AZ-400 Practice Test 29 — 15 Questions

Question 1

Your organization is adopting GitHub Actions for CI/CD. You need to enforce that all workflows must pass required status checks before merging pull requests to the main branch. The repository is in an organization. What should you configure?

Accepted Answer

Create a branch protection rule for the main branch with required status checks.. Branch protection rules with required status checks enforce that workflows pass before merging. Option A is wrong because environment protection rules apply to deployments, not PR merges. Option B is wrong because workflow permissions control what workflows can do, not merge requirements. Option D is wrong because CODEOWNERS defines reviewers, not checks.

Answer

Add an environment protection rule requiring approval from specific reviewers.

Answer

Set the workflow to have 'contents: write' permission.

Answer

Define a CODEOWNERS file that requires team review for main branch changes.

Question 2

Which TWO are valid strategies for managing secrets in a GitHub Actions workflow?

Accepted Answer

Use OpenID Connect to authenticate to Azure without storing any credentials.. GitHub secrets and OIDC are both secure methods. Option B is wrong because base64 is not encryption. Option C is wrong because hardcoding is insecure. Option D is wrong because environment variables are visible.

Answer

Hardcode the secret in the YAML file.

Answer

Set the secret as an environment variable in the runner's shell profile.

Answer

Base64-encode the secret and include it directly in the workflow file.

Question 3

Your build pipeline uses a YAML template to define steps. You want to pass a parameter to the template to conditionally run a task. What syntax should you use in the template?

Accepted Answer

parameters:. Option C is correct because 'parameters' is the correct YAML key to define template parameters. Option A is wrong because 'inputs' is for task inputs. Option B is wrong because 'variables' are for pipeline variables. Option D is wrong because 'arguments' is not a valid key.

Answer

arguments:

Answer

inputs:

Answer

variables:

Question 4

You have a multi-stage YAML pipeline that builds and deploys a containerized application to Azure Kubernetes Service (AKS). The build stage runs successfully, but the deploy stage fails with an error: 'Error: failed to get credentials: context deadline exceeded'. You verify that the AKS cluster is running and that the service connection is valid. What is the most likely cause?

Accepted Answer

The build agent's IP address is not allowed by the AKS cluster's network policies.. Option A is correct because the Kubernetes API server may have a network restriction (e.g., firewall, NSG) blocking the build agent's IP address. Option B is wrong because RBAC issues would produce a permission denied error, not a timeout. Option C is wrong because the service connection is valid per the scenario. Option D is wrong because the container registry credentials are used for pulling images, not for connecting to AKS.

Answer

The Azure service connection has expired.

Answer

The service principal used by the pipeline does not have RBAC permissions on the cluster.

Answer

The container registry is not accessible from the build agent.

Question 5

Which TWO practices help improve the security of container images in a CI/CD pipeline? (Choose two.)

Accepted Answer

Sign container images to verify their integrity.. Options A and D are correct. Option A: Scanning images for vulnerabilities as part of the build process helps catch issues early. Option D: Using signed images ensures integrity and trust. Option B is wrong because using the 'latest' tag can lead to unpredictable updates; pinning to specific versions is more secure. Option C is wrong because storing images in a public registry exposes them to potential attacks; private registries are more secure. Option E is wrong because running containers as root is a security risk.

Answer

Run containers with root privileges to avoid permission issues.

Answer

Store container images in a public registry for easy access.

Answer

Use the 'latest' tag for base images to always get the newest patches.

Question 6

Which TWO are valid strategies to reduce build times in Azure Pipelines? (Choose 2)

Accepted Answer

Use the Cache task to cache NuGet packages or npm modules.. Options A and D are correct. A: Incremental builds only compile changed files, reducing build time. D: Using the Cache task for package dependencies avoids re-downloading. Option B is wrong because more agents increase parallelism but not per-build time. Option C is wrong because the 'dotnet build' command with '--no-restore' skips restore but doesn't reduce build time if restore is already cached; however, it saves time if restore is already done. But the question asks for strategies to reduce build times; incremental builds and caching are direct strategies. Option E is wrong because increasing timeout doesn't reduce build time.

Answer

Use 'dotnet build --no-restore' to skip restore.

Answer

Use a larger agent pool with more parallel jobs.

Answer

Increase the build job timeout.

Question 7

Your organization uses Azure Pipelines and wants to enforce that all builds must pass a security scan before being deployed to production. The security scan is performed by a third-party tool that is not available as a built-in task. You have installed the tool on a self-hosted agent. What is the best way to integrate the security scan into the pipeline?

Accepted Answer

Use a command-line task (e.g., Bash, PowerShell) to execute the security scan tool.. Option C is correct because you can use a command-line script task (e.g., bash, PowerShell) to run the security scan tool installed on the agent. Option A is wrong because there is no generic 'Run Security Scan' task. Option B is wrong because the third-party tool may not have an API. Option D is wrong because you would need to execute it, not just install it.

Answer

Add the tool as a capability of the agent pool and use the 'Install Tool' task.

Answer

Add the 'Run Security Scan' task from the Azure DevOps marketplace.

Answer

Create a custom service hook to trigger the scan externally and wait for results.

Question 8

Your release pipeline deploys to multiple environments (Dev, QA, Prod) using approvals. You need to ensure that the deployment to Prod only proceeds if the deployment to QA succeeded and an approval is granted. Which combination of triggers and pre-deployment conditions should you configure?

Accepted Answer

Set the trigger on Prod to 'After stage' and select QA as the stage, and add a pre-deployment approval on Prod.. Option C is correct because setting the trigger to 'After stage' on the QA stage and adding a pre-deployment approval on Prod ensures both conditions. Option A is wrong because automatic trigger does not enforce QA success. Option B is wrong because 'After release' ignores QA. Option D is wrong because manual only trigger ignores QA.

Answer

Set the trigger on Prod to 'Automatic' and add a post-deployment approval on QA.

Answer

Set the trigger on Prod to 'After release' and add a pre-deployment approval on Prod.

Answer

Set the trigger on Prod to 'Manual only' and add a pre-deployment approval on Prod.

Question 9

Your organization uses GitHub Actions for CI/CD. You want to ensure that the workflow runs only when a pull request is labeled 'safe-to-deploy'. Which trigger should you use?

Accepted Answer

on:
  pull_request:
    types: [labeled]
    branches: [main]. GitHub Actions supports 'pull_request' triggers with 'types' to filter on specific actions, but labeling is not a pull_request type event; it's an 'issues' or 'pull_request' event with 'labeled' type. Option A is correct. Option B is wrong because 'pull_request_target' is similar but has different security implications; it still requires correct event types. Option C is wrong because 'issue_comment' triggers on comments, not labels. Option D is wrong because 'workflow_run' triggers on completion of another workflow.

Answer

on:
  workflow_run:
    workflows: ["Build"]
    types: [completed]

Answer

on:
  issue_comment:
    types: [created]

Answer

on:
  pull_request_target:
    types: [opened, synchronize]
    branches: [main]

Question 10

You are designing a release pipeline for a mission-critical application. The pipeline must deploy to multiple environments (dev, test, prod) in sequence, with manual approval required before production deployment. Which Azure Pipelines feature should you use?

Accepted Answer

Pre-deployment approvals. Pre-deployment approvals allow manual approval before deployment to a stage. Option A is wrong because gates evaluate conditions automatically. Option B is wrong because pipeline triggers start runs automatically. Option D is wrong because variable groups store variables, not approvals.

Answer

Variable groups

Answer

Pipeline triggers

Answer

Deployment gates

Question 11

Refer to the exhibit. You are deploying this ARM template using Azure Pipelines. The pipeline passes the parameter 'environmentName' with value 'prod'. What will be the name of the virtual network?

Accepted Answer

vnet-prod. The variables section concatenates 'vnet-' with the parameter value, so 'vnet-prod'. Option A is wrong because it uses the default. Option C is wrong because it ignores the concatenation. Option D is wrong because it uses a static name.

Answer

vnet-default

Answer

vnet-prod-vnet

Answer

vnet-dev

Question 12

You are designing a release pipeline that deploys to multiple environments (dev, test, prod) sequentially. You need to require manual approval before deploying to prod. The approver should be able to review the changes and approve or reject. Which feature should you use?

Accepted Answer

Approval gates.. Option B is correct because approval gates allow manual approval with review. Option A is wrong because pre-deployment conditions include approvals but the gate is the feature. Option C is wrong because it only requires a manual step, not a proper approval with rejection capability. Option D is wrong because checks are for Azure environments.

Answer

Pre-deployment conditions.

Answer

Environment checks.

Answer

Manual intervention task.

Question 13

You are using Azure Pipelines to deploy a function app. You need to automatically roll back the deployment if the post-deployment smoke tests fail. What should you do?

Accepted Answer

Add a stage that runs only when the previous stage fails, executing a rollback script.. Option D is correct because a conditional stage that runs on failure can execute a rollback deployment. Option A is wrong because retrying the same deployment does not roll back. Option B is wrong because manual intervention is not automatic. Option C is wrong because approval gates prevent deployment but do not roll back after failure.

Answer

Configure the pipeline to retry the deployment on failure.

Answer

Use a pre-deployment approval gate to validate the build before deployment.

Answer

Set up a manual validation gate that requires operations to initiate a rollback.

Question 14

Your team uses Azure DevOps to deploy a Node.js web app to Azure App Service on Linux. The build pipeline runs `npm install` and `npm run build`, then publishes the `dist` folder. The release pipeline uses the 'Azure App Service deploy' task. Recently, deployments fail intermittently with 'ERR_MODULE_NOT_FOUND' for a custom module. The module is listed in `package.json` and is present in the `node_modules` folder on the build agent. What is the most likely cause?

Accepted Answer

The build artifact does not include node_modules; the app requires them at runtime.. Option B is correct because the App Service on Linux runs the app directly from the `dist` folder, but the `node_modules` folder is not included in the published artifact since only the `dist` folder is published. Hence, modules outside `dist` are missing. Option A is wrong because the task does not modify `package.json`. Option C is wrong because Kudu syncs all files, but the root issue is missing modules. Option D is wrong because the task does not run `npm install` by default.

Answer

The 'Azure App Service deploy' task modifies package.json during deployment.

Answer

The 'Azure App Service deploy' task runs npm install on the target, but it fails due to network restrictions.

Answer

The deployment slot's Kudu service fails to sync the dist folder.

Question 15

Which THREE are true about using deployment groups in Azure Pipelines? (Choose 3)

Accepted Answer

Each machine in a deployment group must have the Azure Pipelines agent installed.. Options A, C, and D are correct. A: Deployment groups are used to target multiple machines for rolling deployments. C: Each machine in a deployment group runs an agent that listens for jobs. D: Deployment groups can be used in release pipelines with the 'Deployment group' phase. Option B is wrong because deployment groups are not limited to Windows; they support Linux, macOS, etc. Option E is wrong because deployment groups are not environment-specific; environments are a separate concept.

Answer

Deployment groups can only be used with Windows-based machines.

Answer

Deployment groups are tied to a specific environment.