AZ-400 Practice Test 41 — 15 Questions

Question 1

Your team is migrating from TFVC to Git in Azure Repos. Developers frequently work on the same files simultaneously. Which Git workflow should you recommend to minimize merge conflicts?

Accepted Answer

Feature branch workflow. The feature branch workflow is ideal for minimizing merge conflicts when developers work on the same files simultaneously because each developer creates a short-lived branch off the main branch for their specific feature or fix, commits frequently, and merges back via pull requests. This isolates changes until they are ready, reducing the surface area for conflicts compared to long-lived branches. Git's merge or rebase strategies within this workflow allow for incremental conflict resolution, which is more manageable than resolving large conflicts from divergent histories.

Answer

GitFlow

Answer

Forking workflow

Answer

Centralized workflow

Question 2

Your team uses Azure Pipelines to deploy a web app to Azure App Service. You need to ensure that secrets (e.g., connection strings) are not exposed in the pipeline logs. What is the recommended approach?

Accepted Answer

Use secret pipeline variables and reference them in the pipeline.. Azure Pipelines supports secret pipeline variables that are masked in logs, preventing exposure of sensitive data like connection strings. When you mark a variable as secret, its value is automatically hidden from pipeline output, and you can reference it securely using $(variableName) syntax. This is the recommended approach for handling secrets directly within the pipeline without additional service dependencies.

Answer

Remove all logging from the pipeline.

Answer

Store secrets in Azure Key Vault and retrieve them in the pipeline, then log them for debugging.

Answer

Store secrets as environment variables in the pipeline.

Question 3

You have a multi-stage pipeline that deploys to multiple regions. You want to ensure that if the deployment to one region fails, the pipeline does not proceed to the next region. What is the best way to implement this?

Accepted Answer

Define stage dependencies with 'dependsOn' and set 'condition' to 'succeeded()'.. Azure Pipelines allows you to define stage dependencies using 'dependsOn' and control execution flow with 'condition'. By setting each region deployment as a separate stage that depends on the previous region's stage succeeding (condition: 'succeeded()'), the pipeline will automatically halt if any region deployment fails, preventing progression to subsequent regions.

Answer

Use pipeline decorators to inject error handling steps.

Answer

Add a manual approval between regions.

Answer

Configure each region deployment as a separate stage with no dependencies.

Question 4

Refer to the exhibit. A developer is working on the feature/login branch and wants to ensure that the latest changes from main are incorporated before creating a pull request. Which command should the developer run next?

Accepted Answer

git pull --rebase origin main. The exhibit shows that the feature/login branch has a merge commit from main (3a1b2c3) which means main was already merged into feature/login. However, the local branch is ahead of origin by 1 commit (the merge commit). The developer wants to incorporate the latest changes from main. Since main has advanced (d4e5f6a is the latest on origin/main), the developer should pull the latest main and rebase or merge again. The best practice is to rebase onto the latest main to maintain a linear history. Therefore, the developer should run 'git pull --rebase origin main' to fetch and rebase.

Answer

git rebase --abort

Answer

git merge main

Answer

git push origin feature/login

Question 5

Your team manages a large-scale microservices application deployed on Azure Kubernetes Service (AKS). The code is hosted in Azure Repos, and you use Azure Pipelines for CI/CD. You have recently adopted GitHub Copilot for code suggestions. Your compliance team requires that all pipeline runs include a security scan using Microsoft Defender for Cloud. Additionally, all pull requests must have at least two reviewers from separate teams before merging. The current pipeline completes in 45 minutes, and you want to minimize overhead. You need to design a process that enforces these requirements without degrading developer productivity. Which approach should you recommend?

Accepted Answer

Integrate the security scan as a step early in the CI pipeline, and configure branch policies on the main branch to require two reviewers from different teams and a successful CI build including the scan. Document the process and use Copilot to generate commit messages that reference work items.. It integrates the security scan early in the CI pipeline, ensuring it runs on every build without adding a separate pipeline overhead. Branch policies enforce both the required two reviewers from different teams and the successful CI build (including the scan) before merging, which minimizes additional pipeline complexity and maintains developer productivity.

Answer

Configure a branch policy on the main branch that requires a successful build and security scan before merging, and use a single pipeline that includes the scan.

Answer

Create a separate security scan pipeline triggered on pull request creation, and require its successful completion via branch policy. Then set up a separate PR policy requiring two reviewers.

Answer

Add a manual approval gate in the release pipeline that requires the security officer to approve after the scan completes.

Question 6

Your company uses GitHub for source control. The security team requires that all commits to the main branch be signed with an approved GPG key. Additionally, developers must use their corporate email for commits. You need to configure branch protection rules and repository settings to enforce these requirements. Which combination of settings should you use?

Accepted Answer

Enable 'Require signed commits' in branch protection and use a required status check that runs a custom action to verify commit author email.. GitHub branch protection rules can require signed commits, but they only verify that a commit is signed with any GPG key, not that the signer's email matches a corporate domain. To enforce the corporate email requirement, you must add a required status check that runs a custom action (e.g., using `actions-ecosystem/action-check-commit-email`) to verify the commit author email matches the corporate domain. This combination satisfies both the GPG signature and email domain requirements.

Answer

Configure repository to require commit signature verification via SSH keys.

Answer

Enable 'Require signed commits' in branch protection rules and use a pre-receive hook to validate email domain.

Answer

Use a GitHub Actions workflow that checks commit signatures and email and rejects if invalid.

Question 7

Your pipeline uses a multi-stage YAML file. You want to conditionally run a stage only when the build is triggered from the 'main' branch. Which expression should you use in the 'condition' property of the stage?

Accepted Answer

eq(variables['Build.SourceBranch'], 'refs/heads/main'). The `Build.SourceBranch` variable in Azure Pipelines contains the full Git ref path (e.g., `refs/heads/main`). The `condition` property evaluates expressions at runtime, and using `eq(variables['Build.SourceBranch'], 'refs/heads/main')` precisely matches the full ref for the main branch, ensuring the stage runs only when the trigger originates from that branch.

Answer

startsWith(variables['Build.SourceBranch'], 'main')

Answer

eq(variables['Build.SourceBranchName'], 'refs/heads/main')

Answer

eq(variables['Build.SourceBranch'], 'main')

Question 8

Your team uses trunk-based development with short-lived feature branches. You notice that code reviews often delay merging because reviewers are not available. What is the best way to reduce review latency while maintaining quality?

Accepted Answer

Encourage pair programming or mob programming to review code in real-time.. Pair programming or mob programming allows code to be reviewed in real-time during development, reducing the need for asynchronous pull request reviews and thus decreasing review latency while maintaining quality. Option A is incorrect because enabling auto-merge does not address reviewer availability; it still requires a review to be completed. Option B is incorrect because requiring only one reviewer may reduce review depth and quality. Option C is incorrect because creating a separate review team can introduce new bottlenecks and does not solve the issue of reviewer unavailability.

Answer

Enable auto-merge for pull requests that have passed all checks.

Answer

Require only one reviewer instead of two.

Answer

Create a separate review team that only handles pull requests.

Question 9

Your release pipeline deploys to Azure App Service using deployment slots. You need to ensure that traffic is gradually shifted to the new slot over 30 minutes, and if performance issues occur, it should automatically roll back. Which deployment strategy should you implement?

Accepted Answer

Use the 'Deploy to Azure App Service' task with the 'Deploy to Slot' option and configure auto-swap with monitoring.. The 'Deploy to Azure App Service' task with 'Deploy to Slot' and auto-swap with monitoring enables a gradual traffic shift over a specified duration (e.g., 30 minutes) using Azure's swap-with-preview and auto-rollback capabilities. When performance issues are detected via Application Insights or health checks, the swap is automatically aborted, rolling back to the previous slot. This meets the requirement for gradual shifting and automatic rollback without manual intervention.

Answer

Use two separate deployment slots (blue/green) and manually swap after validation.

Answer

Use a canary deployment with multiple slots and manual approval gate.

Answer

Use an A/B testing deployment by deploying to two different App Services and routing traffic via Traffic Manager.

Question 10

Your organization has a multi-stage YAML pipeline that builds and deploys a containerized application to Azure Kubernetes Service (AKS). The pipeline uses environment approvals for the production stage. You need to ensure that the container image deployed to production is the same as the one that passed all previous stages. Which strategy should you implement?

Accepted Answer

Publish the container image as a pipeline artifact and reference it from each stage.. Publishing the container image as a pipeline artifact ensures that the exact same image (by digest, not just tag) is available to all stages. By referencing the artifact in each stage, you guarantee that the image deployed to production is identical to the one that passed testing, avoiding any risk of tag mutation or rebuild inconsistencies.

Answer

Use the same image tag in all stages, updating the tag as needed.

Answer

Enable immutable tags on the container registry to prevent overwrites.

Answer

Rebuild the container image in each stage to ensure freshness.

Question 11

Your team uses Azure Repos and has a repository with a large number of binary files (e.g., images, compiled libraries) that bloat the repository size. You want to reduce clone times and storage usage while still maintaining version history for those files. Which approach should you recommend?

Accepted Answer

Use Git Large File Storage (LFS) to track large files with pointers.. Git LFS (Large File Storage) replaces large binary files in the repository with text pointers, while storing the actual file content in a separate remote store. This keeps the repository lightweight for cloning and fetching, but still preserves the full version history of the binary files because each pointer references a specific version in the LFS store. It integrates natively with Azure Repos and requires minimal workflow changes.

Answer

Split the repository into two: one for code and one for binaries.

Answer

Use git annex to manage large files with a separate store.

Answer

Use git submodules to reference the large files from another repository.

Question 12

Refer to the exhibit. You queue a build in Azure Pipelines. The build status remains 'notStarted' for an extended period. What is the most likely reason?

Accepted Answer

The build is waiting for an available agent that meets the demands.. The 'notStarted' status indicates the build has been queued but no agent has picked it up yet. In Azure Pipelines, a build waits for an available agent that matches the demands specified in the pipeline (e.g., capabilities like 'Agent.OS' or custom demands). If all agents in the pool are busy or none meet the demands, the build remains in a 'notStarted' state until a suitable agent becomes free.

Answer

The build priority is set to normal, causing delay.

Answer

The build definition has a syntax error in the YAML file.

Answer

The build definition is not authorized to use the Azure Pipelines pool.

Question 13

You have a YAML pipeline that builds a .NET application. You want to cache the NuGet packages to speed up subsequent builds. Which task should you use?

Accepted Answer

Cache task with a key based on the packages.lock.json hash.. The Cache task in Azure Pipelines allows you to cache NuGet packages by specifying a key derived from the hash of `packages.lock.json`. This ensures that the cache is invalidated only when the lock file changes, which accurately reflects changes in package dependencies. The cached `~/.nuget/packages` folder is then restored on subsequent runs, significantly reducing restore time.

Answer

CopyFiles task to copy packages to a staging directory.

Answer

NuGet restore task with 'cacheRestore' option.

Answer

PublishBuildArtifacts task to upload packages.

Question 14

Your organization uses GitHub Copilot for pull request summaries. However, some developers report that the summaries are inaccurate. What should you do to improve the quality of Copilot-generated pull request summaries?

Accepted Answer

Ask developers to write clear, structured PR titles and descriptions.. GitHub Copilot for pull request summaries relies on the PR title and description as primary input to generate accurate summaries. Clear, structured titles and descriptions provide better context for the AI model, reducing ambiguity and improving summary quality. Detailed commit messages (Option A) are not directly used by Copilot for PR summaries, as it focuses on the PR-level metadata.

Answer

Encourage developers to write more detailed commit messages.

Answer

Disable Copilot for pull requests and use manual summaries.

Answer

Provide a link to a documentation wiki in the PR description.

Question 15

You have a YAML pipeline that uses a self-hosted agent. The agent runs on a VM in Azure. The pipeline fails intermittently with the error: '##[error]The job running on agent MyAgent has been cancelled because the agent was idle for more than the maximum idle time.' You need to resolve this issue. What should you do?

Accepted Answer

Configure the agent's idle timeout setting to a higher value or disable it.. The error indicates that the self-hosted agent was idle for longer than the configured maximum idle time, causing Azure Pipelines to cancel the job. Option A is correct because increasing or disabling the idle timeout setting on the agent (via the agent's configuration file or environment variable) directly addresses this issue by allowing longer periods of inactivity before cancellation.

Answer

Add more agents to the agent pool.

Answer

Increase the job's timeout in minutes.

Answer

Reduce the number of parallel jobs to avoid overloading the agent.