AZ-400 Practice Test 44 — 15 Questions

Question 1

Your team uses Git with a trunk-based development strategy. They want to ensure that all code changes are integrated into the main branch at least once a day, and that branch lifetimes are short. Which practice best supports this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Developers work on short-lived feature branches (less than a day) and merge to main via pull requests after successful CI.. Trunk-based development emphasizes short-lived feature branches (typically less than a day) that are merged into the main branch via pull requests after passing continuous integration (CI) checks. This ensures all code changes are integrated at least daily, keeping branch lifetimes short and reducing merge conflicts.

Answer

Developers use GitFlow with develop and feature branches, merging to develop daily and to main at release.

Answer

Developers commit directly to a release branch, and then the release branch is merged to main at the end of the sprint.

Answer

Developers work on long-lived feature branches and merge to main only after all features are complete.

Question 2

Your team uses Azure Pipelines with Microsoft-hosted agents. You need to ensure that sensitive variables like API keys are securely passed to build tasks, but not exposed in logs. Which approach should you use?

Accepted Answer

Store the API key as a secret variable in the pipeline library or variable group. Secret variables in Azure Pipelines are encrypted at rest and masked in logs, ensuring sensitive values like API keys are never exposed. Storing the API key as a secret in a pipeline library or variable group allows it to be securely referenced by tasks without appearing in output or debug logs.

Answer

Retrieve the API key from Azure Key Vault at runtime using the Azure Key Vault task, but do not mark the output as secret

Answer

Define the API key in a variable template with 'isSecret: false'

Answer

Store the API key as a plain text variable in the pipeline and use it as an environment variable

Question 3

A development team is implementing a distributed tracing solution for a microservices application deployed on Azure. They want to correlate requests across services using OpenTelemetry and send data to Azure Monitor. The application currently generates traces, but the traces are incomplete, showing only individual service spans without end-to-end correlation. The team has already instrumented each service with the OpenTelemetry SDK. What should the team do to ensure proper end-to-end trace correlation?

Accepted Answer

Implement context propagation by passing trace headers between services.. Distributed tracing requires propagating trace context (trace ID, span ID) across service boundaries via HTTP headers (e.g., W3C Trace-Context). Without context propagation, each service creates its own trace, resulting in disconnected spans. The OpenTelemetry SDK automatically handles propagation when configured, but the team must ensure that outgoing requests include the trace headers and incoming requests extract them.

Answer

Enable the Application Insights auto-instrumentation agent on the application host.

Answer

Configure the OpenTelemetry SDK to use the Azure Monitor exporter instead of the default exporter.

Answer

Set the same service name for all services in the OpenTelemetry configuration.

Question 4

Your team uses GitHub Actions and needs to enforce that all workflows must use approved actions from a curated list. What is the best way to implement this?

Accepted Answer

Set up an allowed list of actions in organization settings. GitHub Organizations allow administrators to define an 'allowed list' of actions under Settings > Actions > Policies, restricting workflow execution to only approved actions from the curated list. This directly enforces the requirement that all workflows use only approved actions, preventing the use of unverified or malicious third-party actions.

Answer

Configure branch protection rules

Answer

Enable Dependabot alerts

Answer

Use OpenID Connect (OIDC)

Question 5

You are setting up a GitHub Actions workflow to deploy a containerized application to Azure Kubernetes Service (AKS). You need to securely authenticate to the AKS cluster using a service principal. What is the recommended way to store and use the service principal credentials?

Accepted Answer

Store the service principal credentials as GitHub Actions secrets and reference them in the 'azure/login' action. GitHub Actions secrets are the recommended secure mechanism for storing sensitive credentials like a service principal's client ID and secret. The 'azure/login' action can directly reference these secrets (e.g., `${{ secrets.AZURE_CREDENTIALS }}`) to authenticate to Azure, and then the 'azure/aks-set-context' action uses that authenticated session to connect to the AKS cluster. This approach avoids hardcoding credentials in the workflow file and leverages GitHub's encrypted storage.

Answer

Use managed identity for GitHub Actions and assign it to the AKS cluster

Answer

Store the service principal credentials in a Kubernetes secret in the AKS cluster

Answer

Store the service principal credentials as environment variables in the workflow file

Question 6

Which THREE features are available in GitHub Actions for managing secrets across environments?

Accepted Answer

Organization-level secrets. GitHub Actions supports three types of secrets for managing sensitive data: organization-level secrets, which are encrypted and shared across multiple repositories within an organization; repository-level secrets, which are available to all workflows in a single repository; and environment-specific secrets, which are scoped to a particular environment (e.g., production) within a repository. Together these allow centralized and scoped management of secrets across different environments and repositories. Options A and C are incorrect: 'encrypted variables in workflows' is not the official GitHub Actions secret feature, and secret scanning alerts is a reactive security service, not a secret management feature.

Answer

Encrypted variables in workflows

Answer

Secret scanning alerts

Question 7

A company is designing an Azure DevOps strategy for a microservices application. They need to ensure that each microservice can be built, tested, and deployed independently. They also want to reuse pipeline components across services. Which TWO practices should they implement?

Accepted Answer

Use pipeline templates to define common build and test steps.. Pipeline templates in Azure DevOps allow you to define reusable YAML snippets for common build and test steps, enabling consistency across microservices without duplicating code. Option E is correct because multi-stage YAML pipelines with separate definitions per microservice ensure each service can be built, tested, and deployed independently, aligning with microservices architecture principles.

Answer

Publish all microservice artifacts to the same Azure Artifacts feed.

Answer

Store all pipeline variables in a single variable group.

Answer

Create a single pipeline that handles all microservices.

Question 8

Which TWO triggers can start a release in Azure Pipelines?

Accepted Answer

Schedule. In Azure Pipelines, a release can be triggered by a schedule, which allows you to define a cron-based trigger to deploy at specific times (e.g., nightly builds). The 'Build completion' trigger starts a release when a specific build pipeline completes, enabling chained deployments. Both are native release triggers in classic release pipelines.

Answer

Continuous integration

Answer

Work item state change

Answer

Pull request

Question 9

Your team uses Azure Pipelines to build a Java application. The build must produce a JAR file and publish it as a pipeline artifact. Which THREE steps should be included in the build pipeline?

Accepted Answer

Use a Maven or Gradle task to compile and package the application.. A Maven or Gradle task is the standard way to compile and package a Java application into a JAR file. These tasks invoke the build tool's lifecycle (e.g., `mvn package` or `gradle build`) to produce the artifact, which is a prerequisite for publishing.

Answer

Use the DotNetCoreCLI task to build the application.

Answer

Use the NuGetCommand task to pack the JAR.

Question 10

You have a multi-stage YAML pipeline that deploys to Azure Kubernetes Service (AKS). The pipeline uses a deployment job with a strategy of 'runOnce'. You need to ensure that if the deployment fails, the pipeline automatically redeploys the previous successful version. Which strategy should you use instead?

Accepted Answer

Use the 'runOnce' strategy with a rollback task. The requirement can be met by adding a rollback task to the existing 'runOnce' strategy. When a deployment fails, the rollback task can automatically redeploy the previous successful version. Option A requires manual intervention, which contradicts the 'automatically' requirement. Option B uses invalid syntax ('on:failure: always')—the correct hook is 'on: failure: rollback'—and option C's automatic swap does not revert the deployment on failure.

Answer

Use the 'canary' strategy with manual intervention

Answer

Use the 'rolling' strategy and configure 'on:failure: always'

Answer

Use the 'blueGreen' strategy and configure automatic swap

Question 11

You need to create a build pipeline that runs on a Microsoft-hosted agent. You want to use the latest Ubuntu image. Which YAML snippet should you use?

Accepted Answer

pool: vmImage: 'ubuntu-latest'. In Azure Pipelines YAML, the `pool` keyword is used to specify the agent pool, and `vmImage` is a sub-property that defines the virtual machine image for Microsoft-hosted agents. Setting `vmImage: 'ubuntu-latest'` within the `pool` section selects the latest Ubuntu LTS image provided by Microsoft, ensuring the build runs on a current, maintained environment.

Answer

pool: name: 'ubuntu-latest'

Answer

agent: vmImage: 'ubuntu-latest'

Answer

resources: vmImage: 'ubuntu-latest'

Question 12

You are designing a build pipeline that must run on Microsoft-hosted agents. The pipeline has a dependency on a native library that is not pre-installed. You want to minimize pipeline duration. Which approach should you use?

Accepted Answer

Use a container job with a custom Docker image that includes the library. Using a container job with a custom Docker image that includes the native library allows the pipeline to run on Microsoft-hosted agents while eliminating installation overhead, thus minimizing pipeline duration. This approach meets the requirement of using Microsoft-hosted agents and avoids the time cost of installing the library in each run.

Answer

Use a self-hosted agent with the library pre-installed

Answer

Add a script step to install the library using a package manager

Answer

Download the library from Azure Blob Storage in each build

Question 13

Drag and drop the steps to perform a blue-green deployment in Azure using App Service slots into the correct order.

Accepted Answer

1. Create a staging slot, 2. Deploy the application to the staging slot, 3. Validate the staging slot, 4. Swap the staging slot to production, 5. Monitor the production slot. Blue-green deployment involves creating a slot, deploying to it, validating, swapping, and monitoring.

Answer

1. Deploy the application to the staging slot, 2. Create a staging slot, 3. Validate the staging slot, 4. Swap the staging slot to production, 5. Monitor the production slot

Answer

1. Create a staging slot, 2. Deploy the application to the staging slot, 3. Swap the staging slot to production, 4. Validate the staging slot, 5. Monitor the production slot

Answer

1. Create a staging slot, 2. Deploy the application to the staging slot, 3. Validate the staging slot, 4. Monitor the production slot, 5. Swap the staging slot to production

Question 14

You manage a release pipeline that deploys to multiple environments. The pipeline uses variables that differ per environment. You want to avoid duplicating variable definitions. Which strategy should you use?

Accepted Answer

Use variable groups linked to environments. Variable groups linked to environments allow you to define variables once and have different values per environment without duplication. Option A is correct because variable groups can be scoped to specific environments, allowing you to reuse the same variable names with different values across environments. Option B is incorrect because using conditions in the 'variables' section still requires you to define each variable for each condition, leading to duplication. Option C is incorrect because defining variables in each stage duplicates the variable definitions across stages. Option D is incorrect because while Azure Key Vault is useful for secrets, it is not designed for all types of variables, and you still need to reference the secrets per environment, which does not avoid duplication of variable references.

Answer

Use the 'variables' section in the pipeline YAML with conditions

Answer

Define variables in each stage of the YAML pipeline

Answer

Store all variables in Azure Key Vault and reference them in the pipeline

Question 15

You are designing a build pipeline for a .NET Core application. The pipeline must run on a self-hosted agent in a private network without internet access. Which TWO actions are required to ensure the build can download NuGet packages?

Accepted Answer

Install the NuGet tool on the self-hosted agent machine.. To restore NuGet packages on a self-hosted agent without internet access, the NuGet tool must be installed on the agent machine (B) and the agent must be configured to access an internal NuGet feed, such as Azure Artifacts or a local feed (D). Disabling the NuGet restore step (A) would prevent packages from being downloaded. Using a Microsoft-hosted agent (C) would require internet access, which violates the private network constraint. The NuGet Authenticate task (E) is not required because authentication can be handled through feed configuration or integrated authentication.

Answer

Disable the NuGet restore step in the pipeline.

Answer

Use a Microsoft-hosted agent instead.

Answer

Use the NuGet Authenticate task to authenticate with Azure Artifacts.