AZ-400 Practice Test 46 — 15 Questions

Question 1

Your team uses Azure Boards with a custom process. Which two features allow you to customize the work item types? (Choose two.)

Accepted Answer

Create an inherited process from the default process.. In Azure Boards, customization of work item types is only possible through an inherited process. You must create an inherited process from a default process (e.g., Agile, Scrum, CMMI) to enable any modifications. This ensures the default process remains unaltered and supports upgrade compatibility.

Answer

Configure rules to create new work item types.

Answer

Use team settings to define new work item types.

Answer

Modify the default process directly.

Question 2

Your Azure DevOps pipeline deploys a microservice to a Kubernetes cluster using Helm. The Helm chart requires a values file that contains environment-specific configurations. You want to store the values file securely and use it during deployment. What is the recommended approach?

Accepted Answer

Store the values file as a secure file in Azure Pipelines library.. Azure Pipelines Library's Secure Files feature allows storing files like Helm values securely and referencing them in pipeline tasks (e.g., HelmDeploy with the 'filePath' parameter). Option A is incorrect because variable groups store key-value pairs, not entire files. Option B is incorrect because the HelmDeploy task's 'overrideValues' parameter expects individual key-value overrides, not a file; Azure Key Vault is for secrets, but using it for a whole values file is not straightforward. Option D is incorrect because storing the values file in a separate Git repository still exposes it to source control, reducing security compared to Secure Files.

Answer

Store the values in a variable group and map them to Helm values.

Answer

Store the values file in Azure Key Vault and use the HelmDeploy task's 'overrideValues' parameter to set values.

Answer

Store the values file in a separate Git repository and clone it during the pipeline.

Question 3

Your team uses GitHub Enterprise and GitHub Actions for CI/CD. You need to implement a security compliance plan. The organization has the following requirements: 1) All code pushed to the main branch must be scanned for secrets and vulnerabilities. 2) Developers must use signed commits. 3) Only approved GitHub Actions can be used. 4) Dependencies must be scanned for vulnerabilities. You have enabled secret scanning and code scanning (CodeQL) on all repositories. You have configured branch protection rules to require signed commits using GPG keys. To restrict actions, you have set an allowed list of actions in the organization settings. You have enabled Dependabot alerts. However, during an audit, a reviewer notes that secret scanning alerts are not being reviewed within 30 days. You need to ensure that secret scanning alerts are triaged within 30 days. What should you do?

Accepted Answer

Assign secret scanning alerts to the security team using the 'Assign to' feature in the alerts view.. GitHub secret scanning allows you to assign alerts to specific team members using the 'Assign to' feature in the alerts view. This ensures that alerts are explicitly owned and triaged within the 30-day requirement. Option B is incorrect because webhooks merely send notifications; they do not guarantee that someone will review and triage the alert. Option C is incorrect because disabling secret scanning on any repository would violate the requirement to scan all code pushed to main branch. Option D is incorrect because automatically closing alerts after 30 days could hide legitimate secrets that require investigation, which fails the security compliance goal.

Answer

Set up a webhook to send secret scanning alerts to a security team's email.

Answer

Disable secret scanning on repositories that do not contain secrets.

Answer

Configure secret scanning to automatically close alerts after 30 days.

Question 4

You have a build pipeline that produces several artifacts. You need to publish these artifacts to Azure Artifacts feed, but only if the build succeeds. Which task should you add to the pipeline?

Accepted Answer

Add a 'Publish Build Artifacts' task and then a 'Universal Publish' task.. The 'Publish Build Artifacts' task makes the build outputs available as pipeline artifacts, and the 'Universal Publish' task is the correct way to publish those artifacts to an Azure Artifacts feed (which supports Universal Packages). This combination ensures artifacts are only published after the build succeeds because both tasks run in the pipeline's job sequence, and by default, subsequent tasks execute only if the previous task succeeded.

Answer

Add an 'npm publish' task to publish packages.

Answer

Add a 'Copy Files' task to copy artifacts to the feed location.

Answer

Add a 'NuGet push' task to push packages to the feed.

Question 5

Your team uses GitHub Flow and wants to ensure that every pull request is reviewed by at least one team member. Which branch protection rule should you enable?

Accepted Answer

Require a pull request before merging and set required number of reviewers to 1. GitHub Flow relies on pull requests for collaboration, and the 'Require a pull request before merging' rule with a required number of reviewers set to 1 enforces that every PR must be reviewed by at least one team member before it can be merged. This directly satisfies the requirement of ensuring code review for all changes.

Answer

Require signed commits

Answer

Require status checks to pass before merging

Answer

Require conversation resolution before merging

Question 6

You have a YAML pipeline that builds a Docker image and pushes it to Azure Container Registry (ACR). You need to ensure the pipeline uses the latest version of Docker and that the build is cached for faster subsequent runs. Which two tasks should you include? (Choose two.)

Accepted Answer

DockerInstaller@0. (DockerInstaller@0) is correct because it ensures the pipeline uses the latest version of Docker by installing or upgrading the Docker engine on the build agent. Option B (Docker@2 with --cache-from) is correct because it enables layer caching by pulling the previously built image from ACR as a cache source, which speeds up subsequent builds by reusing unchanged layers.

Answer

DockerCompose@0

Answer

HelmDeploy@0

Question 7

You are designing a release pipeline that must deploy to Azure App Service across multiple regions. Which two practices should you implement to minimize downtime during deployments? (Choose 2)

Accepted Answer

Use Azure App Service deployment slots and perform a swap. Azure App Service deployment slots allow you to deploy a new version of your application to a staging slot, perform validation, and then swap it into production with zero downtime. The swap operation warms up the target slot and smoothly transitions traffic, ensuring no requests are dropped during the update. Additionally, implementing a rolling deployment strategy across regions reduces the blast radius and allows you to gradually shift traffic, further minimizing downtime during multi-region updates.

Answer

Stop the web app before deploying, then start it after

Answer

Deploy to all regions simultaneously

Answer

Use a single deployment slot for all regions

Question 8

Your organization uses Azure Pipelines to deploy a web application to multiple Azure App Service instances across regions. You need to implement a deployment strategy that allows rolling back to the previous version quickly if issues are detected. Which TWO strategies should you recommend?

Accepted Answer

Use blue-green deployment with a traffic manager endpoint.. The correct answers are D and E. Blue-green deployment with a traffic manager endpoint allows you to quickly route traffic back to the previous version if issues are detected. Deploying to a staging slot and then swapping with production (slot swap) enables instant rollback by swapping back to the previous slot. Option A (rolling update) does not provide instant rollback because it requires redeployment. Option B (canary deployment) is designed for gradual traffic shifting, not immediate rollback. Option C (storing artifacts) is a good practice but does not itself constitute a deployment strategy for rollback.

Answer

Use a rolling update with incremental deployment.

Answer

Implement a canary deployment with traffic splitting.

Answer

Store previous deployment artifacts in Azure Blob Storage.

Question 9

You are designing a build pipeline for a Node.js application. The team wants to ensure that the pipeline runs unit tests and publishes test results to Azure DevOps. Which task should you add to the pipeline?

Accepted Answer

Publish Test Results task. The Publish Test Results task (A) is correct because it specifically ingests test result files (e.g., JUnit, NUnit, xUnit, or TRX formats) and publishes them to Azure DevOps, enabling test analytics, trend charts, and pass/fail reporting in the pipeline summary. For a Node.js application, after running unit tests with a framework like Jest or Mocha, the test results are typically output as JUnit XML files, and this task is required to make those results visible in the DevOps portal.

Answer

Copy Files task

Answer

npm test

Answer

Publish Build Artifacts task

Question 10

Your organization uses GitHub Actions for CI/CD. You need to ensure that secrets stored in GitHub Actions are not exposed in logs. A developer accidentally logs a secret using 'echo ${{ secrets.API_KEY }}' in a workflow step. What is the default behavior?

Accepted Answer

The secret value is masked with asterisks in the log output. GitHub Actions automatically masks secrets in workflow logs. When a secret is used in a step (e.g., via `${{ secrets.API_KEY }}`), GitHub replaces any occurrence of the secret's value in the log output with `***`. This redaction happens at runtime, so even if a developer accidentally echoes the secret, the log will show asterisks instead of the actual value.

Answer

The secret value is replaced with an empty string in the log

Answer

The workflow run fails with an error about secret exposure

Answer

The secret is redacted before the step runs, and the step fails if it tries to use the secret

Question 11

A development team is designing a build pipeline for a microservices application. They want to ensure that each service is built and tested independently, but they also need to run integration tests that span multiple services. What is the recommended approach?

Accepted Answer

Create individual build pipelines for each service, and a separate release pipeline that deploys all services to an integration environment for testing.. It aligns with microservices best practices: each service has its own build pipeline for independent compilation, unit testing, and artifact generation, while a separate release pipeline orchestrates deployment of all services to a shared integration environment for cross-service testing. This decouples build concerns from deployment concerns, enabling parallel development and faster feedback loops.

Answer

Use a single release pipeline that triggers manual deployment for each service.

Answer

Create a single build pipeline that builds all services together to ensure consistency.

Answer

Build each service separately, but skip integration tests to avoid complexity.

Question 12

Your team uses Azure Repos and wants to enforce that all commits to the release branch must be signed using GPG. Which branch policy should you enable?

Accepted Answer

Require signed commits. Azure Repos branch policies include a 'Require signed commits' setting that enforces GPG signature verification on all commits pushed to the branch. When enabled, any commit without a valid GPG signature is rejected, ensuring the integrity and authenticity of the commit author.

Answer

Limit merge types

Answer

Check for linked work items

Answer

Require a minimum number of reviewers

Question 13

Your team uses Azure Pipelines to deploy a web app. They want to automatically roll back the deployment if the post-deployment smoke tests fail. What is the recommended approach?

Accepted Answer

Use a deployment gate with a monitoring tool that automatically initiates a rollback if health check fails.. Azure Pipelines supports deployment gates that can integrate with monitoring tools (e.g., Azure Monitor, Application Insights) to evaluate health metrics after deployment. If the gate detects a failure (e.g., a smoke test health check fails), it can automatically trigger a rollback to the previous stable version, ensuring zero manual intervention and faster recovery.

Answer

Define an approval gate that requires manual sign-off after deployment.

Answer

Set up a manual intervention step in the pipeline to decide rollback.

Answer

Configure a release variable that toggles between deployment slots.

Question 14

Which TWO Git commands are commonly used to incorporate changes from a remote repository into your local branch while keeping history linear?

Accepted Answer

git pull --rebase. `git pull --rebase` (A) is correct because it fetches changes from the remote and then replays your local commits on top of the fetched commits, resulting in a linear history without merge commits. `git rebase` (E) is correct because it directly rewrites commit history by moving or combining a sequence of commits onto a new base, which can be used to incorporate remote changes linearly when combined with `git fetch`.

Answer

git fetch

Answer

git merge

Answer

git cherry-pick

Question 15

You are designing a release pipeline for a microservices application. Each service must be deployed independently with zero downtime. Which deployment strategy should you recommend?

Accepted Answer

Blue-green deployment. Blue-green deployment is the correct strategy because it maintains two identical environments (blue and green) and allows instant traffic switch to the new version while keeping the old version running, enabling zero-downtime deployment and immediate rollback if issues arise. This aligns with the requirement of independent deployment for each microservice. Option A (rolling update) is incorrect because it replaces instances gradually, which can cause version skew and does not provide instant rollback. Option B (feature flags) is a technique for feature toggling, not a deployment strategy; it does not handle traffic shifting or environment isolation. Option C (canary release) is incorrect because it routes a small subset of users to the new version, which does not guarantee immediate full zero-downtime deployment and requires gradual rollout and monitoring.

Answer

Rolling update

Answer

Feature flags

Answer

Canary release