AZ-400 Practice Test 26 — 15 Questions

Question 1

Refer to the exhibit. This multi-stage YAML pipeline has a variable 'publishEnabled' set to false. The team wants the Publish stage to run only when 'publishEnabled' is true. However, the Publish stage never runs, even when the variable is changed to true at queue time. What is the most likely cause?

Accepted Answer

The variable 'publishEnabled' is not settable at queue time; it is a compile-time variable.. In YAML pipelines, variables defined in the 'variables' section are compile-time and cannot be overridden at queue time unless they are marked as 'queue-time' settable. The condition 'eq(variables['publishEnabled'], true)' evaluates at runtime, but the variable value is fixed at compile time. Option C is correct. Option A is incorrect because 'dependsOn' is correct. Option B is incorrect because the condition syntax is valid. Option D is incorrect because the variable is not runtime-settable.

Answer

The condition syntax is wrong; it should use 'eq(variables.publishEnabled, true)'.

Answer

The Publish stage is missing 'dependsOn: Build'.

Answer

The 'dependsOn' syntax is incorrect; it should be 'dependsOn: Build'.

Question 2

You have a multi-stage pipeline that deploys to multiple regions. You want to ensure that if the deployment to one region fails, the pipeline does not proceed to the next region. What is the best way to implement this?

Accepted Answer

Define stage dependencies with 'dependsOn' and set 'condition' to 'succeeded()'.. Using a multi-stage YAML pipeline with stage dependencies ensures stages run sequentially and stop on failure. Option A is wrong because parallel stages continue independently. Option B is wrong because pipeline decorators inject steps but don't handle dependencies. Option C is wrong because manual approvals don't automatically stop on failure.

Answer

Use pipeline decorators to inject error handling steps.

Answer

Add a manual approval between regions.

Answer

Configure each region deployment as a separate stage with no dependencies.

Question 3

Refer to the exhibit. The pipeline YAML includes an Azure CLI script that sets an app setting on a Web App. The pipeline fails with an authentication error. What is the most likely cause?

Accepted Answer

The pipeline does not have an Azure service connection configured for authentication.. The Azure CLI script requires authentication to Azure. Without an Azure CLI task or service connection, it fails. Option A is wrong because the resource group name is correct. Option B is wrong because the script syntax is valid. Option D is wrong because the script is not missing any parameters; it lacks authentication.

Answer

The resource group name is incorrect.

Answer

The DEPLOYMENT_SLOT setting name is invalid.

Answer

The script syntax is invalid.

Question 4

Your team uses GitHub Actions for CI/CD. You need to enforce that all pull requests to the main branch pass a required status check that runs a security scan. The security scan is a GitHub Action that runs on pull_request events. However, the status check is not appearing as required in the branch protection rules. What should you do?

Accepted Answer

Ensure the workflow has a name that matches the status check name in the branch protection rule.. Option C is correct because the workflow must have a name that matches the status check name used in branch protection rules. Often the workflow name is different from the job name or the check suite name. Option A is incorrect because the event type is correct. Option B is incorrect because the YAML is valid for pull_request events. Option D is incorrect because the action is not a third-party problem.

Answer

Add 'types: [opened, synchronize]' to the pull_request trigger.

Answer

Change the trigger from 'pull_request' to 'pull_request_target'.

Answer

Use a GitHub App instead of the default GITHUB_TOKEN for the action.

Question 5

Which TWO are best practices for securing Azure Pipelines? (Choose two.)

Accepted Answer

Use variable groups linked to Azure Key Vault for secrets.. Options B and D are correct. Option B: Using variable groups with secret variables from Azure Key Vault ensures secrets are not stored in YAML. Option D: Service connections with 'Contributor' role scoped to a resource group limit blast radius. Option A is unnecessary and insecure. Option C is not a security best practice. Option E is not a security practice.

Answer

Grant 'Administrator' role to all service connections for ease of management.

Answer

Store all pipeline variables in the YAML file as plain text.

Answer

Disable pipeline logging for all jobs.

Question 6

Refer to the exhibit. You have this Azure Pipeline YAML. When you run the pipeline, it fails because the resource group name is not correctly resolved. What is the likely cause?

Accepted Answer

The variable 'resourceGroupName' uses $(environment) which cannot reference a parameter.. Option A is correct. In Azure Pipelines, variables defined in YAML using 'variables' can reference parameters using ${{ parameters.environment }} but not $(environment). The macro syntax $(variable) is for runtime variables, but 'environment' is a parameter. So $(environment) is not resolved. Option B is incorrect because parameters can be used in templates. Option C is not the issue. Option D is incorrect because the script type is valid.

Answer

The script type 'pscore' is not supported on Ubuntu.

Answer

Parameters cannot be used in YAML pipelines; they must be defined in a template.

Answer

The 'trigger: none' prevents the pipeline from running.

Question 7

Which TWO of the following are valid strategies to reduce the build time of a container image in Azure Pipelines?

Accepted Answer

Build multiple images in parallel using matrix strategy.. Options A and D are correct. Option A reduces build time by reusing cached layers. Option D reduces build time by parallelizing image builds. Option B is wrong because using a larger agent may not reduce build time if the bottleneck is network or I/O. Option C is wrong because running all commands in a single layer reduces layers but does not significantly reduce build time. Option E is wrong because skipping security scanning does not reduce build time.

Answer

Combine multiple RUN commands into a single RUN instruction to reduce layers.

Answer

Disable security scanning for the image.

Answer

Use a larger build agent with more CPU cores.

Question 8

You have a multi-stage pipeline that builds a .NET application and deploys it to Azure App Service. The build stage produces a drop artifact that is used by the deployment stage. Recently, the deployment stage started failing intermittently with a '403 Forbidden' error when trying to download the artifact. The service connection used for deployment has 'Contributor' role at the resource group level. The artifact is stored in Azure Artifacts. What is the most likely cause of the failure?

Accepted Answer

The service principal used by the service connection lacks 'Reader' permissions on the Azure Artifacts feed.. Option B is correct because Azure Artifacts requires the 'Reader' role at the project level to read packages. The deployment stage uses a service principal that may not have the necessary permissions on the artifact feed. Option A is incorrect because the service connection is for Azure App Service, not for reading artifacts. Option C is not relevant as the error is not about pipeline permissions. Option D is incorrect because the pipeline does not need to be in the same region.

Answer

The service connection does not have 'Website Contributor' role on the App Service.

Answer

The pipeline has 'Limit job authorization scope to current project' enabled, restricting access to the artifact.

Answer

The artifact is stored in a different Azure region than the App Service, causing a cross-region access error.

Question 9

Refer to the exhibit. You run the Azure CLI command to trigger a pipeline run. The pipeline fails because tests were skipped but should have run. What is the most likely issue?

Accepted Answer

The command uses a flag '--variables-parameters' which is not a valid Azure DevOps CLI option.. Option B is correct because the parameter name should be 'skipTests' but the command uses '-parameters' which passes parameters, not variables. The correct parameter for variables is '--variables'. The exhibit uses '--variables-parameters' which is incorrect. Option A is wrong because the pipeline name is correct. Option C is wrong because the branch exists. Option D is wrong because the command syntax is invalid.

Answer

The JSON value for skipTests must be a boolean without quotes.

Answer

The pipeline name is incorrect.

Answer

The branch 'feature/new-feature' does not exist.

Question 10

You need to ensure that only specific branches can trigger a release to production in Azure Pipelines. What should you configure?

Accepted Answer

Add a branch filter to the release pipeline's artifact trigger.. Option C is correct because branch filters in the release trigger control which branches can start a release. Option A is wrong because it restricts build triggers, not releases. Option B is wrong because deployment gates do not filter branches. Option D is wrong because approval gates are for manual approval, not branch restriction.

Answer

Add an approval gate that requires a manager to approve the release.

Answer

Add a deployment gate that checks the source branch.

Answer

Add a branch filter to the build pipeline trigger.

Question 11

Which TWO conditions must be met for a self-hosted agent to be used in an Azure Pipelines agent pool? (Choose two.)

Accepted Answer

The agent must have network access to Azure Pipelines.. Options A and C are correct. A: The agent must be registered with the agent pool. C: The agent must have network access to Azure Pipelines. Option B is wrong because the agent can run on any OS. Option D is wrong because the agent can be registered to any pool. Option E is wrong because the agent can be on any machine.

Answer

The agent must be in the Default pool.

Answer

The agent must run on Windows Server.

Answer

The agent must be installed on a virtual machine.

Question 12

You are managing a pipeline that deploys a microservices application to multiple Azure Kubernetes Service (AKS) clusters in different regions. You want to implement a progressive exposure strategy where the deployment first goes to a small cluster (canary), then to a medium cluster, and finally to all clusters. The deployment should be automated but with the ability to halt if errors occur. What should you use?

Accepted Answer

Use deployment gates with evaluation of health metrics (e.g., error rate) before proceeding to the next stage.. Option B is correct because deployment gates with metrics evaluation allow progressive exposure and automated halt. Option A is incorrect because approvals are manual. Option C is incorrect because manual validation steps require human intervention. Option D is incorrect because rolling deployment strategy is not about progressive exposure across clusters.

Answer

Use manual approval gates between stages.

Answer

Configure a rolling deployment strategy on each cluster.

Answer

Use a manual validation step in the pipeline.

Question 13

You are designing a multi-stage YAML pipeline in Azure DevOps that builds, tests, and deploys a .NET Core application. The pipeline must use a self-hosted agent pool for compliance. You need to minimize agent idle time while ensuring that the agent is always available for builds. What should you do?

Accepted Answer

Deploy a scale set agent pool with autoscaling enabled. Option D is correct because scaling set with autoscaling adjusts capacity based on demand. Option A is wrong because scaling set without autoscaling does not minimize idle time. Option B is wrong because persistent agents are always running, causing idle time. Option C is wrong because multiple agents still run idle if not scaled.

Answer

Provision a virtual machine scale set with a fixed number of agents

Answer

Install multiple agents on a single VM to maximize utilization

Answer

Use a single persistent agent and queue builds when idle

Question 14

The pipeline fails with the error 'The resource with name 'myregistry' could not be found'. What is the most likely cause?

Accepted Answer

The Azure Container Registry name is incorrect. Option B is correct because the registry name might be incorrect or not exist. Option A is wrong because the CLI is available. Option C is wrong because authentication is not the issue if the error says not found. Option D is wrong because build ID is a variable that resolves.

Answer

The build ID variable is not defined

Answer

The service connection does not have permission to access the registry

Answer

The Azure CLI is not installed on the agent

Question 15

Your Azure Pipeline builds a Docker image and pushes it to Azure Container Registry (ACR). You need to ensure that the image is scanned for vulnerabilities before being pushed. Which task should you add to the pipeline?

Accepted Answer

Container scanning task from Microsoft Defender for Cloud. Option C is correct because the 'Container scanning' task (from Defender for Cloud) can scan images in ACR for vulnerabilities. Option A is wrong because the 'Docker' task only builds and pushes. Option B is wrong because 'Azure CLI' task can run commands but not built-in scanning. Option D is wrong because 'PublishBuildArtifacts' publishes files, not scanning.

Answer

Azure CLI task to run 'az acr scan'

Answer

Docker task with the 'push' action

Answer

PublishBuildArtifacts task

AZ-400 Practice Test 26 — 15 Questions

Exhibit

AZ-400 Practice Test 26 — 15 Questions

Exhibit