes to be committed directly.

Answer

Use GitFlow with separate develop and release branches.

Question 10

Which THREE steps should you take to implement a secure CI/CD pipeline that uses secrets from Azure Key Vault?

Accepted Answer

Use the Azure Key Vault task to download secrets as variables. The Azure Key Vault task in Azure Pipelines can download secrets as pipeline variables at runtime, allowing the pipeline to securely reference them without exposing the secret values in logs or configuration. This task authenticates to Key Vault using a service connection or managed identity, ensuring secrets are never stored in the pipeline definition.

Answer

Store secrets as plain text variables in the pipeline library

Answer

Hardcode secrets in the YAML file and use variables to mask them

Question 11

Which TWO options are benefits of using Git LFS (Large File Storage) in a team environment? (Select TWO.)

Accepted Answer

Prevents large files from being stored in the Git history. Git LFS replaces large files in the repository with text pointer files, while the actual file content is stored in a separate remote store. This prevents the large files from bloating the Git history, which would otherwise permanently increase repository size for all clones and fetches.

Answer

Automatically detects and tracks all binary files in the repository

Answer

Works only with GitHub and Azure Repos

Answer

Eliminates the need for Git when working with large binary files

Question 12

You are implementing a release pipeline that deploys a web app to Azure App Service. The deployment must be approved by a manager before proceeding to the production slot. However, the manager is on leave and the deployment is critical. What should you do to ensure the deployment can proceed without delaying the release?

Accepted Answer

Add an additional approver in the pre-deployment approval settings.. Adding an additional approver in the pre-deployment approval settings allows another authorized user (e.g., a backup manager or team lead) to approve the deployment while the primary manager is unavailable. This maintains the required governance and security controls without blocking the critical release. Azure Pipelines supports multiple approvers, and any one of them can approve to proceed.

Answer

Skip the approval for this deployment by overriding the settings.

Answer

Configure the approval to time out after 24 hours and automatically approve.

Answer

Remove the approval requirement from the pipeline.

Question 13

Your Azure DevOps project contains a Git repository with multiple branches. You need to ensure that code reviews are mandatory for all pull requests targeting the 'release' branch. Additionally, the build pipeline must pass before merging. How should you configure branch policies?

Accepted Answer

Enable 'Require a minimum number of reviewers' and 'Build validation'.. The requirement specifies two distinct conditions: mandatory code reviews (enforced by 'Require a minimum number of reviewers') and a passing build pipeline before merge (enforced by 'Build validation'). In Azure Repos, branch policies allow you to combine multiple checks; enabling only one of these would leave the other requirement unmet. Therefore, both policies must be enabled to satisfy the full criteria.

Answer

Enable 'Build validation' only.

Answer

Enable 'Require a minimum number of reviewers' only.

Answer

Enable 'Require a minimum number of reviewers' and 'Comment resolution'.

Question 14

Your Azure DevOps project has multiple teams. You need to ensure that each team's board only shows work items assigned to that team. What should you configure?

Accepted Answer

Configure team settings to set default area paths for each team.. Team settings allow you to configure default area paths for each team, which ensures that the team board only displays work items assigned to those area paths. This effectively scopes the board to the team's work. Option A is wrong because shared queries are custom views and do not affect the default board filtering; they are used for reporting or dashboards, not for team board visibility. Option B is wrong because iteration paths control sprint scheduling and timeboxes, not the visibility of work items on the board; area paths are used for team assignment. Option C is wrong because permissions on area paths control access levels (who can view or edit), not which work items appear on a team board; area path permissions do not filter the board content by team.

Answer

Create a shared query for each team and pin it to the dashboard.

Answer

Assign each team a unique iteration path.

Answer

Set permissions on area paths to restrict access.

Question 15

Your team uses GitHub Actions for CI/CD. You need to enforce that all workflows use approved actions from a private marketplace. Which GitHub feature should you configure?

Accepted Answer

Set the Actions permissions to 'Allow only specified actions'.. The 'Allow only specified actions' setting in GitHub Actions permissions allows you to restrict workflow execution to a curated list of actions from a private marketplace or specific verified publishers. This enforces governance by preventing the use of unapproved actions, which is critical for compliance and security in enterprise CI/CD pipelines.

Answer

Use environment secrets to store allowed action names.

Answer

Require self-hosted runners.

Answer

Configure OpenID Connect (OIDC) for Actions.