AZ-400 Practice Test 49 — 15 Questions

Question 1

Your organization is adopting GitHub Copilot and wants to ensure that no proprietary code is used to train models. Which setting should you configure in the GitHub organization?

Accepted Answer

Opt out of allowing GitHub to use code snippets for product improvement.. GitHub provides an organization-level setting to opt out of allowing GitHub to use code snippets for product improvement, which prevents Copilot from training on that code. Option A is incorrect because secret scanning is unrelated to model training. Option B is incorrect because Dependabot alerts focus on dependency vulnerabilities, not data usage. Option C is incorrect because disabling Copilot prevents its use but does not address the underlying data usage for training; the organization may still want to use Copilot while preventing training on proprietary code.

Answer

Enable secret scanning.

Answer

Enable Dependabot alerts.

Answer

Disable GitHub Copilot for the organization.

Question 2

You are designing a build pipeline for a .NET Core application. You need to ensure that the pipeline restores NuGet packages from both an Azure Artifacts feed and the public NuGet gallery. The pipeline must fail if a package is not found in either source. Which two actions must you take? (Select two.)

Accepted Answer

Create a NuGet.config file that includes both feeds as package sources and reference it in the restore task.. Creating a NuGet.config file that includes both the Azure Artifacts feed and the public NuGet gallery as package sources, and referencing it in the restore task, ensures the pipeline consults both sources. Option D is incorrect because the 'CheckConsistency' flag is not related to failing on missing packages; the restore task already fails by default if a package cannot be resolved from any configured source. Options B, C, and E do not fulfill the requirement to fail on missing packages from both sources.

Answer

Set the 'NoWarn' property to NU1603 to ignore warnings about missing packages.

Answer

Use the 'dotnet restore' task with the '--no-cache' flag.

Answer

Set the 'CheckConsistency' flag to true in the restore task.

Answer

Configure the Azure Artifacts feed to use the public NuGet gallery as an upstream source.

Question 3

Your team uses a YAML-based build pipeline in Azure Pipelines. You need to ensure that the pipeline runs automatically when a pull request is created against the main branch, but only if the changes include modifications to the 'src/' directory. Which trigger configuration should you use?

Accepted Answer

trigger: none; pr: branches: include: - main paths: include: - src/*. It sets `trigger: none` to disable CI triggers on commits, and uses a PR trigger with `branches: include: - main` and `paths: include: - src/*` to ensure the pipeline only runs automatically when a pull request targets the main branch and the changes include modifications to the 'src/' directory. This configuration meets the requirement of conditional PR-triggered builds based on file paths.

Answer

trigger: - main; pr: none

Answer

trigger: none; pr: - main

Answer

pr: - main; trigger: - main

Question 4

Your organization uses Azure Pipelines to build a large monolithic application. The build takes over 60 minutes. Management wants to reduce the build time to under 30 minutes. The application has multiple independent modules that could be built in parallel. What is the most effective strategy to reduce build time?

Accepted Answer

Refactor the build pipeline to use multiple parallel jobs, each building a separate module.. The build time is dominated by sequential compilation of independent modules. By refactoring the pipeline to use multiple parallel jobs, each building a separate module, Azure Pipelines can leverage its built-in parallelism to reduce wall-clock time significantly. This directly addresses the root cause—lack of concurrency—without sacrificing code quality or infrastructure cost.

Answer

Reduce the number of unit tests run during the build.

Answer

Upgrade the build agent to a larger VM size with more CPU and memory.

Answer

Move the build to a self-hosted agent in the same network as the source code repository.

Question 5

Your team uses Azure Boards and has several work item types (Epic, Feature, User Story, Bug, Issue). They want to enforce a rule that bugs can only be linked to Features, not directly to Epics. Which TWO actions should you perform?

Accepted Answer

Customize the Epic work item type to remove the 'Child' link to Bug.. By customizing the Epic work item type to remove the 'Child' link type to Bug, you prevent any Bug from being linked as a child of an Epic. This enforces the rule that Bugs can only be linked to Features. Option E is correct because by customizing the Bug work item type to remove the 'Parent' link type to Epic, you prevent a Bug from having an Epic as its parent, which directly enforces the desired linking restriction.

Answer

Configure the Epic work item type to require a link to a Bug.

Answer

Use a work item rule to set the parent type to Feature when a Bug is created.

Answer

Add a rule to the Bug work item type that prohibits linking to Epics.

Question 6

Your company uses GitHub Actions to build and deploy a Python application. The workflow includes a job that runs on a self-hosted runner. You need to ensure that sensitive environment variables are not exposed in the workflow logs. What is the best approach?

Accepted Answer

Store secrets in GitHub repository secrets and reference them in the workflow.. GitHub repository secrets and environment secrets are both automatically masked in workflow logs when referenced via ${{ secrets.NAME }}. The best practice is to store sensitive variables in GitHub secrets and reference them in the workflow, rather than defining them directly in YAML or reading from a file. Option C correctly describes this approach.

Answer

Use a custom action to read secrets from a file.

Answer

Use GitHub environment secrets and mark the secret as sensitive to ensure it is masked in logs.

Answer

Define the variables directly in the workflow YAML.

Question 7

Which THREE practices improve the efficiency of code review processes in GitHub?

Accepted Answer

Enable required status checks to pass before merging.. Enabling required status checks ensures that automated tests, builds, or other validation steps must pass before a pull request can be merged. This enforces quality gates directly in the branch protection rules, preventing broken code from being merged and reducing manual review overhead.

Answer

Allow direct pushes to main for urgent fixes.

Answer

Require at least 5 reviewers for every PR.

Question 8

Your organization uses GitHub Actions for CI/CD. You need to ensure that secrets stored in GitHub are not exposed in build logs. A developer accidentally printed a secret to the console in a workflow step. How can you prevent this from happening in the future?

Accepted Answer

Enable 'Secret scanning' and 'Push protection' for the repository.. Enabling Secret scanning and Push protection for the repository helps prevent secrets from being exposed in build logs. Secret scanning can detect secrets when they are pushed or used in workflows, and Push protection blocks pushes containing secrets. Additionally, GitHub Actions automatically masks any string that matches a repository secret or organization secret if it appears in logs, but the developer accidentally printed it. Enabling these features provides proactive detection and prevention. Option B is incorrect because adding the secret to the exclusion list would allow it to be exposed. Option C is incorrect because echoing with `::set-output` still prints the value to logs. Option D is incorrect because the `actions/secrets` action does not exist; secrets are accessed via the `secrets` context.

Answer

Add the secret to the 'Secret scanning' exclusion list.

Answer

Instruct developers to avoid using 'echo' and use '::set-output' instead.

Answer

Use the 'actions/secrets' action to mask secrets automatically.

Question 9

Your organization uses Azure Key Vault to store secrets and certificates used in Azure Pipelines. You need to implement a security and compliance plan that ensures secrets are rotated automatically and access is audited. Which THREE actions should you take?

Accepted Answer

Enable soft-delete and purge protection on the Key Vault.. Enabling soft-delete and purge protection ensures deleted secrets and certificates can be recovered and permanent deletion is blocked, which is important for compliance and recovery. Using a managed identity for Azure Pipelines removes the need to store and rotate credentials, and each access is tied to a known identity, enabling access auditing. Configuring certificate auto-rotation with a specified lifetime ensures secrets are rotated automatically. Together, these actions address recovery, secure access, and automatic rotation as required.

Answer

Use a resource lock on the Key Vault to prevent deletion.

Answer

Use a Key Vault access policy to grant developers full access.

Question 10

Your organization uses GitHub Actions for CI/CD. You need to ensure that deployment to production only occurs after a successful deployment to a staging environment and requires approval from a senior developer. The deployment workflow is defined in a single YAML file. What is the most efficient way to achieve this?

Accepted Answer

Use two environments (staging and production) with required reviewers on the production environment, and use conditional steps to deploy to staging first.. GitHub Actions supports deployment environments with required reviewers. By defining separate 'staging' and 'production' environments, you can use a conditional step to deploy to staging first, and then require manual approval from a senior developer before the production deployment proceeds. This approach is built into GitHub Actions and does not require external webhooks or manual workflow triggers, making it the most efficient and secure method.

Answer

Add a step that pauses the pipeline until a manual approval is received via a custom webhook.

Answer

Use a workflow_dispatch trigger and require the senior developer to manually run the production deployment.

Answer

Use a build matrix to run staging and production deployments in parallel.

Question 11

Your company uses Microsoft Sentinel for security monitoring. Azure DevOps pipelines deploy resources to production. You need to create an automated response that triggers when Sentinel detects a high-severity alert related to unauthorized pipeline changes. The response should temporarily disable the service connection used by the pipeline and notify the security team. What should you do?

Accepted Answer

Create a Sentinel playbook using Azure Logic Apps that calls the Azure DevOps REST API to update the service connection status.. Sentinel playbooks (based on Azure Logic Apps) can automate responses to alerts, including calling the Azure DevOps REST API to disable a service connection. Option A is incorrect because an analytics rule with automated response can send notifications but cannot directly interact with Azure DevOps to disable a connection. Option B is incorrect because Azure DevOps service hooks trigger on pipeline events, not on Sentinel alerts. Option C is incorrect because Azure Policy can prevent changes to service connections but cannot disable an existing active service connection.

Answer

Configure a Sentinel analytics rule with the alert and use automated response to send an email.

Answer

Set up an Azure DevOps service hook that triggers on pipeline events.

Answer

Use Azure Policy to deny changes to service connections.

Question 12

Your team uses a multi-stage YAML pipeline in Azure Pipelines. The pipeline includes a stage that runs integration tests against a test environment. You want to ensure that the integration tests are not affected by other pipelines that deploy to the same environment concurrently. What should you implement?

Accepted Answer

Set the environment's 'Exclusive lock' check to enabled.. The 'Exclusive lock' check on an environment ensures that only one pipeline deployment can use that environment at a time. When enabled, Azure Pipelines will queue any other pipeline runs that target the same environment, preventing concurrent deployments that could interfere with integration tests. This directly addresses the requirement to avoid conflicts from parallel deployments.

Answer

Set the pipeline's 'Maximum number of parallel deployments' to 1.

Answer

Configure a required template check on the environment.

Answer

Add a manual approval check on the environment.

Question 13

Your team uses Azure Pipelines to deploy a web app to Azure App Service. The deployment uses the 'AzureWebApp@1' task with a deployment slot. You need to ensure that after a successful deployment to the staging slot, the slot swap happens automatically and the staging slot is warmed up before the swap. Which configuration should you use?

Accepted Answer

Set the 'Slot' parameter to 'staging' and enable 'Swap with production' in the task.. The 'AzureWebApp@1' task includes a 'Swap with production' checkbox that, when enabled, automatically performs a slot swap after the deployment to the specified slot (e.g., staging) completes. This ensures the staging slot is warmed up by the deployment process before the swap, as the swap operation respects the warm-up phase of the target slot, preventing downtime and ensuring the production slot receives a fully initialized application.

Answer

Use the 'Azure App Service manage' task to swap slots after deployment.

Answer

Use the 'Azure CLI' task to run 'az webapp deployment slot swap' after deployment.

Answer

Configure the deployment task to deploy to staging and then use a separate task to swap.

Question 14

Your organization uses Microsoft Defender for Cloud to monitor Azure resources. The compliance team needs to ensure that all Azure DevOps projects have their pipelines scanned for security issues before deployment. Which integration should you use?

Accepted Answer

Enable GitHub Advanced Security for Azure DevOps in Microsoft Defender for Cloud.. Enabling GitHub Advanced Security for Azure DevOps in Microsoft Defender for Cloud allows Defender for Cloud to ingest security alerts from Azure DevOps repositories and pipelines, including secret scanning, code scanning, and dependency scanning. This integration ensures that all Azure DevOps projects are monitored for security issues before deployment, meeting the compliance team's requirement for centralized visibility and enforcement.

Answer

Configure branch policies in Azure Repos to require a security scan.

Answer

Configure deployment gates in Azure Pipelines to require a security scan.

Answer

Use Azure Policy to enforce scanning on Azure DevOps pipelines.

Question 15

Which THREE practices are recommended for managing technical debt in a DevOps environment?

Accepted Answer

Allocate time for refactoring in each iteration. Options A, C, and D are correct because managing technical debt in a DevOps environment requires proactive and automated quality practices. Allocating time for refactoring each iteration (A) prevents debt accumulation. Automating unit and integration tests (C) ensures early detection of regressions and quality issues. Integrating static code analysis into the CI pipeline (D) provides continuous feedback on code quality and debt indicators. Option B is incorrect because deferring unit tests increases technical debt by delaying detection. Option E is incorrect because ignoring low-priority code smells allows debt to grow, which should be tracked and addressed systematically.

Answer

Defer unit tests until after deployment

Answer

Ignore low-priority code smells