AZ-400 Practice Test 36 — 15 Questions

Question 1

Your team uses GitHub Actions to build a Python application. The workflow includes a step to run unit tests with pytest. The tests pass locally but fail in CI with 'ModuleNotFoundError: No module named 'myapp''. The repository structure has the application code in a subdirectory 'src/'. What is the most likely fix?

Accepted Answer

Set the environment variable PYTHONPATH to 'src/' before running tests.. Option C is correct because the CI environment does not have the 'src' directory in the Python path. Setting PYTHONPATH ensures the module is found. Option A is wrong because the working directory changes the context but not the Python path. Option B is wrong because installing the package in editable mode requires a setup.py. Option D is wrong because the dependencies are already installed.

Answer

Set the working directory of the test step to 'src/'.

Answer

Add a step to install dependencies with 'pip install -r requirements.txt'.

Answer

Add a step to run 'pip install -e .' from the repository root.

Question 2

Your Azure Pipelines release pipeline deploys to multiple stages. You need to implement a manual approval gate that requires two specific users to approve before deployment proceeds to production. The approval should expire after 8 hours. Which configuration should you use?

Accepted Answer

Pre-deployment conditions: Add approvers (user1, user2) with 'All' policy and set timeout to 480 minutes. Option C is correct because you can add multiple approvers (individuals) and set a timeout for approval. Option A is wrong because requiring 'Any one' allows a single approver. Option B is wrong because 'Team' approval requires the team's collective approval, not two specific individuals. Option D is wrong because pre-deployment conditions don't support timeout on approvals.

Answer

Pre-deployment conditions: Add approvers (user1, user2) with 'Any one' policy

Answer

Pre-deployment conditions: Add approvers (user1, user2) with 'All' policy and set 'Allow deployment without approval' to true

Answer

Post-deployment conditions: Add approvers (team) with 'All' policy

Question 3

Which TWO triggers can be used to automatically start a pipeline in Azure Pipelines? (Choose two.)

Accepted Answer

Continuous integration (CI) trigger. Options A and C are correct. A: Continuous integration (CI) trigger runs on code push. C: Pull request trigger runs on PR creation. Option B is wrong because a manual trigger requires user action. Option D is wrong because a scheduled trigger is time-based, but not automatic on code changes. Option E is wrong because a webhook trigger is also automatic but not a built-in trigger type in Azure Pipelines (it's a service hook).

Answer

Webhook trigger

Answer

Manual trigger

Answer

Scheduled trigger

Question 4

You are designing a release pipeline for a Node.js application that deploys to Azure App Service. The pipeline must run integration tests against the deployed application. You want to use deployment slots to minimize downtime. What is the recommended approach?

Accepted Answer

Deploy to a staging slot, run tests against the staging slot, then swap to production.. Option C is correct because deploying to a staging slot, running tests, then swapping ensures zero downtime. Option A is incorrect because deploying to production directly causes downtime. Option B is incorrect because running tests before swap does not validate the deployed app. Option D is incorrect because deploying to staging then deleting the slot loses the deployed app.

Answer

Deploy to the production slot directly and run tests after deployment.

Answer

Deploy to a staging slot, swap, then run tests.

Answer

Deploy to a staging slot, run tests, then delete the staging slot.

Question 5

Your release pipeline uses deployment groups to deploy to Windows servers. You need to securely pass credentials to a script that runs on target machines. What is the recommended approach?

Accepted Answer

Use Azure Key Vault task to fetch secrets during deployment. Option A is correct because Azure Key Vault integration provides secure secret storage and retrieval. Option B is wrong because storing in pipeline variables exposes secrets. Option C is wrong because environment variables can be logged. Option D is wrong because plaintext in scripts is insecure.

Answer

Hardcode credentials in the script and encrypt the script file

Answer

Store credentials as pipeline variables and reference them

Answer

Use environment variables on the target machines

Question 6

What is the most likely cause of this error?

Accepted Answer

The secret name in Key Vault does not match 'myKeyVaultSecret'. Option D is correct because the secret name in Key Vault must match exactly. Option A is wrong because the variable group is linked. Option B is wrong because missing permissions would give a different error. Option C is wrong because variable groups are supported.

Answer

The variable group is not linked to the Key Vault

Answer

The service connection does not have 'Get' permission on the Key Vault

Answer

Pipeline variables cannot reference Key Vault secrets

Question 7

Which TWO actions can you take to improve the security of secrets in Azure Pipelines? (Choose two.)

Accepted Answer

Limit variable group permissions to specific pipelines. Options B and C are correct. Option B: Using Azure Key Vault to store secrets and mapping them as secret variables prevents exposure. Option C: Limiting variable group permissions ensures only authorized pipelines can access secrets. Option A is wrong because storing secrets as plain text variables exposes them in logs. Option D is wrong because checking 'Allow at queue time' exposes secrets to users. Option E is wrong because logging secret values defeats the purpose.

Answer

Log secret values for debugging purposes

Answer

Allow pipeline users to override secret values at queue time

Answer

Store secrets as plain text variables in the pipeline

Question 8

Your organization uses GitHub Actions for CI/CD. You need to ensure that secrets used in workflows are not exposed in logs. What should you do?

Accepted Answer

Store the secret in GitHub Secrets and reference it as ${{ secrets.SECRET_NAME }}.. Option B is correct because GitHub automatically masks secrets when used in workflows. Option A is wrong because logging to a file still exposes the secret in the log. Option C is wrong because runner logs are stored and could be accessed. Option D is wrong because encryption does not prevent exposure if the secret is printed.

Answer

Encrypt the secret with a password before using it.

Answer

Use the 'echo' command to output the secret and then delete the log.

Answer

Disable logging on the self-hosted runner.

Question 9

Which TWO strategies can you use to manage secrets in Azure Pipelines securely?

Accepted Answer

Use a variable group linked to Azure Key Vault.. Options A and C are correct. Variable groups can be linked to Azure Key Vault to fetch secrets, and you can mark variables as secret in the pipeline UI. Option B is wrong because storing secrets in YAML files exposes them in source control. Option D is wrong because logging secrets is not secure. Option E is wrong because environment variables are not inherently secure.

Answer

Store secrets directly in the YAML pipeline file.

Answer

Use environment variables in the build agent.

Answer

Print the secret in a script to verify it is correct.

Question 10

Which TWO conditions must be met to use the 'Approvals and gates' feature in a release pipeline? (Choose two.)

Accepted Answer

A post-deployment approval must be configured.. Options A and C are correct. Approvals and gates require a pre-deployment approval and a post-deployment approval. Option B is incorrect because gates can be used without manual approval. Option D is incorrect because variable groups are not required. Option E is incorrect because service connections are not specifically required for approvals.

Answer

A manual intervention task must be added.

Answer

A variable group must be linked to the pipeline.

Answer

The pipeline must use a service connection.

Question 11

Your team uses GitHub Actions to build a Docker image and push it to Azure Container Registry (ACR). The workflow fails with the error 'unauthorized: authentication required'. The workflow uses the 'azure/docker-login@v1' action. What is the most likely cause?

Accepted Answer

The service principal used for authentication lacks the AcrPush role on the ACR.. Option B is correct because the Docker login action requires a service principal with AcrPush role. Option A is wrong because the action supports ACR. Option C is wrong because the action does not need admin credentials by default. Option D is wrong because the action can handle private registries.

Answer

The 'azure/docker-login@v1' action does not support ACR.

Answer

The Dockerfile is not in the repository root.

Answer

The workflow uses the registry admin credentials, which are disabled.

Question 12

Your build pipeline runs on a self-hosted agent pool. You need to ensure that only authorized pipelines can use these agents. Which security measure should you implement?

Accepted Answer

Set permissions on the agent pool. Option C is correct because agent pools can have permissions set to restrict which pipelines can use them. Option A is wrong because agent queues are deprecated and don't provide granular pipeline permissions. Option B is wrong because agent tokens are for agent registration, not pipeline authorization. Option D is wrong because variable groups are for variables, not agent access.

Answer

Use agent tokens

Answer

Use variable groups

Answer

Configure agent queues

Question 13

You are designing a release pipeline for a critical application that requires zero-downtime deployments. The application runs on Azure Kubernetes Service (AKS) with multiple replicas. You are using Azure Pipelines with a canary deployment strategy. What is the best approach to gradually shift traffic to the new version while monitoring for errors?

Accepted Answer

Use a service mesh like Istio to route a percentage of traffic to the new version.. Option B is correct because AKS native features for canary deployments using Istio or similar service mesh provide fine-grained traffic shifting. Option A is incorrect because blue-green with full swap does not allow gradual traffic shift. Option C is incorrect because rolling update in AKS is not canary; it replaces pods gradually but does not split traffic. Option D is incorrect because using Application Gateway does not provide gradual traffic shift at the pod level.

Answer

Use Azure Application Gateway as an ingress controller with weighted backend pools.

Answer

Use the AKS rolling update strategy with max surge.

Answer

Deploy to a staging environment, then swap VIPs with production.

Question 14

Which TWO tools can be used to manage feature flags in Azure DevOps pipelines?

Accepted Answer

LaunchDarkly.. Options A and D are correct. Azure App Configuration provides feature management. LaunchDarkly is a third-party tool that integrates. Options B, C, and E are not feature flag management tools.

Answer

Azure Policy.

Answer

Azure Monitor.

Answer

Azure Key Vault.

Question 15

Which TWO practices should you adopt to improve the security of your Azure DevOps pipeline? (Choose two.)

Accepted Answer

Grant the least privilege to service connections. Options B and D are correct. B reduces the attack surface by limiting permissions. D ensures secrets are not stored in code. A is wrong because using the default agent may expose the pipeline to untrusted code. C is wrong because it bypasses security reviews.

Answer

Use the default hosted agent for all builds

Answer

Store secrets as plain text in pipeline variables

Answer

Allow contributors to bypass the required reviewer policy