AZ-400 Practice Test 27 — 15 Questions

Question 1

You are implementing a secrets management strategy for a multi-cloud deployment. You need to securely store and rotate API keys for a third-party service. Which Azure service should you use?

Accepted Answer

Azure Key Vault. Azure Key Vault is the correct service because it is designed specifically for securely storing and managing secrets, including API keys, with built-in support for automatic rotation via integration with Azure Event Grid and Azure Functions. It provides hardware security module (HSM)-backed encryption, access policies, and auditing, making it ideal for multi-cloud secrets management.

Answer

Microsoft Entra ID

Answer

Azure App Configuration

Answer

Azure Storage Blob

Question 2

Your organization uses Microsoft Entra ID. You want to ensure that only users from specific countries can access Azure DevOps. Which security feature should you configure?

Accepted Answer

Microsoft Entra ID Conditional Access policies. Microsoft Entra ID Conditional Access policies allow you to enforce location-based access controls by specifying allowed countries or IP ranges. By configuring a Conditional Access policy that targets Azure DevOps (as a cloud app) and setting the condition to 'Locations' with 'Selected countries,' you can restrict sign-ins to only users from those countries. This is the correct approach because Azure DevOps relies on Entra ID for authentication, and Conditional Access is the native mechanism to control access based on geographic location.

Answer

Azure Network Security Group (NSG) rules

Answer

Azure DevOps security groups with allowed IP ranges

Answer

Microsoft Intune compliance policies

Question 3

Which THREE are benefits of using a monorepo vs multiple repositories?

Accepted Answer

Easier code sharing and refactoring across projects. A monorepo enables easier code sharing and refactoring across projects by allowing all code to reside in a single repository. This eliminates the need for cross-repository package publishing or versioning, as shared libraries can be directly referenced and refactored atomically across all dependent projects within the same commit.

Answer

Reduced risk of configuration drift

Answer

Faster clone times due to smaller repository size

Question 4

Your organization uses GitHub and wants to automatically assign pull request reviewers based on the files changed. Which three steps should you take?

Accepted Answer

Configure 'Code owner review requirement' in branch protection.. Configuring 'Code owner review requirement' in branch protection enforces that pull requests affecting files with defined code owners must be approved by those owners before merging. This ensures that changes to specific file patterns automatically require review from the designated teams or individuals, aligning with the goal of automatic assignment based on files changed.

Answer

Enable 'Protected branches' for the main branch.

Answer

Configure team synchronization for the organization.

Question 5

Your company is migrating to Microsoft Entra ID and needs to manage secrets used in Azure Pipelines. Which service should you use to securely store and rotate secrets?

Accepted Answer

Azure Key Vault. Azure Key Vault is the correct service to securely store and rotate secrets used in Azure Pipelines. It is natively integrated with Azure Pipelines via library variable groups, allowing secrets to be referenced in pipelines without exposing them. Option B, GitHub Secrets, is designed for GitHub Actions, not Azure Pipelines. Option C, Azure App Configuration, manages feature flags and configuration settings, not secrets. Option D, Microsoft Purview, is for data governance and compliance, not secret management.

Answer

GitHub Secrets

Answer

Azure App Configuration

Answer

Microsoft Purview

Question 6

Your YAML pipeline uses a self-hosted agent pool. You need to ensure that only the pipeline can trigger builds on that pool, preventing other projects from using it. What should you do?

Accepted Answer

Configure pipeline permissions in the agent pool security settings. Azure DevOps agent pool security settings allow you to restrict which pipelines or projects can use a specific agent pool. By configuring pipeline permissions, you can grant the 'Use' permission only to the intended pipeline, preventing other projects from triggering builds on that pool. This ensures exclusive access without disabling the pool for all other uses.

Answer

Set the agent pool to 'Disabled' for other projects

Answer

Use a deployment group instead of an agent pool

Answer

Create a separate agent pool for each project

Question 7

You are reviewing an Azure Policy assignment in a DevOps environment. The exhibit shows the policy assignment JSON. The policy set includes the built-in policy 'Allowed Locations' with effect Deny. During a pipeline deployment, a resource creation fails with a policy violation error. The resource being deployed is a storage account in the 'centralus' region. What is the most likely reason for the failure?

Accepted Answer

The resource being deployed is in a region that is not allowed by the policy assignment parameters.. The policy assignment includes the built-in 'Allowed Locations' policy with the Deny effect. The resource being deployed (a storage account) is in the 'centralus' region, but the policy assignment parameters likely specify a list of allowed regions that does not include 'centralus'. Since the Deny effect prevents any non-compliant resource creation, the deployment fails with a policy violation error. This is the most direct and common cause of such failures in Azure Policy.

Answer

The policy assignment is misconfigured because it does not specify a policy set definition.

Answer

The resource group is located in a region that overrides the policy assignment.

Answer

The policy set definition does not include the 'Allowed Locations' policy.

Question 8

Your company uses Azure DevOps and must enforce that all pipelines use approved agent pools. The security team wants to prevent the use of the default agent pool. What should you do?

Accepted Answer

Set agent pool permissions to deny the default pool for all projects. Setting agent pool permissions to deny the default pool for all projects explicitly blocks its use across the organization. This enforces the security policy by preventing any pipeline from selecting the default agent pool, while still allowing administrators to manage the pool if needed. In Azure DevOps, agent pool permissions control which users, teams, or projects can use a pool, and setting 'Deny' overrides any inherited 'Allow' permissions.

Answer

Use pipeline settings to require authorization for the default pool

Answer

Remove the default agent pool from the organization

Answer

Disable the default agent pool in project settings

Question 9

Which THREE are required to set up a self-hosted agent for Azure Pipelines?

Accepted Answer

Network connectivity to Azure DevOps services.. B is correct because the self-hosted agent must communicate with Azure Pipelines to receive job assignments and report status. This requires outbound HTTPS connectivity (port 443) to Azure DevOps services (e.g., dev.azure.com). Without network connectivity, the agent cannot register, poll for jobs, or send logs, making it non-functional.

Answer

A virtual machine running in Azure.

Answer

Docker installed on the agent machine.

Question 10

Refer to the exhibit. A developer pushes a new commit to an existing pull request targeting the main branch. What is the effect on the pull request?

Accepted Answer

All existing approvals are revoked, and the pull request must be re-approved.. The policy 'Reset code reviewer votes when new changes are pushed' is set to true. Therefore, when a new commit is pushed, all previous reviewer votes are reset. The required number of reviewers is 2, but minimum is 1, so at least one reviewer must approve again.

Answer

The pull request is automatically merged.

Answer

The existing approvals remain valid, and no re-review is needed.

Answer

The new commit is rejected because it was pushed without a code review.

Question 11

Your team follows trunk-based development. The main branch should always be deployable. Which two practices must you implement? (Choose two.)

Accepted Answer

Use feature flags to manage incomplete work.. In trunk-based development, the main branch must always be deployable. Feature flags (B) allow incomplete or work-in-progress code to be merged into the main branch without affecting production behavior, because the new functionality is toggled off until ready. Keeping branches short-lived (C) (typically less than a day) minimizes merge conflicts and ensures that changes are integrated quickly, reducing the risk of long-lived divergence that could break the main branch.

Answer

Require manual approval for every pull request.

Answer

Create release branches for each deployment.

Answer

Use long-lived feature branches for each feature.

Question 12

You are implementing a build pipeline for a .NET application that uses GitHub Advanced Security (GHAS) for code scanning. The pipeline must run CodeQL analysis on every pull request to the main branch. You have added the CodeQL task to the pipeline. However, the analysis results are not appearing in the 'Security' tab of the repository on GitHub. What is the most likely cause?

Accepted Answer

The pipeline is missing the 'Publish Security Analysis Logs' step to upload SARIF results to GitHub.. CodeQL analysis results are uploaded to GitHub as SARIF files. Without the 'Publish Security Analysis Logs' step (or the equivalent 'upload-sarif' action), the SARIF file generated by CodeQL is not sent to GitHub, so the findings never appear in the Security tab. The pipeline must explicitly include this step to complete the integration with GitHub Advanced Security.

Answer

The GitHub repository is private, so security alerts are disabled.

Answer

The .NET project is not supported by CodeQL.

Answer

CodeQL analysis is not supported on pull request triggers.

Question 13

You are designing a build pipeline for a Java application that uses Maven. You want to publish the compiled JAR file as a build artifact. Which task should you use?

Accepted Answer

PublishBuildArtifacts@1. The Publish Build Artifacts task publishes files as pipeline artifacts. Option B (Maven@3) is wrong because it builds the project but does not publish artifacts. Option C (ArchiveFiles@2) is wrong because it creates a zip but does not publish. Option D (CopyFiles@2) is wrong because it only copies files within the agent.

Answer

Maven@3

Answer

ArchiveFiles@2

Answer

CopyFiles@2

Question 14

You need to integrate Azure Pipelines with GitHub to trigger a build when a release is published in GitHub. Which trigger type should you use in the pipeline?

Accepted Answer

resources:
  repositories:
    - repository: self
      type: github
      trigger:
        release: true. Azure Pipelines supports a GitHub release trigger through the `resources` definition, where you specify a `trigger` with `release: true` under the repository configuration. This tells the pipeline to automatically start a build whenever a new release is published in the linked GitHub repository, which directly matches the requirement.

Answer

pr:

Answer

trigger:

Answer

schedules:

Question 15

Your development team uses GitHub Enterprise and wants to automatically synchronize code from a public GitHub repository to their private repository every morning. What feature should they use?

Accepted Answer

A scheduled GitHub Actions workflow that fetches from the public repo and pushes to the private repo.. B is correct because a scheduled GitHub Actions workflow can periodically fetch changes from the public repository (using `git fetch` or `git pull`) and push them to the private repository. This approach avoids the need for external triggers and works even when the public repo does not send webhooks to your private environment. The schedule is defined using cron syntax in the workflow YAML, ensuring automatic daily synchronization.

Answer

Webhooks from the public repository to trigger a sync pipeline.

Answer

Git submodules to link the public repository as a subdirectory.

Answer

GitHub repository mirroring to automatically mirror the public repo.