AZ-400 Practice Test 39 — 15 Questions

Question 1

Your company develops a microservices-based application deployed on Azure Kubernetes Service (AKS). The CI/CD pipeline uses Azure Pipelines. The development team has recently adopted a trunk-based development strategy where all feature work is done on short-lived branches that merge to main at least daily. The release pipeline must automatically deploy to a development environment on each commit to main, and to a staging environment after a manual approval. The staging environment is used for integration tests and must remain stable. You need to design the release pipeline strategy to support this workflow. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a single release pipeline with two stages: 'Dev' triggered automatically on successful build, and 'Staging' with a pre-deployment approval gate.. It creates a single release pipeline with two stages: 'Dev' triggered automatically on successful build, and 'Staging' with a pre-deployment approval gate. This meets the requirements: automatic deployment to dev on each commit to main, and manual approval before deploying to staging, keeping staging stable. Option A is wrong because deploying to both environments simultaneously bypasses the manual approval needed for staging. Option C is wrong because separate pipelines add maintenance overhead and don't leverage pipeline stages for approval gates. Option D is wrong because a post-deployment approval gate would deploy to staging first, then require approval, which doesn't prevent deployment without approval. Also disabling continuous deployment trigger for staging would require manual promotion, which is not desired.

Answer

Create a single release pipeline with one stage that deploys to both dev and staging simultaneously, and add a manual intervention task before staging deployment.

Answer

Create two separate release pipelines: one for dev with continuous deployment trigger, and one for staging with a manual trigger.

Answer

Create a single release pipeline with two stages: 'Dev' triggered automatically, and 'Staging' with a post-deployment approval gate and disable continuous deployment trigger.

Question 2

You are designing a communication strategy for a large Azure DevOps migration. The team is distributed across multiple time zones. Which approach best supports asynchronous collaboration?

Accepted Answer

Maintain a wiki in Azure DevOps with status and decisions.. Maintaining a wiki in Azure DevOps provides a persistent, searchable, and asynchronous record of status and decisions, which is ideal for distributed teams across time zones. Option A is wrong because Slack huddles are real-time and require synchronous participation. Option C is wrong because email threads can be hard to search and lack integration with Azure DevOps. Option D is wrong because daily standup meetings at a fixed time require synchronous attendance. Option E is wrong because recording meetings is passive and not easily searchable; the information is not structured for quick reference.

Answer

Use Slack huddles for quick sync-ups.

Answer

Use email threads for status updates.

Answer

Schedule daily standup meetings at a fixed time.

Answer

Record all team meetings and share links.

Question 3

Your team uses Azure Boards with a custom process. You need to ensure that when a bug is closed, it automatically triggers a new release pipeline. Which approach should you use?

Accepted Answer

Set up a Service Hook from Azure Boards to Azure Pipelines.. Service Hooks in Azure DevOps allow you to integrate Azure Boards with Azure Pipelines by subscribing to events like 'work item updated' or 'work item state changed'. When a bug is closed (state changed to 'Closed'), a Service Hook can automatically trigger a release pipeline, enabling event-driven automation without polling or custom code. This is the correct approach because it directly connects the work item state change to pipeline execution.

Answer

Configure a CI trigger in the release pipeline.

Answer

Add a release gate that checks for closed bugs.

Answer

Create an Azure Function that polls work items.

Question 4

You are designing a centralized logging strategy for multiple microservices hosted in Azure Kubernetes Service (AKS). Each microservice writes logs in JSON format to stdout/stderr. The operations team needs to query logs across all services and correlate them with application performance metrics. Which solution provides the best integration?

Accepted Answer

Enable Container Insights in Azure Monitor to collect stdout/stderr logs and metrics into a Log Analytics workspace.. Container Insights in Azure Monitor is the best solution because it natively collects stdout/stderr logs from AKS containers and correlates them with performance metrics (CPU, memory, disk, network) in a single Log Analytics workspace. This enables the operations team to query logs across all microservices using KQL and join them with metrics for end-to-end troubleshooting, without additional infrastructure or data movement.

Answer

Configure AKS to send logs to Azure Blob Storage and use Azure Storage Analytics for querying.

Answer

Stream logs to Azure Event Hubs and then to Azure Data Explorer for analysis.

Answer

Deploy the Application Insights agent as a DaemonSet in AKS and send logs directly to Application Insights.

Question 5

You receive a webhook notification from Azure Pipelines with the above payload. The build for the 'feature/logging' branch failed. You want to automatically create a work item to track the fix. What should you configure in Azure DevOps?

Accepted Answer

Enable the 'Create work item on failure' option in the pipeline settings.. Azure Pipelines provides a built-in setting called 'Create work item on failure' that automatically generates a work item (e.g., a bug or task) in Azure Boards whenever a pipeline run fails. This directly meets the requirement to track the fix for the failed build on the 'feature/logging' branch without requiring external integrations or manual steps.

Answer

Add a branch policy on 'feature/logging' to require a successful build before merging.

Answer

Use a GitHub Actions workflow to create an issue on failure.

Answer

Create a service hook subscription to listen for build failures and call Azure Boards API.

Question 6

Which TWO are true about Azure Pipelines YAML templates? (Choose two.)

Accepted Answer

Template expressions are evaluated at compile time.. Template expressions in Azure Pipelines YAML are evaluated at compile time, before the pipeline runs. This allows the template to inject variables, conditions, and other logic into the pipeline definition statically, ensuring that the final pipeline structure is fully resolved before execution begins.

Answer

Templates must be stored in the same repository as the main pipeline.

Answer

Templates require parameters to be defined.

Answer

Templates can only define a single job.

Question 7

Which TWO actions should you take to ensure that your Git repository in Azure Repos remains performant as it grows?

Accepted Answer

Use shallow clones in CI/CD pipelines.. Shallow clones fetch only the most recent commit history rather than the entire repository history, which significantly reduces the amount of data transferred and stored during CI/CD pipeline runs. This keeps pipeline execution fast and avoids performance degradation as the repository grows. Azure Repos and Azure Pipelines support shallow clone options via the `--depth` parameter in Git commands or through pipeline YAML settings.

Answer

Store large binary files directly in the repository.

Answer

Keep all branches indefinitely to preserve history.

Answer

Encourage developers to commit all changes in a single commit per day.

Question 8

Your organization uses GitHub Actions for CI/CD. You have a workflow that deploys to Azure App Service. The deployment uses a publish profile secret stored as a GitHub secret. You want to improve security by using OpenID Connect (OIDC) to authenticate to Azure without storing secrets. What should you do?

Accepted Answer

Configure the GitHub workflow to use the 'azure/login' action with OIDC, and set up a federated identity credential in Microsoft Entra ID for the GitHub environment.. Using the 'azure/login' action with OIDC and configuring a federated identity credential in Microsoft Entra ID allows GitHub Actions to authenticate to Azure without storing any secrets. The federated credential establishes a trust relationship between GitHub's OIDC provider and an Microsoft Entra ID app registration, so the workflow can obtain a short-lived token. This eliminates the need for a publish profile secret, improving security by removing long-lived credentials.

Answer

Remove the secret and use Azure AD Managed Identity directly from the GitHub runner.

Answer

Replace the publish profile secret with an Azure service principal secret stored as a GitHub secret.

Answer

Use the 'Azure App Service Deploy' task with the 'Publish Profile' parameter set to an empty string.

Question 9

You are a security engineer for a large financial institution. The organization uses Azure DevOps with multiple projects, each containing hundreds of pipelines. The security team recently discovered that several pipeline variables marked as 'Secret' were inadvertently printed to logs due to a custom script task that echoed the variable. Consequently, the compliance officer requires that all secrets used in pipelines must be centrally managed in Azure Key Vault, and any pipeline that references a variable not from Key Vault must be blocked from running. Additionally, the solution must minimize administrative overhead and provide real-time enforcement across all projects in the organization. You have the following options:

Option A: Develop a custom pipeline task that checks at runtime whether all secret variables originate from Key Vault, and add it to every pipeline YAML file manually.

Option B: Create an Azure Policy definition that audits pipelines for the use of non-Key Vault variables and attach it to the management group containing the Azure DevOps resources.

Option C: Use Azure DevOps Audit Logs to periodically review pipeline runs and manually identify pipelines that use non-Key Vault secrets.

Option D: Configure a pipeline decorator in the organization settings that injects a task at the beginning of every pipeline to validate that all secret variables are linked to Key Vault, and fail the pipeline if any are not.

Which option meets the requirements most effectively?

Accepted Answer

Configure a pipeline decorator in the organization settings that injects a task at the beginning of every pipeline to validate that all secret variables are linked to Key Vault. A pipeline decorator is an organization-level extension that automatically injects tasks into every pipeline across all projects without modifying individual YAML files. By injecting a validation task at the start of each pipeline that checks whether secret variables are linked to Azure Key Vault and fails the run otherwise, it provides real-time enforcement, central management, and minimal administrative overhead — exactly matching the requirements.

Answer

Develop a custom pipeline task that checks at runtime whether all secret variables originate from Key Vault

Answer

Create an Azure Policy definition that audits pipelines for the use of non-Key Vault variables

Answer

Use Azure DevOps Audit Logs to periodically review pipeline runs

Question 10

You run the PowerShell command shown in the exhibit. The virtual network already exists. What is the outcome?

Accepted Answer

The virtual network's tags are updated to the specified tags.. The `New-AzResource` cmdlet can create a new resource or update an existing resource. If the virtual network already exists, the cmdlet updates it, including applying the specified tags. The `-Force` parameter suppresses confirmation prompts and does not determine create vs. update behavior.

Answer

The virtual network is deleted and recreated.

Answer

An error occurs because the virtual network already exists.

Answer

A new virtual network with a different name is created.

Question 11

You are designing a build pipeline that must run on Microsoft-hosted agents. The pipeline has a dependency on a native library that is not pre-installed. You want to minimize pipeline duration. Which approach should you use?

Accepted Answer

Use a container job with a custom Docker image that includes the library. Using a container job with a custom Docker image that includes the native library allows the pipeline to run on Microsoft-hosted agents while eliminating installation overhead, thus minimizing pipeline duration. This approach meets the requirement of using Microsoft-hosted agents and avoids the time cost of installing the library in each run.

Answer

Use a self-hosted agent with the library pre-installed

Answer

Add a script step to install the library using a package manager

Answer

Download the library from Azure Blob Storage in each build

Question 12

Your team uses Azure Pipelines for CI/CD. You need to enforce that all pipeline runs use approved agents from a specific agent pool with the latest security patches. The agents are self-hosted on Azure VMs. What should you implement?

Accepted Answer

Add a demand on the agent for a custom capability that only approved agents have. By adding a demand for a custom capability (e.g., 'SecurityPatchLevel = latest') on the pipeline, only agents that possess that capability can run the pipeline. This allows you to enforce that only approved, patched agents are used. Option C is incorrect because 'setting an agent pool to use a specific agent queue with an isolation scope' is not a recognized Azure Pipelines feature; agent pools use demands, not isolation scopes, to filter agents. Options A and B are also incorrect because configuring pool permissions or creating a deployment pool does not enforce that only agents with specific patches are used; they only control access or assignment but not the selection logic based on capabilities.

Answer

Configure pipeline permissions for the agent pool

Answer

Create a deployment pool and assign the agents to it

Answer

Set the agent pool to use a specific agent queue with an isolation scope

Question 13

Your team uses Azure Pipelines to deploy a web app to Azure App Service. You need to ensure that secrets (e.g., connection strings) are not exposed in the pipeline logs. What is the recommended approach?

Accepted Answer

Use secret pipeline variables and reference them in the pipeline.. Azure Pipelines supports secret pipeline variables that are masked in logs, preventing exposure of sensitive data like connection strings. When you mark a variable as secret, its value is automatically hidden from pipeline output, and you can reference it securely using $(variableName) syntax. This is the recommended approach for handling secrets directly within the pipeline without additional service dependencies.

Answer

Remove all logging from the pipeline.

Answer

Store secrets in Azure Key Vault and retrieve them in the pipeline, then log them for debugging.

Answer

Store secrets as environment variables in the pipeline.

Question 14

You have the YAML pipeline snippet shown in the exhibit. The first run produces version 1.0.0. What will be the version produced on the third run?

Accepted Answer

1.0.2. The YAML pipeline uses a counter expression `$[counter(format('{0}.{1}', variables['major'], variables['minor']), 0)]` for the patch version. The counter starts at 0 for the first run, producing version 1.0.0. Each subsequent run increments the counter by 1, so the second run produces 1.0.1, and the third run produces 1.0.2. Therefore, option C is correct.

Answer

1.0.1

Answer

1.0.3

Answer

1.0.0

Question 15

Your organization wants to enforce that all commits to the main branch are signed using GPG or S/MIME. Which GitHub feature should you enable?

Accepted Answer

Configure a branch protection rule that requires signed commits.. GitHub branch protection rules include a 'Require signed commits' setting that enforces all commits pushed to the protected branch must be signed with a verified GPG or S/MIME key. This ensures commit integrity and non-repudiation directly at the repository level, without requiring external scripts or API calls.

Answer

Use the GitHub API to check commit signatures after push.

Answer

Enable the 'Include administrators' setting in branch protection.

Answer

Require SSH key authentication for all users.