AZ-400 Practice Test 33 — 15 Questions

Question 1

A team uses Azure Pipelines to build a .NET application. The build takes 30 minutes, and developers complain that the pipeline runs slowly. The pipeline uses the 'windows-latest' agent and installs the .NET SDK in each run. Which action would MOST reduce the build time?

Accepted Answer

Enable pipeline caching for the .NET SDK.. Option B is correct because using a Microsoft-hosted agent with caching for the .NET SDK avoids downloading it each time, significantly reducing build time. Option A is wrong because more agents won't speed a single job. Option C is wrong because moving to Linux doesn't address SDK download overhead. Option D is wrong because self-hosted agents require maintenance and may not reduce time if SDK still downloads.

Answer

Deploy a self-hosted agent in Azure.

Answer

Increase the number of parallel jobs.

Answer

Change the agent pool to 'ubuntu-latest'.

Question 2

Which THREE of the following are valid steps to implement a trunk-based development workflow in Azure Repos? (Select THREE.)

Accepted Answer

Run CI builds on the main branch.. Options A, C, and E are correct. Short-lived feature branches (A) are key; CI builds on main (C) ensure quality; pair programming (E) reduces need for long-lived branches. Option B is wrong because frequent merges are encouraged, not weekly. Option D is wrong because release branches are not part of trunk-based development; everything is done on main.

Answer

Merge to main only once per week.

Answer

Create release branches for each production release.

Question 3

You are designing a release pipeline that deploys to multiple environments (dev, test, prod) with approval gates between each. You need to ensure that the same build artifact is deployed to all environments. Which strategy should you use?

Accepted Answer

Use a single build pipeline and promote the same build artifact through each environment.. Option C is correct because releasing the same artifact version across stages ensures consistency; promoting the build from dev to test to prod without rebuilding. Option A is wrong because rebuilding for each environment may produce different artifacts. Option B is wrong because separate pipelines for each environment do not guarantee the same artifact. Option D is wrong because the release pipeline should use a single artifact source.

Answer

Use a multi-stage YAML pipeline with a separate artifact for each stage.

Answer

Create a separate build pipeline for each environment to ensure environment-specific configurations.

Answer

Use a single build pipeline but trigger a new build for each environment.

Question 4

You are implementing a build pipeline for a .NET application that uses GitHub Advanced Security (GHAS) for code scanning. The pipeline must run CodeQL analysis on every pull request to the main branch. You have added the CodeQL task to the pipeline. However, the analysis results are not appearing in the 'Security' tab of the repository on GitHub. What is the most likely cause?

Accepted Answer

The pipeline is missing the 'Publish Security Analysis Logs' step to upload SARIF results to GitHub.. Option D is correct because CodeQL results are uploaded as SARIF files, and the 'CodeQL Analysis' task includes an option to upload results to GitHub. If that step is omitted or fails, results won't appear. Option A is wrong because CodeQL supports pull request analysis. Option B is wrong because CodeQL works with .NET. Option C is wrong because GitHub Advanced Security is available even in private repos.

Answer

The GitHub repository is private, so security alerts are disabled.

Answer

The .NET project is not supported by CodeQL.

Answer

CodeQL analysis is not supported on pull request triggers.

Question 5

You are designing a build pipeline for a Node.js application. The pipeline must run unit tests and publish code coverage results to Azure Pipelines. Which task should you use to ensure coverage results are available in the pipeline summary?

Accepted Answer

PublishCodeCoverageResults@1. Option B is correct because the PublishCodeCoverageResults task consumes coverage data (e.g., Cobertura format) and displays it in the pipeline summary. Option A is wrong because the PublishTestResults task only publishes test results, not coverage. Option C is wrong because the Visual Studio Test task is for .NET, not Node.js. Option D is wrong because the Copy Files task only copies files, it does not process coverage.

Answer

PublishTestResults@2

Answer

VSTest@2

Answer

CopyFiles@2

Question 6

Which TWO benefits does using deployment groups provide in Azure Pipelines? (Choose two.)

Accepted Answer

You can deploy to a specific set of target servers (e.g., all web servers in a farm).. Options A and D are correct. A: Deployment groups allow targeting specific sets of servers for deployments. D: They support rolling deployments with health checks. Option B is wrong because you can have multiple agents per deployment group. Option C is wrong because deployment groups are not limited to classic releases; they work with YAML pipelines too. Option E is wrong because agents in deployment groups are registered to the group, not individual machines.

Answer

You can assign multiple deployment groups to a single agent.

Answer

Each target server must have its own agent.

Answer

Deployment groups can only be used with classic release pipelines.

Question 7

You are designing a release pipeline for a .NET Core application that must comply with regulatory requirements. The pipeline must sign the assembly with a code-signing certificate stored in Azure Key Vault. Which THREE actions should you perform?

Accepted Answer

Add a step to download the certificate from Key Vault using the AzureKeyVault task.. Option A, Option C, and Option D are correct. The pipeline needs access to the certificate via a service connection, and the signing tool must run after the build. Option B is wrong because the certificate should be kept in Key Vault, not the build artifact. Option E is wrong because signing should happen before packaging.

Answer

Store the certificate in a secure file in the build artifact.

Answer

Package the application before signing to avoid signature corruption.

Question 8

You need to configure a release pipeline that deploys to Azure App Service. The deployment should use the 'slot swap' strategy to minimize downtime. Which deployment slot should you initially deploy to?

Accepted Answer

Staging slot. Option B is correct because you should deploy to a non-production slot (e.g., staging), then swap it with the production slot. Option A is wrong because deploying directly to production defeats the purpose of slot swap. Option C is wrong because Azure DevOps does not have a 'warmup' slot. Option D is wrong because you should deploy to a specific slot, not all slots.

Answer

Production slot

Answer

Warmup slot

Answer

All slots simultaneously

Question 9

Your release pipeline deploys to Azure App Service using a deployment slot. You need to ensure that after swapping slots, the staging slot retains the previous production configuration for rollback. Which deployment strategy should you use?

Accepted Answer

Swap with preview. Option D is correct because swap with preview allows you to validate before completing the swap, and the staging slot keeps the old production configuration. Option A is wrong because rolling update doesn't use slots. Option B is wrong because blue-green typically uses separate environments, not slots. Option C is wrong because canary deploys traffic gradually, not slot swap.

Answer

Rolling deployment

Answer

Blue-green deployment

Answer

Canary deployment

Question 10

You need to run unit tests in your build pipeline and publish the test results to Azure Pipelines. Which task should you use?

Accepted Answer

Publish Test Results task. Option B is correct because the 'Publish Test Results' task publishes test results to Azure Pipelines. Option A is wrong because 'Visual Studio Test' runs tests but does not publish to the pipeline. Option C is wrong because 'DotNetCoreCLI' can run tests but needs an additional task to publish results. Option D is wrong because 'Npm' is for Node.js, not .NET tests.

Answer

DotNetCoreCLI task with test command

Answer

Npm task

Answer

Visual Studio Test task

Question 11

Which TWO actions should you take to implement a gated deployment strategy in Azure Pipelines?

Accepted Answer

Use deployment gates to evaluate metrics like error rate before allowing the next stage.. Options B and D are correct. Approval gates and deployment gates with health evaluation are key components of gated deployment. Option A is not specific to gated deployment. Option C is about monitoring, not gating. Option E is about rollback, not gating.

Answer

Configure a dashboard to monitor application health.

Answer

Use a multi-stage YAML pipeline.

Answer

Configure a rollback strategy if deployment fails.

Question 12

You are deploying a multi-container application to Azure Kubernetes Service (AKS) using Azure Pipelines. You need to ensure that the deployment rollback automatically if the health checks fail. Which strategy should you implement?

Accepted Answer

Configure a rolling update with readiness and liveness probes. Option B is correct because Kubernetes deployment strategy with health probes enables automatic rollback. Option A is wrong because blue-green does not automatically rollback. Option C is wrong because canary does not automatically rollback. Option D is wrong because Helm alone does not provide health check-based rollback.

Answer

Use a blue-green deployment strategy

Answer

Use Helm charts with pre-upgrade hooks

Answer

Implement a canary deployment with manual verification

Question 13

Your organization uses GitHub Actions for CI/CD. You need to implement a deployment strategy where a new version of the application is gradually shifted from the stable environment to a canary environment, and if health checks pass, the traffic is fully shifted to the canary. Which GitHub Actions deployment strategy should you use?

Accepted Answer

Canary deployment. Option B is correct because the 'canary' deployment strategy in GitHub Actions gradually shifts traffic to the new version and promotes if health checks pass. Option A is wrong because 'blue-green' switches all traffic at once. Option C is wrong because 'rolling' updates instances in batches but doesn't use canary traffic shifting. Option D is wrong because 'recreate' replaces all instances at once.

Answer

Recreate deployment

Answer

Blue-green deployment

Answer

Rolling deployment

Question 14

Refer to the exhibit. The pipeline will trigger when changes are pushed to which branches?

Accepted Answer

The main branch and any branch starting with 'release/'. Option C is correct because the trigger includes 'main' and 'release/*' branches, so any branch matching 'main' or starting with 'release/' will trigger the pipeline. Option A is wrong because it only includes main, not release/*. Option B is wrong because it includes all branches. Option D is wrong because it only includes release/* branches.

Answer

All branches

Answer

Only the main branch

Answer

Only branches starting with 'release/'

Question 15

Your team uses a monorepo in Azure Repos with multiple projects. You want to trigger a pipeline only when changes are made to a specific subfolder. Which configuration should you use?

Accepted Answer

Add a 'paths' filter to the CI trigger.. Option A is correct because the 'paths' trigger filter allows specifying include/exclude patterns. Option B is wrong because branch filters limit which branches trigger, not paths. Option C is wrong because the checkout step is for fetching code, not triggering. Option D is wrong because file matching is not a trigger property.

Answer

Use a branch filter in the CI trigger.

Answer

Configure the checkout step to only include the subfolder.

Answer

Use a 'file_match' condition on the job.