AZ-400 Practice Test 27 — 15 Questions

Question 1

Your team uses Azure Repos and wants to trigger a pipeline automatically when a pull request is created targeting the main branch. The pipeline should run validations and report the status to the PR. Which trigger type should you configure?

Accepted Answer

PR trigger. Option A is correct because PR triggers are specifically designed to run pipelines on pull request creation and report status back. Option B is wrong because CI triggers run on pushes to branches. Option C is wrong because scheduled triggers run on a schedule. Option D is wrong because path filters restrict which files trigger, not the event type.

Answer

Path filter

Answer

Scheduled trigger

Answer

CI trigger

Question 2

Your Azure DevOps pipeline deploys an ARM template to create a storage account. The deployment fails with 'AuthorizationFailed' error. The service principal used by the service connection has 'Contributor' role on the resource group. What is the most likely issue?

Accepted Answer

The service principal does not have 'Contributor' role at the subscription scope.. Option B is correct because ARM template deployments require 'Microsoft.Resources/deployments/write' permission, which is included in Contributor. However, if the deployment is at subscription scope, the service principal needs Contributor on the subscription. Option A is incorrect because the error is authorization, not conflict. Option C is not required. Option D is incorrect because ARM templates don't require a specific provider registration for deployment itself.

Answer

The service principal is not registered for the 'Microsoft.Storage' resource provider.

Answer

The storage account name is already taken.

Answer

The ARM template is using an unsupported API version.

Question 3

You are setting up a release pipeline that deploys to multiple environments (dev, test, prod) sequentially. Each environment requires approval before deployment. What is the best way to implement this in Azure Pipelines?

Accepted Answer

Define pipeline stages with environment resources and pre-deployment approvals.. Option C is correct because environments in Azure Pipelines support approvals and gates, and can be used in a multi-stage pipeline with manual triggers. Option A is outdated; releases are the classic approach. Option B is insufficient for approvals. Option D requires custom scripting.

Answer

Use environment resources with 'auto' trigger and no approvals.

Answer

Use classic release pipelines with approval gates per environment.

Answer

Use a custom PowerShell script to pause and prompt for approval.

Question 4

Refer to the exhibit. You deploy this ARM template using Azure Pipelines. The deployment succeeds, but the storage account is created with a name that is not what you expected. What is the most likely reason?

Accepted Answer

The uniqueString function returns a hash based on the resource group ID, resulting in a non-meaningful name.. Option C is correct. The 'uniqueString(resourceGroup().id)' function generates a hash based on the resource group ID, not the storage account name parameter. The default value is a hash, not a human-readable name. Option A is incorrect because the parameter type is string. Option B is incorrect because the default value uses resourceGroup().id, not resourceGroup().location. Option D is not relevant.

Answer

The storage account name parameter is of type 'string' but the default value is an object.

Answer

The location parameter uses resourceGroup().location which is not a valid function.

Answer

The apiVersion '2022-09-01' is too new and causes a naming conflict.

Question 5

Refer to the exhibit. You have this GitHub Actions workflow YAML. The workflow does not trigger when you push to the main branch. What is the most likely issue?

Accepted Answer

The correct keyword is 'on', not 'triggers'.. Option B is correct. The 'triggers' keyword is incorrect. In GitHub Actions, the correct keyword is 'on'. The workflow should use 'on: push: branches: [main]' instead of 'triggers'. Option A is incorrect because the push event is valid. Option C is not the issue. Option D is not the cause.

Answer

The branch name should be in a list under 'branches' inside 'push'.

Answer

The 'vmImage' should be 'windows-latest' for scripts.

Answer

The 'triggers' keyword is misspelled; it should be 'trigger'.

Question 6

Your team uses a multi-stage YAML pipeline. The 'Build' stage compiles the code and runs unit tests. The 'Deploy' stage deploys to a staging environment. You notice that if the 'Build' stage fails, the 'Deploy' stage still starts because it depends on a condition that always evaluates to true. How should you modify the pipeline to prevent the 'Deploy' stage from running if the 'Build' stage fails?

Accepted Answer

Add 'condition: succeeded()' to the Deploy stage.. Option B is correct because using 'condition: succeeded()' ensures that the stage only runs if all previous stages succeeded. Option A is wrong because 'dependsOn: Build' alone does not enforce success. Option C is wrong because 'condition: eq(variables['Build.Succeeded'], 'true')' is not the recommended way. Option D is wrong because 'condition: and(succeeded(), eq(variables['Build.Succeeded'], 'true'))' is redundant.

Answer

Add 'condition: eq(variables['Build.Succeeded'], 'true')' to the Deploy stage.

Answer

Add 'condition: and(succeeded(), eq(variables['Build.Succeeded'], 'true'))' to the Deploy stage.

Answer

Add 'dependsOn: Build' to the Deploy stage.

Question 7

Your organization requires that all code changes must be built and tested before merging to the main branch. You plan to use branch policies in Azure Repos. Which policy enforcement will ensure that a pull request cannot be completed unless the build succeeds?

Accepted Answer

Add a build validation policy that triggers a build on each PR update.. Option C is correct because 'Build validation' enforces that a build must succeed before the PR is completed. Option A is wrong because 'Require a minimum number of reviewers' does not enforce build success. Option B is wrong because 'Comment resolution' is about comments. Option D is wrong because 'Check for linked work items' is about work items.

Answer

Require a linked work item in the pull request.

Answer

Require a minimum number of reviewers.

Answer

Reset code reviewer votes when new changes are pushed.

Question 8

You are configuring a release pipeline to deploy to Azure App Service. You want to use the 'Deploy Azure App Service' task. Which authentication method should you use to securely connect Azure DevOps to the Azure subscription?

Accepted Answer

Azure Resource Manager service connection using a service principal.. Option B is correct because the Azure Resource Manager service connection with Service Principal authentication is the recommended and secure method. Option A is wrong because Azure CLI does not provide persistent service connection. Option C is wrong because Managed Identity is not directly used by Azure DevOps. Option D is wrong because SAS tokens are for storage, not App Service.

Answer

Azure CLI authentication with a user account.

Answer

Use a SAS token for the App Service.

Answer

Managed Identity assigned to the Azure DevOps agent.

Question 9

Your team is using GitHub Actions for CI/CD. The workflow builds a container image and pushes it to Azure Container Registry (ACR). However, the workflow fails with an authentication error when pushing to ACR. What is the most likely cause?

Accepted Answer

The workflow does not include an 'azure/login' step to authenticate with Azure.. Option A is correct because the most common cause is that the Azure login action is missing or misconfigured. Option B is wrong because Docker login is handled by the Azure login action. Option C is wrong because ACR allows anonymous pull but not push. Option D is wrong because the issue is authentication, not repository name.

Answer

The repository name in the workflow is incorrect.

Answer

The Dockerfile is missing a required LABEL instruction.

Answer

The ACR allows anonymous pull access.

Question 10

You need to implement a strategy to manage secrets for your multi-stage YAML pipeline. The pipeline runs on Microsoft-hosted agents. Which approach should you use to securely pass secrets to pipeline tasks?

Accepted Answer

Use pipeline variables with 'secret: true' and reference them as $(variableName).. Option D is correct because using variables with 'secret: true' in the YAML pipeline and referencing them as $(variableName) is the recommended way. Option A is wrong because environment variables are not secure in YAML. Option B is wrong because hardcoding is insecure. Option C is wrong because Azure Key Vault task should be used to fetch secrets into variables.

Answer

Define the secrets as environment variables in the pipeline YAML directly.

Answer

Use the Azure Key Vault task to download secrets and then pass them as parameters.

Answer

Store secrets in a file in the repository and read it during the build.

Question 11

You are designing a build pipeline that uses Microsoft-hosted agents. The pipeline must build a .NET Framework 4.8 application and run on a Windows agent. Due to compliance, the build must use a specific version of Visual Studio that is not pre-installed on the Microsoft-hosted agents. What should you do?

Accepted Answer

Use a self-hosted agent that has the required version of Visual Studio installed.. The only way to ensure a specific version of Visual Studio is to use a self-hosted agent with that version installed. Microsoft-hosted agents have pre-installed software but you cannot customize them to add a specific version not available. Using a Docker container with the required version is a valid approach but requires a self-hosted agent to run the container. Building with MSBuild alone might not work if the project depends on Visual Studio components.

Answer

Build the application inside a Docker container that includes the required Visual Studio version.

Answer

Specify the 'vsVersion' parameter in the MSBuild task to target the required version.

Answer

Use the 'Visual Studio Test Platform Installer' task to install the required version at build time.

Question 12

Your organization uses GitHub Actions for CI/CD. You want to enforce that all workflows pass required checks before a pull request can be merged. The repository is in an organization that uses GitHub Enterprise Cloud. What should you configure?

Accepted Answer

Add a branch protection rule that requires status checks to pass.. Branch protection rules can require status checks to pass before merging. In GitHub, you can set up a branch protection rule that requires status checks, including GitHub Actions workflows. Option A is correct. Option B is wrong because rulesets are for repository rules, not for requiring checks. Option C is wrong because the required status check can be set at the branch level, not per workflow file. Option D is wrong because GitHub Actions does not have a built-in 'Approval' feature for workflow runs; approval is for deployments.

Answer

Enable 'Require approval for all workflows' in the organization settings.

Answer

Set the workflow to be required in the 'Require status check' settings of each pull request.

Answer

Create a repository ruleset that requires linear history.

Question 13

Which TWO are valid ways to pass build artifacts from one stage to another in a multi-stage YAML pipeline in Azure Pipelines?

Accepted Answer

Use the Publish Pipeline Artifact task in the first stage and Download Pipeline Artifact task in the second stage.. Publishing and downloading artifacts is the standard way. Option C is misleading because pipeline artifacts are a type of artifact. Option D is wrong because stages run sequentially? Actually stages can run in parallel, but publishing/downloading is still needed. Option E is wrong because variables are not for artifacts.

Answer

Use the Pipeline Artifact task to publish artifacts, which are automatically available to subsequent stages without download.

Answer

Use the Publish Build Artifacts task and then the Download Build Artifacts task.

Answer

Define variables in the first stage and reference them in the second stage.

Question 14

Your release pipeline uses Azure Kubernetes Service (AKS) and Helm charts. You need to roll back to a previous release quickly if the new release fails health checks. What is the BEST approach?

Accepted Answer

Use Helm rollback command.. Option C is correct because Helm provides built-in rollback functionality. Option A is wrong because manual redeployment is slow. Option B is wrong because it requires additional tooling and scripting. Option D is wrong because it is not native to Helm and requires custom logic.

Answer

Manually redeploy the previous Helm chart version.

Answer

Use a canary deployment strategy.

Answer

Use a Kubernetes Deployment rollout undo.

Question 15

You are designing a release pipeline that deploys a web app to Azure App Service. You need to ensure that configuration secrets (e.g., database connection strings) are not stored in the pipeline YAML file. Which approach should you use?

Accepted Answer

Use an Azure Key Vault variable group linked to the pipeline.. Option B is correct because Azure Key Vault securely stores secrets and integrates with Azure Pipelines via variable groups linked to Key Vault. Option A is wrong because pipeline variables are stored in YAML or in the pipeline settings, not encrypted at rest in a secure vault. Option C is wrong because agent-scoped variables are not designed for secret management and are still visible in logs. Option D is wrong because environment variables in the App Service configuration are not managed by the pipeline securely.

Answer

Define the secrets as agent-scoped variables in the release pipeline.

Answer

Hardcode the secrets in the App Service configuration and reference them in the pipeline.

Answer

Store the secrets as pipeline variables and mark them as 'Secret'.