AZ-400 Practice Test 36 — 15 Questions

Question 1

Your team uses Azure Test Plans. You need to ensure that testers can easily see which test cases are blocked by a known bug. What should you do?

Accepted Answer

Link test cases to the bug and create a query for linked items.. Azure Test Plans allows test cases to be linked directly to bugs via work item linking. By creating a query for linked items (e.g., a shared query that returns all test cases linked to a specific bug), testers can instantly see which test cases are blocked by that known bug. This provides a dynamic, filterable view without duplicating or reorganizing test artifacts.

Answer

Configure the test plan to show only failed tests.

Answer

Create a test suite for each bug.

Answer

Copy the test case and mark it as blocked.

Question 2

Your team uses Azure Pipelines for CI/CD. A release pipeline fails intermittently during deployment to an Azure App Service slot. The error message indicates 'Failed to fetch access token for Azure Resource Manager service endpoint.' The service principal used has been granted Contributor role on the resource group. The issue resolves after re-creating the service connection in Azure DevOps. What is the most likely cause?

Accepted Answer

The service principal client secret has expired.. Service principal credentials (client secret) can expire, causing intermittent token fetch failures. Re-creating the service connection generates a new secret, temporarily resolving the issue until it expires again. Option B is wrong because the service connection is bound to the service principal, not the user who created it; removing the user does not affect the existing connection. Option C is wrong because network restrictions would cause consistent failure, not intermittent. Option D is wrong because the service principal already has the Contributor role on the resource group.

Answer

The user who created the service connection has been removed from Azure DevOps.

Answer

The Azure DevOps organization is behind a firewall that blocks outbound requests to Azure Resource Manager.

Answer

The service principal lacks the required role on the target resource group.

Question 3

Which THREE components are required to implement a self-hosted agent pool in Azure Pipelines?

Accepted Answer

The Azure Pipelines agent software installed on the machine.. The Azure Pipelines agent software is the core component that executes pipeline jobs on the self-hosted machine. Without installing the agent software (via the agent configuration script), the machine cannot register with Azure Pipelines or run any tasks, making it a mandatory requirement for a self-hosted agent pool.

Answer

An Azure Resource Manager service connection.

Answer

A YAML pipeline definition.

Question 4

Your team uses GitHub Actions for CI/CD. You need to ensure that only specific branches can trigger the deployment workflow to production. Which workflow trigger should you configure?

Accepted Answer

on: push: branches: [main]. The `on: push: branches: [main]` trigger ensures that the deployment workflow runs only when a push event occurs on the `main` branch. This directly enforces the requirement that only specific branches (here, `main`) can trigger production deployments, preventing accidental or unauthorized deployments from other branches.

Answer

on: pull_request: branches: [main]

Answer

on: workflow_dispatch: inputs: branch: description: 'Select branch'

Answer

on: schedule: cron: '0 0 * * *'

Question 5

Your organization uses Azure Pipelines with Microsoft-hosted agents. The pipeline runs a .NET Core application build. You notice that the build takes longer than expected. Which THREE actions can you take to improve build performance? (Choose three.)

Accepted Answer

Enable caching for NuGet packages.. Enabling NuGet package caching reduces build time by avoiding repeated downloads of packages. Using a self-hosted agent with pre-installed dependencies eliminates the need to install and download tools on each run, further reducing overhead. Additionally, structuring the pipeline as a multi-stage build and running tests in parallel across multiple agents can significantly shorten overall pipeline duration by executing independent test suites concurrently. Together, these optimizations improve build performance.

Answer

Add more build steps to the pipeline.

Answer

Increase the number of parallel jobs in the pipeline.

Question 6

You have a YAML pipeline that uses a multi-stage build. You want to cache the restored NuGet packages across builds to improve performance. Which caching strategy should you use?

Accepted Answer

Use the Cache@2 task with key: 'nuget | "$(Agent.OS)" | packages.lock.json', path: '$(System.DefaultWorkingDirectory)/packages'. The Cache@2 task is the recommended way to cache NuGet packages in Azure Pipelines. By using a cache key that includes the agent OS and the packages.lock.json file, the cache is invalidated only when the lock file changes, ensuring restored packages are reused across builds. The path points to the NuGet global packages folder, which is typically $(System.DefaultWorkingDirectory)/packages when NUGET_PACKAGES is set.

Answer

Use the NuGetCommand@2 task with the -Cache argument.

Answer

Set the NUGET_PACKAGES environment variable to a custom path and rely on pipeline caching plugin.

Answer

Use the DotNetCoreCLI@2 task with the --no-restore flag and manually copy packages.

Question 7

Refer to the exhibit. You have a YAML pipeline with the above steps. The pipeline publishes a web app and deploys to Azure App Service. The deployment fails with error: 'Could not find the package in the specified path.' What is the most likely cause?

Accepted Answer

The package path is wrong; the zip file is in $(Build.ArtifactStagingDirectory).. The error 'Could not find the package in the specified path' indicates that the AzureWebApp task is looking for a deployment package (typically a .zip file) at a path that does not exist. In the exhibit, the `dotnet publish` command outputs to `$(Build.ArtifactStagingDirectory)`, but the subsequent AzureWebApp task likely references a different path (e.g., `$(System.DefaultWorkingDirectory)` or a hardcoded path). The correct path should be `$(Build.ArtifactStagingDirectory)/**/*.zip` to match the published artifact. Option A correctly identifies this path mismatch as the root cause.

Answer

The AzureWebApp task input 'appType' is incorrect.

Answer

The dotnet publish command did not generate a zip file.

Answer

The service connection 'MyServiceConnection' is not authorized.

Question 8

A development team is transitioning from a centralized version control system to Git in Azure Repos. The team lead wants to ensure that the branch structure supports both feature development and hotfix releases, with the ability to stabilize a release candidate before final deployment. Which branch strategy should the team implement?

Accepted Answer

Use Git Flow with feature, develop, release, and main branches.. Git Flow is the correct choice because it explicitly supports feature development, release stabilization, and hotfix releases through its structured branch hierarchy. The release branch allows the team to stabilize a release candidate before merging to main, while hotfix branches can be created from main for urgent fixes. This aligns perfectly with the requirement for both feature development and hotfix releases with release candidate stabilization.

Answer

Use trunk-based development with short-lived feature branches that merge directly to main.

Answer

Use a forking workflow where each developer forks the repository and creates pull requests.

Answer

Use GitHub Flow with feature branches and pull requests directly to main.

Question 9

Your project uses a monorepo in Azure Repos. You want to enforce that changes to a specific folder (/src/security) require approval from the security team. What is the best approach?

Accepted Answer

Configure a branch policy with a path filter and require approval from the security team group.. Azure Repos branch policies allow you to define path filters that scope policy enforcement to specific folders. By adding a required reviewer policy with a path filter for `/src/security` and assigning the security team group, only pull requests modifying files under that folder will require their approval, leaving other changes unaffected.

Answer

Add a required reviewer policy for all pull requests.

Answer

Move the security folder to a separate repository with its own policies.

Answer

Set folder-level permissions to restrict who can modify the folder.

Question 10

During a release pipeline, you notice that the deployment to staging fails intermittently due to a timeout waiting for the health check endpoint to return 200. The health check typically passes within 30 seconds, but occasionally takes up to 2 minutes. You need to make the deployment more reliable without affecting the overall release time. What should you do?

Accepted Answer

Increase the health check timeout in the pipeline task to 3 minutes.. Increasing the health check timeout to 3 minutes accommodates the occasional 2-minute delay without failing the deployment. Since the health check typically passes within 30 seconds but can take up to 2 minutes, a 3-minute timeout ensures the pipeline waits long enough for the endpoint to return HTTP 200, making the deployment more reliable without adding extra retry cycles or changing the overall release time.

Answer

Remove the health check from the pipeline and rely on monitoring.

Answer

Add a retry task that runs the health check again after a failure.

Answer

Reduce the health check timeout to 10 seconds to fail fast and trigger a rollback.

Question 11

You manage a release pipeline for a Java application that is deployed to Azure App Service. The pipeline currently uses manual approval gates. You need to implement automated quality gates to reduce manual intervention. Which THREE conditions can you use in the 'Post-deployment approvals' settings of a release pipeline? (Choose three.)

Accepted Answer

Invoke Azure Functions. 'Invoke Azure Functions' is a valid gate type in Azure DevOps release pipelines. It allows you to call an Azure Function as a quality gate, enabling custom automated checks (e.g., validating deployment health or running custom logic) without manual intervention. This directly supports the goal of reducing manual approvals by automating post-deployment validation.

Answer

Azure Policy

Answer

Manual approval

Question 12

A team is migrating from TFVC to Git in Azure Repos. They have a large repository with a history of 10,000+ commits. They want to preserve the full history while minimizing migration time. Which approach should they recommend?

Accepted Answer

Use git-tfs to clone the TFVC repository with full history, then push to Azure Repos.. Git-tfs is a specialized bridge tool that can clone a TFVC repository with full history into a local Git repository, preserving all commits, branches, and metadata. This approach minimizes migration time by performing the conversion locally without network overhead, after which the Git repo can be pushed to Azure Repos. Other methods either lose history or are not supported for TFVC-to-Git migration.

Answer

Check out the latest version from TFVC, initialize a new Git repo, and push.

Answer

Use the Azure Repos import repository feature to import from TFVC.

Answer

Clone the TFVC repository using Git and push to Azure Repos.

Question 13

A team uses Terraform to manage Azure infrastructure. They want to store the Terraform state file securely and enable collaboration. What is the recommended approach?

Accepted Answer

Store the state file in an Azure Storage account with state locking enabled. Storing the Terraform state file in an Azure Storage account with state locking enabled is the recommended approach because it provides a centralized, durable backend that supports native state locking via Azure Blob Storage leases. This prevents concurrent modifications and state corruption, enabling safe collaboration among team members. Azure Storage also offers encryption at rest and access control via RBAC, aligning with security best practices for infrastructure-as-code.

Answer

Store the state file in a local folder and commit to Git

Answer

Store the state file in Terraform Cloud

Answer

Store the state file in a Git repository with manual locking

Question 14

Your organization is adopting GitHub Copilot and wants to ensure that no proprietary code is used to train models. Which setting should you configure in the GitHub organization?

Accepted Answer

Opt out of allowing GitHub to use code snippets for product improvement.. GitHub provides an organization-level setting to opt out of allowing GitHub to use code snippets for product improvement, which prevents Copilot from training on that code. Option A is incorrect because secret scanning is unrelated to model training. Option B is incorrect because Dependabot alerts focus on dependency vulnerabilities, not data usage. Option C is incorrect because disabling Copilot prevents its use but does not address the underlying data usage for training; the organization may still want to use Copilot while preventing training on proprietary code.

Answer

Enable secret scanning.

Answer

Enable Dependabot alerts.

Answer

Disable GitHub Copilot for the organization.

Question 15

Your team uses a YAML-based build pipeline in Azure Pipelines. You need to ensure that the pipeline runs automatically when a pull request is created against the main branch, but only if the changes include modifications to the 'src/' directory. Which trigger configuration should you use?

Accepted Answer

trigger: none; pr: branches: include: - main paths: include: - src/*. It sets `trigger: none` to disable CI triggers on commits, and uses a PR trigger with `branches: include: - main` and `paths: include: - src/*` to ensure the pipeline only runs automatically when a pull request targets the main branch and the changes include modifications to the 'src/' directory. This configuration meets the requirement of conditional PR-triggered builds based on file paths.

Answer

trigger: - main; pr: none

Answer

trigger: none; pr: - main

Answer

pr: - main; trigger: - main