AZ-400 Practice Test 45 — 15 Questions

Question 1

Your organization uses GitHub Enterprise and requires that all commits to the main branch are signed with a GPG key verified by your organization. Developers are getting errors when pushing signed commits. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The developer's GPG key is not uploaded to their GitHub account or not verified.. GitHub requires that the GPG key used to sign a commit be uploaded to the user's GitHub account and marked as verified. If the key is missing or unverified, GitHub cannot confirm the signature's authenticity, causing the push to be rejected when branch protection rules enforce signed commits.

Answer

The branch protection rule requires a linear history.

Answer

The developer's email in the commit does not match any email on their GitHub account.

Answer

The developer's SSH key is not added to their GitHub account.

Question 2

Your organization uses GitHub Actions for CI/CD. You need to ensure that secrets used in workflows are not exposed in logs. What should you do?

Accepted Answer

Store the secret in GitHub Secrets and reference it as ${{ secrets.SECRET_NAME }}.. GitHub Secrets are encrypted environment variables that are automatically masked in workflow logs. When you reference a secret using the `${{ secrets.SECRET_NAME }}` syntax, GitHub Actions ensures the value is never printed in plain text, even if the workflow attempts to echo it. This is the built-in, secure method for handling sensitive data in CI/CD pipelines.

Answer

Encrypt the secret with a password before using it.

Answer

Use the 'echo' command to output the secret and then delete the log.

Answer

Disable logging on the self-hosted runner.

Question 3

Your company uses Microsoft Defender for Cloud to monitor Azure DevOps environments. You receive an alert that a service principal has excessive permissions. What is the first step you should take to investigate and remediate?

Accepted Answer

Review the Microsoft Entra ID audit logs for the service principal.. Reviewing the Microsoft Entra ID audit logs is the correct first step because it allows you to investigate the service principal's activity, such as which resources it accessed, when, and from where, before taking any remediation action. This forensic analysis is essential to understand the scope of the excessive permissions and to ensure that reducing permissions or other actions do not inadvertently disrupt legitimate operations. Without this step, you risk breaking functionality or missing evidence of misuse.

Answer

Reduce the service principal's permissions to the minimum required.

Answer

Immediately delete the service principal.

Answer

Reset the service principal's credentials.

Question 4

Refer to the exhibit. A developer queues a build with a variable 'BuildConfiguration' set to 'Release'. The pipeline definition has a default variable 'BuildConfiguration' set to 'Debug' and does not allow overrides at queue time. What will be the value of 'BuildConfiguration' during the build?

Accepted Answer

Debug. In Azure Pipelines, when a variable is defined in the pipeline YAML and the 'Settable at queue time' option is not enabled, the queue-time value is ignored and the pipeline definition's default value is used. Since the default is 'Debug' and overrides are not allowed, the build runs with BuildConfiguration=Debug (A). The developer's attempt to set 'Release' at queue time has no effect.

Answer

Release

Answer

null

Answer

The build fails with an error

Question 5

You are designing a release pipeline for a critical application that requires zero-downtime deployments. The application runs on Azure Kubernetes Service (AKS) with multiple replicas. You are using Azure Pipelines with a canary deployment strategy. What is the best approach to gradually shift traffic to the new version while monitoring for errors?

Accepted Answer

Use a service mesh like Istio to route a percentage of traffic to the new version.. A service mesh like Istio provides fine-grained traffic splitting at the network layer, allowing a precise percentage of traffic (e.g., 5%, then 10%, then 50%) to be routed to the canary version while the rest goes to the stable version. Istio's telemetry (via Envoy sidecars) enables real-time error-rate and latency monitoring, so you can automatically or manually roll back if anomalies appear. This is the most controlled, observable approach for canary deployments on AKS.

Answer

Use Azure Application Gateway as an ingress controller with weighted backend pools.

Answer

Use the AKS rolling update strategy with max surge.

Answer

Deploy to a staging environment, then swap VIPs with production.

Question 6

Your Azure DevOps project uses Git for source control. You want to enforce that all code changes are reviewed before merging into the main branch. Which branch policy should you enable?

Accepted Answer

Require a minimum number of reviewers.. The 'Require a minimum number of reviewers' branch policy in Azure DevOps enforces that a specified number of approvers must sign off before a pull request can be completed, directly satisfying the requirement that all code changes are reviewed before merging. This policy can be set on the main branch and optionally reset votes on new pushes. It is the standard mechanism for mandatory code review in Azure Repos.

Answer

Allow only comment resolution.

Answer

Require a successful build before merging.

Answer

Limit merge types to squash merge.

Question 7

Which THREE of the following are valid methods to securely store and use secrets in Azure DevOps pipelines?

Accepted Answer

Azure Key Vault task in the pipeline. The Azure Key Vault task in a pipeline allows you to fetch secrets directly from an Azure Key Vault instance during pipeline execution. This task retrieves secret values as pipeline variables, ensuring they are never exposed in logs or YAML files, and it supports both Azure Resource Manager and service principal authentication for secure access.

Answer

Azure App Configuration with Key Vault references

Answer

Storing secrets in a pipeline YAML file with encryption

Question 8

You are designing a Git branching strategy for a large enterprise with multiple Azure DevOps projects. The strategy must support hotfixes for production releases, feature development in isolated branches, and release branches for stabilization. The team uses CI/CD pipelines that trigger on branch creation. You need to minimize merge conflicts and ensure that hotfix changes are propagated to all active branches. Which branching model should you recommend and how should you configure branch policies?

Accepted Answer

Use GitFlow with main, develop, and hotfix branches. Configure branch policies on main and develop to enforce pull requests with required reviewers. Use a pipeline to automatically merge hotfix branches into both main and develop.. GitFlow is designed for projects with multiple release cycles and hotfixes. It uses main, develop, feature, release, and hotfix branches. Configuring branch policies on main and develop enforces pull requests with required reviewers, ensuring code quality. Automatically merging hotfix branches into both main and develop ensures that hotfix changes are propagated to all active branches, minimizing merge conflicts and ensuring consistency.

Answer

Use GitHub Flow with feature branches merging directly to main. Use a release branch for stabilization. Use pull requests for all merges.

Answer

Use trunk-based development with short-lived feature branches. Use feature toggles for incomplete work. No separate hotfix branch.

Answer

Use a forking workflow where each developer forks the repository and submits pull requests. Use branch policies on the upstream main branch.

Question 9

Your organization is adopting GitHub Advanced Security. Which THREE features should you enable to improve security?

Accepted Answer

Secret scanning. Secret scanning (Option C) is a GitHub Advanced Security feature that automatically detects exposed secrets (e.g., API keys, tokens, private keys) in repositories by matching against known patterns and partner-defined signatures. It helps prevent credential leaks from reaching production or being exploited, directly improving the security posture of your codebase.

Answer

GitHub Pages

Answer

Branch protection rules

Question 10

Your organization uses Azure DevOps Services. The development team uses feature branches and pull requests to merge changes into the main branch. You need to implement a policy that ensures every pull request has at least two approvals from the 'Senior Developers' group, and the build must succeed before merging. Additionally, any comment on the pull request must be resolved before merging. The policy should apply to the main branch only. You have already created the 'Senior Developers' group in Azure DevOps. What should you do?

Accepted Answer

Add a branch policy on the main branch that requires a minimum of two reviewers from 'Senior Developers', a successful build, and that all comments are resolved.. Azure DevOps branch policies allow you to enforce specific requirements on pull requests targeting a branch. By configuring a branch policy on the main branch, you can require a minimum number of reviewers from a specific group (e.g., 'Senior Developers'), a successful build, and that all comments are resolved before merging. This directly meets all the stated requirements.

Answer

Configure the team's settings to require approvals for all pull requests.

Answer

Set up a build validation policy on the main branch that runs the pipeline and fails if comments are unresolved.

Answer

Configure the repository's pull request settings to require approvals and comment resolution.

Question 11

Refer to the exhibit. An Azure CLI command outputs the configuration of an Azure Web App. Your pipeline deploys to this Web App using the 'AzureWebApp@1' task. The deployment fails with an error indicating that the runtime stack is not supported. What is the most likely cause?

Accepted Answer

The runtime stack (DOTNETCORE|6.0) is not compatible with the deployed application.. The error 'runtime stack is not supported' indicates that the Azure Web App's configured runtime stack (DOTNETCORE|6.0) does not match the application being deployed. The AzureWebApp@1 task uses the Web App's stack setting to determine how to deploy and run the code; if the deployed app requires a different runtime (e.g., .NET 8.0 or a non-.NET framework), the deployment fails. Option C correctly identifies this mismatch as the root cause.

Answer

The Web App is not a Linux app.

Answer

The ASPNETCORE_ENVIRONMENT setting is incorrect.

Answer

The resource group name is incorrect.

Question 12

Refer to the exhibit. You run the Azure CLI command to trigger a pipeline run. The pipeline fails because tests were skipped but should have run. What is the most likely issue?

Accepted Answer

The JSON value for skipTests must be a boolean without quotes.. The Azure DevOps CLI `az pipelines run` supports `--variables` and `--parameters` but not `--variables-parameters`. If that invalid flag were used, the command would fail before any pipeline run is triggered. The symptom says the pipeline ran and skipped tests, which is typically caused by passing `skipTests` as a string value (e.g., `"false"`) rather than a boolean `false`. In Azure DevOps, pipeline variables are strings, so a value of `'false'` is interpreted as a non-empty string and evaluated as `true` in conditional logic. For runtime parameters of type boolean, the correct syntax is `--parameters '{"skipTests":false}'` (value without quotes).

Answer

The pipeline name is incorrect.

Answer

The command uses a flag '--variables-parameters' which is not a valid Azure DevOps CLI option.

Answer

The branch 'feature/new-feature' does not exist.

Question 13

You are designing a release pipeline for a .NET Core application that must comply with regulatory requirements. The pipeline must sign the assembly with a code-signing certificate stored in Azure Key Vault. Which THREE actions should you perform?

Accepted Answer

Add a step to download the certificate from Key Vault using the AzureKeyVault task.. Option A is correct because the AzureKeyVault task (AzureKeyVault@2) is the supported pipeline task for retrieving secrets, including a code-signing certificate, from an Azure Key Vault so the certificate can be used during the build. Option B is correct because after the assembly is built, a script or command-line step must invoke a signing tool such as signtool.exe with the certificate to apply the code-signing signature to the .NET Core assembly. Option C is correct because the Azure Pipelines service principal (or the identity running the pipeline) must be granted access to the Key Vault, typically via an access policy or Azure RBAC role such as Key Vault Secrets User, otherwise the AzureKeyVault task cannot retrieve the certificate. Option D is not correct because storing the certificate in a secure file in the build artifact does not satisfy the requirement to use a certificate stored in Azure Key Vault and can expose the private key in the artifact. Option E is not correct because packaging before signing would leave the package unsigned; signing must occur on the assembly before it is packaged so the signature is included in the final artifact.

Answer

Store the certificate in a secure file in the build artifact.

Answer

Package the application before signing to avoid signature corruption.

Question 14

A DevOps engineer needs to ensure that only approved Azure Resource Manager (ARM) templates are used for deployments. They want to enforce this at the subscription level. Which Azure service should they use?

Accepted Answer

Azure Policy. Azure Policy is the correct service because it allows you to create, assign, and manage policies that enforce specific rules on your Azure resources. You can define a custom policy to audit or deny resources that do not contain metadata indicating they were deployed from an approved ARM template. Azure Policy evaluates all resource creation and update requests against these rules, blocking or auditing non-compliant deployments at the subscription level. RBAC only controls who can deploy, not what is deployed; Azure Blueprints packages templates but does not enforce their exclusive use.

Answer

Azure Role-Based Access Control (RBAC)

Answer

Azure Blueprints

Answer

Azure Management Groups

Question 15

Refer to the exhibit. A team wants to release version 1.0 from the main branch. They notice that the tag v1.0 is already on the current main commit. However, they also see that the origin/feature/experiment branch has commits that are not merged into main. What is the most likely scenario?

Accepted Answer

The experiment branch contains experimental work that was not intended for release; the tag v1.0 correctly marks the release on main.. The tag v1.0 sits on the current main commit, and the experiment branch has unmerged commits — this is the normal, expected state when experimental work is intentionally kept out of a release. Tags mark specific commits as release points; they do not require every branch to be merged. The most likely scenario is that the experiment branch is exploratory work not destined for v1.0, so the tag correctly identifies the release commit on main.

Answer

The team should delete the experiment branch because it is not merged.

Answer

The tag v1.0 was applied to the wrong commit; it should be on the merge commit of the experiment branch.

Answer

The main branch is missing the experiment branch commits; a merge is required before release.