AZ-400 Practice Test 29 — 15 Questions

Question 1

You need to automatically run a security scan on every pull request in GitHub. The scan should block the PR if critical vulnerabilities are found. Which GitHub feature should you use?

Accepted Answer

GitHub Code Scanning with a CodeQL workflow. GitHub Code Scanning with a CodeQL workflow is the correct choice because it allows you to define a custom security analysis that runs on every pull request. By configuring the workflow to fail on critical-severity alerts, the pull request is automatically blocked, preventing vulnerable code from being merged. This integrates directly with GitHub's checks API to enforce the scan result as a required status check.

Answer

Dependabot version updates

Answer

Secret scanning

Answer

Branch protection rules with required status checks

Question 2

Your organization uses GitHub Flow with branch protections. Developers must link every pull request to an issue using a closing keyword (e.g., 'Fixes #123'). You need to enforce this linking automatically. What should you do?

Accepted Answer

Create a GitHub Actions workflow that validates the PR description contains a closing keyword.. A GitHub Actions workflow can be configured to run on pull request events and parse the PR description for a closing keyword pattern (e.g., regex matching 'Fixes #\d+'). If the keyword is missing, the workflow can fail the check, blocking the merge via branch protection rules that require status checks to pass. This directly enforces the linking requirement without relying on human compliance or third-party tools.

Answer

Configure an issue template with a closing keyword prompt.

Answer

Add a branch protection rule requiring a linked issue.

Answer

Use a required status check from a third-party app.

Question 3

Your Azure Pipelines release pipeline deploys to multiple stages. You need to implement a manual approval gate that requires two specific users to approve before deployment proceeds to production. The approval should expire after 8 hours. Which configuration should you use?

Accepted Answer

Pre-deployment conditions: Add approvers (user1, user2) with 'All' policy and set timeout to 480 minutes. It configures a pre-deployment approval gate requiring both user1 and user2 to approve (the 'All' policy) before the production stage proceeds, and sets the timeout to 480 minutes (8 hours) to expire the approval request. This matches the requirement for two specific users to approve and an 8-hour expiration.

Answer

Pre-deployment conditions: Add approvers (user1, user2) with 'Any one' policy

Answer

Pre-deployment conditions: Add approvers (user1, user2) with 'All' policy and set 'Allow deployment without approval' to true

Answer

Post-deployment conditions: Add approvers (team) with 'All' policy

Question 4

Your organization uses Microsoft Entra ID and Azure DevOps. You need to ensure that only users from specific Entra ID groups can create new Azure DevOps organizations. What should you configure?

Accepted Answer

Assign the Azure DevOps Administrator role to the security group. The Azure DevOps Administrator role in Microsoft Entra ID is specifically designed to manage Azure DevOps service-level settings, including the ability to restrict who can create new Azure DevOps organizations. By assigning this role to a security group, only members of that group can create new organizations, which directly meets the requirement.

Answer

Assign the Global Administrator role to the security group

Answer

Configure Conditional Access policies to block non-group members

Answer

Use Azure DevOps security policies to restrict organization creation

Question 5

You are reviewing an Azure Policy definition that denies pipeline creation if the pipeline template path is not '/pipeline-templates/my-template.yml'. What does this policy do?

Accepted Answer

Denies any pipeline that does not use a specific YAML template.. This Azure Policy definition uses a 'deny' effect with a condition that checks whether the pipeline references a specific YAML template. If the pipeline does not reference that template, the policy denies the pipeline creation or update. Option D is correct because the policy explicitly denies any pipeline that does not use the specified YAML template, enforcing compliance by blocking non-compliant pipelines.

Answer

Denies pipelines that use an outdated template version.

Answer

Allows only pipelines that use a specific YAML template.

Answer

Allows only pipelines in the pipeline-templates folder.

Question 6

Your team uses Azure Boards to manage work items. You need to ensure that when a work item is moved to 'Closed', all linked pull requests in Azure Repos are automatically completed. What should you configure?

Accepted Answer

Service hook to a custom Azure Function. Azure Boards service hooks can trigger a custom Azure Function when a work item state changes to 'Closed', and that function can complete linked pull requests via Azure Repos REST API. Option C is incorrect because work item rules (state transition rules) in Azure Boards do not have a built-in action to automatically complete pull requests; they only allow changes to work item fields, not external actions like completing PRs.

Answer

Work item 'Pull Request' tab

Answer

Work item rule (state transition rule)

Answer

Branch policy on the target branch

Question 7

You are designing a compliance plan for Azure DevOps. The compliance officer requires that all changes to build pipelines are audited and cannot be reverted without approval. What should you implement?

Accepted Answer

Store pipeline YAML in a repository with branch policies. Storing pipeline YAML in a repository with branch policies ensures that every change to the pipeline definition goes through a pull request (PR) process, which is auditable and requires approval before merging. Once merged, the change is recorded in the Git history, and reverting it requires another PR with approval, meeting the compliance requirement that changes cannot be reverted without approval.

Answer

Enable Azure DevOps audit logs

Answer

Use release approval gates

Answer

Set pipeline retention policies

Question 8

You are using GitHub Advanced Security. The security team wants to prevent developers from introducing code with high-severity vulnerabilities. What is the best way to enforce this?

Accepted Answer

Enable code scanning and configure a quality gate to fail PRs with high-severity alerts. Enabling code scanning with a quality gate that fails pull requests (PRs) on high-severity alerts directly prevents vulnerable code from being merged. This enforces security policy at the PR merge point, using GitHub's CodeQL analysis to detect vulnerabilities before they reach the main branch. Dependabot and secret scanning address different risks (outdated dependencies and leaked secrets) and do not block code with high-severity vulnerabilities.

Answer

Enable Dependabot and require pull request reviews for dependency updates

Answer

Enable push protection for all repositories

Answer

Enable secret scanning and block pushes with high-confidence secrets

Question 9

Your build pipeline uses a YAML template to define steps. You want to pass a parameter to the template to conditionally run a task. What syntax should you use in the template?

Accepted Answer

parameters:. The 'parameters' key in a YAML template is used to define parameters that can be passed to the template, allowing conditional execution based on the parameter value. Option B is incorrect: 'arguments' is not a standard YAML key for passing parameters to templates; it is used for specifying script arguments. Option C is incorrect: 'inputs' is used for task inputs within a step, not for template parameters. Option D is incorrect: 'variables' are used to define pipeline variables, not for passing parameters to templates.

Answer

arguments:

Answer

inputs:

Answer

variables:

Question 10

Your team uses Azure Pipelines to deploy a Docker container to Azure Kubernetes Service (AKS). The pipeline builds a Docker image, pushes it to Azure Container Registry (ACR), and then runs a deployment to AKS. You want to ensure that the deployment uses the exact image that was built in the same pipeline run. Which approach should you use?

Accepted Answer

Generate a unique tag (e.g., Build.BuildId) and pass it to both the Docker build and Kubernetes manifest via variable substitution.. Using a unique tag like Build.BuildId ensures that the exact image built in the pipeline is referenced in the Kubernetes manifest. This prevents deployment from accidentally using a stale or overwritten image, as the tag is unique per run and passed consistently via variable substitution from the Docker build to the deployment YAML.

Answer

Use two separate pipelines: one for build/push, one for deploy, and share the image tag via a variable group.

Answer

Use a single task for build and push, and rely on ACR's internal pull-through cache.

Answer

Tag the image as 'latest' and reference it in the Kubernetes manifest.

Question 11

Your organization is adopting GitHub Actions for CI/CD. You need to enforce that all workflows must pass required status checks before merging pull requests to the main branch. The repository is in an organization. What should you configure?

Accepted Answer

Create a branch protection rule for the main branch with required status checks.. Branch protection rules in GitHub allow you to enforce required status checks on pull requests before merging. By configuring a branch protection rule for the main branch, you can specify that certain GitHub Actions workflow runs must pass (e.g., CI checks) before a pull request can be merged. This directly enforces the policy that all workflows must pass required status checks.

Answer

Add an environment protection rule requiring approval from specific reviewers.

Answer

Set the workflow to have 'contents: write' permission.

Answer

Define a CODEOWNERS file that requires team review for main branch changes.

Question 12

Drag and drop the steps to configure Azure DevOps artifact feeds for NuGet packages into the correct order.

Accepted Answer

Step 1: Create a new feed, Step 2: Configure upstream sources, Step 3: Set feed permissions, Step 4: Publish NuGet packages, Step 5: Consume packages from feed. Feed setup starts with creation, upstream sources, permissions, publishing, and consumption.

Answer

Step 1: Create a new feed, Step 2: Set feed permissions, Step 3: Configure upstream sources, Step 4: Publish NuGet packages, Step 5: Consume packages from feed

Answer

Step 1: Create a new feed, Step 2: Publish NuGet packages, Step 3: Configure upstream sources, Step 4: Set feed permissions, Step 5: Consume packages from feed

Answer

Step 1: Create a new feed, Step 2: Configure upstream sources, Step 3: Publish NuGet packages, Step 4: Set feed permissions, Step 5: Consume packages from feed

Question 13

Your team uses GitHub Actions to build a Python application. The workflow includes a step to run unit tests with pytest. The tests pass locally but fail in CI with 'ModuleNotFoundError: No module named 'myapp''. The repository structure has the application code in a subdirectory 'src/'. What is the most likely fix?

Accepted Answer

Set the environment variable PYTHONPATH to 'src/' before running tests.. The Python interpreter cannot find the 'myapp' module when tests run in CI, even though the code is present in the 'src/' subdirectory. Setting PYTHONPATH to 'src/' tells Python to include that directory in the module search path, allowing 'import myapp' to resolve correctly without moving or copying files. This is the most direct fix for a missing module path issue in a CI environment where the working directory is not automatically set to the source folder.

Answer

Set the working directory of the test step to 'src/'.

Answer

Add a step to install dependencies with 'pip install -r requirements.txt'.

Answer

Add a step to run 'pip install -e .' from the repository root.

Question 14

Which TWO tools can be used to manage feature flags in Azure DevOps pipelines?

Accepted Answer

LaunchDarkly.. LaunchDarkly is a third-party feature management platform that integrates with Azure DevOps pipelines to control feature flag rollouts, targeting, and experimentation. It allows teams to toggle features on/off without redeploying code, making it a valid tool for managing feature flags in pipeline-driven deployments.

Answer

Azure Policy.

Answer

Azure Monitor.

Answer

Azure Key Vault.

Question 15

Which TWO practices should you adopt to improve the security of your Azure DevOps pipeline? (Choose two.)

Accepted Answer

Grant the least privilege to service connections. Granting the least privilege to service connections (Option A) is a core security principle that limits the permissions of automated processes to only what is strictly necessary, reducing the blast radius of a compromised connection. Using Azure Key Vault to store secrets and fetch them at runtime (Option B) ensures that sensitive values like API keys and passwords are never exposed in pipeline definitions or logs, and are securely retrieved via managed identities or service principals at execution time.

Answer

Use the default hosted agent for all builds

Answer

Store secrets as plain text in pipeline variables

Answer

Allow contributors to bypass the required reviewer policy