AZ-400 Practice Test 5 — 25 Questions

Question 1

Which TWO Azure DevOps features can be used to implement change management processes?

Accepted Answer

Release approval gates.. Release approval gates (Option B) in Azure Pipelines allow you to enforce manual or automated checks before a release proceeds to a stage, implementing change management by requiring sign-offs or validation against external systems. Audit logging (Option C) captures a chronological record of changes to Azure DevOps resources, providing an immutable trail for compliance and change review processes.

Answer

Test plans.

Answer

Project wiki.

Answer

Code search.

Question 2

Your organization uses Azure DevOps for a large-scale e-commerce platform. The source code is stored in a single Azure Repos Git repository with over 100 contributors. The current branching strategy is a modified GitFlow with main, develop, release, and hotfix branches. However, the team is experiencing frequent merge conflicts and long integration periods. You have been asked to redesign the branching strategy to support continuous integration and deployment (CI/CD) while ensuring high-quality releases. The new strategy must reduce merge conflicts, enable fast feedback, and support hotfixes. The team uses feature flags to manage incomplete features. Which branching strategy should you recommend?

Accepted Answer

Implement trunk-based development: developers work on short-lived feature branches (less than a day) and merge to main multiple times a day. Use feature flags to control release of incomplete features. Hotfixes are created from main and merged back quickly.. Trunk-based development with short-lived feature branches (less than a day) and frequent merging to main directly addresses the team's merge conflicts and long integration periods. Feature flags allow incomplete features to be merged safely, enabling continuous integration and fast feedback. Hotfixes from main are simple and quick. Option B is wrong because committing directly to main without branches increases risk of breaking the main branch, even with CI, and does not provide isolation for work-in-progress. Option C is wrong because using release branches introduces long-lived branches and delays integration, contrary to the need for fast feedback and continuous deployment. Option D is wrong because GitFlow's long-lived feature and release branches are the root cause of the frequent merge conflicts and integration delays.

Answer

Use a single main branch and allow developers to commit directly to main, but require all commits to be small and pass CI. Hotfixes are committed directly to main.

Answer

Use a single main branch and create release branches from main for each deployment. Feature branches are merged to release branches, and then release branches are merged to main after deployment.

Answer

Continue using GitFlow but enforce stricter branch policies and require more frequent merges.

Question 3

Your team uses Azure DevOps and needs to ensure that secrets are not exposed in pipeline logs. Which THREE practices should you implement?

Accepted Answer

Use logging commands to mask secrets in scripts. Azure DevOps provides a logging command, `##vso[task.setvariable variable=mySecret;isSecret=true]value`, which masks the variable's value in pipeline logs. This ensures that even if a script echoes the secret, it is replaced with asterisks, preventing accidental exposure during execution.

Answer

Enable pipeline log encryption

Answer

Store secrets in YAML variable files

Question 4

Which TWO actions are recommended practices for improving communication within a DevOps team?

Accepted Answer

Create a shared team charter with communication norms.. A shared team charter with communication norms establishes explicit expectations for how the team interacts, reducing ambiguity and fostering a culture of transparency and accountability. Daily stand-up meetings promote regular, synchronous communication, enabling quick updates, identification of blockers, and alignment on priorities. Both practices align with DevOps principles of collaboration and shared ownership. In contrast, separate documentation repositories, monthly email reports, and removing chat channels hinder real-time collaboration and transparency.

Answer

Use separate documentation repositories for each team.

Answer

Send monthly status reports via email.

Answer

Remove team chat channels to reduce noise.

Question 5

Your organization uses a monorepo in Azure Repos containing multiple microservices. You need to design a build pipeline that only builds and tests the services that have changed in a given commit, to optimize build times. The pipeline must trigger on any push to any branch, but only the affected services should be built. You also need to ensure that dependent services are rebuilt if their dependencies change. The services are located in subdirectories: /services/serviceA, /services/serviceB, etc. Each service has a Dockerfile and a unit test project. You plan to use a script to determine which services changed. Which approach should you use to implement this pipeline?

Accepted Answer

Use a script step to determine which services changed, then output variables to dynamically create a job matrix or use the 'each' keyword to iterate over changed services.. Use a script to determine which services changed, then output variables to dynamically create a job matrix. This satisfies the requirement to only build affected services and handle dependency rebuilding if the script includes dependency detection. Option B is wrong because it requires a stage for every service upfront and is less dynamic. Option C is wrong because it does not optimize build times. Option D is wrong because it creates all jobs and uses complex conditions to skip unchanged services.

Answer

Create a multi-stage pipeline where each stage represents a service, and use a 'dependsOn' condition to run stages only if the corresponding service changed.

Answer

Create a single job that runs all unit tests for all services on every commit. Use caching to speed up the build.

Answer

Create a job for each service that runs in parallel on every commit. Use conditions to skip jobs if the service has not changed, but the conditions would need to check every service, which is complex.

Question 6

Your team uses Azure DevOps to manage a monolithic .NET Framework application that is deployed to on-premises Windows servers. You plan to modernize the application by containerizing it and moving it to Azure Kubernetes Service (AKS). The existing build pipeline uses the .NET Framework build task and MSBuild. The release pipeline uses WinRM-based deployment to copy files to on-premises servers. You need to design a new CI/CD pipeline that builds a Docker image, pushes it to Azure Container Registry (ACR), and deploys it to AKS. Your solution should minimize changes to the existing codebase and leverage Azure Pipelines. What should you do?

Accepted Answer

Modify the existing build pipeline by adding a 'Docker' task to build and push the image, and modify the release pipeline to use a 'Kubernetes' task for deployment.. Adding a Docker task to build and push the image to ACR, and a Kubernetes task to deploy to AKS, minimally changes the existing pipelines. Option A is incorrect because building the Docker image via a script in the release pipeline is less integrated and does not leverage the build pipeline's Docker capabilities. Option C is incorrect because creating new pipelines from scratch is unnecessary and introduces more changes. Option D is incorrect because self-hosted agents are not required to build and push to ACR or deploy to AKS.

Answer

Keep the existing build pipeline as is, and add a script to build the Docker image in the release pipeline before deploying.

Answer

Create a new build pipeline from scratch using the 'Docker' template and a new release pipeline with the 'Deploy to Kubernetes' template.

Answer

Use self-hosted agents to build the Docker image and deploy to AKS.

Question 7

The exhibit shows a parameters file for an ARM template deployment. During a release pipeline, the deployment fails with the error 'The provided value for the template parameter 'sku' is not valid'. The ARM template defines the 'sku' parameter as an allowed value set of ['F1', 'D1', 'B1', 'S1']. What could be the issue?

Accepted Answer

The parameter file contains an extra space or hidden character in the 'sku' value.. The error indicates that the value provided for the 'sku' parameter is not within the allowed set ['F1','D1','B1','S1']. Even if the exhibit appears to show 'S1', the actual value might contain invisible characters (e.g., leading/trailing spaces, newline, tab, or a BOM) or a typographical variation (like a different dash or letter), causing it to not exactly match 'S1'. Option B is incorrect because a missing '$schema' property would produce a different error about the parameter file schema, not about parameter value validation. Option C is incorrect because defining 'sku' in the variables section would be a template error (or a different parameter-related error), and the error explicitly mentions the parameter 'sku', so it exists as a parameter. Option D is incorrect because an API version mismatch would cause a resource-manager-specific error about the API or resource, not the parameter value.

Answer

The parameter file is missing the '$schema' property.

Answer

The 'sku' parameter is defined in the 'variables' section instead of 'parameters'.

Answer

The ARM template expects a different API version for the resource.

Question 8

Your organization uses Azure DevOps and wants to enforce that all pipelines use a specific set of approved tasks. How can you achieve this?

Accepted Answer

Use the task restrictions feature in Azure DevOps to block unapproved tasks. Use the task restrictions feature in Azure DevOps to block unapproved tasks. Azure DevOps provides a 'Task restrictions' policy under Organization Settings > Policies > Add new policy, where you can specify which tasks are allowed or blocked across all pipelines. This enforces that only approved tasks are used. Option B is incorrect because assigning permissions to a task group only controls who can modify the group, not which tasks are used in pipelines. Option C is incorrect because while YAML templates can standardize tasks, they do not enforce mandatory usage; pipelines can still be created without the template. Option D is incorrect because service hooks only trigger notifications when an unapproved task is used, but do not block its usage.

Answer

Assign permissions to the task group to limit who can add tasks

Answer

Create a YAML template with the approved tasks and require all pipelines to use it

Answer

Configure a service hook to notify when an unapproved task is used

Question 9

Your organization uses GitHub Actions for CI/CD. You need to ensure that secrets stored in GitHub are not exposed in logs. A developer reports that a secret value appeared in the workflow run log. What is the most likely reason?

Accepted Answer

The secret was printed using a script that bypassed automatic masking.. GitHub Actions automatically masks secrets in log output, but this masking can be bypassed if the secret is printed via a script that outputs it directly (e.g., using `echo` with a variable that contains the secret value, or printing it in a manipulated form). The most likely reason the secret appeared is that the developer used a script that directly printed the secret value, bypassing the automatic masking. Option A is incorrect because the trigger type (repository_dispatch) does not affect logging. Option C is incorrect because secret names are not masked; only their values are masked. Option D is incorrect because the 'debug' log level does not disable masking; masking applies to all log levels.

Answer

The workflow was triggered via repository_dispatch.

Answer

The secret name was used in the log output.

Answer

The workflow used 'debug' log level.

Question 10

You configured a multi-stage YAML pipeline with a deployment job that uses a deployment strategy like 'runOnce' or 'rolling'. You need to ensure that the deployment target is marked as 'succeeded' only after the deployment job completes successfully, and that any previous deployment to the same environment is preserved for rollback. Which setting must you configure?

Accepted Answer

Set the environment's 'retain' property to 1 or more. Setting the environment's 'retain' property to 1 or more ensures that the previous deployment (e.g., the last successful run) is preserved as a 'retained' revision in the environment. This allows you to redeploy that specific revision for rollback purposes. The deployment job marks the environment target as 'succeeded' only after the job completes successfully, and retaining previous revisions prevents them from being automatically cleaned up.

Answer

Set the deployment job's 'continueOnError' to true

Answer

Use the 'deployment' job with 'strategy: rolling'

Answer

Set the 'deploymentStrategy' to 'blueGreen'

Question 11

Refer to the exhibit. A developer pushes a commit to a branch named 'feature/new-login'. Which of the following will occur?

Accepted Answer

The pipeline will not trigger because the branch is excluded.. The trigger includes main and release/* branches, and explicitly excludes feature/* branches. Since 'feature/new-login' matches the exclude pattern 'feature/*', the pipeline will not trigger. The pipeline will only trigger for branches that match include patterns and do not match exclude patterns. 'feature/new-login' is excluded, so no build will start.

Answer

The pipeline will trigger and run all steps because the branch name does not match any exclude pattern.

Answer

The pipeline will trigger only the restore and build steps, skipping tests.

Answer

The pipeline will trigger but fail with an error because the branch is not in the include list.

Question 12

Refer to the exhibit. You run an ARM template deployment and get the error shown. What is the most likely cause?

Accepted Answer

The template references a resource that already exists and conflicts with the deployment.. The error details show a Conflict with message 'User 'adminuser' already exists in this resource group.' This indicates the template tries to create a resource that already exists, causing a conflict.

Answer

The deployment name already exists in the resource group.

Answer

The resource group location does not match the template location.

Answer

The template has a syntax error in the JSON.

Question 13

Refer to the exhibit. A release pipeline deploys this ARM template. The deployment fails with error: 'The template parameters 'adminPassword' is not a valid input.' What is the most likely cause?

Accepted Answer

The parameter 'adminPassword' is not defined in the parameters section of the template.. The template references a parameter 'adminPassword' that is not defined in the parameters section. It must be declared as a parameter to be provided during deployment.

Answer

The VM size is not available in the specified location.

Answer

The resource group location is invalid.

Answer

The parameter 'adminPassword' is misspelled in the template.

Question 14

Your Azure DevOps organization has multiple projects. You need to ensure that only approved extension versions are installed across all projects. What is the most efficient way to enforce this?

Accepted Answer

Use the Azure DevOps extension management settings to mark approved extensions and block others.. Azure DevOps provides extension management settings at the organization level where administrators can mark specific extensions as approved and block all others. This is the most efficient way to enforce approved extension versions across all projects. Option A is wrong because extensions cannot be restricted to specific pipelines via YAML; YAML can only reference tasks from installed extensions. Option C is wrong because Azure Policy does not manage Azure DevOps extensions; it manages Azure resources. Option D is wrong because uninstalling extensions per project is inefficient and does not enforce approved versions globally.

Answer

Restrict extension usage to specific pipelines via YAML.

Answer

Create an Azure Policy that audits extension installations.

Answer

Uninstall all extensions and only install them per project as needed.

Question 15

Your team uses Azure Pipelines to build a .NET application. Recently, builds have been failing intermittently with NuGet restore errors. The pipeline uses a hosted agent. You need to ensure consistent package restoration. What should you do?

Accepted Answer

Use a self-hosted agent with persistent NuGet package caches.. Using a self-hosted agent with persistent NuGet package caches ensures that packages are not re-downloaded on each build, avoiding intermittent network failures. Option B would clear the cache and force re-download, worsening the issue. Option C is for Docker builds, not NuGet. Option D is unrelated to package restoration.

Answer

Clear the NuGet cache in the pipeline using 'dotnet nuget locals all --clear' before restore.

Answer

Enable multi-stage Docker builds for the application.

Answer

Configure the pipeline to use the Dapr sidecar for package management.

Question 16

Your YAML pipeline uses the 'AzureResourceManagerTemplateDeployment' task to deploy ARM templates. You need to handle incremental deployments and ensure that the task fails if any resource already exists and cannot be updated. Which deployment mode should you specify?

Accepted Answer

Incremental. The 'Incremental' deployment mode in the AzureResourceManagerTemplateDeployment task handles only changes specified in the template, leaving existing resources unchanged. If a resource already exists and cannot be updated (e.g., due to a property conflict or immutable resource), the deployment fails, meeting the requirement to fail on such conflicts. This mode is the standard for additive, non-destructive ARM template deployments.

Answer

Complete

Answer

Validate

Answer

CreateOrUpdate

Question 17

Refer to the exhibit. A developer commits code to the 'develop' branch. The pipeline does not trigger. What is the most likely reason?

Accepted Answer

The trigger is configured to only run on the 'main' branch.. The trigger is set to 'main' branch only. Commits to 'develop' will not trigger the pipeline.

Answer

The pipeline requires a manual trigger.

Answer

The pipeline has a CI trigger disabled.

Answer

The pool 'ubuntu-latest' is not available.

Question 18

Your team uses GitFlow with Azure Repos. You need to ensure that every commit to the 'main' branch is built and deployed to production automatically. Which trigger should you configure in your YAML pipeline?

Accepted Answer

trigger:
  branches:
    include:
    - main. A branch-specific trigger defined with `trigger: branches: include: - main` will automatically run the pipeline on every commit to the 'main' branch. Option A is wrong because `trigger: none` disables CI triggers entirely, so the pipeline will not start on any commits. Option C is wrong because a scheduled trigger (`schedules:`) runs the pipeline at specific times, not in response to commits. Option D is wrong because a PR trigger (`pr:`) runs the pipeline when a pull request is created or updated, not on direct commits to 'main'.

Answer

Trigger: none

Answer

schedules:
- cron: "0 0 * * *"
  branches:
    include:
    - main

Answer

pr:
  branches:
    include:
    - main

Question 19

Your release pipeline deploys to Azure App Service using slots. You need to ensure that after swapping, the warmup request is sent to the production slot before traffic is fully routed. What should you configure?

Accepted Answer

Enable auto swap for the deployment slot and configure a custom warmup path.. Enabling auto swap with a custom warmup path sends a warmup request to the target slot before the swap completes, ensuring the production slot is warmed up. Option B is incorrect because a health check is used for monitoring instance health, not for warmup before swap. Option C is incorrect because a manual swap does not include automatic warmup; you would need to implement custom logic. Option D is incorrect because slot-specific app settings are sticky and not swapped; they do not enable warmup.

Answer

Add a health check to the App Service.

Answer

Perform a manual swap and then send a warmup request via a script.

Answer

Configure slot-specific app settings to enable warmup.

Question 20

Refer to the exhibit. You are reviewing an ARM template used in an Azure Pipeline deployment. Which security concern should you address?

Accepted Answer

The admin password is hardcoded in the template. The admin password is hardcoded in plain text in the ARM template, which is a significant security vulnerability. Passwords should be stored securely using Azure Key Vault or referenced as secure parameters. Option A is incorrect because VM size is not a security concern. Option B is incorrect because the apiVersion is valid. Option D is incorrect because a default value for location is acceptable.

Answer

The VM size is too small for production

Answer

The apiVersion is outdated

Answer

The location parameter has a default value