AZ-400 Practice Test 37 — 15 Questions

Question 1

You need to ensure that only approved users can deploy to production from Azure Pipelines. What should you implement?

Accepted Answer

Environment checks with required approvers. Azure Pipelines environment checks with required approvers allow you to enforce that only specific users or groups can approve deployments to a production environment. This is a native Azure DevOps feature that integrates with pipeline stages to gate deployments based on manual approval, ensuring that unauthorized users cannot trigger or approve production releases.

Answer

Pipeline approval gates

Answer

Microsoft Entra ID Conditional Access policies

Answer

Branch protection rules in GitHub

Question 2

You have a multi-stage YAML pipeline in Azure DevOps that deploys to multiple environments. The pipeline uses a deployment job with environment approvals. You need to ensure that the deployment to the production environment is only triggered after a manual approval is granted. However, you also want the deployment to automatically roll back if the post-deployment health check fails. Which configuration should you implement?

Accepted Answer

Enable 'Auto-revert' on the production environment and set post-deployment conditions.. Azure DevOps environments support an 'Auto-revert' setting that automatically triggers a rollback to the previous successful deployment when a post-deployment health check (defined via post-deployment conditions) fails. This combines manual approval (pre-deployment approvals on the environment) with automatic rollback, meeting both requirements without additional tasks or release pipelines.

Answer

Use a release pipeline with a pre-deployment approval and a post-deployment automatic rollback trigger.

Answer

Configure pre-deployment approvals on the production environment and use a post-deployment gate that fails the deployment.

Answer

Configure pre-deployment approvals and add a manual intervention task to roll back if health check fails.

Question 3

You want to ensure that every commit message in your repository follows a specific format. Which GitHub feature can enforce this?

Accepted Answer

Required status checks with a commit lint action. Required status checks, when combined with a commit lint action in a GitHub Actions workflow, can enforce commit message formatting. The workflow runs on push or pull request events, and the status check must pass before a pull request can be merged, effectively rejecting commits that do not conform to the specified format.

Answer

Webhooks to validate and reject pushes

Answer

Branch protection rules

Answer

GitHub Actions workflow with push trigger

Question 4

Your Azure DevOps release pipeline deploys to Azure Kubernetes Service (AKS). You need to ensure that the deployment is rolled back automatically if the health checks fail within 5 minutes after deployment. The AKS cluster uses a canary deployment strategy. What should you use?

Accepted Answer

Use the Kubernetes manifest task with 'canary' deployment strategy and configure 'stabilityCheck' and 'rollback' settings.. The Kubernetes manifest task in Azure DevOps supports a 'canary' deployment strategy with built-in 'stabilityCheck' and 'rollback' settings. This allows you to define a health check window (e.g., 5 minutes) and automatically trigger a rollback if the canary pods fail the stability checks, meeting the requirement without custom scripting.

Answer

Use an Azure CLI task to run 'kubectl rollout undo' in a post-deployment script.

Answer

Use a Helm upgrade task with --wait and --timeout flags.

Answer

Use the Kubectl task with a 'rollback' subcommand condition.

Question 5

You are designing a build pipeline for a Node.js application. The pipeline must run unit tests and publish code coverage results to Azure Pipelines. Which task should you use to ensure coverage results are available in the pipeline summary?

Accepted Answer

PublishCodeCoverageResults@1. The PublishCodeCoverageResults@1 task is specifically designed to publish code coverage results (e.g., Cobertura, JaCoCo, or .coverage formats) to Azure Pipelines, making them visible in the pipeline summary and the Tests tab. This task consumes coverage data files generated by a previous test run and integrates them into the pipeline's reporting UI.

Answer

PublishTestResults@2

Answer

VSTest@2

Answer

CopyFiles@2

Question 6

Your team manages a large monorepo in Azure Repos containing multiple projects. Developers frequently complain that cloning the entire repository takes too long and that they only need a subset of the code. The team uses Git LFS for large binary files. The repository currently has 50,000 commits and is 5 GB in size. You want to improve clone performance without sacrificing the ability to contribute to any part of the repo. What should you do?

Accepted Answer

Instruct developers to use a shallow clone with depth 1 to reduce clone time.. Using a shallow clone with depth 1 significantly reduces clone time by fetching only the latest commit history instead of all 50,000 commits. This minimizes the data transferred over the network, which is the primary cause of slow clones. Developers can later deepen the clone if they need more history. Sparse checkout alone does not reduce the data transferred during clone; it only limits what appears in the working directory. Git LFS is already being used for large binaries, so that is not the issue. Splitting the monorepo would require significant restructuring and may complicate cross-project contributions.

Answer

Configure sparse checkout so developers can clone only the directories they need.

Answer

Move all large binary files to Git LFS to reduce repository size.

Answer

Split the monorepo into multiple repositories and use submodules to aggregate them.

Question 7

You are setting up a CI/CD pipeline for a microservices application deployed to Azure Kubernetes Service (AKS). Your team wants to automatically generate release notes from commit messages and work items. Which Azure DevOps feature should you use?

Accepted Answer

Generate release notes task (from YAML pipeline). The Generate release notes task (from YAML pipeline) is the correct choice because it is specifically designed to automatically generate release notes from commit messages and work items in Azure Pipelines. This task parses the commit history and linked work items between two Git refs (e.g., tags or branches) and outputs a formatted markdown file, which can be published as an artifact or used in a release pipeline. It directly addresses the requirement to derive release notes from commits and work items without manual effort.

Answer

Copy Files task

Answer

Azure Repos Wiki

Answer

Azure Test Plans

Question 8

Your Azure Pipeline builds a Docker image and pushes it to Azure Container Registry (ACR). You need to ensure that the image is scanned for vulnerabilities before being pushed. Which task should you add to the pipeline?

Accepted Answer

Container scanning task from Microsoft Defender for Cloud. Microsoft Defender for Cloud provides a dedicated container scanning task that integrates directly into Azure Pipelines to scan Docker images for vulnerabilities before they are pushed to ACR. This task leverages the same vulnerability assessment engine used by Microsoft Defender for Cloud to identify CVEs in OS packages and application dependencies, ensuring only compliant images are pushed.

Answer

Azure CLI task to run 'az acr scan'

Answer

Docker task with the 'push' action

Answer

PublishBuildArtifacts task

Question 9

A development team uses a forking workflow in Azure Repos. They want to ensure that only specific users can create forks of the main repository. How can they achieve this?

Accepted Answer

Remove the 'Create Fork' permission from all users except the required group. In Azure Repos, the ability to create forks is controlled by the 'Create Fork' permission, which is a repository-level permission, not a branch-level setting. By default, all contributors have this permission. To restrict fork creation to only specific users, navigate to the repository settings, go to Security (or Permissions), remove the 'Create Fork' permission from all users and groups, then explicitly grant it only to the desired group or individuals. Therefore, the correct answer is D: remove the 'Create Fork' permission from all users except the required group.

Answer

Use branch security to restrict who can create forks

Answer

Set branch policies on the main branch to prevent forks

Answer

Configure the repository to disable forks globally

Question 10

Your company uses GitHub Enterprise for source control and GitHub Actions for CI/CD. The development team is distributed across three time zones. You are designing a process to improve communication and collaboration for code reviews. The team currently uses email notifications for pull request reviews, which often get missed. You want to implement a more efficient system that integrates with Microsoft Teams and provides real-time updates. Additionally, you need to ensure that critical pull requests (e.g., those affecting production) are escalated if not reviewed within 4 hours. You also want to automatically assign reviewers based on the files changed. Which combination of actions should you take?

Accepted Answer

Use GitHub's built-in code owners feature to automatically request reviews based on file patterns. Create a GitHub Action that posts a notification to Microsoft Teams via webhook when a pull request is opened. For escalation, create a scheduled workflow (e.g., using cron) that runs every 30 minutes to identify pull requests older than 4 hours and sends an alert to Teams.. It uses GitHub's built-in code owners feature for automatic reviewer assignment based on file patterns, which is native and requires no third-party app. It then uses a GitHub Action with a webhook to post real-time notifications to Microsoft Teams when a pull request is opened. For escalation, a scheduled workflow (cron) running every 30 minutes checks pull request age and sends an alert to Teams if older than 4 hours, meeting the real-time and escalation requirements without manual intervention.

Answer

Use a GitHub App (e.g., Pull Request Assigner) to automatically assign reviewers based on file patterns. Create a GitHub Action that sends a message to Microsoft Teams via webhook when a pull request is opened. Set up a second GitHub Action that runs every hour and checks pull request age, sending an escalation to Teams if older than 4 hours.

Answer

Configure GitHub branch protection rules to require pull request reviews. Create a Microsoft Teams webhook connector and add it to the repository to post notifications. Instruct team leads to manually tag reviewers based on file changes.

Answer

Use a third-party service like PullRequest.com to manage code reviews. Configure GitHub Actions to send notifications to Teams. For escalation, use a GitHub Action that triggers on pull request review request and uses conditional logic to escalate after 4 hours.

Question 11

Your team is using YAML pipelines in Azure DevOps and wants to ensure that a specific stage runs only for changes to the 'main' branch. Which condition should you add to the stage?

Accepted Answer

condition: eq(variables['Build.SourceBranch'], 'refs/heads/main'). The `eq(variables['Build.SourceBranch'], 'refs/heads/main')` condition evaluates to true only when the pipeline is triggered by a change to the 'main' branch. In YAML pipelines, conditions are evaluated as expressions, and this simple equality check ensures the stage runs exclusively for that branch. The other options either invert the logic, use a partial match that could include other branches, or unnecessarily combine conditions.

Answer

condition: ne(variables['Build.SourceBranch'], 'refs/heads/main')

Answer

condition: contains(variables['Build.SourceBranch'], 'main')

Answer

condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))

Question 12

You are creating a release pipeline that deploys to Azure App Service. You want to ensure that the deployment uses the 'Run from package' feature for faster deployments and reduced downtime. Which deployment method should you select in the 'Azure App Service deploy' task?

Accepted Answer

RunFromPackage. The 'Run from package' feature deploys your app as a zip package directly to Azure App Service, bypassing the file copy and compilation steps of traditional methods. This reduces deployment time and downtime because the app runs from the package without extracting it to the wwwroot folder. Selecting 'RunFromPackage' in the Azure App Service deploy task enables this behavior by setting the WEBSITE_RUN_FROM_PACKAGE app setting to 1.

Answer

Web Deploy

Answer

Container

Answer

Zip Deploy

Question 13

You are the lead DevOps engineer for a large e-commerce company. The company has a multi-region Azure Kubernetes Service (AKS) cluster deployment for its microservices. The current CI/CD pipeline uses Azure DevOps to build Docker images and deploy to AKS via Helm charts. Recently, the team noticed that after a deployment to the West Europe region, the application experienced a 5-minute downtime due to a configuration error where the new pods couldn't connect to the database because the connection string was pointing to a staging database instead of production. The issue was detected manually after a customer reported the outage. The team wants to implement a mechanism to automatically detect such misconfigurations before they affect production traffic. They also want to ensure that if a deployment fails health checks, the previous version is automatically rolled back. The pipeline currently runs all stages in sequence: build, deploy to West Europe, then deploy to East US. The team has a small budget for additional resources. Which approach should the team implement?

Accepted Answer

Implement a canary deployment strategy with automated health checks and automatic rollback on failure.. A canary deployment strategy with automated health checks and automatic rollback directly addresses the need to detect misconfigurations before they affect all production traffic. By routing a small percentage of traffic to the new pods and monitoring health probes (e.g., liveness and readiness probes in Kubernetes), the pipeline can automatically roll back if the canary fails, preventing the 5-minute downtime scenario. This approach is cost-effective as it leverages existing AKS features without requiring additional infrastructure.

Answer

Use a blue-green deployment strategy with deployment slots in AKS.

Answer

Add a manual approval gate before the deployment to East US, requiring a tester to verify the deployment in West Europe.

Answer

Deploy to a separate test environment first, run integration tests, then deploy to production.

Question 14

Refer to the exhibit. A build pipeline produces the above logs. Which change would resolve the build failure?

Accepted Answer

Add a definition for 'MyMethod' in the 'MyClass' class.. The build failure is caused by a missing method definition. The logs indicate that the test step is attempting to invoke 'MyMethod' on an instance of 'MyClass', but the compiler cannot find it. Adding the missing method to the class resolves the compilation error, which is the root cause of the pipeline failure.

Answer

Change the build configuration from Release to Debug.

Answer

Remove the '--no-build' flag from the test step.

Answer

Add the '--no-restore' flag to the build step.

Question 15

Your organization uses GitHub Actions for CI/CD. You need to enforce branch protection rules and ensure that all pull requests to the main branch require a successful status check from a specific workflow. Which TWO actions should you take? (Choose two.)

Accepted Answer

Add a workflow to the repository that runs tests and reports a conclusion status.. A workflow that runs tests and reports a conclusion status provides the status check that branch protection rules can require. Option E is correct because enabling 'Require status checks to pass before merging' under branch protection rules in the repository settings enforces that the specific workflow's status check must succeed before a pull request can be merged into the main branch.

Answer

Configure a GitHub environment with required reviewers.

Answer

Use a repository ruleset to require status checks.

Answer

Set up branch policies in Azure Repos for the main branch.