AZ-400 Practice Test 4 — 25 Questions

Question 1

You have a YAML pipeline that builds a Docker image and pushes it to Azure Container Registry (ACR). You need to ensure the pipeline uses the latest version of Docker and that the build is cached for faster subsequent runs. Which two tasks should you include? (Choose two.)

Accepted Answer

DockerInstaller@0. Option A (DockerInstaller@0) is correct because it ensures the pipeline uses the latest version of Docker by installing or upgrading the Docker engine on the build agent. Option B (Docker@2 with --cache-from) is correct because it enables layer caching by pulling the previously built image from ACR as a cache source, which speeds up subsequent builds by reusing unchanged layers.

Answer

DockerCompose@0

Answer

HelmDeploy@0

Question 2

Match each Azure DevOps concept to its correct description.

Accepted Answer

Build pipeline. Option A (Build pipeline) matches 'compiles code', Option B (Release pipeline) matches 'deploys', Option C (Task) matches 'a single action', Option D (Variable) matches 'holds values', Option E (Trigger) matches 'starts pipeline'.

Question 3

A company deploys a .NET Core web application to Azure App Service. The application uses Application Insights for monitoring. The operations team reports that dependency tracking is missing for calls to a third-party REST API made using HttpClient. The application is instrumented with the Application Insights SDK. Which action should be taken to enable dependency tracking for HttpClient calls?

Accepted Answer

Ensure the SDK is configured using services.AddApplicationInsightsTelemetry(); in the Startup.cs file.. Option A is correct because `services.AddApplicationInsightsTelemetry()` in `Startup.cs` automatically registers the `DependencyTrackingModule` for .NET Core applications. This module collects dependency telemetry for `HttpClient` calls made via `IHttpClientFactory` or typed `HttpClient` instances, provided the SDK is properly configured. Since the application already uses the Application Insights SDK, this single line enables automatic dependency tracking without additional packages or agents.

Answer

Install the Application Insights Agent on the App Service instance.

Answer

Add a reference to Microsoft.ApplicationInsights.DependencyCollector and call DependencyTrackingModule.Initialize().

Answer

Use the Application Insights Status Monitor to enable dependency tracking.

Question 4

You have a YAML pipeline with multiple jobs that need to run in parallel. However, one job depends on artifacts produced by a previous job. How should you configure the dependency?

Accepted Answer

Set dependsOn on the dependent job and use PublishBuildArtifacts and DownloadBuildArtifacts tasks.. Option A is correct because in Azure DevOps YAML pipelines, job dependencies are explicitly declared using the `dependsOn` keyword, and artifacts must be published and downloaded using `PublishBuildArtifacts` and `DownloadBuildArtifacts` tasks (or the `publish` and `download` pipeline decorators). Without explicit artifact sharing, outputs from one job are not automatically available to another job, even if `dependsOn` is set.

Answer

Use the 'dependsOn' keyword only, artifacts are automatically shared.

Answer

Set the 'condition' to 'eq(variables['Agent.JobStatus'], 'Succeeded')' on the dependent job.

Answer

Use the 'pool' keyword to ensure both jobs run on the same agent.

Question 5

Your YAML pipeline uses a self-hosted agent pool. You need to ensure that only the pipeline can trigger builds on that pool, preventing other projects from using it. What should you do?

Accepted Answer

Configure pipeline permissions in the agent pool security settings. Option B is correct because Azure DevOps agent pool security settings allow you to restrict which pipelines or projects can use a specific agent pool. By configuring pipeline permissions, you can grant the 'Use' permission only to the intended pipeline, preventing other projects from triggering builds on that pool. This ensures exclusive access without disabling the pool for all other uses.

Answer

Set the agent pool to 'Disabled' for other projects

Answer

Use a deployment group instead of an agent pool

Answer

Create a separate agent pool for each project

Question 6

You are designing a pipeline that deploys to an Azure Kubernetes Service (AKS) cluster. You need to securely pass the Kubernetes cluster credentials to the pipeline without hardcoding them. Which approach should you use?

Accepted Answer

Use a variable group linked to Azure Key Vault.. Option B is correct because Azure Key Vault provides a secure, centralized store for secrets like Kubernetes cluster credentials, and linking a variable group to Key Vault allows the pipeline to dynamically retrieve those secrets at runtime without exposing them in the pipeline definition or logs. This approach follows the principle of least privilege and ensures credentials are never hardcoded or stored in plaintext within the pipeline.

Answer

Store credentials in a pipeline variable with 'secret' type.

Answer

Hardcode the credentials in the pipeline YAML.

Answer

Use a secure file in the pipeline library.

Question 7

You configured a multi-stage YAML pipeline with a deployment job that uses a deployment strategy like 'runOnce' or 'rolling'. You need to ensure that the deployment target is marked as 'succeeded' only after the deployment job completes successfully, and that any previous deployment to the same environment is preserved for rollback. Which setting must you configure?

Accepted Answer

Set the environment's 'retain' property to 1 or more. Option A is correct because setting the environment's 'retain' property to 1 or more ensures that the previous deployment (e.g., the last successful run) is preserved as a 'retained' revision in the environment. This allows you to redeploy that specific revision for rollback purposes. The deployment job marks the environment target as 'succeeded' only after the job completes successfully, and retaining previous revisions prevents them from being automatically cleaned up.

Answer

Set the deployment job's 'continueOnError' to true

Answer

Use the 'deployment' job with 'strategy: rolling'

Answer

Set the 'deploymentStrategy' to 'blueGreen'

Question 8

You are designing a build pipeline that produces a NuGet package. The pipeline must conditionally sign the assembly only when the build is triggered by a tag starting with 'v' (e.g., v1.0.0). The pipeline uses a script task that signs the assembly. Which expression should you use in the condition of the script task?

Accepted Answer

and(succeeded(), startsWith(variables['Build.SourceBranch'], 'refs/tags/v')). Option A is correct because the condition uses `startsWith(variables['Build.SourceBranch'], 'refs/tags/v')` to check if the build was triggered by a tag whose full Git ref starts with `refs/tags/v`. This ensures the signing script runs only when the source branch is a tag reference matching the 'v' prefix, which is the standard way to identify version tags in Azure Pipelines. The `and(succeeded(), ...)` wrapper guarantees the previous tasks completed successfully before signing.

Answer

and(succeeded(), startsWith(variables['Build.SourceBranchName'], 'v'))

Answer

and(succeeded(), startsWith(variables['Build.SourceVersion'], 'v'))

Answer

and(succeeded(), eq(variables['Build.Reason'], 'IndividualCI'))

Question 9

Which two actions can you use to validate that a deployment to a staging environment is successful before promoting to production? (Choose two.)

Accepted Answer

Configure gates on the staging environment to check health metrics.. Gates with health checks can monitor metrics like error rates before allowing promotion. Manual intervention with a post-deployment approval also allows a human to validate before proceeding. Both are valid methods.

Answer

Add a manual intervention task in the pipeline.

Answer

Use a pull request to validate the deployment.

Answer

Run a load test as part of the pipeline.

Question 10

Your YAML pipeline uses the 'AzureResourceManagerTemplateDeployment' task to deploy ARM templates. You need to handle incremental deployments and ensure that the task fails if any resource already exists and cannot be updated. Which deployment mode should you specify?

Accepted Answer

Incremental. The 'Incremental' deployment mode in the AzureResourceManagerTemplateDeployment task handles only changes specified in the template, leaving existing resources unchanged. If a resource already exists and cannot be updated (e.g., due to a property conflict or immutable resource), the deployment fails, meeting the requirement to fail on such conflicts. This mode is the standard for additive, non-destructive ARM template deployments.

Answer

Complete

Answer

Validate

Answer

CreateOrUpdate

Question 11

You need to create a build pipeline that runs on a Microsoft-hosted agent. You want to use the latest Ubuntu image. Which YAML snippet should you use?

Accepted Answer

pool: vmImage: 'ubuntu-latest'. Option A is correct because in Azure Pipelines YAML, the `pool` keyword is used to specify the agent pool, and `vmImage` is a sub-property that defines the virtual machine image for Microsoft-hosted agents. Setting `vmImage: 'ubuntu-latest'` within the `pool` section selects the latest Ubuntu LTS image provided by Microsoft, ensuring the build runs on a current, maintained environment.

Answer

pool: name: 'ubuntu-latest'

Answer

agent: vmImage: 'ubuntu-latest'

Answer

resources: vmImage: 'ubuntu-latest'

Question 12

Which TWO are valid strategies for managing secrets in a GitHub Actions workflow?

Accepted Answer

Use OpenID Connect to authenticate to Azure without storing any credentials.. Option A is correct because OpenID Connect (OIDC) allows GitHub Actions to exchange a short-lived token directly with Azure without storing any long-lived credentials as secrets. This eliminates the need to manage and rotate client secrets or service principal passwords, reducing the risk of credential leakage. The workflow uses the `azure/login` action with `client-id`, `tenant-id`, and `subscription-id` parameters, and Azure trusts the OIDC token issued by GitHub.

Answer

Hardcode the secret in the YAML file.

Answer

Set the secret as an environment variable in the runner's shell profile.

Answer

Base64-encode the secret and include it directly in the workflow file.

Question 13

Your team is designing a build pipeline for a Java application that uses Maven. The pipeline must run unit tests and integration tests separately, and fail the build if integration tests fail. However, integration tests require a running database container. Which approach should you use to ensure the database is available for the integration tests?

Accepted Answer

Use a Docker Compose task in the pipeline to start the database container before running integration tests.. Option A is correct because Docker Compose allows you to define and start a database container as a dependency before running integration tests in a build pipeline. By using a Docker Compose task, you can ensure the database container is running in a clean, isolated environment, and the pipeline can fail the build if the integration tests fail. This approach is ideal for CI/CD pipelines where ephemeral, disposable infrastructure is needed for testing.

Answer

Configure the pipeline to use a self-hosted agent that has the database already installed and running.

Answer

Install the database as a service in the pipeline using the Service Fabric task.

Answer

Use a PowerShell script in the pipeline to install and start the database on the build agent.

Question 14

You are designing a source control strategy for a team that uses GitHub Copilot. The team wants to ensure that code suggestions do not include sensitive data. Which approach should you recommend?

Accepted Answer

Configure content exclusions in GitHub Copilot settings to block sensitive data patterns. Option D is correct because GitHub Copilot's content exclusions allow you to define patterns (e.g., regex for API keys, tokens, or PII) that Copilot will block from being used as context for code suggestions. This directly prevents sensitive data from appearing in suggestions without disabling the tool entirely. It is the most targeted and least disruptive approach to meet the team's goal.

Answer

Use pre-commit hooks to scan for secrets

Answer

Disable GitHub Copilot for the organization

Answer

Enable secret scanning for the repository

Question 15

Which TWO tasks can be used to run unit tests in an Azure Pipeline?

Accepted Answer

DotNetCoreCLI@2. The DotNetCoreCLI@2 task can run unit tests for .NET Core and .NET 5+ projects by invoking the 'dotnet test' command, which discovers and executes tests in the specified project files. The VSTest@2 task runs unit tests using the Visual Studio Test Runner, supporting a wide range of test frameworks (MSTest, xUnit, NUnit) and can run tests from assemblies or test containers. Both tasks are designed specifically for executing unit tests within an Azure Pipeline, making them the correct choices.

Answer

NuGetCommand@2

Answer

PublishBuildArtifacts@1

Answer

CopyFiles@2

Question 16

Your release pipeline deploys a web app to Azure App Service. You need to implement safe deployment practices that minimize downtime and enable quick rollback. Which THREE strategies should you recommend?

Accepted Answer

Deploy to a staging slot first, validate, then swap.. Option A is correct because deploying to a staging slot first allows you to validate the application in a production-like environment without affecting live traffic. Once validated, swapping the staging and production slots ensures zero-downtime deployment by instantly routing all traffic to the validated version. This is a core safe deployment practice for Azure App Service.

Answer

Use rolling deployment with manual step to approve each instance.

Answer

Deploy directly to the production slot.

Question 17

Your company uses Azure Key Vault to store secrets. Which TWO actions should you take to ensure secure access? (Select TWO.)

Accepted Answer

Restrict access using Key Vault access policies. Restricting access using Key Vault access policies (Option A) is correct because Azure Key Vault uses a granular permission model where you assign specific permissions (e.g., GET, LIST, SET) to individual security principals (users, groups, or service principals) at the vault level. This ensures that only authorized identities can read or manage secrets, keys, and certificates, following the principle of least privilege. Using managed identities (Option B) is correct because they provide an automatically managed identity in Azure AD for applications to authenticate to Key Vault without storing credentials in code or configuration, eliminating the risk of secret leakage.

Answer

Enable HTTP access for performance

Answer

Disable audit logging to reduce exposure

Answer

Enable soft-delete to recover deleted secrets

Question 18

Your organization is implementing a security compliance plan for Azure DevOps. Which TWO actions help enforce the principle of least privilege?

Accepted Answer

Use Azure DevOps security groups to grant minimal permissions. Option B is correct because Azure DevOps security groups allow administrators to assign specific permissions to groups rather than individuals, enabling granular control over who can perform actions like editing work items or managing pipelines. This directly supports the principle of least privilege by ensuring users have only the permissions necessary for their role. Option D is correct because restricting agent pool creation to a small admin team prevents unauthorized users from deploying agents that could execute arbitrary code or access sensitive resources, which is a common attack vector in CI/CD environments.

Answer

Allow all team members to edit security permissions

Answer

Use built-in roles without customizing

Answer

Grant Project Collection Administrators group to all developers

Question 19

An organization uses Azure DevOps and wants to implement a change management process where all changes to the main branch require approval from a change advisory board (CAB). The CAB members are not part of the development team. How should they configure this?

Accepted Answer

Create a new branch policy on main that requires a minimum number of reviewers from a separate CAB group.. Option B is correct because Azure DevOps branch policies allow you to enforce a minimum number of reviewers from a specific security group (e.g., a CAB group) on pull requests targeting the main branch. This ensures that every change to main requires explicit approval from CAB members, who are separate from the development team, without relying on manual processes or altering team membership.

Answer

Set branch permissions to restrict push to main and only allow CAB to approve via manual process.

Answer

Use a service hook to notify CAB when a PR is created, and rely on manual approval.

Answer

Add the CAB as members of the development team and require team review.

Question 20

Your team uses GitHub. You need to automatically remove a user's access to all repositories when they leave the company. What is the most efficient approach?

Accepted Answer

Enable SCIM provisioning from Microsoft Entra ID to GitHub. SCIM (System for Cross-domain Identity Management) provisioning from Microsoft Entra ID to GitHub automates user lifecycle management. When a user is disabled or removed from Entra ID, SCIM automatically deprovisions their access across all GitHub resources, including repositories, without manual intervention. This is the most efficient approach because it is event-driven and scales to thousands of users.

Answer

Assign the user to a 'Leaver' team and remove all repository permissions

Answer

Manually remove the user from each repository

Answer

Configure SAML single sign-on (SSO) with Microsoft Entra ID