AZ-400 Practice Test 50 — 15 Questions

Question 1

Your build pipeline uses a hosted agent. You need to securely pass a connection string to a deployment task. The connection string contains a password. What is the recommended approach to store and use this secret in Azure Pipelines?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Define the connection string as a secret variable in the pipeline's variable group or in the pipeline settings UI, and reference it as `$(connectionString)`.. The recommended approach is to define the connection string as a secret variable in the pipeline's variable group or in the pipeline settings UI, and reference it as $(connectionString). Secret variables are encrypted at rest and never exposed in logs or to other tasks. Option A is incorrect because plain variables are visible in logs and YAML. Option B is incorrect because hardcoding secrets in scripts is insecure and violates best practices. Option D, while secure, is overkill for a simple secret and requires additional configuration and permissions, making it less recommended for this scenario.

Answer

Define the connection string as a plain variable in the YAML pipeline.

Answer

Hardcode the connection string in the deployment script and set the file as read-only.

Answer

Store the connection string in Azure Key Vault and use the 'Azure Key Vault' task to retrieve it at runtime.

Question 2

You are deploying a web app to Azure App Service using Azure Pipelines. The security team requires that all secrets are stored in Azure Key Vault and retrieved at deployment time. What is the best approach?

Accepted Answer

Add an Azure Key Vault task in the pipeline to download secrets. The Azure Key Vault task in Azure Pipelines directly downloads secrets from Key Vault as pipeline variables at deployment time, ensuring secrets are never stored in the pipeline definition or source control. This meets the security team's requirement for retrieving secrets at deployment time without exposing them in logs or build artifacts.

Answer

Store secrets in pipeline variables and mark them as secret

Answer

Use Variable Groups linked to Key Vault

Answer

Reference Key Vault secrets directly in App Service configuration

Question 3

Your DevOps team is using Microsoft Defender for Cloud to monitor Azure resources. Which of the following is a security recommendation that Defender for Cloud might provide?

Accepted Answer

Enable Transparent Data Encryption (TDE) on SQL databases. Microsoft Defender for Cloud provides security recommendations based on best practices and compliance frameworks. Enabling Transparent Data Encryption (TDE) on SQL databases is a standard security recommendation because it encrypts data at rest, protecting against unauthorized access to the physical database files. This aligns with the 'Develop a security and compliance plan' domain, as TDE helps meet regulatory requirements like GDPR or HIPAA.

Answer

Allow all inbound traffic on port 22 for SSH

Answer

Disable auditing on storage accounts to reduce overhead

Answer

Configure web apps to use HTTP instead of HTTPS

Question 4

Which TWO of the following are valid strategies to securely store and use secrets in Azure Pipelines?

Accepted Answer

Link a variable group to Azure Key Vault and reference variables in the pipeline.. Azure Pipelines allows you to link a variable group to Azure Key Vault, enabling secure retrieval of secrets as pipeline variables without exposing them in YAML or logs. This integration uses Azure Key Vault's access policies and managed identities to authenticate, ensuring secrets are never stored in the pipeline definition.

Answer

Use the 'secret' variable type in YAML and hardcode the value.

Answer

Store secrets in a text file in the repository and use a script to read them.

Answer

Use encrypted environment variables in GitHub Actions.

Question 5

Your team uses Azure DevOps and wants to implement a change management process where all production releases must be approved by a change advisory board (CAB) after the build is complete but before deployment. The approval must be recorded in the pipeline. What is the best approach?

Accepted Answer

Create a release pipeline with a pre-deployment approval gate for the production stage.. A release pipeline with a pre-deployment approval gate for the production stage enforces that a designated approver (or group, such as the CAB) must approve the release before deployment begins. The approval is recorded in the pipeline's audit trail, satisfying the requirement for documented change management. This approach aligns with Azure DevOps release management best practices for gating production deployments.

Answer

Configure a branch policy requiring CAB member approval on pull requests.

Answer

Add a manual intervention task in the YAML pipeline.

Answer

Set up a service hook to send an email to the CAB and wait for a reply.

Question 6

You are designing a communication strategy for a large Azure DevOps migration. The team is distributed across multiple time zones. Which approach best supports asynchronous collaboration?

Accepted Answer

Maintain a wiki in Azure DevOps with status and decisions.. Maintaining a wiki in Azure DevOps provides a persistent, searchable, and asynchronous record of status and decisions, which is ideal for distributed teams across time zones. Option A is wrong because Slack huddles are real-time and require synchronous participation. Option C is wrong because email threads can be hard to search and lack integration with Azure DevOps. Option D is wrong because daily standup meetings at a fixed time require synchronous attendance. Option E is wrong because recording meetings is passive and not easily searchable; the information is not structured for quick reference.

Answer

Use Slack huddles for quick sync-ups.

Answer

Use email threads for status updates.

Answer

Schedule daily standup meetings at a fixed time.

Answer

Record all team meetings and share links.

Question 7

Your team uses GitHub Actions for CI/CD. You want to securely store a database connection string used in a workflow. Where should you store it?

Accepted Answer

GitHub Secrets.. GitHub Secrets is the correct choice because it provides encrypted storage for sensitive data like database connection strings. When you store a value in GitHub Secrets, it is encrypted via libsodium before being stored, and it is only exposed to GitHub Actions workflows as an environment variable or input when explicitly referenced. This prevents the secret from being logged or leaked in the workflow output, unlike other storage methods that risk exposure.

Answer

Workflow environment variables.

Answer

Directly in the workflow YAML.

Answer

In a configuration file committed to repo.

Question 8

You are implementing a release pipeline with multiple stages. You want to automatically trigger the next stage only if the previous stage succeeds and the build is from the 'main' branch. Which TWO conditions should you configure?

Accepted Answer

Add a condition that checks if the source branch is 'main'.. The correct answers are A and B. To automatically trigger the next stage only when the previous stage succeeds and the build is from the 'main' branch, you need two configurations: first, set the stage trigger to 'After stage' and select the previous stage (option B), which ensures the stage runs after the previous stage completes successfully. Second, add a condition that checks the source branch—Option A correctly identifies this need, though the exact expression should be `eq(variables['Build.SourceBranch'], 'refs/heads/main')`. Option D is incorrect because `succeeded()` only checks that all previous stages succeeded but does not enforce the branch condition. Option C is wrong due to incorrect syntax (missing 'refs/heads/'). Option E is also incorrect because the syntax shown is not correct; the correct syntax requires 'refs/heads/main'.

Answer

Add a condition: 'eq(variables['Build.SourceBranch'], 'main')' to the stage.

Answer

Add a condition: 'succeeded()' to the stage.

Answer

Add a condition: 'eq(variables['Build.SourceBranch'], 'main')' with correct syntax.

Question 9

A team wants to enforce that all Azure resource groups in a subscription are tagged with 'CostCenter' and 'Environment'. They need a solution that automatically applies these tags to any new resource group and ensures compliance without manual intervention. What should they use?

Accepted Answer

Azure Policy. Azure Policy is the correct choice because it allows you to define and enforce tagging rules at scale. By creating a policy that requires 'CostCenter' and 'Environment' tags on resource groups, and setting the policy effect to 'deny' or 'append' (to automatically add missing tags), any new resource group creation that violates the policy is blocked or automatically remediated, ensuring compliance without manual intervention.

Answer

Azure RBAC

Answer

Azure Blueprints

Answer

Azure Resource Graph

Question 10

Refer to the exhibit. You are reviewing a branch protection rule for the main branch of a GitHub repository. A developer complains that after pushing new commits to an existing pull request, the existing approvals from two reviewers are dismissed, and the pull request cannot be merged even though the CI checks pass. What is the most likely cause?

Accepted Answer

The 'dismiss_stale_reviews' setting is enabled, which dismisses approvals when new commits are pushed.. The 'dismiss_stale_reviews' setting in GitHub branch protection rules automatically dismisses existing pull request approvals when new commits are pushed to the branch. This explains why the developer sees approvals removed after pushing new commits, even though CI checks pass. The setting is designed to ensure that reviewers re-evaluate changes after updates.

Answer

The 'strict' setting requires the branch to be up to date with the base branch, which is not the case.

Answer

The code owner review is required but no code owner has reviewed.

Answer

The CI check 'continuous-integration/jenkins/pr-merge' failed.

Question 11

You are designing a release pipeline for a critical business application that must adhere to strict compliance requirements. The pipeline must deploy to multiple environments (dev, test, staging, prod) with manual approvals required for staging and prod. Additionally, the pipeline must automatically run integration tests after deployment to dev and test, and only proceed to the next environment if tests pass. You need to implement this using Azure Pipelines YAML. What should you do?

Accepted Answer

Use a single multi-stage YAML pipeline with a stage per environment. Add a job after deployment to dev that runs integration tests, and use a condition on the next stage to run only if tests passed. Add approvals on staging and prod stages.. It uses a single multi-stage YAML pipeline with a stage per environment, adds a job after deployment to dev that runs integration tests, uses a condition on the next stage to run only if tests passed, and adds approvals on staging and prod stages. This satisfies all requirements: sequential deployment, conditional test execution, and manual approvals. Option A is incorrect because it lacks the conditional test execution; after deployment to dev, the pipeline would proceed to test regardless of test results. Option B is incorrect because separate pipelines with completion triggers cannot enforce the required conditions (run tests and only proceed if passed) and cannot easily add approvals per environment. Option C is incorrect because it describes a classic release pipeline, which does not support YAML-based definitions and cannot easily integrate conditional test execution with stage dependencies.

Answer

Use a single multi-stage YAML pipeline with a stage per environment. Add approvals on staging and prod stages. Ensure stages run sequentially by default.

Answer

Create separate YAML pipelines for each environment and use pipeline completion triggers to chain them together.

Answer

Use a classic release pipeline with environments and pre-deployment approvals on staging and prod. Add a post-deployment task to run integration tests in dev and test environments.

Question 12

You are designing a build pipeline for a Python application that uses multiple third-party packages from the public PyPI repository. Your organization has security policies that require all build dependencies to be scanned for known vulnerabilities before being used. The build pipeline runs on Microsoft-hosted agents. You need to integrate vulnerability scanning into the build pipeline with minimal overhead and without storing credentials in the pipeline. What should you do?

Accepted Answer

Add a dependency scanning task from the Azure DevOps marketplace to the build pipeline.. The correct approach is to add a dependency scanning task from the Azure DevOps marketplace to the build pipeline. These tasks, such as WhiteSource Bolt or Snyk, integrate seamlessly with Azure Pipelines, automatically scan dependencies from PyPI for known vulnerabilities, and require no credential storage in the pipeline. Option A is incorrect because connecting to a private vulnerability database adds unnecessary complexity and overhead. Option B is incorrect because using a custom script with pip audit would require maintaining the script and potentially storing credentials for external services. Option C is incorrect because manual review is not automated and defeats the purpose of a CI/CD pipeline.

Answer

Configure a service connection to a private vulnerability database and use a script to scan.

Answer

Write a custom script that uses pip audit to scan the requirements.txt file.

Answer

Use a pre-build validation step in the pipeline to manually review dependencies.

Question 13

You are designing a release pipeline for a critical application that must minimize downtime during deployment. The application runs on Azure Kubernetes Service (AKS) and uses Azure SQL Database. Which deployment strategy should you recommend?

Accepted Answer

Blue-green deployment with traffic manager.. Blue-green deployment with Traffic Manager is recommended because it allows you to maintain two identical environments (blue and green) and instantly switch traffic between them via Azure Traffic Manager. This minimizes downtime to the time it takes to update DNS or routing rules, and provides immediate rollback capability by switching back to the previous environment. For a critical application on AKS with Azure SQL Database, this strategy avoids the complexity of managing state during rolling updates and ensures zero-downtime cutover.

Answer

Rolling update with health probes.

Answer

Canary deployment with progressive exposure.

Answer

Recreate deployment by deleting the old version first.

Question 14

Refer to the exhibit. An Azure CLI command outputs the configuration of an Azure Web App. Your pipeline deploys to this Web App using the 'AzureWebApp@1' task. The deployment fails with an error indicating that the runtime stack is not supported. What is the most likely cause?

Accepted Answer

The runtime stack (DOTNETCORE|6.0) is not compatible with the deployed application.. The error 'runtime stack is not supported' indicates that the Azure Web App's configured runtime stack (DOTNETCORE|6.0) does not match the application being deployed. The AzureWebApp@1 task uses the Web App's stack setting to determine how to deploy and run the code; if the deployed app requires a different runtime (e.g., .NET 8.0 or a non-.NET framework), the deployment fails. Option C correctly identifies this mismatch as the root cause.

Answer

The Web App is not a Linux app.

Answer

The ASPNETCORE_ENVIRONMENT setting is incorrect.

Answer

The resource group name is incorrect.

Question 15

Which TWO actions should you take to ensure that Azure Pipelines artifacts are securely stored and access is audited?

Accepted Answer

Enable Azure Artifacts retention policies to automatically delete old artifact versions. Azure Artifacts retention policies allow you to automatically delete older versions of packages, reducing the attack surface and ensuring that only current, approved artifacts are stored. This is a key security practice to prevent outdated or vulnerable artifacts from being accessed. Option E is correct because enabling audit logging for artifact downloads via Azure DevOps audit logs provides a detailed, immutable record of who accessed which artifact and when, which is essential for compliance and security investigations.

Answer

Configure the storage account firewall to only allow access from Azure Pipelines IP ranges

Answer

Use Azure Policy to enforce that artifacts are only deployed to production storage accounts

Answer

Enable customer-managed keys (CMK) for artifact encryption