AZ-400 Practice Test 30 — 15 Questions

Question 1

Your team uses a multi-stage YAML pipeline to build and deploy a .NET Core application. The build stage runs successfully, but the deployment to a Linux web app fails with an error indicating that the Kudu service cannot start because the startup command is missing. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The pipeline is missing the 'AzureWebApp@1' task with a 'StartupCommand' parameter.. The Kudu service on Linux web apps requires a startup command to launch the .NET Core application. The 'AzureWebApp@1' task's 'StartupCommand' parameter specifies this command (e.g., 'dotnet myapp.dll'). Without it, Kudu cannot start the process, causing the deployment failure.

Answer

The service connection lacks permission to access the web app.

Answer

The web app is configured with a Windows runtime stack.

Answer

The build output does not include the web.config file.

Question 2

A development team is configuring a YAML-based pipeline in Azure Pipelines. The pipeline must meet the following requirements: 
- Build only the main branch.
- Run integration tests after a successful build.
- Deploy to a staging environment only if tests pass.
- Handle failures gracefully by sending a notification to the team.
You need to define the pipeline structure. Which TWO configurations should you include?

Accepted Answer

Define a stage for 'Deploy' with `dependsOn: Test` and `condition: succeeded('Test')`.. It defines a 'Deploy' stage that depends on the 'Test' stage and uses `condition: succeeded('Test')` to ensure deployment only occurs after tests pass. This satisfies the requirement to deploy to staging only if tests succeed. Option C is correct because `trigger: main` at the pipeline root configures the pipeline to build only the main branch, meeting the first requirement.

Answer

Use a `deployment: Staging` job with `displayName: Deploy to staging`.

Answer

Add `condition: succeeded()` to the build job.

Answer

Define the trigger in the `resources` section using `pipelines`.

Question 3

Match each Git branching strategy to its description.

Accepted Answer

Git Flow: Uses develop and master branches with release branches.. Git branching strategies vary in complexity. Git Flow uses long-lived branches (develop, release), GitHub Flow is simple with feature branches to main, GitLab Flow adds environment branches, and trunk-based development centers on frequent commits to main. Common confusions involve swapping descriptions between Git Flow and GitHub Flow.

Answer

Git Flow: Uses only main branch and feature branches.

Answer

GitHub Flow: Uses develop and release branches.

Question 4

Match each YAML pipeline trigger to its behavior.

Accepted Answer

CI trigger: Triggers a pipeline when a push occurs on the specified branch. In Azure Pipelines YAML, each trigger type has a distinct purpose: CI for push events, PR for pull requests, Schedules for cron-based runs, and Pipeline for cross-pipeline dependencies. Common confusions mix the behaviors of CI/PR or PR/Pipeline triggers.

Answer

CI trigger: Triggers a pipeline when a pull request is opened

Answer

PR trigger: Triggers a pipeline on completion of another pipeline

Question 5

Refer to the exhibit. You executed the Azure CLI command to list variable groups. A security audit requires that all variable groups containing secrets are configured to be authorized for all pipelines. Which statement is true based on the output?

Accepted Answer

The variable group 'ProdVars' contains a secret variable, but the output does not indicate whether it is authorized for all pipelines. The JSON output shows that 'ProdVars' has an 'ApiKey' variable with a null value, indicating it is a secret variable (values are masked). The output does not include any authorization properties, so we cannot determine if it is authorized for all pipelines. Option B is incorrect because the property 'authorized' may exist but is not shown in the list command; you need to use 'az pipelines variable-group show' or check the settings separately. Option C is incorrect because the secret value is masked (null), not exposed. Option D is incorrect because having secret variables does not automatically authorize the group for all pipelines; authorization must be explicitly configured.

Answer

The variable group 'ProdVars' is not authorized for all pipelines because no such property exists

Answer

The variable group 'ProdVars' has exposed the secret value in the output

Answer

The variable group 'ProdVars' is authorized for all pipelines because it has secret variables

Question 6

Match each Azure Artifacts feed type to its description.

Accepted Answer

Project-scoped feed: A feed scoped to a specific project within an organization, accessible by members of that project.. In Azure Artifacts, project-scoped feeds are limited to a specific project, organization-scoped feeds are available to the entire org, and public feeds allow anonymous access. Common confusions arise from swapping the scope of project and org feeds, or misstating public feed authentication requirements.

Answer

Project-scoped feed: A feed scoped to the entire organization, accessible by all members.

Answer

Organization-scoped feed: A feed scoped to a specific project, accessible by project members.

Answer

Public feed: A feed that requires authentication from external users.

Question 7

A company uses Azure DevOps for CI/CD. The security team requires that all pipeline runs must use a specific service connection (ServiceConnection-Prod) that has been approved for production deployments. However, developers are accidentally using unapproved connections. You need to enforce that only the approved service connection can be used in any pipeline that deploys to the production environment. What should you do?

Accepted Answer

Create an Azure Pipeline decorator that validates the service connection used in each task and fails the pipeline if it is not the approved one.. Azure Pipeline decorators inject custom validation logic at runtime, allowing you to inspect each task's service connection and fail the pipeline if it does not match the approved one. This enforces the security requirement centrally without relying on developer compliance or manual gates.

Answer

Define a required template for all pipelines that includes the service connection, and instruct developers to use it.

Answer

Set up a manual approval gate on the production environment stage in the pipeline.

Answer

Configure a branch policy on the main branch to require a successful build before merging.

Question 8

Which TWO practices help you manage build artifacts efficiently in Azure Pipelines?

Accepted Answer

Set retention policies to automatically delete old artifacts. Setting retention policies (A) helps automate cleanup of old artifacts, reducing storage waste. Using the Publish Build Artifacts task (D) is the standard way to store artifacts from builds efficiently. Option B (copying to each agent) is wasteful because it duplicates artifacts unnecessarily. Option C (manual download) is inefficient because it requires human intervention and does not scale. Option E (large single files) makes downloads and incremental updates difficult.

Answer

Copy artifacts to each agent's local storage

Answer

Download all artifacts manually after each build

Answer

Store artifacts as large single files to reduce number of files

Question 9

Refer to the exhibit. You monitor an Azure App Service web app. At 10:30 AM, you observe a spike in HTTP 5xx errors and response time. Based on the metrics, what is the most likely cause?

Accepted Answer

The web app reached its scaling limit and could not handle the increased load.. The request count increased gradually from 1200 to 2500 before the errors started at 10:30 AM. The sharp rise in errors and response time coinciding with peak load indicates the app reached its capacity limit (e.g., instance count or plan limits).

Answer

A deployment of new code at 10:30 AM introduced a bug.

Answer

A DDoS attack started at 10:30 AM.

Answer

A database outage caused the errors and slow responses.

Question 10

A company uses Azure Monitor and Application Insights to monitor a microservices application deployed on Azure Kubernetes Service (AKS). The development team wants to implement distributed tracing to correlate requests across services. They currently have Application Insights SDKs instrumented in each service. Which TWO configurations are required to enable end-to-end distributed tracing?

Accepted Answer

Ensure all services use the same Application Insights instrumentation key or connection string.. All services must share the same Application Insights instrumentation key or connection string to ensure that telemetry from different microservices is correlated into a single application map and trace. Without a common instrumentation key, the distributed trace data would be siloed across separate Application Insights resources, preventing end-to-end correlation.

Answer

Enable the Live Metrics Stream feature in Application Insights.

Answer

Configure adaptive sampling in the Application Insights SDK.

Answer

Enable Application Map in the Azure portal for each service.

Question 11

Drag and drop the steps to configure a service hook for build completion notifications to Microsoft Teams into the correct order.

Accepted Answer

First, navigate to Project Settings and select Service Hooks. Then, create a new subscription choosing the Build completed event and Microsoft Teams as the service. Finally, configure the webhook URL and test the subscription.. To configure a service hook for build completion notifications to Microsoft Teams, you must first access the Service Hooks page in Project Settings. Then, you create a new subscription and select the Build completed event and Microsoft Teams as the service. Finally, you provide the webhook URL and test the subscription to ensure it works.

Answer

First, create a new subscription choosing the Build completed event and Microsoft Teams. Then, navigate to Project Settings and select Service Hooks. Finally, configure the webhook URL and test the subscription.

Answer

First, configure the webhook URL and test the subscription. Then, navigate to Project Settings and select Service Hooks. Finally, create a new subscription for the Build completed event.

Answer

First, choose Microsoft Teams as the service and paste the webhook URL. Then, navigate to Project Settings and select Service Hooks. Finally, create a new subscription for the Build completed event.

Question 12

Your Azure DevOps pipeline uses a YAML template that defines variables. You want to override a variable value when running the pipeline manually. What is the best approach?

Accepted Answer

Use the 'Variables' tab in the pipeline run UI to set a new value for the variable.. Azure Pipelines allows you to override the value of a YAML-defined variable directly in the pipeline run UI via the 'Variables' tab when manually triggering a run. This approach is the simplest and most flexible way to change a variable's value without modifying the YAML template or pipeline definition, and it supports runtime parameterization for manual runs.

Answer

Create a variable group and link it to the pipeline.

Answer

Edit the template YAML file to hardcode the desired value.

Answer

Define a parameter in the template and pass the value via the 'Override' parameter in the pipeline.

Question 13

Which THREE are valid ways to trigger a pipeline in Azure Pipelines using GitHub integration? (Choose three.)

Accepted Answer

GitHub App webhooks. GitHub App webhooks are the primary integration mechanism for Azure Pipelines with GitHub. When you configure a GitHub App connection in Azure Pipelines, it registers webhooks that listen for specific GitHub events (like push and pull request) and automatically triggers pipeline runs in real-time without polling.

Answer

Polling GitHub on a schedule

Answer

Azure Pipelines schedule trigger

Question 14

Your Azure DevOps pipeline deploys to multiple environments. You want to require manual approval before production deployment, but only if the deployment originated from a branch other than 'main'. How can you implement this?

Accepted Answer

Add a manual validation task with a condition: ne(variables['Build.SourceBranch'], 'refs/heads/main'). To require manual approval only for non-main branches, add a manual validation task to the production deployment job with a condition checking that the source branch is not main: `ne(variables['Build.SourceBranch'], 'refs/heads/main')`. This pauses the pipeline and waits for approval. Pre-deployment approvals (A) cannot be conditional on branch, and deployment groups (B) are not for manual approval. Branch policies (C) do not apply to pipeline stages.

Answer

Set a pre-deployment approval on the production environment

Answer

Configure a deployment group with approval gates

Answer

Use a branch policy that requires approval for non-main branches

Question 15

Your team uses Azure DevOps with a Git repository. You want to enforce that all pull requests to main must have at least one reviewer from the 'security' group. Which two configurations are required? (Choose two.)

Accepted Answer

Add the security group as a required reviewer for the main branch policy.. You can add the security group as a required reviewer in the branch policy. Option D is correct because setting the minimum number of reviewers to 1 ensures at least one reviewer is required. Option A is incorrect because automatic reviewers are not the same as required reviewers; they only suggest reviewers but do not enforce mandatory review. Option C is incorrect because a repository policy applies to all branches, not just main, and does not enforce required reviewers for pull requests; a branch policy is needed. Option E is incorrect because a branch protection rule is a GitHub feature, not available in Azure Repos.

Answer

Configure automatic reviewers for the security group.

Answer

Create a repository policy for the main branch.

Answer

Configure a branch protection rule in GitHub.