AZ-400 Practice Test 26 — 15 Questions

Question 1

You are a DevOps engineer for a financial services company with strict regulatory compliance requirements (e.g., PCI-DSS, SOX). The company uses Azure DevOps for CI/CD and manages multiple projects. Each project has its own set of service connections, variable groups, and agent pools. The security team recently audited the environment and found that several service connections have been granted Contributor rights at the subscription level, and some variable groups are accessible by all pipelines across all projects. Additionally, audit logs show that a former employee's service principal still has active service connections in two projects. You need to implement a security and compliance plan to address these issues. Which approach should you take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement Azure Policy to enforce that service connections cannot have subscription-level Contributor role; instead, require specific resource group roles. Use Azure AD access reviews to automatically remove stale service principals. Use pipeline decorators to enforce branch policy and approval checks on variable groups that contain secrets.. It provides a comprehensive, automated, and scalable approach to enforcing least privilege and compliance. Azure Policy can audit and enforce that service connections are scoped to resource groups rather than subscriptions, preventing over-permissioned Contributor access. Microsoft Entra ID access reviews automate the detection and removal of stale service principals, addressing the former employee issue without manual effort. Pipeline decorators enforce mandatory approval checks and branch policies on variable groups containing secrets, ensuring that sensitive variables are not accessible to all pipelines across projects.

Answer

Conduct a manual audit of all service connections and variable groups every quarter, and revoke any permissions that are not needed. Disable service connections associated with the former employee.

Answer

Immediately delete all service connections associated with the former employee and recreate them using service principals with the least privilege. Then, update all pipelines to use the new connections.

Answer

Restrict all service connections to use resource-group level scoped permissions instead of subscription-level. For variable groups, set them to be accessible only to specific pipelines.

Question 2

Your team uses Azure Pipelines for CI/CD. You need to ensure that only approved branches can trigger production deployments. Which feature should you use?

Accepted Answer

Branch control for environments. Branch control for environments in Azure Pipelines allows you to restrict which branches can trigger deployments to specific environments, such as production. By configuring branch filters on an environment, you ensure that only approved branches (e.g., main or release branches) can initiate a production deployment, providing a security and governance boundary.

Answer

YAML template expressions

Answer

Deployment gates

Answer

Pipeline decorators

Question 3

Your team uses Azure Pipelines with GitHub for source control. You need to ensure that whenever a pull request is created against the main branch, a validation build runs automatically. Which YAML trigger should you configure in the pipeline?

Accepted Answer

pr: branches: include: - main. The correct syntax for a pull request trigger in Azure Pipelines YAML. The `pr` trigger requires a `branches` node with `include` or `exclude`, and the verbose form `pr: branches: include: - main` is fully valid. Option B, `pr: main`, is not valid YAML syntax for Azure Pipelines; the shorthand `pr: main` is not recognized and will cause the pipeline to ignore the trigger. Options C and D use the `trigger` keyword, which is for CI builds on push, not for PR validation.

Answer

pr: main

Answer

trigger: branches: exclude: - main

Answer

trigger: main

Question 4

Match each Azure Pipeline concept to its definition.

Accepted Answer

Pipeline: A collection of stages that defines the CI/CD process.. The correct matches are: A: Pipeline → 'A collection of stages that defines the CI/CD process' (correct); B: Stage → 'A logical boundary in the pipeline used to group jobs' (correct); C: Job → 'A unit of work that runs on an agent' (correct); D: Task → 'A single operation to perform in a job' (correct). E is incorrect because Pipeline is not a logical boundary; that definition belongs to Stage. F is incorrect because Stage is not a collection of stages; that definition belongs to Pipeline. The most common confusion is swapping the definitions of Pipeline and Stage.

Answer

Pipeline: A logical boundary in the pipeline used to group jobs.

Answer

Stage: A collection of stages that defines the CI/CD process.

Question 5

Your Azure DevOps project uses a self-hosted agent pool. Users report that builds are randomly failing with a 'disk full' error. The agents have 50 GB of disk space. What is the most effective way to mitigate this issue?

Accepted Answer

Enable the 'Clean after build' option on the build pipeline. Enabling 'Clean after build' ensures workspace cleanup after each run, reclaiming disk space to prevent failures. Option A is wrong because adding more agents doesn't free disk space on existing agents. Option B is wrong because 'Clean all build directories' cleans before builds, which may not prevent mid-build disk full errors and can disrupt parallel builds. Option D is wrong because limiting parallel jobs doesn't free disk space; a single build can still consume all available disk space.

Answer

Add more agents to the pool

Answer

Use the 'Clean all build directories' option in the agent configuration

Answer

Set 'Maximum number of parallel jobs' to 1

Question 6

Refer to the exhibit. A developer queues a build manually but notices the build status remains 'notStarted' for an extended period. The pipeline has no demands and priority is normal. Which is the most likely cause?

Accepted Answer

All agents in the pool are currently busy.. When a build remains in 'notStarted' status for an extended period, it typically means the pipeline is waiting for an available agent. Since the pipeline has no demands and priority is normal, the most likely cause is that all agents in the specified agent pool are currently busy executing other jobs, so the build is queued until an agent becomes free.

Answer

The variable 'BuildConfiguration' is misspelled.

Answer

The branch 'main' does not exist.

Answer

The pipeline definition ID is incorrect.

Question 7

Your team uses Azure Pipelines to build a .NET Core application. You notice that the build takes too long because it restores NuGet packages every time. What is the best way to improve build performance?

Accepted Answer

Enable the 'Cache' task to cache the NuGet packages folder. The best way to improve build performance is to cache the NuGet packages folder using the 'Cache' task in Azure Pipelines. This avoids re-downloading packages on each run. Option A (self-hosted agent) is not guaranteed to cache the packages folder across builds unless caching is explicitly configured. Option B (faster network) may help but doesn't eliminate the restore time. Option C (larger SKU) improves CPU/memory but does not cache packages. Therefore, option D is correct.

Answer

Configure the build to use a self-hosted agent with previously restored packages

Answer

Use a private agent with a faster network connection

Answer

Use a Microsoft-hosted agent with a larger SKU

Question 8

A developer reports that their Azure DevOps pipeline is failing with 'Access denied' when trying to push to a protected branch. The branch policy requires a successful build and approval from the 'Code Owners' group. The developer is a member of 'Contributors' but not 'Code Owners'. What is the most likely cause?

Accepted Answer

The developer is not in the 'Code Owners' group allowed to bypass the policy.. The branch policy requires membership in the 'Code Owners' group to push directly to the branch. The developer is not a member, so they get 'Access denied'. Option A (invalid characters) would cause a different error. Option B (pipeline service principal lacking permission) is unrelated to the developer's push. Option C (lacking 'Contribute' permissions at project level) is less specific and would result in a different error; the error here is specifically due to branch policy enforcement.

Answer

The branch name contains invalid characters.

Answer

The pipeline's service principal lacks 'Create Branch' permission.

Answer

The developer lacks 'Contribute' permissions at the project level.

Question 9

Which TWO actions can you take to improve the security of secrets in Azure Pipelines? (Choose two.)

Accepted Answer

Limit variable group permissions to specific pipelines. Limiting variable group permissions to specific pipelines ensures that only authorized pipelines can access sensitive secrets, reducing the risk of unauthorized exposure. Option D is correct because Azure Key Vault provides a centralized, auditable, and encrypted store for secrets, and mapping them as secret variables in Azure Pipelines prevents the secret values from being exposed in logs or output.

Answer

Log secret values for debugging purposes

Answer

Allow pipeline users to override secret values at queue time

Answer

Store secrets as plain text variables in the pipeline

Question 10

You are designing a release pipeline that deploys to multiple environments (dev, test, prod) sequentially. You need to require manual approval before deploying to prod. The approver should be able to review the changes and approve or reject. Which feature should you use?

Accepted Answer

Pre-deployment conditions.. In Azure DevOps release pipelines, to require manual approval before deploying to a specific stage, you configure the pre-deployment conditions of that stage, specifically assigning pre-deployment approvers. These approvers can review the changes and then approve or reject the deployment. This satisfies the requirement directly.

Answer

Environment checks.

Answer

Approval gates.

Answer

Manual intervention task.

Question 11

Which THREE options are valid strategies for implementing progressive exposure in Azure Pipelines?

Accepted Answer

Ring-based deployment.. Ring-based deployment, canary deployment, and blue-green deployment are all valid strategies for progressive exposure. Ring-based deployment gradually rolls out to increasing groups of users (rings), often using deployment gates and percentage-based rollout. Canary deployment routes a small percentage of traffic to the new version before increasing it, allowing monitoring and rollback. Blue-green deployment runs two identical environments (blue and green) and switches traffic from the old to the new version, enabling immediate rollback. These strategies all provide controlled, incremental exposure to validate changes before full rollout.

Answer

Rolling update.

Answer

Immutable infrastructure.

Question 12

Your team uses Azure DevOps and wants to automatically scan pull requests for secrets before they are merged. Which Azure DevOps feature should you use?

Accepted Answer

GitHub Advanced Security.. GitHub Advanced Security (GHAS) for Azure DevOps provides secret scanning that automatically detects secrets (e.g., API keys, passwords, connection strings) in pull requests before they are merged. This feature is integrated into Azure Repos when Advanced Security is enabled and triggers on PR creation, blocking the merge if secrets are found. Therefore, the correct choice is GitHub Advanced Security, not a separate 'Secret scanning in Azure DevOps' feature, which does not exist as a native built-in feature.

Answer

Azure Policy.

Answer

Secret scanning in Azure DevOps.

Answer

Branch policy with a required reviewer.

Question 13

Which TWO are best practices when configuring alerts in Azure Monitor for a production application?

Accepted Answer

Use dynamic thresholds for metrics with seasonal patterns.. Dynamic thresholds in Azure Monitor use machine learning to automatically detect and adjust alert thresholds based on historical patterns, making them ideal for metrics with seasonal or cyclical behavior (e.g., CPU usage that spikes during business hours). This reduces alert noise and manual tuning effort compared to static thresholds.

Answer

Use metric alerts only for simple threshold-based conditions.

Answer

Create separate alert rules for each condition to avoid complexity.

Answer

Ensure each alert rule uses a unique action group to isolate notifications.

Question 14

Your organization uses GitHub for code and GitHub Actions for CI/CD. You want to enforce that all workflows include a 'codeql-analysis' job for security scanning. What is the best approach?

Accepted Answer

Use GitHub's required workflows feature to mandate specific workflows. GitHub's required workflows feature allows organization owners to enforce that specific workflows (like a CodeQL analysis) run on all repositories in the organization, ensuring consistent security scanning without relying on templates or manual setup. This is the only approach that centrally mandates the workflow's presence and execution across all repositories, even if developers create new workflows or modify existing ones.

Answer

Create a workflow template and add it to the organization's workflow templates directory

Answer

Use branch protection rules to require a status check named 'codeql-analysis'

Answer

Create a custom GitHub Action that runs CodeQL and require it in all workflows

Question 15

The exhibit shows a draft Azure Monitor alert rule for Key Vault secret expiry. However, the query fails to return results for secrets that have already expired. What is the most likely reason?

Accepted Answer

The condition `DaysToExpiry > 0` excludes secrets that have already expired.. The query filters on `DaysToExpiry > 0`, which only returns secrets with a positive number of days remaining until expiry. Once a secret has expired, its `DaysToExpiry` becomes zero or negative, so it is excluded from the results. This is a logical filter error: the condition should be `DaysToExpiry <= 0` or remove the filter entirely to include expired secrets.

Answer

The query does not include secrets that have no expiry date set.

Answer

The query only checks secrets that are enabled.

Answer

The `limit 10` clause restricts to only 10 secrets, which may miss expired ones.