AZ-400 Practice Test 48 — 15 Questions

Question 1

You are debugging a production issue using Application Insights Snapshot Debugger. The exhibit shows a snapshot from a NullReferenceException. The variable _dbContext is null. What is the most likely root cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The DbContext is not registered in the dependency injection container.. In ASP.NET Core, when a constructor-injected service like a DbContext is null at runtime, the most likely root cause is that the service (the DbContext) has not been registered in the dependency injection container. Page models themselves do not require registration. The missing null check (Option D) is a symptom, not the root cause, and the other options are unrelated.

Answer

The call to the database is not awaited, causing a race condition.

Answer

The database connection string is invalid in appsettings.json.

Answer

The OnGet method is missing a null check for _dbContext before usage.

Question 2

You have a YAML pipeline that uses a multi-stage build. You want to cache the restored NuGet packages across builds to improve performance. Which caching strategy should you use?

Accepted Answer

Use the Cache@2 task with key: 'nuget | "$(Agent.OS)" | packages.lock.json', path: '$(System.DefaultWorkingDirectory)/packages'. The Cache@2 task is the recommended way to cache NuGet packages in Azure Pipelines. By using a cache key that includes the agent OS and the packages.lock.json file, the cache is invalidated only when the lock file changes, ensuring restored packages are reused across builds. The path points to the NuGet global packages folder, which is typically $(System.DefaultWorkingDirectory)/packages when NUGET_PACKAGES is set.

Answer

Use the NuGetCommand@2 task with the -Cache argument.

Answer

Set the NUGET_PACKAGES environment variable to a custom path and rely on pipeline caching plugin.

Answer

Use the DotNetCoreCLI@2 task with the --no-restore flag and manually copy packages.

Question 3

Refer to the exhibit. You have a YAML pipeline with the above steps. The pipeline publishes a web app and deploys to Azure App Service. The deployment fails with error: 'Could not find the package in the specified path.' What is the most likely cause?

Accepted Answer

The package path is wrong; the zip file is in $(Build.ArtifactStagingDirectory).. The error 'Could not find the package in the specified path' indicates that the AzureWebApp task is looking for a deployment package (typically a .zip file) at a path that does not exist. In the exhibit, the `dotnet publish` command outputs to `$(Build.ArtifactStagingDirectory)`, but the subsequent AzureWebApp task likely references a different path (e.g., `$(System.DefaultWorkingDirectory)` or a hardcoded path). The correct path should be `$(Build.ArtifactStagingDirectory)/**/*.zip` to match the published artifact. Option A correctly identifies this path mismatch as the root cause.

Answer

The AzureWebApp task input 'appType' is incorrect.

Answer

The dotnet publish command did not generate a zip file.

Answer

The service connection 'MyServiceConnection' is not authorized.

Question 4

You have a multi-stage YAML pipeline that deploys to a Linux-based Azure App Service. The pipeline uses a 'Deploy to Azure App Service' task. You need to ensure that the deployment uses the Kudu REST API with ZIP deployment. Which value should you set for the 'packageForLinux' task input?

Accepted Answer

Set 'packageForLinux' to true. The 'packageForLinux' input must be set to 'true' to force the 'Deploy to Azure App Service' task to use the Kudu REST API with ZIP deployment when targeting a Linux-based Azure App Service. This is required because Linux App Services do not support WebDeploy (MSDeploy) and rely on the Kudu endpoint for ZIP-based deployments.

Answer

Set 'enableCustomDeployment' to true

Answer

Set 'useWebDeploy' to false

Answer

Set 'enableKuduDeploy' to true

Question 5

Your team uses Azure Pipelines for CI/CD. You need to enforce that all pipeline runs use approved agents from a specific agent pool with the latest security patches. The agents are self-hosted on Azure VMs. What should you implement?

Accepted Answer

Add a demand on the agent for a custom capability that only approved agents have. By adding a demand for a custom capability (e.g., 'SecurityPatchLevel = latest') on the pipeline, only agents that possess that capability can run the pipeline. This allows you to enforce that only approved, patched agents are used. Option C is incorrect because 'setting an agent pool to use a specific agent queue with an isolation scope' is not a recognized Azure Pipelines feature; agent pools use demands, not isolation scopes, to filter agents. Options A and B are also incorrect because configuring pool permissions or creating a deployment pool does not enforce that only agents with specific patches are used; they only control access or assignment but not the selection logic based on capabilities.

Answer

Configure pipeline permissions for the agent pool

Answer

Create a deployment pool and assign the agents to it

Answer

Set the agent pool to use a specific agent queue with an isolation scope

Question 6

Your organization uses GitHub Enterprise and wants to enforce that all repositories have a specific issue template. What is the most scalable way to achieve this?

Accepted Answer

Create a global issue template in the organization settings.. GitHub Enterprise allows organization owners to create a global issue template by placing a `.github/ISSUE_TEMPLATE/` directory in the `.github` repository. This template is automatically applied to all repositories within the organization, ensuring consistency without manual intervention per repo. This is the most scalable approach as it centralizes enforcement at the organization level.

Answer

Use a script to periodically check and add templates.

Answer

Create a repository template and require all new repos to use it.

Answer

Configure a CODEOWNERS file in each repository.

Question 7

Your team uses GitHub for source control and GitHub Actions for CI/CD. Security policy requires that all code changes must be signed by a verified contributor using a GPG key. You need to enforce this requirement at the organization level. However, some developers use SSH keys for authentication, and you want to allow them to continue. What should you do?

Accepted Answer

Add a branch protection rule for the default branch requiring signed commits.. Adding a branch protection rule for the default branch that requires signed commits enforces that all commits to that branch must be signed with a verified GPG key. While this does not apply to the entire organization, it is the standard method to enforce signing on the most critical branch. Option A is incorrect because GitHub does not have an organization setting to 'Require SSH keys for authentication'; the setting mentioned is not valid. Option B is incorrect because S/MIME signing via Microsoft Entra ID is not a native GitHub enforcement for commits. Option D is incorrect because a GitHub Action would only reject unsigned commits after they are pushed, not prevent them from being pushed.

Answer

In GitHub organization settings, enable 'Require signed commits' and 'Require SSH keys for authentication'.

Answer

Enforce S/MIME signing via Microsoft Entra ID Conditional Access.

Answer

Configure a GitHub Action that rejects unsigned commits in CI.

Question 8

Your organization uses GitHub and wants to implement a policy that requires all pull requests to be approved by at least two members of the 'security-team' team before merging. The 'security-team' team is a child team of 'engineering'. Which branch protection rule setting should you use?

Accepted Answer

Use the 'Require pull request reviews before merging' rule and set 'Required reviewers' to the security team.. 'Require pull request reviews before merging' with 'Required reviewers' set to the security team. This configuration enables branch protection to enforce reviews from that specific team. To require approval from at least two members, you must also set the 'Required number of reviewers' to 2 within the same branch protection rule. Option A is unrelated to reviewer requirements. Option C only sets a minimum number of reviewers without specifying which team, so it could allow any approver. Option D requires a CODEOWNERS file and only applies to file patterns owned by the team, not all pull requests. Therefore, B is the foundational setting needed to achieve the policy.

Answer

Enable 'Dismiss stale pull request approvals when new commits are pushed'.

Answer

Require a minimum number of reviewers and set it to 2.

Answer

Require code owner review and add the security team as code owners.

Question 9

Which TWO are valid ways to pass build artifacts from one stage to another in a multi-stage YAML pipeline in Azure Pipelines?

Accepted Answer

Use the Publish Pipeline Artifact task in the first stage and Download Pipeline Artifact task in the second stage.. The Publish Pipeline Artifact task in the first stage makes the artifact available to the pipeline, and the Download Pipeline Artifact task in the second stage explicitly retrieves it. This is the standard, supported method for passing artifacts between stages in a multi-stage YAML pipeline. Option D is also correct because the Copy Files task can copy artifacts to a shared network drive accessible by subsequent stages, which is a valid alternative method. Options A and C are incorrect: A is wrong because published pipeline artifacts are not automatically available without a download task; C is wrong because the Publish/Download Build Artifacts tasks are legacy and not the recommended way for multi-stage YAML pipelines, and they do not work seamlessly across stages without additional configuration.

Answer

Use the Pipeline Artifact task to publish artifacts, which are automatically available to subsequent stages without download.

Answer

Use the Publish Build Artifacts task and then the Download Build Artifacts task.

Answer

Define variables in the first stage and reference them in the second stage.

Question 10

Your organization uses Azure Pipelines to manage infrastructure as code with Terraform. The pipeline runs terraform plan and apply. You need to ensure that the state file is stored securely and can be locked to prevent concurrent modifications. What should you configure?

Accepted Answer

Use the Terraform Cloud backend with remote operations.. Both Azure Storage backend (D) and Terraform Cloud backend (B) satisfy the requirement of secure state storage and locking. Azure Storage uses blob leases; Terraform Cloud uses its own locking mechanism. The original explanation only justifies D but does not explain why B is incorrect, and it cannot be considered incorrect as written.

Answer

Store the state file in a Git repository with LFS.

Answer

Store the state file in Azure Pipelines secure files.

Question 11

During a release pipeline, you notice that the deployment to staging fails intermittently due to a timeout waiting for the health check endpoint to return 200. The health check typically passes within 30 seconds, but occasionally takes up to 2 minutes. You need to make the deployment more reliable without affecting the overall release time. What should you do?

Accepted Answer

Increase the health check timeout in the pipeline task to 3 minutes.. Increasing the health check timeout to 3 minutes accommodates the occasional 2-minute delay without failing the deployment. Since the health check typically passes within 30 seconds but can take up to 2 minutes, a 3-minute timeout ensures the pipeline waits long enough for the endpoint to return HTTP 200, making the deployment more reliable without adding extra retry cycles or changing the overall release time.

Answer

Remove the health check from the pipeline and rely on monitoring.

Answer

Add a retry task that runs the health check again after a failure.

Answer

Reduce the health check timeout to 10 seconds to fail fast and trigger a rollback.

Question 12

You manage a release pipeline for a Java application that is deployed to Azure App Service. The pipeline currently uses manual approval gates. You need to implement automated quality gates to reduce manual intervention. Which THREE conditions can you use in the 'Post-deployment approvals' settings of a release pipeline? (Choose three.)

Accepted Answer

Invoke Azure Functions. 'Invoke Azure Functions' is a valid gate type in Azure DevOps release pipelines. It allows you to call an Azure Function as a quality gate, enabling custom automated checks (e.g., validating deployment health or running custom logic) without manual intervention. This directly supports the goal of reducing manual approvals by automating post-deployment validation.

Answer

Azure Policy

Answer

Manual approval

Question 13

Which THREE measures should be implemented to protect secrets in Azure Pipelines? (Choose three.)

Accepted Answer

Restrict which pipelines can access the variable group. Restricting which pipelines can access a variable group ensures that only authorized pipelines can use secrets stored in that group, preventing unauthorized access or accidental exposure. This is a key security measure in Azure Pipelines to enforce the principle of least privilege.

Answer

Log secret values to pipeline console for debugging

Answer

Store secrets in code as environment variables

Question 14

You are designing a release pipeline for a .NET Core application that must comply with regulatory requirements. The pipeline must sign the assembly with a code-signing certificate stored in Azure Key Vault. Which THREE actions should you perform?

Accepted Answer

Add a step to download the certificate from Key Vault using the AzureKeyVault task.. The AzureKeyVault task can download the certificate from Azure Key Vault. Option B is correct because after downloading the certificate, a script task like signtool.exe must be used to sign the assembly. Option C is correct because the Azure Pipelines service principal must be granted access to the Key Vault to retrieve the certificate. Option D is incorrect because the certificate should not be stored in a secure file in the build artifact; it should remain in Key Vault for security. Option E is incorrect because signing should occur before packaging; packaging after signing is typical to avoid corruption.

Answer

Store the certificate in a secure file in the build artifact.

Answer

Package the application before signing to avoid signature corruption.

Question 15

A team is migrating from TFVC to Git in Azure Repos. They have a large repository with a history of 10,000+ commits. They want to preserve the full history while minimizing migration time. Which approach should they recommend?

Accepted Answer

Use git-tfs to clone the TFVC repository with full history, then push to Azure Repos.. Git-tfs is a specialized bridge tool that can clone a TFVC repository with full history into a local Git repository, preserving all commits, branches, and metadata. This approach minimizes migration time by performing the conversion locally without network overhead, after which the Git repo can be pushed to Azure Repos. Other methods either lose history or are not supported for TFVC-to-Git migration.

Answer

Check out the latest version from TFVC, initialize a new Git repo, and push.

Answer

Use the Azure Repos import repository feature to import from TFVC.

Answer

Clone the TFVC repository using Git and push to Azure Repos.