AZ-400 Practice Test 32 — 15 Questions

Question 1

You are debugging a recent issue introduced in the main branch. Based on the exhibit, which command would you run to revert the 'Fix login bug' commit while preserving the merge commit?

Accepted Answer

git revert -m 1 HEAD. The 'Fix login bug' commit is a merge commit. To revert a merge commit while preserving its merge parent (i.e., the mainline), you must use `git revert -m 1 HEAD`. The `-m 1` flag specifies that the first parent (the main branch) should be kept, effectively reverting the changes brought by the merge. Option C, `git revert HEAD`, would fail because Git requires the `-m` flag when reverting a merge commit. Option B destroys history, which is not desired. Option D uses `-m 2`, which would revert the changes from the secondary parent (the feature branch), not the merge itself.

Answer

git reset --hard HEAD~1

Answer

git revert HEAD

Answer

git revert c3a2b1e -m 2

Question 2

A company uses Azure DevOps for CI/CD. They have multiple pipelines that deploy to different environments. They want to ensure that secrets like API keys are not exposed in pipeline logs. What is the best approach?

Accepted Answer

Create a Variable Group linked to Azure Key Vault. Variable Groups linked to Azure Key Vault allow you to securely store secrets in Key Vault and reference them in pipelines without exposing the actual values in logs or output. Option A is incorrect: Azure App Configuration with Key Vault references is designed for application configuration, not for managing pipeline secrets directly. Option C is incorrect: Azure Kubernetes Service (AKS) secrets are specific to Kubernetes workloads and not intended for general pipeline secret management. Option D is incorrect: Pipeline variables marked as 'secret' are masked in logs, but they are still stored in Azure DevOps and lack the centralized security and auditing capabilities of Key Vault.

Answer

Use Azure App Configuration with Key Vault references

Answer

Use Azure Kubernetes Service secrets

Answer

Use pipeline variables marked as 'secret'

Question 3

A company uses Microsoft Defender for Cloud to assess the security posture of Azure Pipelines agents. They notice that self-hosted agents are flagged as having high-severity vulnerabilities. What is the recommended action to remediate these findings while minimizing downtime?

Accepted Answer

Apply the security updates recommended by Microsoft Defender for Cloud to the agent VMs.. Microsoft Defender for Cloud identifies vulnerabilities on the VMs hosting self-hosted Azure Pipelines agents and provides specific security update recommendations. Applying these updates directly remediates the high-severity findings without requiring agent replacement or disabling security monitoring, thus minimizing downtime by patching in-place.

Answer

Disable Microsoft Defender for Cloud for the agent pool.

Answer

Uninstall the self-hosted agents and use only Microsoft-hosted agents.

Answer

Replace all self-hosted agents with Microsoft-hosted agents.

Question 4

Refer to the exhibit. A developer is on the 'feature/login' branch and wants to integrate the latest changes from 'feature/user-profile' without creating a merge commit. Which Git command should the developer use?

Accepted Answer

git rebase origin/feature/user-profile. To integrate changes from another branch without a merge commit, rebase is appropriate. The developer can rebase feature/login onto feature/user-profile (or onto main after merging user-profile). However, the exhibit shows that feature/user-profile is already merged into main, so rebasing feature/login onto main is also valid. The simplest is to rebase feature/login onto main, but that would include all changes. Alternatively, rebasing feature/login onto feature/user-profile directly would also work, but since user-profile is merged into main, rebasing onto main is common. The correct answer is rebase.

Answer

git pull --rebase origin main

Answer

git merge origin/feature/user-profile

Answer

git cherry-pick 9f8e7d6..8a7b6c5

Question 5

Your organization uses GitHub and wants to enforce that all commits to the main branch are signed with a GPG key that is verified against the user's GitHub account. Additionally, you want to block unsigned commits even if the committer is a repository admin. Which configuration should you use?

Accepted Answer

Enable 'Require signed commits' and set 'Include administrators' to true.. Enabling 'Require signed commits' in a GitHub branch protection rule, combined with setting 'Include administrators' to true, enforces that every commit pushed to the protected branch must be signed with a GPG key verified against the user's GitHub account, and this restriction applies even to repository administrators. This configuration blocks unsigned commits entirely, meeting the requirement to enforce signing for all users including admins.

Answer

Add a pre-receive hook that rejects unsigned commits.

Answer

Enable 'Require signed commits' and set 'Include administrators' to false.

Answer

Enable 'Require signed commits' and configure web commit signing.

Question 6

Your team uses Azure Pipelines to build a .NET Core application. The build runs successfully on Windows agents, but you need to also run the build on Linux agents to validate cross-platform compatibility. The pipeline currently has a single `windows-latest` agent pool. What is the most efficient way to run the build on both platforms without duplicating the entire pipeline?

Accepted Answer

Add a `strategy` with a `matrix` that specifies `vmImage: ['windows-latest', 'ubuntu-latest']` in the job.. Using a `strategy` with a `matrix` allows the same job to run on multiple agent pools in parallel, enabling cross-platform validation without duplicating the pipeline. Option A duplicates the entire pipeline, which is inefficient. Option B would require separate jobs, but not as concise as the matrix strategy. Option C uses stages, which run sequentially, not in parallel for this purpose.

Answer

Create two separate pipelines, one for each platform.

Answer

Use a multi-job pipeline with two jobs, each specifying a different pool.

Answer

Use a multi-stage pipeline with a stage for each platform.

Question 7

Your organization uses Azure DevOps and has a strict compliance requirement: all changes to the main branch must be reviewed by at least two members of the 'ComplianceTeam' group. Additionally, a static code analysis tool must run and its results must be published to the pull request. The ComplianceTeam is a custom group defined in Azure DevOps, not a Microsoft Entra ID group. The team wants to enforce this using branch policies. You need to configure the minimum number of reviewers and also ensure that the code analysis results are visible to reviewers. What should you do?

Accepted Answer

Add a branch policy 'Require a minimum number of reviewers' set to 2, and specify the ComplianceTeam as required reviewers. Additionally, add a build policy that runs the code analysis and publishes results as a build summary.. The 'Require a minimum number of reviewers' branch policy enforces that at least two members from the ComplianceTeam must approve the pull request. Adding a build policy that runs static code analysis and publishes results as a build summary ensures the analysis output is visible directly in the PR, meeting the compliance requirement for both reviewer count and code analysis visibility.

Answer

Add a branch policy 'Require code owner review' and define the ComplianceTeam as code owners in a CODEOWNERS file.

Answer

Add a branch policy 'Comment resolution' and configure the ComplianceTeam to resolve comments.

Answer

Add a branch policy 'Automatically included reviewers' and set the ComplianceTeam to be automatically added to all PRs.

Question 8

Refer to the exhibit. You have an availability set with two VMs. One VM shows a degraded availability state. What is the most likely impact on application availability?

Accepted Answer

The application will be vulnerable to unplanned hardware failures that affect the degraded VM's host.. In an availability set, VMs are placed on different fault domains (separate racks with independent power, cooling, and network) to protect against unplanned hardware failures. If one VM shows a degraded availability state, it indicates that its underlying host or hardware is experiencing issues, making that VM vulnerable to failure. The other VM remains healthy, but the application is not fully resilient because the degraded VM could fail, reducing the application's capacity or causing partial downtime if the application requires both VMs to handle load.

Answer

The application will be fully resilient to both planned and unplanned maintenance events.

Answer

The application will experience downtime during planned maintenance events.

Answer

The application will continue to run without any impact because the other VM is healthy.

Question 9

You are designing a build pipeline that produces a NuGet package. The pipeline must conditionally sign the assembly only when the build is triggered by a tag starting with 'v' (e.g., v1.0.0). The pipeline uses a script task that signs the assembly. Which expression should you use in the condition of the script task?

Accepted Answer

and(succeeded(), startsWith(variables['Build.SourceBranch'], 'refs/tags/v')). The condition uses `startsWith(variables['Build.SourceBranch'], 'refs/tags/v')` to check if the build was triggered by a tag whose full Git ref starts with `refs/tags/v`. This ensures the signing script runs only when the source branch is a tag reference matching the 'v' prefix, which is the standard way to identify version tags in Azure Pipelines. The `and(succeeded(), ...)` wrapper guarantees the previous tasks completed successfully before signing.

Answer

and(succeeded(), startsWith(variables['Build.SourceBranchName'], 'v'))

Answer

and(succeeded(), startsWith(variables['Build.SourceVersion'], 'v'))

Answer

and(succeeded(), eq(variables['Build.Reason'], 'IndividualCI'))

Question 10

Refer to the exhibit. After executing the delete command, what is the state of the repository?

Accepted Answer

The tag v1.0-rc is removed, and the repository now contains only one tag (v1.0) and three branches.. The command deleted the tag refs/tags/v1.0-rc. After deletion, the tag is no longer available. The other refs (branches and tags) remain unchanged. The repository now has only one tag: v1.0. The branches main, develop, and feature/new-feature still exist.

Answer

The tag v1.0-rc is removed, but the commit it pointed to is also deleted from the repository.

Answer

The tag v1.0-rc is removed, and the branch feature/new-feature is also deleted because it was the same object.

Answer

The command fails because the tag does not exist.

Question 11

Your organization uses GitHub Actions for CI/CD. You need to implement a deployment strategy where a new version of the application is gradually shifted from the stable environment to a canary environment, and if health checks pass, the traffic is fully shifted to the canary. Which GitHub Actions deployment strategy should you use?

Accepted Answer

Canary deployment. A canary deployment gradually shifts traffic from the stable environment to a new canary environment, using health checks to validate the new version before fully routing all traffic to it. This matches the requirement of a gradual shift with health-check gating. GitHub Actions supports this via deployment strategies like `canary` in environments or custom workflows with traffic-splitting tools.

Answer

Recreate deployment

Answer

Blue-green deployment

Answer

Rolling deployment

Question 12

You are a DevOps engineer for a financial services company with strict regulatory compliance requirements (e.g., PCI-DSS, SOX). The company uses Azure DevOps for CI/CD and manages multiple projects. Each project has its own set of service connections, variable groups, and agent pools. The security team recently audited the environment and found that several service connections have been granted Contributor rights at the subscription level, and some variable groups are accessible by all pipelines across all projects. Additionally, audit logs show that a former employee's service principal still has active service connections in two projects. You need to implement a security and compliance plan to address these issues. Which approach should you take?

Accepted Answer

Implement Azure Policy to enforce that service connections cannot have subscription-level Contributor role; instead, require specific resource group roles. Use Azure AD access reviews to automatically remove stale service principals. Use pipeline decorators to enforce branch policy and approval checks on variable groups that contain secrets.. It provides a comprehensive, automated, and scalable approach to enforcing least privilege and compliance. Azure Policy can audit and enforce that service connections are scoped to resource groups rather than subscriptions, preventing over-permissioned Contributor access. Azure AD access reviews automate the detection and removal of stale service principals, addressing the former employee issue without manual effort. Pipeline decorators enforce mandatory approval checks and branch policies on variable groups containing secrets, ensuring that sensitive variables are not accessible to all pipelines across projects.

Answer

Conduct a manual audit of all service connections and variable groups every quarter, and revoke any permissions that are not needed. Disable service connections associated with the former employee.

Answer

Immediately delete all service connections associated with the former employee and recreate them using service principals with the least privilege. Then, update all pipelines to use the new connections.

Answer

Restrict all service connections to use resource-group level scoped permissions instead of subscription-level. For variable groups, set them to be accessible only to specific pipelines.

Question 13

Your team uses Azure Pipelines for CI/CD. You need to ensure that only approved branches can trigger production deployments. Which feature should you use?

Accepted Answer

Branch control for environments. Branch control for environments in Azure Pipelines allows you to restrict which branches can trigger deployments to specific environments, such as production. By configuring branch filters on an environment, you ensure that only approved branches (e.g., main or release branches) can initiate a production deployment, providing a security and governance boundary.

Answer

YAML template expressions

Answer

Deployment gates

Answer

Pipeline decorators

Question 14

Your team uses Azure Pipelines with GitHub for source control. You need to ensure that whenever a pull request is created against the main branch, a validation build runs automatically. Which YAML trigger should you configure in the pipeline?

Accepted Answer

pr: branches: include: - main. The correct syntax for a pull request trigger in Azure Pipelines YAML. The `pr` trigger requires a `branches` node with `include` or `exclude`, and the verbose form `pr: branches: include: - main` is fully valid. Option B, `pr: main`, is not valid YAML syntax for Azure Pipelines; the shorthand `pr: main` is not recognized and will cause the pipeline to ignore the trigger. Options C and D use the `trigger` keyword, which is for CI builds on push, not for PR validation.

Answer

pr: main

Answer

trigger: branches: exclude: - main

Answer

trigger: main

Question 15

Match each Azure Pipeline concept to its definition.

Accepted Answer

Pipeline: A collection of stages that defines the CI/CD process.. The correct matches are: A: Pipeline → 'A collection of stages that defines the CI/CD process' (correct); B: Stage → 'A logical boundary in the pipeline used to group jobs' (correct); C: Job → 'A unit of work that runs on an agent' (correct); D: Task → 'A single operation to perform in a job' (correct). E is incorrect because Pipeline is not a logical boundary; that definition belongs to Stage. F is incorrect because Stage is not a collection of stages; that definition belongs to Pipeline. The most common confusion is swapping the definitions of Pipeline and Stage.

Answer

Pipeline: A logical boundary in the pipeline used to group jobs.

Answer

Stage: A collection of stages that defines the CI/CD process.