AZ-400 Practice Test 4 — 25 Questions

Question 1

Your team is migrating from TFVC to Git in Azure Repos. You need to preserve the full history of the TFVC repository, including all branches and changesets. The TFVC repository is large (over 10 GB). Which tool should you use to perform the migration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use git-tfs to clone the TFVC repository and then push to Azure Repos.. B is correct because git-tfs is specifically designed to bridge TFVC and Git, allowing you to clone a TFVC repository (including all branches, changesets, and history) into a local Git repository, which can then be pushed to Azure Repos. It handles large repositories (over 10 GB) by performing an incremental clone, preserving the full history without manual recreation.

Answer

Manually recreate the commits in a new Git repository.

Answer

Use git-svn to convert TFVC to Git.

Answer

Use the Azure DevOps Migration Tools to export TFVC to Git.

Question 2

Which TWO actions should a DevOps engineer take to ensure that Azure DevOps pipelines comply with the principle of least privilege for service connections?

Accepted Answer

Create a service principal with permissions scoped to the minimum required Azure resources.. Creating a service principal with permissions scoped to the minimum required Azure resources directly implements the principle of least privilege. By assigning only the necessary roles (e.g., Contributor on a specific resource group) to the service principal used in the service connection, you ensure that the pipeline can only perform actions on those resources, reducing the attack surface. This aligns with Azure RBAC best practices for securing automated deployments.

Answer

Use the Project Collection Build Service account for all pipeline runs.

Answer

Use Workload identity federation to avoid managing secrets.

Answer

Use the same service connection for both build and release pipelines.

Question 3

A development team uses Git for source control. They want to ensure that all code changes are reviewed before merging into the main branch. Which branch policy should they configure in Azure Repos?

Accepted Answer

Configure a branch policy that requires a minimum number of reviewers and resolves all comments.. Azure Repos branch policies allow you to enforce that pull requests require a minimum number of reviewers and that all comments are resolved before merging. This directly ensures that all code changes are reviewed and any feedback is addressed, meeting the team's requirement for mandatory code review before merging into the main branch.

Answer

Configure a branch policy that requires commit messages to follow a specific pattern.

Answer

Configure a branch policy that requires a successful build.

Answer

Configure a branch policy that requires linked work items.

Question 4

Refer to the exhibit. A developer runs 'git log --oneline --graph --decorate' and sees the output. Which Git workflow does this history most closely represent?

Accepted Answer

Git Flow. The output of `git log --oneline --graph --decorate` shows multiple long-lived branches (e.g., `develop`, `feature/*`, `release/*`, `hotfix/*`) with periodic merges back to `develop` and `main`. This branching structure with dedicated branches for features, releases, and hotfixes is the hallmark of Git Flow, which uses a strict branching model to manage releases and maintenance in parallel.

Answer

GitLab Flow

Answer

Trunk-based development

Answer

GitHub Flow

Question 5

Your organization is implementing a security compliance plan for Azure DevOps. Which TWO actions should you take to ensure that only authorized users can modify build pipelines?

Accepted Answer

Configure branch policies to require reviews for changes to pipeline YAML files. Branch policies in Azure Repos enforce required reviews for changes to YAML pipeline files stored in the repository. This ensures that any modification to the pipeline definition must be approved by authorized reviewers before merging, preventing unauthorized or accidental changes. Option C is correct because pipeline permissions in Azure DevOps allow you to restrict editing of a pipeline to specific security groups (e.g., 'Build Administrators'), directly controlling who can modify the pipeline through the web interface or API.

Answer

Require all users to use Personal Access Tokens (PATs)

Answer

Enable audit logging for all pipeline changes

Answer

Enable OpenID Connect (OIDC) for pipeline authentication

Question 6

Refer to the exhibit. The pipeline YAML includes an Azure CLI script that sets an app setting on a Web App. The pipeline fails with an authentication error. What is the most likely cause?

Accepted Answer

The pipeline does not have an Azure service connection configured for authentication.. The Azure CLI script in the pipeline attempts to run `az webapp config appsettings set`, which requires authentication to Azure. Without an Azure service connection configured in the pipeline, there is no authenticated session or service principal to authorize the command, resulting in an authentication error. The service connection provides the necessary credentials (e.g., via Microsoft Entra ID) for the pipeline to interact with Azure resources.

Answer

The resource group name is incorrect.

Answer

The DEPLOYMENT_SLOT setting name is invalid.

Answer

The script syntax is invalid.

Question 7

You have a YAML pipeline that builds a Java project using Maven. The pipeline uses a private artifact feed in Azure Artifacts. You need to authenticate to the feed from the pipeline. Which authentication method should you use?

Accepted Answer

Use the 'MavenAuthenticate' task with a settings.xml file.. The 'MavenAuthenticate' task is specifically designed to authenticate Maven builds against Azure Artifacts feeds. It injects credentials into a settings.xml file, which Maven uses to resolve dependencies from the private feed. This task handles the OAuth token exchange required for Azure DevOps authentication.

Answer

Use the 'PipAuthenticate' task with a pip.conf file.

Answer

Use the 'npmAuthenticate' task with a .npmrc file.

Answer

Use the 'NuGetAuthenticate' task with a nuget.config file.

Question 8

Which TWO GitHub Actions features can be used to enforce deployment approvals for a production environment? (Choose two.)

Accepted Answer

Deployment protection rules that require approval.. Deployment protection rules in GitHub Actions allow you to define required approvals before a workflow job can deploy to an environment. These rules are configured at the environment level and can mandate that a specific number of reviewers approve the deployment, effectively enforcing a manual approval gate for production environments.

Answer

The 'deployment' event trigger in a workflow.

Answer

Branch protection rules that require pull request reviews.

Answer

OpenID Connect (OIDC) for cloud provider authentication.

Question 9

Drag and drop the steps to troubleshoot a failed Azure DevOps release pipeline into the correct order.

Accepted Answer

Review pipeline logs, then identify the failing task, then check variable values and conditions, then run in debug mode, then apply a fix and retrigger. Troubleshooting starts with logs, then task identification, variable check, debug run, and fix.

Answer

Run in debug mode, then review pipeline logs, then identify the failing task, then check variable values and conditions, then apply a fix and retrigger

Answer

Identify the failing task, then check variable values and conditions, then run in debug mode, then review pipeline logs, then apply a fix and retrigger

Answer

Check variable values and conditions, then apply a fix and retrigger, then review pipeline logs, then identify the failing task, then run in debug mode

Question 10

Your team uses GitHub for source control and wants to enforce that all pull requests into the main branch require at least two reviewers and must pass a status check from a CI pipeline. Which branch protection rule configurations should you apply?

Accepted Answer

Require a minimum of 2 reviewers, require status checks to pass before merging. GitHub branch protection rules allow you to require a minimum number of reviewers before merging and to require status checks to pass. By setting 'Require a minimum number of reviewers' to 2 and enabling 'Require status checks to pass before merging', you enforce that every pull request into the main branch must be approved by at least two reviewers and must pass the CI pipeline status check, meeting the stated requirements.

Answer

Require signed commits and status checks

Answer

Require status checks to pass, but do not require reviewers

Answer

Require a minimum of 2 reviewers, but do not require status checks

Question 11

You are designing a branching strategy for a microservices application with independent deployment cadences. The team wants to support continuous deployment to production from the main branch while allowing feature work to be isolated and tested. Which branching strategy best meets these requirements?

Accepted Answer

Trunk-based development with short-lived feature branches. Trunk-based development with short-lived feature branches (C) is correct because it enables continuous deployment from the main branch while isolating feature work in branches that are merged back to main within hours or a day. This approach minimizes merge conflicts and supports independent deployment cadences for microservices, as each service can be deployed from main independently without waiting for release branches.

Answer

One branch per environment (dev, test, prod)

Answer

GitHub Flow with feature branches merging to main

Answer

Git Flow with develop, release, and hotfix branches

Question 12

Which TWO practices help improve the efficiency of code reviews? (Choose two.)

Accepted Answer

Keep pull requests small and focused on a single change.. Keeping pull requests small and focused on a single change (Option A) improves code review efficiency because it reduces cognitive load on reviewers, allowing them to understand and evaluate the change quickly without context-switching. Smaller PRs also enable faster feedback loops and easier rollback if issues are found, which aligns with DevOps principles of continuous integration and delivery.

Answer

Include multiple unrelated changes in a single pull request to reduce the number of PRs.

Answer

Assign as many reviewers as possible to ensure thoroughness.

Answer

Require that all team members review every pull request.

Question 13

Refer to the exhibit. You have a branch policy JSON for Azure Repos. Which statement about this policy is correct?

Accepted Answer

At least two reviewers must approve the pull request.. The branch policy JSON specifies `minimumApproverCount: 2`, which enforces that at least two distinct reviewers must approve the pull request before it can be completed. This is a standard Azure Repos branch policy setting that controls the required number of approvals, not the identity of the approvers or the merge strategy.

Answer

The last person who pushed can approve the pull request.

Answer

Pull requests to main are automatically squash-merged.

Answer

Approvals are reset when the source branch is updated.

Question 14

Which TWO Azure DevOps features can be used to implement change management processes?

Accepted Answer

Release approval gates.. Release approval gates (Option B) in Azure Pipelines allow you to enforce manual or automated checks before a release proceeds to a stage, implementing change management by requiring sign-offs or validation against external systems. Audit logging (Option C) captures a chronological record of changes to Azure DevOps resources, providing an immutable trail for compliance and change review processes.

Answer

Test plans.

Answer

Project wiki.

Answer

Code search.

Question 15

Which THREE measures should be implemented to protect secrets in Azure Pipelines? (Choose three.)

Accepted Answer

Restrict which pipelines can access the variable group. Restricting which pipelines can access a variable group ensures that only authorized pipelines can use secrets stored in that group, preventing unauthorized access or accidental exposure. This is a key security measure in Azure Pipelines to enforce the principle of least privilege.

Answer

Log secret values to pipeline console for debugging

Answer

Store secrets in code as environment variables

Question 16

Which TWO actions are recommended practices for improving communication within a DevOps team?

Accepted Answer

Create a shared team charter with communication norms.. A shared team charter with communication norms establishes explicit expectations for how the team interacts, reducing ambiguity and fostering a culture of transparency and accountability. Daily stand-up meetings promote regular, synchronous communication, enabling quick updates, identification of blockers, and alignment on priorities. Both practices align with DevOps principles of collaboration and shared ownership. In contrast, separate documentation repositories, monthly email reports, and removing chat channels hinder real-time collaboration and transparency.

Answer

Use separate documentation repositories for each team.

Answer

Send monthly status reports via email.

Answer

Remove team chat channels to reduce noise.

Question 17

Your organization uses Azure DevOps and wants to enforce that all pipelines use a specific set of approved tasks. How can you achieve this?

Accepted Answer

Use the task restrictions feature in Azure DevOps to block unapproved tasks. Use the task restrictions feature in Azure DevOps to block unapproved tasks. Azure DevOps provides a 'Task restrictions' policy under Organization Settings > Policies > Add new policy, where you can specify which tasks are allowed or blocked across all pipelines. This enforces that only approved tasks are used. Option B is incorrect because assigning permissions to a task group only controls who can modify the group, not which tasks are used in pipelines. Option C is incorrect because while YAML templates can standardize tasks, they do not enforce mandatory usage; pipelines can still be created without the template. Option D is incorrect because service hooks only trigger notifications when an unapproved task is used, but do not block its usage.

Answer

Assign permissions to the task group to limit who can add tasks

Answer

Create a YAML template with the approved tasks and require all pipelines to use it

Answer

Configure a service hook to notify when an unapproved task is used

Question 18

You configured a multi-stage YAML pipeline with a deployment job that uses a deployment strategy like 'runOnce' or 'rolling'. You need to ensure that the deployment target is marked as 'succeeded' only after the deployment job completes successfully, and that any previous deployment to the same environment is preserved for rollback. Which setting must you configure?

Accepted Answer

Set the environment's 'retain' property to 1 or more. Setting the environment's 'retain' property to 1 or more ensures that the previous deployment (e.g., the last successful run) is preserved as a 'retained' revision in the environment. This allows you to redeploy that specific revision for rollback purposes. The deployment job marks the environment target as 'succeeded' only after the job completes successfully, and retaining previous revisions prevents them from being automatically cleaned up.

Answer

Set the deployment job's 'continueOnError' to true

Answer

Use the 'deployment' job with 'strategy: rolling'

Answer

Set the 'deploymentStrategy' to 'blueGreen'

Question 19

Your YAML pipeline uses the 'AzureResourceManagerTemplateDeployment' task to deploy ARM templates. You need to handle incremental deployments and ensure that the task fails if any resource already exists and cannot be updated. Which deployment mode should you specify?

Accepted Answer

Incremental. The 'Incremental' deployment mode in the AzureResourceManagerTemplateDeployment task handles only changes specified in the template, leaving existing resources unchanged. If a resource already exists and cannot be updated (e.g., due to a property conflict or immutable resource), the deployment fails, meeting the requirement to fail on such conflicts. This mode is the standard for additive, non-destructive ARM template deployments.

Answer

Complete

Answer

Validate

Answer

CreateOrUpdate

Question 20

Match each Azure DevOps security concept to its purpose.

Accepted Answer

Azure Active Directory: Used for identity and access management, including authentication to Azure DevOps.. Microsoft Entra ID manages user identities; PATs authenticate scripts; Service Principals authenticate automated services; Security Groups manage user permissions. Common confusions include mixing the roles of Microsoft Entra ID and Service Principals, or PATs with Security Groups.

Answer

Azure Active Directory: Used to authenticate automated pipelines to Azure resources.

Answer

Personal Access Token (PAT): Used to manage permissions for groups of users.