AZ-400 Practice Questions 2 — 50 Questions

Question 1

Your team is using GitHub Actions to deploy a containerized application to Azure Kubernetes Service (AKS). You need to securely authenticate the workflow to AKS without storing credentials in the repository. What should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use OpenID Connect (OIDC) with a federated identity credential.. OpenID Connect (OIDC) allows GitHub Actions to exchange a short-lived token for Azure credentials using a federated identity credential, eliminating the need to store any long-lived secrets in the repository. This is the recommended approach for secure, passwordless authentication to Azure services, including AKS, because it uses token-based authentication that automatically rotates and is scoped to specific workflows.

Answer

Use the GITHUB_TOKEN to authenticate to Azure.

Answer

Use an SSH deploy key to authenticate to AKS.

Answer

Store an Azure service principal password as a GitHub secret.

Question 2

Your Azure DevOps pipeline uses a YAML template that includes a step to push a Docker image to Azure Container Registry. The pipeline fails with 'unauthorized: authentication required'. The service connection uses a workload identity federation. What is the most likely cause?

Accepted Answer

The service principal used by the workload identity does not have the 'acrPush' role. The error 'unauthorized: authentication required' indicates that the Docker client could not authenticate with Azure Container Registry. With workload identity federation, the service principal used by the federated credential must have the 'acrPush' role assigned on the ACR scope to push images. Without this role assignment, the authentication token lacks the necessary permissions, even if the identity itself is valid.

Answer

The Docker image tag contains invalid characters

Answer

The Azure Container Registry name is incorrect

Answer

The service connection secret has expired

Question 3

Which TWO actions should you take to implement a secure build pipeline that uses Azure Key Vault to store secrets? (Choose two.)

Accepted Answer

Grant the Azure DevOps service principal 'Get' and 'List' permissions on the Key Vault.. The Azure DevOps service principal (the identity used by Azure Pipelines) must be granted 'Get' and 'List' permissions on the Key Vault's access policy. This allows the pipeline to retrieve secret values securely without storing credentials in the repository or pipeline configuration. Without these permissions, any attempt to read secrets from the vault will fail with an authorization error.

Answer

Store the Key Vault name and secret names in a secure file in the repository.

Answer

Define secrets as pipeline variables and mark them as secret.

Answer

Use the 'Azure CLI' task to run 'az keyvault secret show' for each secret.

Question 4

The exhibit shows an Azure CLI command to run a pipeline. What does this command do?

Accepted Answer

Runs the pipeline named 'MyPipeline' on the 'main' branch with a variable 'myVar' set to 'value1'.. The Azure CLI command `az pipelines run --name MyPipeline --branch main --variables myVar=value1` triggers an existing pipeline named 'MyPipeline' on the 'main' branch, passing a plain-text variable 'myVar' with the value 'value1'. The `--variables` parameter sets pipeline variables at runtime, but they are not automatically marked as secret; to set a secret variable, you must use the `--secret-variables` parameter instead. This matches option C exactly.

Answer

Runs the pipeline on all branches with the variable.

Answer

Runs the pipeline and sets a secret variable.

Answer

Creates a new pipeline named 'MyPipeline' with a variable.

Question 5

Your team uses Azure Pipelines to build and deploy a web app. You want to send a notification to a Microsoft Teams channel when a build fails. What should you configure?

Accepted Answer

Use the built-in Azure Pipelines Teams integration to send a notification on build failure.. Azure Pipelines has a built-in integration with Microsoft Teams that allows you to subscribe to notifications for pipeline events, such as build failures, directly from the Azure DevOps interface. This integration uses a service hook to send adaptive cards to a Teams channel without requiring custom logic or additional tasks.

Answer

Add a task in the pipeline to send an email on failure.

Answer

Create a service hook to trigger an Azure Logic App that sends a Teams message.

Answer

Add a dashboard widget that shows build status.

Question 6

Your team uses Azure DevOps to deploy a Node.js web app to Azure App Service on Linux. The build pipeline runs `npm install` and `npm run build`, then publishes the `dist` folder. The release pipeline uses the 'Azure App Service deploy' task. Recently, deployments fail intermittently with 'ERR_MODULE_NOT_FOUND' for a custom module. The module is listed in `package.json` and is present in the `node_modules` folder on the build agent. What is the most likely cause?

Accepted Answer

The build artifact does not include node_modules; the app requires them at runtime.. The most likely cause is that the build artifact does not include the `node_modules` folder. The build pipeline runs `npm install` and `npm run build`, which installs dependencies on the build agent, but only the `dist` folder is published as the artifact. At deployment time, the Azure App Service on Linux expects the `node_modules` folder to be present in the deployed artifact because it does not automatically run `npm install` for Node.js apps on Linux (unlike Windows-based App Services). Without `node_modules`, the app cannot resolve custom modules at runtime, leading to the `ERR_MODULE_NOT_FOUND` error.

Answer

The 'Azure App Service deploy' task modifies package.json during deployment.

Answer

The 'Azure App Service deploy' task runs npm install on the target, but it fails due to network restrictions.

Answer

The deployment slot's Kudu service fails to sync the dist folder.

Question 7

Your team uses Azure Pipelines to deploy to multiple environments. You need to ensure that deployment to the production environment requires approval from the security team. What should you configure?

Accepted Answer

Add an environment approval check for the production environment. Environment approval checks in Azure Pipelines allow you to require manual approval before a deployment proceeds to a specific environment, such as production. By adding an approval check to the production environment, you ensure that the security team must explicitly approve the deployment, meeting the requirement without modifying the pipeline code or branch policies.

Answer

Add a branch policy to the production branch

Answer

Use a condition in the YAML pipeline to check a variable

Answer

Configure a service connection with restricted permissions

Question 8

Which TWO compliance frameworks are directly supported by Microsoft Purview Compliance Manager for Azure DevOps?

Accepted Answer

ISO 27001. Microsoft Purview Compliance Manager directly supports ISO 27001 and SOC 2 as built-in compliance templates for Azure DevOps. These frameworks are pre-configured with control mappings, assessment templates, and automated testing actions that align with Azure DevOps security and audit capabilities. This allows organizations to continuously monitor and manage compliance posture against these standards without manual configuration.

Answer

HIPAA

Answer

PCI DSS

Answer

FedRAMP High

Question 9

An organization uses Azure DevOps and wants to implement a change management process where all changes to the main branch require approval from a change advisory board (CAB). The CAB members are not part of the development team. How should they configure this?

Accepted Answer

Create a new branch policy on main that requires a minimum number of reviewers from a separate CAB group.. Azure DevOps branch policies allow you to enforce a minimum number of reviewers from a specific security group (e.g., a CAB group) on pull requests targeting the main branch. This ensures that every change to main requires explicit approval from CAB members, who are separate from the development team, without relying on manual processes or altering team membership.

Answer

Set branch permissions to restrict push to main and only allow CAB to approve via manual process.

Answer

Use a service hook to notify CAB when a PR is created, and rely on manual approval.

Answer

Add the CAB as members of the development team and require team review.

Question 10

Your organization uses Microsoft Purview to classify and protect sensitive data. You need to ensure that source code in Azure DevOps repositories containing credit card numbers is detected and flagged. What should you configure?

Accepted Answer

Configure a Microsoft Purview Data Classification scan for Azure DevOps repositories.. Microsoft Purview Data Classification scans can be configured to scan Azure DevOps repositories for sensitive data types, such as credit card numbers, using built-in or custom sensitive information types. This allows the organization to detect and flag source code containing credit card numbers directly within the repository, aligning with the requirement to classify and protect sensitive data under a compliance plan.

Answer

Create a Data Loss Prevention (DLP) policy in Microsoft 365.

Answer

Set up Microsoft Sentinel to monitor Azure DevOps logs.

Answer

Enable Microsoft Defender for Cloud to scan repositories.

Question 11

You are implementing a CI pipeline for a Node.js application. The pipeline must run unit tests and generate code coverage reports. You want to publish the coverage results to Azure DevOps and enforce a minimum coverage threshold of 80%. Which tasks should you use?

Accepted Answer

Use the Publish Code Coverage Results task and configure the threshold in the task settings.. The Publish Code Coverage Results task is specifically designed to publish code coverage data (e.g., Cobertura or JaCoCo XML reports) to Azure DevOps and supports configuring a minimum coverage threshold directly in its settings. This meets both requirements: publishing results and enforcing the 80% threshold. Other tasks like Publish Test Results or Publish Build Artifacts do not natively handle coverage threshold enforcement.

Answer

Use the Publish Test Results task to publish coverage data.

Answer

Use the Publish Build Artifacts task with coverage files.

Answer

Use the Copy Files task to copy coverage files and then the Publish Build Artifacts task.

Question 12

Which TWO features in Azure Pipelines allow you to enforce separation of duties between development and operations teams? (Choose two.)

Accepted Answer

Approvals and checks on environments. Approvals and checks on environments (B) enforce separation of duties by requiring designated approvers (e.g., operations team members) to approve a deployment before it proceeds, ensuring that development cannot directly push to production. Environment security roles (D) allow you to define who can create, view, or manage environments, restricting developers from modifying production environments without operations oversight.

Answer

Pipeline decorators

Answer

Service connections with different scopes

Answer

Branch policies on the main branch

Question 13

Your team uses GitHub repositories and wants to ensure that all code changes are signed by a verified contributor before merging. Which branch protection rule should you enable?

Accepted Answer

Require signed commits. Requiring signed commits ensures that each commit is cryptographically verified using a GPG or S/MIME key linked to the contributor's GitHub account. This enforces non-repudiation and confirms the identity of the author, directly addressing the requirement that all code changes be signed by a verified contributor before merging.

Answer

Require pull request reviews before merging

Answer

Require linear history

Answer

Restrict who can push to matching branches

Question 14

Refer to the exhibit. A developer pushes a commit to the main branch. Which stages will run?

Accepted Answer

Only the Build stage.. The exhibit shows that the Build stage has a trigger condition that matches the 'main' branch, and the Test stage does not have a trigger condition that is satisfied by the push (e.g., it is set to a different branch condition or to manual). Therefore, when a commit is pushed to main, only the Build stage is triggered automatically; the Test stage does not run.

Answer

Only the Test stage.

Answer

Neither stage.

Answer

Both Build and Test stages.

Question 15

You need to ensure that only specific branches can trigger a release to production in Azure Pipelines. What should you configure?

Accepted Answer

Add a branch filter to the release pipeline's artifact trigger.. A branch filter on the release pipeline's artifact trigger allows you to specify which branches of the source artifact (e.g., a build pipeline) should automatically trigger a release. By configuring this filter to only include branches like 'main' or 'release/*', you ensure that only builds from those specific branches can initiate a release to production, providing precise control over deployment triggers.

Answer

Add an approval gate that requires a manager to approve the release.

Answer

Add a deployment gate that checks the source branch.

Answer

Add a branch filter to the build pipeline trigger.

Question 16

You are creating a release pipeline that uses Azure Pipelines to deploy to multiple virtual machines. You need to ensure that the deployment runs on each machine in parallel. Which deployment strategy should you use?

Accepted Answer

Run once deployment with parallel execution. The requirement is to deploy to multiple virtual machines in parallel, which is achieved by configuring a 'run once' deployment strategy with parallel execution in Azure Pipelines. This strategy uses the deployment group's parallel execution settings to run the deployment job simultaneously on all target machines, ensuring each machine receives the deployment at the same time.

Answer

Blue-green deployment

Answer

Canary deployment

Answer

Rolling deployment

Question 17

You are the Azure DevOps administrator for a large enterprise with multiple projects using the Scrum process. The organization has recently adopted a new compliance policy requiring that all work items of type 'Epic' must be approved by a compliance officer before they can be moved to the 'Committed' state. The compliance officers are external to the development teams and should not have direct access to modify work items. You need to implement this requirement with minimal administrative overhead. The current process has the following states for Epics: New, Proposed, Committed, In Progress, Done. The desired flow is: from 'Proposed' to 'Committed', a compliance officer must approve the transition. Compliance officers are part of a security group named 'Compliance Officers'. They should be able to approve the transition without having to edit the work item directly. What should you do?

Accepted Answer

In the process template for Epic, add a work item rule on the transition from 'Proposed' to 'Committed' that requires approval from a member of the 'Compliance Officers' group.. Azure DevOps process templates allow you to add work item rules on state transitions. By adding a rule on the 'Proposed' to 'Committed' transition for the Epic work item type that requires approval from a member of the 'Compliance Officers' group, you enforce the compliance policy without granting those officers direct edit permissions. This leverages built-in approval gates within the work item tracking system, minimizing administrative overhead.

Answer

Use a service hook to send an email to the compliance officers when an Epic is moved to 'Proposed', and rely on them to manually approve the transition.

Answer

Modify the Epic work item type to add a field 'Compliance Approval' and set the compliance officer as a required reviewer in the field settings.

Answer

Configure a branch policy on the main branch that requires approval from the 'Compliance Officers' group for pull requests.

Question 18

During a sprint review, stakeholders complain that they don't receive notifications about completed work items. The team uses Azure Boards with a custom notification subscription. What is the most likely cause?

Accepted Answer

The subscription's 'Deliver to' filter excludes stakeholders.. The most likely cause is that the custom notification subscription's 'Deliver to' filter is configured to exclude stakeholders. In Azure Boards, notification subscriptions can have filters that restrict delivery to specific groups or roles, and if stakeholders are not included in the filter, they will not receive notifications even if the subscription is active. This directly addresses the complaint that stakeholders are not getting notified about completed work items.

Answer

Email notifications are disabled at the organization level.

Answer

The subscription is set to deliver only to the team members.

Answer

The subscription was automatically disabled after the first notification.

Question 19

Your team uses Git and wants to ensure that all commits follow a consistent message format. Which approach should you use?

Accepted Answer

Use a client-side Git hook (commit-msg) to validate the message. A client-side Git hook, specifically the commit-msg hook, runs locally on the developer's machine before the commit is finalized, allowing immediate validation of the commit message format. This ensures that every commit adheres to the team's convention at the point of creation, without relying on server-side enforcement or pipeline execution.

Answer

Add a step in Azure Pipelines to validate commit messages

Answer

Create a GitHub Actions workflow that checks commit messages on push

Answer

Configure a branch policy in Azure Repos to enforce commit message format

Question 20

Which TWO benefits does using Git LFS (Large File Storage) provide? (Select TWO.)

Accepted Answer

Prevents large files from being stored in the Git history. Git LFS (Large File Storage) prevents large files from being stored directly in the Git repository history (option B). Instead, it stores a small pointer file in the repo while the actual large file content is stored externally, which reduces the size of the Git repository (option E). Options A, C, and D are incorrect because LFS does not automatically compress all files, replace .gitignore, or speed up diff operations for binary files.

Answer

Automatically compresses all files in the repository

Answer

Replaces .gitignore for excluding large files

Answer

Speeds up diff operations for binary files