AZ-400 Practice Test 36 — 15 Questions

Question 1

Your release pipeline deploys to multiple environments (Dev, Test, Prod) using approval gates. Recently, the Prod deployment failed because a manual validation task timed out after 30 minutes. You need to ensure that if the manual validation is not approved within 15 minutes, the pipeline automatically rejects the deployment and sends a notification. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the Manual Validation task, set 'Timeout' to 15 and 'On timeout' to 'Reject'.. The Manual Validation task has a 'Timeout' setting and an 'On timeout' option. Setting Timeout to 15 minutes and On timeout to 'Reject' will automatically reject the deployment if not approved within 15 minutes. Additionally, you can configure a notification using an Azure DevOps subscription or service hook for the rejection event. Option A is incorrect because the stage timeout does not specifically handle manual validation rejection. Option C is incorrect because, although pre-deployment approvals do have a timeout that can reject on timeout, they apply to the approval gate before the stage, not to a manual validation task within the stage. Option D is incorrect because adding a PowerShell task is unnecessary and less reliable than the built-in timeout behavior.

Answer

Set the 'Timeout in minutes' for the entire stage to 15.

Answer

Configure a pre-deployment approval with a timeout of 15 minutes.

Answer

Add a PowerShell task after the manual validation that checks the status and cancels the pipeline if not approved.

Question 2

Your team uses GitHub Issues for tracking bugs and features. They want to automatically assign issues to the person who created the pull request that closes the issue. Which GitHub Actions workflow trigger and action should you use?

Accepted Answer

Use the 'issues' event with 'closed' type and an action that assigns the issue to the PR author.. The 'issues' event with 'closed' type triggers a workflow when an issue is closed, and the 'actions/github-script' action can be used to assign the issue to the pull request author by querying the pull request that closed the issue. Option A is incorrect because the 'pull_request' event does not directly close issues; closing an issue is done via a commit or pull request merge. Option C is incorrect because the 'push' event is not related to issue closure. Option D is incorrect because the 'schedule' event is time-based and does not respond to issue closures.

Answer

Use the 'pull_request' event and the 'actions/assign' action to assign the issue.

Answer

Use the 'push' event and call the GitHub API to assign the issue.

Answer

Use the 'schedule' event to periodically check for closed issues and assign them.

Question 3

A team uses Azure Boards and wants to ensure that work items moved to the 'Done' state require a completed code review. What should they configure?

Accepted Answer

Add a work item rule in the process template to require a code review for the 'Done' transition.. Azure Boards allows you to define work item rules within the process template that enforce specific conditions on state transitions. By adding a rule to the 'Done' transition that requires a completed code review (e.g., via a custom field or check), you ensure work items cannot be moved to 'Done' without meeting that prerequisite. This is done through the inherited process customization in Azure DevOps, where you can add rules to the work item type's state transition.

Answer

Modify the work item type definition to add a custom field for code review status.

Answer

Use a tag to mark work items as code-reviewed before moving to 'Done'.

Answer

Configure branch policies in Azure Repos to require pull request approvals.

Question 4

A developer pushes a commit to a branch named 'releases/v1.0'. What will happen?

Accepted Answer

The pipeline runs automatically on the push.. Azure Pipelines, by default, triggers a pipeline run automatically on any push to any branch unless a trigger filter is explicitly configured. The branch name 'releases/v1.0' is valid and does not contain any characters that would prevent a trigger; dots are allowed in branch names. The pipeline will execute the steps defined in the YAML file for that branch.

Answer

The pipeline runs but fails because the branch name contains a dot.

Answer

The pipeline runs only if a pull request is created.

Answer

The pipeline does not run because the branch is not main.

Question 5

Which two of the following are valid strategies to implement conditional deployment in a YAML pipeline? (Choose 2)

Accepted Answer

Use the 'condition' property on a stage. Both 'condition' property and template expressions with parameters are valid strategies for conditional deployment in YAML pipelines. The 'condition' property (e.g., `eq(variables['Build.SourceBranch'], 'refs/heads/main')`) controls at runtime whether a stage, job, or step runs, based on variables or expressions. Template expressions with parameters (e.g., `${{ if eq(parameters['environment'], 'prod') }}`) allow you to conditionally include or exclude parts of the pipeline at compile time, making them a powerful tool for conditional deployment based on parameters.

Answer

Configure stage filters in the triggers section

Answer

Use dependency conditions like 'succeededOrFailed'

Answer

Add a PowerShell script to check environment

Question 6

Your organization uses Azure DevOps and has a project with multiple teams. The 'AlphaTeam' wants a branch policy on their feature branch 'feature/alpha' that requires a successful build from the CI pipeline and approval from at least one member of 'AlphaTeam'. However, the 'BetaTeam' should be able to push directly to 'feature/alpha' without a pull request. You need to configure the branch policy accordingly. What should you do?

Accepted Answer

Configure the branch policy on 'feature/alpha' to require build and approval from AlphaTeam, and set 'Allow direct pushes' to 'Selected users' and add BetaTeam.. Azure DevOps branch policies allow you to configure 'Allow direct pushes' to specific users or groups while still enforcing PR requirements for others. By setting the policy on 'feature/alpha' to require a successful build and approval from at least one AlphaTeam member, and then selecting 'Selected users' for direct pushes with BetaTeam added, BetaTeam can push directly without a PR, while AlphaTeam must follow the PR policy.

Answer

Create a new repository for AlphaTeam and apply the policy there.

Answer

Set a branch policy at the repository level that applies to all branches, then grant BetaTeam bypass permission.

Answer

Configure the branch policy on 'feature/alpha' to require build and approval, and set 'Allow direct pushes' to 'Everyone'.

Question 7

You are reviewing the branch protection policy for the main branch in an Azure DevOps repository. Based on the exhibit, what happens when a stale review exists on a pull request after new changes are pushed?

Accepted Answer

The stale review is automatically dismissed, and the PR requires new approvals. The branch protection policy for the main branch has 'Reset code reviewer votes when there are new changes' enabled. When a stale review exists after new changes are pushed, Azure DevOps automatically dismisses the previous approval(s) and requires new approvals to meet the minimum number of reviewers (2). This ensures that reviewers re-evaluate the latest code changes before the pull request can be merged.

Answer

Admins are exempt from the review requirement

Answer

The PR still requires only 2 approvals, but stale reviews are not dismissed

Answer

The PR can be merged even without the required reviews

Question 8

You are a DevOps engineer for a large e-commerce company. The company uses Azure DevOps for CI/CD and Application Insights for monitoring. The application is a .NET Core 6 microservice running on Azure Kubernetes Service (AKS) with a Redis cache and Azure SQL Database. Recently, the operations team noticed that the application's response time has degraded significantly during peak traffic hours. Application Insights shows an increase in server-side dependency call duration to Redis and SQL, but no increase in exceptions. The team suspects a connection pooling issue. You have been asked to diagnose and fix the problem. Which approach should you take first?

Accepted Answer

Use Application Insights 'Dependency' performance blade to analyze call duration percentiles and identify whether the bottleneck is in Redis or SQL. Then adjust connection pool sizes accordingly.. The first step in diagnosing a connection pooling issue is to analyze the dependency performance data in Application Insights. The 'Dependency' blade provides detailed percentiles (e.g., P50, P95, P99) for Redis and SQL call durations, allowing you to pinpoint which dependency is the bottleneck. Once identified, you can adjust the connection pool size (e.g., Max Pool Size in SQL connection string or Redis multiplexer settings) to match the peak concurrency demands without overwhelming the database or cache.

Answer

Increase the number of AKS nodes to handle peak traffic and reduce resource contention.

Answer

Review the application code to ensure that Redis and SQL connections are properly opened and closed using 'using' statements.

Answer

Run a load test against the application to reproduce the issue and monitor system counters.

Question 9

Your organization uses Azure Repos and requires that all code changes pass a security scan before merging. The scan is run as a build validation policy. However, the scan takes 30 minutes and developers often bypass it by pushing directly to main. How can you enforce the policy for all changes?

Accepted Answer

Set a branch policy on main that requires a build validation with the security scan. Setting a branch policy on main that requires a build validation with the security scan enforces the scan as a mandatory gate for all pull requests targeting main. This prevents developers from bypassing the scan by pushing directly, as the policy blocks direct pushes and only allows changes through pull requests that must pass the configured build validation.

Answer

Turn off direct push permissions for all users and force all changes through pull requests

Answer

Delete the main branch and recreate it as a protected branch

Answer

Use a service hook to run the scan on every push to main

Question 10

You have a release pipeline that deploys to multiple environments. You need to ensure that a manual approval is required before deploying to production. What should you configure?

Accepted Answer

Set a pre-deployment approval on the production stage. Pre-deployment approvals are configured on a stage in Azure Pipelines to require manual sign-off before any deployment to that stage begins. Since the question specifies that approval is needed before deploying to production, a pre-deployment approval on the production stage enforces that gate before the release pipeline executes any deployment tasks in that environment.

Answer

Add a manual intervention task in the production stage

Answer

Set a post-deployment approval on the production stage

Answer

Set a branch policy on the release branch

Question 11

Your Azure Pipelines build uses a self-hosted agent that runs on a Windows VM. The build fails with the error 'Access to the path 'C:\agent\_work\1\s\bin' is denied.' What is the most likely cause?

Accepted Answer

The agent service account does not have write permissions on the working directory. The error 'Access to the path ... is denied' indicates a permissions issue. Self-hosted agents run under a specific Windows service account (e.g., Network Service, Local System, or a custom domain account). If that account lacks write permissions on the working directory (e.g., `C:\agent\_work\1\s\bin`), the agent cannot create or modify files during the build, causing the failure. This is the most common cause when using self-hosted agents on Windows VMs.

Answer

The agent is not configured to use the correct agent pool

Answer

The build is trying to overwrite a file that is locked by another process

Answer

The source code checkout failed due to incorrect credentials

Question 12

Drag and drop the steps to configure Azure Monitor alerts for application performance into the correct order.

Accepted Answer

Enable monitoring, then Create alert rule, then Set condition, then Configure action groups, then Test alert. Alert setup begins with enabling monitoring, creating rule, setting condition, action groups, and testing.

Answer

Enable monitoring, then Create alert rule, then Configure action groups, then Set condition, then Test alert

Answer

Create alert rule, then Enable monitoring, then Set condition, then Configure action groups, then Test alert

Answer

Enable monitoring, then Create alert rule, then Set condition, then Test alert, then Configure action groups

Question 13

You have the above YAML task in a pipeline. The task runs but no secrets are available in subsequent tasks. What is the most likely cause?

Accepted Answer

The secrets are not automatically mapped to environment variables; you must reference them using $(secretName).. By default, secrets downloaded from Azure Key Vault in a pipeline task are not automatically mapped to environment variables for subsequent tasks. You must explicitly reference them using the macro syntax `$(secretName)` or map them as environment variables with the `env` keyword. Without this explicit mapping, the secret values remain inaccessible to later tasks, even though the download task succeeds.

Answer

The SecretsFilter is set to '*' which is invalid.

Answer

The service principal does not have 'Get' permission on the key vault.

Answer

The key vault name 'mykv' does not exist.

Question 14

Refer to the exhibit. A developer creates a pull request from a branch called 'feature/update'. The workflow runs on the pull_request event. What will the output of this workflow be?

Accepted Answer

The workflow will run and output 'Running PR tests'.. The workflow is triggered on the `pull_request` event, which fires for any pull request regardless of the source branch name. The condition `github.event_name == 'pull_request'` evaluates to `true` because the event is indeed a pull_request. Therefore, the `if` condition passes, and the step runs, outputting 'Running PR tests'.

Answer

The workflow will not run because the branch is not 'main'.

Answer

The workflow will run but output nothing because the condition fails.

Answer

The workflow will fail due to a syntax error in the conditional expression.

Question 15

Refer to the exhibit. You have a YAML pipeline that deploys an ARM template. The pipeline runs successfully on the first commit to main, but subsequent commits fail with 'The resource group myResourceGroup already exists'. How should you modify the pipeline to avoid this error?

Accepted Answer

Add a condition to check if the resource group exists before creating it.. Adding a condition to check if the resource group exists before creating it avoids the error when the resource group already exists from a previous deployment. Options A, C, and D are incorrect: changing the location (A) does not prevent the existence error, using a different service connection (C) does not address resource group existence, and renaming the pipeline (D) triggers a new pipeline but does not affect resource group existence.

Answer

Change the location to a different region.

Answer

Use a different service connection for each deployment.

Answer

Rename the pipeline to trigger a clean build.