AZ-400 Practice Test 41 — 15 Questions

Question 1

Your organization uses Microsoft Entra ID (formerly Azure AD) for identity management. You need to ensure that only authorized users can access the Azure DevOps organization. What is the most secure way to manage access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Require all users to use multi-factor authentication (MFA) and enable Conditional Access policies.. Requiring MFA and enabling Conditional Access policies is the most secure way to manage access because it enforces strong authentication and context-aware access controls. Conditional Access can evaluate user, device, location, and risk to grant or block access, and MFA adds a critical layer beyond passwords. This combination aligns with Microsoft's Zero Trust model and is recommended for Azure DevOps access.

Answer

Disable external user access and only allow internal users.

Answer

Use IP address restrictions to limit access to the corporate network.

Answer

Add users to the Azure DevOps organization and assign them to the 'Basic' access level.

Question 2

Which TWO features of Azure Pipelines help you manage build artifacts across stages? (Choose two.)

Accepted Answer

Download Pipeline Artifact task. The Publish Pipeline Artifact task (option E) makes files available to subsequent stages by uploading them to Azure Pipelines, while the Download Pipeline Artifact task (option D) retrieves those artifacts in later stages. Together, they form the primary mechanism for passing build outputs across stages in a pipeline.

Answer

Pipeline variables

Answer

Release gates

Answer

Build tags

Question 3

Your company uses Microsoft Teams for collaboration. You want to send notifications to a Teams channel whenever a build pipeline in Azure Pipelines fails. Which approach should you use?

Accepted Answer

Install the Azure Pipelines app for Microsoft Teams and subscribe the channel to pipeline notifications.. The Azure Pipelines app for Microsoft Teams is the officially supported integration that lets you subscribe a Teams channel to pipeline events, including build failures, with rich notifications and actionable cards. Installing the app and configuring the channel subscription is the intended approach. It provides native integration without custom webhooks or email workarounds.

Answer

Configure an email subscription in Azure DevOps to send alerts to the Teams channel email address.

Answer

Set up a webhook in Azure DevOps to post to the Teams channel's incoming webhook URL.

Answer

Use the 'Post to a Microsoft Teams channel' task in the pipeline.

Question 4

Your organization uses GitHub Actions and needs to enforce that only approved actions from the GitHub Marketplace can be used in workflows. Developers have been using custom actions from third-party repositories. What is the most effective way to control which actions are allowed?

Accepted Answer

Use the 'Allow actions created by GitHub and verified partners' policy and add specific actions to the allow list.. The 'Allow actions created by GitHub and verified partners' policy, combined with an explicit allow list, provides granular control over which actions can run in workflows. This approach blocks unverified third-party actions by default while permitting specific approved actions from the Marketplace, directly addressing the need to enforce only approved actions without unnecessarily restricting all third-party actions.

Answer

Create a manual approval process for each new action.

Answer

Set the organization to disallow all third-party actions.

Answer

Configure the organization to allow only actions created by GitHub.

Question 5

Which TWO conditions must be met to use multi-stage YAML pipelines with approvals?

Accepted Answer

An environment must be created and approval checks configured on it.. Multi-stage YAML pipelines in Azure DevOps require that an environment be created and approval checks configured on it to enable manual approvals. Additionally, the deployment job within the pipeline must reference a specific environment, as the approval check is associated with that environment resource. Without these two conditions, the pipeline cannot enforce approval gates before deployment.

Answer

The pipeline must be triggered by a pull request.

Answer

The pipeline must have at least one stage defined in a separate release pipeline.

Answer

The pipeline must be created using the classic release editor.

Question 6

Which TWO actions should be taken to secure secrets in Azure Pipelines? (Choose two.)

Accepted Answer

Use secret variables with the 'secret' input type to mask them in logs.. Azure Pipelines allows you to mark variables as secret by using the 'secret' input type in the pipeline settings UI or by setting `secret: true` in YAML. This ensures the variable's value is masked with asterisks in all logs and output, preventing accidental exposure during build or release execution. Additionally, storing secrets in a variable group linked to Azure Key Vault provides a secure, centralized way to manage secrets, with access control, versioning, and auditability, making it a best practice for protecting sensitive data.

Answer

Use a variable group without Key Vault integration for easier management.

Answer

Store secrets directly in the YAML pipeline file.

Answer

Disable CI triggers to reduce exposure.

Question 7

You need to configure a release pipeline that deploys to Azure App Service. The deployment should use the 'slot swap' strategy to minimize downtime. Which deployment slot should you initially deploy to?

Accepted Answer

Staging slot. The slot swap strategy in Azure App Service deploys to a non-production slot (typically 'staging') first, allowing validation before swapping with the production slot. This eliminates downtime by warming up the staging slot and then routing traffic to it via a zero-downtime swap operation. Deploying directly to production would cause downtime or require manual traffic management.

Answer

Production slot

Answer

Warmup slot

Answer

All slots simultaneously

Question 8

Which TWO actions are required to securely use Azure Key Vault secrets in an Azure Pipelines build? (Choose 2)

Accepted Answer

Use the 'Azure Key Vault' task to download secrets as pipeline variables.. The Azure Key Vault task in Azure Pipelines is the recommended way to securely download secrets from a Key Vault and expose them as pipeline variables. This task automatically handles authentication and ensures that secret values are masked in logs, preventing accidental exposure. It eliminates the need to manually manage secret retrieval and mapping in YAML. For the task to succeed, the Azure DevOps service principal (from the Azure Resource Manager service connection) must have 'Get' and 'List' permissions on the Key Vault. Without these permissions, the task cannot retrieve the secrets. Therefore, both using the Azure Key Vault task and granting the appropriate permissions are required actions.

Answer

Set the 'secrets' output variable to 'true' in the pipeline.

Answer

Use the 'Environment Variables' section in the pipeline to map secrets.

Answer

Reference the secret identifier directly in the pipeline YAML.

Question 9

Which THREE are valid approaches to securely store secrets used in Azure Pipelines? (Choose three.)

Accepted Answer

Secret variables defined in the pipeline UI. Secret variables defined in the pipeline UI (B) are encrypted at rest and masked in logs, preventing exposure in source control. The Azure Key Vault task (C) retrieves secrets from Azure Key Vault at runtime, avoiding storage in Azure DevOps. Variable groups linked to Azure Key Vault (D) allow you to reference Key Vault secrets directly as pipeline variables, keeping them out of YAML and providing centralized access control. All three approaches ensure secrets are not stored in plaintext in repositories or pipeline definitions.

Answer

Inline secret variables defined in the YAML file

Answer

Environment variables set on the build agent

Question 10

Your organization uses Azure DevOps for a large-scale e-commerce platform. The source code is stored in a single Azure Repos Git repository with over 100 contributors. The current branching strategy is a modified GitFlow with main, develop, release, and hotfix branches. However, the team is experiencing frequent merge conflicts and long integration periods. You have been asked to redesign the branching strategy to support continuous integration and deployment (CI/CD) while ensuring high-quality releases. The new strategy must reduce merge conflicts, enable fast feedback, and support hotfixes. The team uses feature flags to manage incomplete features. Which branching strategy should you recommend?

Accepted Answer

Implement trunk-based development: developers work on short-lived feature branches (less than a day) and merge to main multiple times a day. Use feature flags to control release of incomplete features. Hotfixes are created from main and merged back quickly.. Trunk-based development with short-lived feature branches (less than a day) and frequent merges to main directly addresses the root causes of merge conflicts and long integration periods by minimizing divergence. Feature flags decouple deployment from release, allowing incomplete features to be merged safely. Hotfixes from main and quick merges back align with CI/CD principles, enabling fast feedback and high-quality releases.

Answer

Use a single main branch and allow developers to commit directly to main, but require all commits to be small and pass CI. Hotfixes are committed directly to main.

Answer

Use a single main branch and create release branches from main for each deployment. Feature branches are merged to release branches, and then release branches are merged to main after deployment.

Answer

Continue using GitFlow but enforce stricter branch policies and require more frequent merges.

Question 11

You need to run a set of tasks only when the build pipeline runs for the main branch. Which condition should you add to the job or step?

Accepted Answer

condition: eq(variables['Build.SourceBranch'], 'refs/heads/main'). The `Build.SourceBranch` variable in Azure Pipelines contains the full Git ref (e.g., `refs/heads/main`). Using `eq(variables['Build.SourceBranch'], 'refs/heads/main')` ensures the condition evaluates to true only when the pipeline runs on the main branch. This is the standard way to filter by branch in YAML pipeline conditions.

Answer

condition: eq(variables['Build.SourceBranch'], 'main')

Answer

condition: and(succeeded(), eq(variables['System.PullRequest.TargetBranch'], 'main'))

Answer

condition: ne(variables['Build.Reason'], 'PullRequest')

Question 12

Your organization uses GitHub for source control and Azure Pipelines for CI/CD. You need to implement a policy that requires all pull requests to be built and pass tests before merging. What should you do?

Accepted Answer

Add a branch protection rule in the GitHub repository requiring status checks.. GitHub branch protection rules allow you to require status checks to pass before merging a pull request. By configuring a rule that requires the Azure Pipelines build and test status check to succeed, you enforce that all pull requests are validated before they can be merged into the protected branch.

Answer

Set the pipeline trigger to run on pull request.

Answer

Configure pipeline permissions to require approval.

Answer

Add a pre-deployment check on the environment.

Question 13

You are configuring a release pipeline that deploys to multiple environments (dev, test, prod). You want to ensure that the same build artifact is deployed to each environment without rebuilding. Which type of trigger should you use for the release pipeline?

Accepted Answer

Build completion trigger. A build completion trigger ensures that the release pipeline is initiated only after a specific build pipeline completes, allowing the same build artifact to be deployed across multiple environments without rebuilding. This trigger is ideal for multi-environment release pipelines where consistency of the artifact is critical, as it decouples the build from the release and promotes the identical binary through dev, test, and prod.

Answer

Pull request trigger

Answer

Continuous integration (CI) trigger

Answer

Scheduled trigger

Question 14

Your team uses GitHub for source control. You need to ensure that sensitive data, such as connection strings, is never committed to the repository. Which tool should you use?

Accepted Answer

GitHub secret scanning. GitHub secret scanning automatically detects sensitive data like connection strings, API keys, and tokens as they are pushed to a repository, preventing them from being committed. It scans for known patterns and can block the push or alert the repository administrator, making it the correct tool for this requirement.

Answer

GitHub Actions

Answer

Dependabot

Answer

Git Large File Storage (LFS)

Question 15

You have a multi-stage YAML pipeline that builds and deploys a containerized application to Azure Kubernetes Service (AKS). The build stage runs successfully, but the deploy stage fails with an error: 'Error: failed to get credentials: context deadline exceeded'. You verify that the AKS cluster is running and that the service connection is valid. What is the most likely cause?

Accepted Answer

The build agent's IP address is not allowed by the AKS cluster's network policies.. The error 'context deadline exceeded' when running `az aks get-credentials` indicates a network timeout, not an authentication or permission failure. Since the AKS cluster is running and the service connection is valid, the most likely cause is that the build agent's IP address is blocked by AKS network policies (e.g., authorized IP ranges or a firewall), preventing the agent from reaching the cluster's API server within the default timeout.

Answer

The Azure service connection has expired.

Answer

The service principal used by the pipeline does not have RBAC permissions on the cluster.

Answer

The container registry is not accessible from the build agent.