AZ-400 Practice Test 45 — 15 Questions

Question 1

Your Azure DevOps project uses Git for source control. You want to enforce that all code changes are reviewed before merging into the main branch. Which branch policy should you enable?

Accepted Answer

Require a minimum number of reviewers.. The 'Require a minimum number of reviewers' branch policy ensures that a specified number of reviewers must approve a pull request before it can be merged, directly enforcing code review. Option A is incorrect because 'Allow only comment resolution' pertains to how comments are resolved, not requiring approvals. Option B is incorrect because 'Require a successful build before merging' validates build status but does not enforce review. Option C is incorrect because 'Limit merge types to squash merge' controls the merge strategy, not the review process.

Answer

Allow only comment resolution.

Answer

Require a successful build before merging.

Answer

Limit merge types to squash merge.

Question 2

You are designing a release pipeline for a critical application that requires zero-downtime deployments. The application runs on Azure Kubernetes Service (AKS) with multiple replicas. You are using Azure Pipelines with a canary deployment strategy. What is the best approach to gradually shift traffic to the new version while monitoring for errors?

Accepted Answer

Use a service mesh like Istio to route a percentage of traffic to the new version.. Using a service mesh like Istio allows granular traffic splitting between versions, enabling gradual canary deployments with real-time monitoring. Option B is incorrect: Azure Application Gateway can route traffic to backends, but it works at the ingress level and cannot easily shift traffic at the pod level without additional configuration; it's less flexible than a service mesh for canary. Option C is incorrect: AKS rolling update gradually replaces pods but does not split traffic between old and new; all traffic goes to the new version once a pod is updated, making it unsuitable for gradual traffic shift. Option D is incorrect: VIP swap is a blue-green deployment, which switches all traffic at once, not gradually.

Answer

Use Azure Application Gateway as an ingress controller with weighted backend pools.

Answer

Use the AKS rolling update strategy with max surge.

Answer

Deploy to a staging environment, then swap VIPs with production.

Question 3

Which TWO conditions should you configure in a release pipeline to ensure that a deployment to production only happens when both the staging deployment succeeded and a manual approval is granted? (Choose two.)

Accepted Answer

Add a pre-deployment approval on the production stage.. To ensure release to production only after staging success and manual approval, you need a pre-deployment approval on the production stage (B) for the manual approval, and a pre-deployment gate on production that checks that the staging deployment succeeded (E). A gate is a valid condition that verifies the required state before deployment. Option D, the deployment queue setting 'After previous deployment', only controls concurrency of the same stage and does not create a dependency on the staging stage, so it does not ensure staging succeeded.

Answer

Add a post-deployment approval on the staging stage.

Answer

Set the trigger to 'After release' and filter by artifact.

Answer

Set the deployment queue setting to 'After previous deployment' for the production stage.

Question 4

You have a pipeline that uses Azure Repos Git. You need to enforce that all commits to the main branch are associated with a work item. Which branch policy should you enable?

Accepted Answer

Require linked work items. Require linked work items. This branch policy enforces that pull requests or commits to the main branch have at least one associated work item, ensuring traceability. Option B, Limit merge types, restricts which merge strategies can be used (e.g., squash, rebase), but does not enforce work item linking. Option C, Require a minimum number of reviewers, ensures code review but not work item association. Option D, Check for comment resolution, requires that all comments on pull requests are resolved before merging, which is unrelated to work items.

Answer

Limit merge types

Answer

Require a minimum number of reviewers

Answer

Check for comment resolution

Question 5

Your team uses Azure Pipelines to deploy a Node.js application. Recently, deployments have been failing intermittently due to a missing npm package. The pipeline runs successfully on the local agent but fails on the hosted agent. Which instrumentation strategy should you implement to identify the root cause?

Accepted Answer

Enable verbose logging for the npm install task and compare the output between pipeline runs.. Enabling verbose logging for the npm install task allows you to see detailed output of package resolution and installation steps. By comparing the logs between the local agent (success) and hosted agent (failure), you can identify differences in npm registry availability, package versions, or authentication issues that cause the intermittent missing package. Option A is wrong because self-hosted agents might not match the hosted environment's configuration, and the goal is to diagnose the problem on hosted agents. Option B is wrong because Application Insights monitors application runtime behavior, not build-time dependency installation. Option D is wrong because pipeline caching would reuse previously installed packages, which could mask the problem by not performing a fresh install, and does not help identify why the package is missing on hosted agents.

Answer

Replace the hosted agent with a self-hosted agent.

Answer

Configure Application Insights for the Node.js app to monitor runtime errors.

Answer

Add a pipeline cache task for npm packages to ensure consistent restore.

Question 6

You are designing a plan to protect Azure DevOps pipelines from supply chain attacks. Which TWO measures should you implement?

Accepted Answer

Require approval for pipeline runs that use external resources. Options A and B are correct. Option A requires approval for pipeline runs that use external resources, which helps prevent unauthorized or malicious external dependencies from being used in builds, directly reducing supply chain attack risk. Option B uses Dependabot to automatically update vulnerable dependencies, ensuring known vulnerabilities are patched promptly. Option C is incorrect because code coverage thresholds are a code quality measure, not a supply chain security control. Option D is incorrect because secret scanning detects secrets in repositories but does not prevent supply chain attacks. Option E is incorrect because release gates validate deployment health, not supply chain integrity.

Answer

Implement code coverage thresholds in pull requests

Answer

Enable secret scanning for all repositories

Answer

Use release gates to validate deployment health

Question 7

Your company uses Azure DevOps for CI/CD. You have a build pipeline that compiles a C++ application and runs unit tests. The pipeline uses a Microsoft-hosted agent. The build takes approximately 45 minutes to complete. You want to reduce the build time. You notice that the pipeline downloads dependencies from a NuGet feed every time. You have a private NuGet feed in Azure Artifacts. The pipeline restores packages using 'nuget restore'. You want to cache the NuGet packages on the agent to avoid downloading them on every build. What should you do?

Accepted Answer

Add a CacheBeta task before the restore step to cache the packages folder.. The CacheBeta task enables caching of the NuGet packages folder between pipeline runs, avoiding repeated downloads from the feed. This directly reduces build time. Option A is wrong because while self-hosted agents can have persistent storage, the question specifies using a Microsoft-hosted agent, and the CacheBeta task works even with Microsoft-hosted agents. Option B is wrong because using upstream sources in Azure Artifacts does not cache packages locally on the agent; it still requires downloading them each time. Option C is wrong because increasing compute resources does not affect the time spent downloading dependencies; caching addresses the root cause.

Answer

Use a self-hosted agent with persistent storage.

Answer

Use a hosted Azure Artifacts feed with upstream sources.

Answer

Increase the agent's compute resources by selecting a higher SKU.

Question 8

You are designing a release pipeline for a microservices application deployed to Azure Kubernetes Service (AKS). You need to implement a strategy that minimizes downtime during updates by gradually shifting traffic to the new version while monitoring for errors. Which deployment strategy should you use?

Accepted Answer

Canary deployment. Canary deployment is the correct choice because it gradually shifts a small percentage of traffic to the new version while monitoring for errors, allowing you to detect issues early and roll back quickly without impacting all users. In AKS, this can be implemented using a service mesh like Istio or a progressive delivery tool like Flagger, which manages traffic splitting via VirtualService and DestinationRule configurations. This minimizes downtime by ensuring the majority of users remain on the stable version until the new version is verified.

Answer

Recreate deployment

Answer

Blue-green deployment

Answer

Rolling update

Question 9

Which TWO Git operations are considered dangerous and should be used with caution because they rewrite history? (Select TWO.)

Accepted Answer

git push --force. `git push --force` overwrites the remote branch history with the local branch, discarding any commits on the remote that are not in the local history. This can cause other collaborators to lose work if they have based changes on the overwritten commits, making it a history-rewriting operation that must be used with caution.

Answer

git fetch

Answer

git merge

Answer

git revert

Question 10

A team uses a monorepo in Azure Repos. They want to implement a build validation policy that only triggers builds for code changes in specific folders to reduce build times. Which approach should they use?

Accepted Answer

Configure the build policy in Azure Repos with a path filter to limit which folders trigger the policy.. Azure Repos build validation policies allow you to specify path filters when configuring the policy. These path filters restrict when the policy requires a build, based on the files changed in the pull request. By setting the path filter to the specific folders of interest, the build validation only triggers for changes in those folders, directly reducing build times for unrelated changes. Pipeline trigger path filters (Option D) control CI builds on push, not the build validation policy for pull requests.

Answer

Use a manual trigger and have developers specify which folder to build.

Answer

Create separate YAML pipelines for each folder and configure branch policies to require all pipelines.

Answer

Configure path filters in the pipeline trigger to include only the changed folder.

Question 11

Your team uses Azure Pipelines and wants to ensure that builds cannot access the internet to prevent data exfiltration. What should you do?

Accepted Answer

Create a private agent pool with no internet access. Microsoft-hosted agents with network isolation (B) is a valid Azure feature. However, using a private agent pool with no internet access (A) or self-hosted agents on an isolated network (D) are also valid methods to prevent internet access for builds. The question should be revised to specify a constraint that excludes these options, or the correct options should include A and D.

Answer

Set the pipeline variable 'DisableInternetAccess' to true

Question 12

You see the above git log output. The team has a policy requiring linear history on the main branch. Which command should be used next time to integrate the feature branch?

Accepted Answer

git rebase main feature/login then git merge --ff-only. The team requires a linear history on the main branch. By first rebasing the feature branch onto main (`git rebase main feature/login`), you reapply the feature commits on top of the latest main commit, creating a clean, linear sequence. Then `git merge --ff-only` performs a fast-forward merge, which simply moves the main branch pointer forward without creating a merge commit, preserving the linear history policy.

Answer

git merge --squash feature/login

Answer

git cherry-pick f4e5d6c a7b8c9d

Answer

git merge --no-ff feature/login

Question 13

You are a security engineer for a large financial institution. The organization uses Azure DevOps with multiple projects, each containing hundreds of pipelines. The security team recently discovered that several pipeline variables marked as 'Secret' were inadvertently printed to logs due to a custom script task that echoed the variable. Consequently, the compliance officer requires that all secrets used in pipelines must be centrally managed in Azure Key Vault, and any pipeline that references a variable not from Key Vault must be blocked from running. Additionally, the solution must minimize administrative overhead and provide real-time enforcement across all projects in the organization. You have the following options:

Option A: Develop a custom pipeline task that checks at runtime whether all secret variables originate from Key Vault, and add it to every pipeline YAML file manually.

Option B: Create an Azure Policy definition that audits pipelines for the use of non-Key Vault variables and attach it to the management group containing the Azure DevOps resources.

Option C: Use Azure DevOps Audit Logs to periodically review pipeline runs and manually identify pipelines that use non-Key Vault secrets.

Option D: Configure a pipeline decorator in the organization settings that injects a task at the beginning of every pipeline to validate that all secret variables are linked to Key Vault, and fail the pipeline if any are not.

Which option meets the requirements most effectively?

Accepted Answer

Configure a pipeline decorator in the organization settings that injects a task at the beginning of every pipeline to validate that all secret variables are linked to Key Vault. Configure a pipeline decorator is correct because it provides real-time enforcement at the organization level with minimal overhead. Option A is wrong because manual addition to each pipeline is high overhead and error-prone. Option B is wrong because Azure Policy does not apply to Azure DevOps pipeline configurations. Option C is wrong because it is reactive and does not block non-compliant runs.

Answer

Develop a custom pipeline task that checks at runtime whether all secret variables originate from Key Vault

Answer

Create an Azure Policy definition that audits pipelines for the use of non-Key Vault variables

Answer

Use Azure DevOps Audit Logs to periodically review pipeline runs

Question 14

Which THREE are valid ways to trigger a pipeline in Azure Pipelines? (Choose three.)

Accepted Answer

Schedule trigger. In Azure Pipelines, scheduled triggers, pull request triggers, and continuous integration (CI) triggers are all valid ways to trigger a pipeline. 'on: push' is GitHub Actions syntax, not Azure Pipelines, and 'commit trigger' is not a formal trigger type in Azure Pipelines.

Answer

'on: push' trigger in YAML

Answer

Commit trigger

Question 15

You have a YAML pipeline with multiple jobs that need to run in parallel. However, one job depends on artifacts produced by a previous job. How should you configure the dependency?

Accepted Answer

Set dependsOn on the dependent job and use PublishBuildArtifacts and DownloadBuildArtifacts tasks.. In Azure DevOps YAML pipelines, job dependencies are explicitly declared using the `dependsOn` keyword, and artifacts must be published and downloaded using `PublishBuildArtifacts` and `DownloadBuildArtifacts` tasks (or the `publish` and `download` pipeline decorators). Without explicit artifact sharing, outputs from one job are not automatically available to another job, even if `dependsOn` is set.

Answer

Use the 'dependsOn' keyword only, artifacts are automatically shared.

Answer

Set the 'condition' to 'eq(variables['Agent.JobStatus'], 'Succeeded')' on the dependent job.

Answer

Use the 'pool' keyword to ensure both jobs run on the same agent.