AZ-400 Practice Test 25 — 15 Questions

Question 1

Match each Azure DevOps extension type to its example.

Accepted Answer

Build task: NuGet Tool Installer. In this matching exercise, the correct pairs are: Build task → NuGet Tool Installer, Dashboard widget → Sprint Burndown, and Service hook → Notify Slack on build completion. The distractors incorrectly assign Sprint Burndown as a build task and NuGet Tool Installer as a dashboard widget, testing your ability to distinguish between extension types based on their purpose. Build tasks execute during pipeline runs, dashboard widgets display information on dashboards, and service hooks trigger external actions on events.

Answer

Build task: Sprint Burndown

Answer

Dashboard widget: NuGet Tool Installer

Question 2

Your Azure Pipelines build is failing with the error: '##[error]No agent found in pool 'Default' that satisfies the specified demands: Agent.Version -gtVersion 2.200.0'. The pool 'Default' contains agents of various versions. What is the most likely cause?

Accepted Answer

The 'Default' agent pool has no agents with version greater than 2.200.0.. The error message explicitly states that no agent in the 'Default' pool satisfies the demand 'Agent.Version -gtVersion 2.200.0'. Since the pool contains agents of various versions, the most likely cause is that none of those agents have a version greater than 2.200.0. This demand is set in the pipeline YAML or classic editor to ensure the agent meets a minimum version requirement.

Answer

The pipeline YAML has a syntax error in the 'demands' section.

Answer

The pipeline is configured to run on an agentless job.

Answer

The 'demands' keyword is not supported in Azure Pipelines.

Question 3

Your company uses Azure DevOps for CI/CD. You have a YAML build pipeline that builds a .NET Core application and publishes artifacts. The build runs on a Microsoft-hosted agent. Recently, the build started failing with the error 'The process cannot access the file because it is being used by another process.' This occurs intermittently during the 'dotnet build' step. The pipeline uses multiple jobs that run in parallel. You suspect that one job is interfering with another because they share the same workspace on the agent. You need to ensure that each job runs in its own isolated workspace. What should you do?

Accepted Answer

Set 'clean: all' on the checkout step in each job.. Setting 'clean: all' on the checkout step ensures that the workspace is cleaned before each job runs, preventing file conflicts caused by shared workspace on the agent. Option A is wrong because 'demands' are for selecting agents with specific capabilities, not for workspace isolation. Option B is wrong because 'workspace: clean' is not a valid setting at the pipeline root; workspace cleaning is configured per checkout step. Option C is wrong because a multi-job configuration with a matrix is used for parallelizing builds across different configurations, not for isolating workspaces.

Answer

Add a 'demands' section to the job to ensure each job runs on a different agent.

Answer

Set 'workspace: clean' in the pipeline root.

Answer

Use a 'multi-job' configuration with a matrix to run each job in separate folders.

Question 4

You are managing a pipeline that deploys a microservices application to multiple Azure Kubernetes Service (AKS) clusters in different regions. You want to implement a progressive exposure strategy where the deployment first goes to a small cluster (canary), then to a medium cluster, and finally to all clusters. The deployment should be automated but with the ability to halt if errors occur. What should you use?

Accepted Answer

Use deployment gates with evaluation of health metrics (e.g., error rate) before proceeding to the next stage.. Deployment gates in Azure Pipelines allow you to automatically evaluate health metrics (such as error rate, CPU usage, or custom metrics from Application Insights) before promoting a release to the next stage. This enables a progressive exposure strategy (canary → medium → all clusters) with automated rollback or halt if the metrics breach thresholds, without requiring manual intervention.

Answer

Use manual approval gates between stages.

Answer

Configure a rolling deployment strategy on each cluster.

Answer

Use a manual validation step in the pipeline.

Question 5

You are debugging a recent issue introduced in the main branch. Based on the exhibit, which command would you run to revert the 'Fix login bug' commit while preserving the merge commit?

Accepted Answer

git revert -m 1 HEAD. The 'Fix login bug' commit is a merge commit. To revert a merge commit while preserving its merge parent (i.e., the mainline), you must use `git revert -m 1 HEAD`. The `-m 1` flag specifies that the first parent (the main branch) should be kept, effectively reverting the changes brought by the merge. Option C, `git revert HEAD`, would fail because Git requires the `-m` flag when reverting a merge commit. Option B destroys history, which is not desired. Option D uses `-m 2`, which would revert the changes from the secondary parent (the feature branch), not the merge itself.

Answer

git reset --hard HEAD~1

Answer

git revert HEAD

Answer

git revert c3a2b1e -m 2

Question 6

A company uses Azure DevOps for CI/CD. They have multiple pipelines that deploy to different environments. They want to ensure that secrets like API keys are not exposed in pipeline logs. What is the best approach?

Accepted Answer

Create a Variable Group linked to Azure Key Vault. Variable Groups linked to Azure Key Vault allow you to securely store secrets in Key Vault and reference them in pipelines without exposing the actual values in logs or output. Option A is incorrect: Azure App Configuration with Key Vault references is designed for application configuration, not for managing pipeline secrets directly. Option C is incorrect: Azure Kubernetes Service (AKS) secrets are specific to Kubernetes workloads and not intended for general pipeline secret management. Option D is incorrect: Pipeline variables marked as 'secret' are masked in logs, but they are still stored in Azure DevOps and lack the centralized security and auditing capabilities of Key Vault.

Answer

Use Azure App Configuration with Key Vault references

Answer

Use Azure Kubernetes Service secrets

Answer

Use pipeline variables marked as 'secret'

Question 7

A company uses Microsoft Defender for Cloud to assess the security posture of Azure Pipelines agents. They notice that self-hosted agents are flagged as having high-severity vulnerabilities. What is the recommended action to remediate these findings while minimizing downtime?

Accepted Answer

Apply the security updates recommended by Microsoft Defender for Cloud to the agent VMs.. Microsoft Defender for Cloud identifies vulnerabilities on the VMs hosting self-hosted Azure Pipelines agents and provides specific security update recommendations. Applying these updates directly remediates the high-severity findings without requiring agent replacement or disabling security monitoring, thus minimizing downtime by patching in-place.

Answer

Disable Microsoft Defender for Cloud for the agent pool.

Answer

Uninstall the self-hosted agents and use only Microsoft-hosted agents.

Answer

Replace all self-hosted agents with Microsoft-hosted agents.

Question 8

Refer to the exhibit. A developer is on the 'feature/login' branch and wants to integrate the latest changes from 'feature/user-profile' without creating a merge commit. Which Git command should the developer use?

Accepted Answer

git rebase origin/feature/user-profile. To integrate changes from another branch without a merge commit, rebase is appropriate. The developer can rebase feature/login onto feature/user-profile (or onto main after merging user-profile). However, the exhibit shows that feature/user-profile is already merged into main, so rebasing feature/login onto main is also valid. The simplest is to rebase feature/login onto main, but that would include all changes. Alternatively, rebasing feature/login onto feature/user-profile directly would also work, but since user-profile is merged into main, rebasing onto main is common. The correct answer is rebase.

Answer

git pull --rebase origin main

Answer

git merge origin/feature/user-profile

Answer

git cherry-pick 9f8e7d6..8a7b6c5

Question 9

Your organization uses GitHub and wants to enforce that all commits to the main branch are signed with a GPG key that is verified against the user's GitHub account. Additionally, you want to block unsigned commits even if the committer is a repository admin. Which configuration should you use?

Accepted Answer

Enable 'Require signed commits' and set 'Include administrators' to true.. Enabling 'Require signed commits' in a GitHub branch protection rule, combined with setting 'Include administrators' to true, enforces that every commit pushed to the protected branch must be signed with a GPG key verified against the user's GitHub account, and this restriction applies even to repository administrators. This configuration blocks unsigned commits entirely, meeting the requirement to enforce signing for all users including admins.

Answer

Add a pre-receive hook that rejects unsigned commits.

Answer

Enable 'Require signed commits' and set 'Include administrators' to false.

Answer

Enable 'Require signed commits' and configure web commit signing.

Question 10

Your team uses Azure Pipelines to build a .NET Core application. The build runs successfully on Windows agents, but you need to also run the build on Linux agents to validate cross-platform compatibility. The pipeline currently has a single `windows-latest` agent pool. What is the most efficient way to run the build on both platforms without duplicating the entire pipeline?

Accepted Answer

Add a `strategy` with a `matrix` that specifies `vmImage: ['windows-latest', 'ubuntu-latest']` in the job.. Using a `strategy` with a `matrix` allows the same job to run on multiple agent pools in parallel, enabling cross-platform validation without duplicating the pipeline. Option A duplicates the entire pipeline, which is inefficient. Option B would require separate jobs, but not as concise as the matrix strategy. Option C uses stages, which run sequentially, not in parallel for this purpose.

Answer

Create two separate pipelines, one for each platform.

Answer

Use a multi-job pipeline with two jobs, each specifying a different pool.

Answer

Use a multi-stage pipeline with a stage for each platform.

Question 11

Your organization uses Azure DevOps and has a strict compliance requirement: all changes to the main branch must be reviewed by at least two members of the 'ComplianceTeam' group. Additionally, a static code analysis tool must run and its results must be published to the pull request. The ComplianceTeam is a custom group defined in Azure DevOps, not a Microsoft Entra ID group. The team wants to enforce this using branch policies. You need to configure the minimum number of reviewers and also ensure that the code analysis results are visible to reviewers. What should you do?

Accepted Answer

Add a branch policy 'Require a minimum number of reviewers' set to 2, and specify the ComplianceTeam as required reviewers. Additionally, add a build policy that runs the code analysis and publishes results as a build summary.. The 'Require a minimum number of reviewers' branch policy enforces that at least two members from the ComplianceTeam must approve the pull request. Adding a build policy that runs static code analysis and publishes results as a build summary ensures the analysis output is visible directly in the PR, meeting the compliance requirement for both reviewer count and code analysis visibility.

Answer

Add a branch policy 'Require code owner review' and define the ComplianceTeam as code owners in a CODEOWNERS file.

Answer

Add a branch policy 'Comment resolution' and configure the ComplianceTeam to resolve comments.

Answer

Add a branch policy 'Automatically included reviewers' and set the ComplianceTeam to be automatically added to all PRs.

Question 12

Refer to the exhibit. You have an availability set with two VMs. One VM shows a degraded availability state. What is the most likely impact on application availability?

Accepted Answer

The application will be vulnerable to unplanned hardware failures that affect the degraded VM's host.. In an availability set, VMs are placed on different fault domains (separate racks with independent power, cooling, and network) to protect against unplanned hardware failures. If one VM shows a degraded availability state, it indicates that its underlying host or hardware is experiencing issues, making that VM vulnerable to failure. The other VM remains healthy, but the application is not fully resilient because the degraded VM could fail, reducing the application's capacity or causing partial downtime if the application requires both VMs to handle load.

Answer

The application will be fully resilient to both planned and unplanned maintenance events.

Answer

The application will experience downtime during planned maintenance events.

Answer

The application will continue to run without any impact because the other VM is healthy.

Question 13

You are designing a build pipeline that produces a NuGet package. The pipeline must conditionally sign the assembly only when the build is triggered by a tag starting with 'v' (e.g., v1.0.0). The pipeline uses a script task that signs the assembly. Which expression should you use in the condition of the script task?

Accepted Answer

and(succeeded(), startsWith(variables['Build.SourceBranch'], 'refs/tags/v')). The condition uses `startsWith(variables['Build.SourceBranch'], 'refs/tags/v')` to check if the build was triggered by a tag whose full Git ref starts with `refs/tags/v`. This ensures the signing script runs only when the source branch is a tag reference matching the 'v' prefix, which is the standard way to identify version tags in Azure Pipelines. The `and(succeeded(), ...)` wrapper guarantees the previous tasks completed successfully before signing.

Answer

and(succeeded(), startsWith(variables['Build.SourceBranchName'], 'v'))

Answer

and(succeeded(), startsWith(variables['Build.SourceVersion'], 'v'))

Answer

and(succeeded(), eq(variables['Build.Reason'], 'IndividualCI'))

Question 14

Refer to the exhibit. After executing the delete command, what is the state of the repository?

Accepted Answer

The tag v1.0-rc is removed, and the repository now contains only one tag (v1.0) and three branches.. The command deleted the tag refs/tags/v1.0-rc. After deletion, the tag is no longer available. The other refs (branches and tags) remain unchanged. The repository now has only one tag: v1.0. The branches main, develop, and feature/new-feature still exist.

Answer

The tag v1.0-rc is removed, but the commit it pointed to is also deleted from the repository.

Answer

The tag v1.0-rc is removed, and the branch feature/new-feature is also deleted because it was the same object.

Answer

The command fails because the tag does not exist.

Question 15

Your organization uses GitHub Actions for CI/CD. You need to implement a deployment strategy where a new version of the application is gradually shifted from the stable environment to a canary environment, and if health checks pass, the traffic is fully shifted to the canary. Which GitHub Actions deployment strategy should you use?

Accepted Answer

Canary deployment. A canary deployment gradually shifts traffic from the stable environment to a new canary environment, using health checks to validate the new version before fully routing all traffic to it. This matches the requirement of a gradual shift with health-check gating. GitHub Actions supports this via deployment strategies like `canary` in environments or custom workflows with traffic-splitting tools.

Answer

Recreate deployment

Answer

Blue-green deployment

Answer

Rolling deployment