AZ-400 Practice Exam 51 — 20 Questions

Question 1

Your organization is implementing a security compliance plan for Azure DevOps. Which TWO actions help enforce the principle of least privilege?

Accepted Answer

Use Azure DevOps security groups to grant minimal permissions. Azure DevOps security groups allow administrators to assign specific permissions to groups rather than individuals, enabling granular control over who can perform actions like editing work items or managing pipelines. This directly supports the principle of least privilege by ensuring users have only the permissions necessary for their role. Option D is correct because restricting agent pool creation to a small admin team prevents unauthorized users from deploying agents that could execute arbitrary code or access sensitive resources, which is a common attack vector in CI/CD environments.

Answer

Allow all team members to edit security permissions

Answer

Use built-in roles without customizing

Answer

Grant Project Collection Administrators group to all developers

Question 2

Your team uses GitHub Copilot for code suggestions. To comply with your organization's data protection policies, you need to ensure that code snippets and prompts sent to Copilot are not stored or used by Microsoft for service improvement. What should you configure?

Accepted Answer

Enable the 'Data Exclusion' setting in Copilot's enterprise settings. GitHub Copilot's enterprise settings include a 'Data Exclusion' feature that, when enabled, prevents Microsoft from storing or using your code snippets and prompts for service improvement. This directly addresses the data protection policy requirement by ensuring that your organization's code is not retained or analyzed by Microsoft beyond the immediate suggestion generation.

Answer

Set a compliance grade in Microsoft Defender for Cloud

Answer

Apply a Microsoft Purview Data Loss Prevention policy

Answer

Configure Azure OpenAI Service content filtering

Question 3

Your organization uses Azure DevOps Server (on-premises) and is planning to migrate to Azure DevOps Services. You have hundreds of build and release pipelines. The migration must be done with minimal downtime and with validation that each pipeline works after migration. You have a test collection of 20 critical pipelines that must be validated first. What is the best approach?

Accepted Answer

Use the Azure DevOps Migration Tools to replicate the test pipelines to a new Azure DevOps Services organization. Validate, fix issues, then migrate the remaining pipelines in batches.. Using the Azure DevOps Migration Tools to perform a trial migration to a test organization allows you to validate and fix issues before migrating the full collection. Direct upgrade is not supported. Manual recreation is error-prone and not minimal downtime. Skipping validation risks breaking pipelines.

Answer

Export all pipelines as JSON from the server and import them into Azure DevOps Services. Skip validation to save time.

Answer

Manually recreate the 20 critical pipelines in Azure DevOps Services and test them. Then recreate the rest manually.

Answer

Perform an in-place upgrade of Azure DevOps Server to the latest version, then migrate to Azure DevOps Services using the Data Migration Tool.

Question 4

Your organization uses Azure DevOps with classic pipelines. Security audit requires that all pipeline variables containing secrets (e.g., API keys) are stored in Azure Key Vault and referenced dynamically. Currently, secrets are stored as plain text in the pipeline UI. You need to migrate to Key Vault with minimal downtime and ensure that secret values are never exposed in logs. What should you do?

Accepted Answer

Create a variable group linked to Key Vault, mark variables as 'secret', and reference them in pipelines. Update pipeline steps to use the variable group.. The correct approach is to create a variable group linked to Azure Key Vault in the Library, mark the variables as 'secret', and reference that variable group in the pipeline. This ensures secrets are stored in Key Vault (not in Azure DevOps) and masked in logs. Option A (secure file) still stores secrets in Azure DevOps and may not prevent log exposure. Option C (Azure Key Vault task) downloads secrets as pipeline variables, which could expose them if not properly masked. Option D (secret pipeline variables) stores secrets in Azure DevOps, not Key Vault, and while masked, they remain in the pipeline definition.

Answer

Store secrets in a secure file in Azure DevOps.

Answer

Use the 'Azure Key Vault' task to download secrets as pipeline variables.

Answer

Add each secret as a pipeline variable with the 'secret' type.

Question 5

Your team uses GitHub and wants to automatically close stale branches that have not been updated in 90 days. Which GitHub feature should you configure?

Accepted Answer

Create a scheduled GitHub Actions workflow that deletes branches older than 90 days. A is correct because GitHub Actions can be scheduled using cron syntax to run a workflow that identifies branches with no commits in the last 90 days and deletes them via the GitHub API. This gives you full control over the deletion logic, logging, and notifications, unlike a simple bot. The workflow can use actions like `actions/github-script` to enumerate branches and filter by `committer.date`.

Answer

Auto-merge feature

Answer

Stale bot (GitHub Actions)

Answer

GitHub Discussions

Question 6

Your team uses GitHub Actions for CI/CD and must ensure that only approved contributors can merge code to the main branch. You need to enforce a policy where every pull request must be reviewed by at least two members of the security team. Which branch protection rule should you configure?

Accepted Answer

Require a minimum number of reviewers. The 'Require a minimum number of reviewers' branch protection rule in GitHub directly enforces that a specified number of reviewers must approve a pull request before it can be merged. By setting this minimum to two and restricting review permissions to the security team, you ensure that only approved security team members can authorize merges to the main branch, meeting the policy requirement.

Answer

Require pull request reviews before merging

Answer

Require status checks to pass before merging

Answer

Dismiss stale pull request approvals

Question 7

Which THREE are valid security best practices for Azure Pipelines? (Choose three.)

Accepted Answer

Restrict agent pool permissions to only necessary users. Restricting agent pool permissions to only necessary users follows the principle of least privilege, reducing the attack surface by ensuring only authorized personnel can register, manage, or use build agents. This prevents unauthorized access that could lead to code injection or credential theft.

Answer

Store secrets as plain text in YAML files

Answer

Run build agents on domain controllers

Question 8

Your team uses Azure Test Plans. You need to ensure that testers can easily see which test cases are blocked by a known bug. What should you do?

Accepted Answer

Link test cases to the bug and create a query for linked items.. Azure Test Plans allows test cases to be linked directly to bugs via work item linking. By creating a query for linked items (e.g., a shared query that returns all test cases linked to a specific bug), testers can instantly see which test cases are blocked by that known bug. This provides a dynamic, filterable view without duplicating or reorganizing test artifacts.

Answer

Configure the test plan to show only failed tests.

Answer

Create a test suite for each bug.

Answer

Copy the test case and mark it as blocked.

Question 9

Which THREE of the following are prerequisites for implementing a CI/CD pipeline for a .NET Core application?

Accepted Answer

Build agent (Microsoft-hosted or self-hosted). A build agent is required to execute the pipeline tasks, such as compiling code, running tests, and packaging artifacts. Microsoft-hosted agents provide a pre-configured environment with common tools, while self-hosted agents allow custom configurations and access to on-premises resources. Without a build agent, the CI/CD pipeline cannot perform any automated build or deployment steps.

Answer

Unit test framework

Answer

Docker container registry

Question 10

Your company, Contoso Ltd., is a financial services firm that must comply with PCI DSS. You manage a Azure DevOps organization with over 200 projects. Each project uses a service principal to deploy to Azure using service connections stored in library variable groups. Recently, an auditor flagged that a developer used a service principal with Contributor rights on a production subscription to accidentally delete a storage account. The developer had been granted access to the variable group containing that service principal's credentials. You are tasked with implementing a security and compliance plan to prevent this from recurring. The solution must minimize administrative overhead and follow the principle of least privilege. Current environment: All service principals are created in Azure AD and assigned to variable groups. Developers are granted 'User' access level in Azure DevOps and are members of various teams. You have the ability to create Azure AD groups and custom roles. Which course of action should you take?

Accepted Answer

Create custom Azure RBAC roles with minimal required permissions for each service principal, restrict service connections to specific pipelines using Azure DevOps security settings (e.g., 'Use' permission), and assign developers only the 'Use' permission to the service connections they need, not the variable groups containing credentials.. It enforces the principle of least privilege by creating custom Azure RBAC roles with minimal permissions, restricting service connections to specific pipelines via Azure DevOps security settings (e.g., 'Use' permission), and assigning developers only the 'Use' permission to the service connections rather than the variable groups containing credentials. This prevents developers from directly accessing or modifying the service principal credentials, eliminating the risk of accidental or malicious use of high-privilege roles like Contributor.

Answer

Remove all variable groups and require developers to use their own Azure AD accounts for deployments, granting them Contributor rights only on non-production environments.

Answer

Require all pipeline runs that use production service connections to be approved by a security team via Azure Pipelines approval gates.

Answer

Implement Azure DevOps pipeline decorators to inject a security task that checks the service connection's role before each deployment, and fail the pipeline if the role is Contributor or higher.

Question 11

Which TWO are best practices for securing Azure Pipelines? (Choose two.)

Accepted Answer

Use variable groups linked to Azure Key Vault for secrets.. Variable groups linked to Azure Key Vault allow you to securely store and manage secrets (e.g., API keys, passwords) outside of pipeline definitions. Azure Pipelines retrieves these secrets at runtime via the Azure Key Vault REST API, ensuring they are never exposed in logs or YAML files. This follows the principle of least privilege and secrets management best practices.

Answer

Grant 'Administrator' role to all service connections for ease of management.

Answer

Store all pipeline variables in the YAML file as plain text.

Answer

Disable pipeline logging for all jobs.

Question 12

Refer to the exhibit. A developer creates a pipeline with this YAML. When a commit is pushed to the 'main' branch of the repository 'MyProject/MyRepo', the pipeline does NOT trigger. Which is the most likely cause?

Accepted Answer

The 'internal' repository trigger requires a pipeline trigger to be enabled in the UI.. When using the 'internal' repository type in Azure Pipelines YAML, the pipeline must have a 'Pipeline trigger' explicitly enabled in the UI settings. The YAML 'trigger' branch specification alone is insufficient for 'internal' repositories; the UI trigger acts as a required gate. Without this UI setting, commits to 'main' will not initiate the pipeline.

Answer

The 'checkout: internal' step should use a different syntax.

Answer

The 'ref' property should be set to a commit SHA, not a branch name.

Answer

The branch specification 'main' is case-sensitive and should be 'Main'.

Question 13

Which TWO triggers can be used to start a release pipeline in Azure DevOps?

Accepted Answer

Scheduled release trigger. B is correct because a scheduled release trigger allows you to define a recurring time (e.g., daily at 2:00 AM) to automatically start a release pipeline, which is essential for scenarios like nightly builds or periodic deployments. C is correct because a continuous deployment trigger automatically starts a release pipeline whenever a new build artifact is available from a linked build pipeline, enabling immediate deployment after a successful build. Both triggers are native to Azure Pipelines and are configured directly on the release pipeline's 'Triggers' tab.

Answer

Continuous integration trigger

Answer

Pull request trigger

Answer

Branch policy trigger

Question 14

Your team uses a monorepo in Azure Repos with multiple microservices. Developers frequently report merge conflicts due to long-lived feature branches. Which branching strategy minimizes merge conflicts while supporting continuous integration?

Accepted Answer

Use trunk-based development with short-lived feature branches and frequent merges to main. Trunk-based development with short-lived feature branches (typically lasting less than a day) minimizes merge conflicts by ensuring that changes are integrated into the main branch frequently, often multiple times per day. This approach reduces the divergence between branches, making conflicts less likely and easier to resolve. It also supports continuous integration by triggering automated builds and tests on every merge to main, aligning with the team's need for rapid feedback and reduced integration overhead.

Answer

Use release branches for all development work and merge to main only at release time

Answer

Use GitFlow with separate develop and main branches, and long-lived feature branches

Answer

Use a forking workflow where each developer works in a personal fork and submits pull requests

Question 15

You run the Azure CLI command shown in the exhibit as part of a release pipeline to deploy a ZIP package to an Azure App Service. The deployment succeeds, but the app does not start. What is the most likely cause?

Accepted Answer

The app's startup command is not configured. The Azure CLI command `az webapp deploy` deploys the ZIP package to the App Service, but it does not configure the startup command. If the application (e.g., a Node.js or Python app) requires a specific startup file or script (like `npm start` or `gunicorn`), the App Service will fail to start because it defaults to a generic handler. The startup command must be set via the `--startup-file` parameter in `az webapp config set` or in the Azure portal.

Answer

The resource group name is incorrect

Answer

The runtime stack is not specified in the command

Answer

The deployment slot is not specified

Question 16

Your team uses a monorepo in Azure Repos with multiple projects. You want to trigger a pipeline only when changes are made to a specific subfolder. Which configuration should you use?

Accepted Answer

Add a 'paths' filter to the CI trigger.. Azure Pipelines CI triggers support a 'paths' filter that allows you to specify include or exclude patterns for file changes. When a monorepo contains multiple projects in separate subfolders, adding a 'paths' filter to the CI trigger ensures the pipeline only runs when changes are detected within that specific subfolder, avoiding unnecessary builds for unrelated projects.

Answer

Use a branch filter in the CI trigger.

Answer

Configure the checkout step to only include the subfolder.

Answer

Use a 'file_match' condition on the job.

Question 17

Which TWO tools can be used to enforce branch protection policies in GitHub repositories? (Choose two.)

Accepted Answer

Azure Pipelines branch policies. Azure Pipelines branch policies allow you to enforce requirements such as requiring a minimum number of reviewers, checking for linked work items, or requiring a successful build before merging pull requests into protected branches. This integrates directly with GitHub repositories to enforce compliance and code quality standards.

Answer

Microsoft Intune compliance policies

Answer

Microsoft Purview data classification

Answer

GitHub Actions workflows

Question 18

Your release pipeline deploys a .NET Core web app to Azure App Service using a deployment slot for staging. The pipeline runs integration tests against the staging slot. After tests pass, you want to swap the staging slot with production. However, the swap fails sometimes because the staging slot has different configuration settings. What is the best practice to ensure swapping succeeds?

Accepted Answer

Use slot-specific configuration settings (deployment slot settings) for connection strings and app settings that differ between slots.. Azure App Service allows you to mark specific configuration settings (like connection strings and app settings) as 'deployment slot settings.' When a setting is marked as slot-specific, it stays with the slot during a swap, preventing failures caused by mismatched configurations. This ensures that the staging slot retains its test-specific settings (e.g., a test database connection string) while the production slot keeps its own settings, making the swap predictable and reliable.

Answer

Manually update the production slot settings to match staging before each swap.

Answer

Perform a swap with preview and then complete the swap after verifying the staging slot.

Answer

Write a custom PowerShell script to copy configuration from staging to production before swapping.

Question 19

Your organization uses Microsoft Purview to manage sensitive data in Azure DevOps repositories. The compliance team needs to automatically classify and label source code that contains personally identifiable information (PII). Which solution should you use?

Accepted Answer

Use Microsoft Purview Information Protection to automatically scan and label repositories.. Microsoft Purview Information Protection provides built-in data classification and labeling capabilities that can automatically scan Azure DevOps repositories for sensitive data such as PII. It uses sensitive information types and machine learning classifiers to detect patterns like social security numbers or credit card numbers, then applies the appropriate sensitivity label directly to the source code files. This meets the compliance team's requirement for automatic classification and labeling without custom development.

Answer

Use Azure Policy to enforce PII labeling on repositories.

Answer

Use Microsoft Sentinel to detect PII in repositories.

Answer

Use Microsoft Defender for Cloud to scan for PII.

Question 20

Your project uses a monorepo in Azure Repos. You want to enforce that changes to a specific folder (/src/security) require approval from the security team. What is the best approach?

Accepted Answer

Configure a branch policy with a path filter and require approval from the security team group.. Azure Repos branch policies allow you to define path filters that scope policy enforcement to specific folders. By adding a required reviewer policy with a path filter for `/src/security` and assigning the security team group, only pull requests modifying files under that folder will require their approval, leaving other changes unaffected.

Answer

Add a required reviewer policy for all pull requests.

Answer

Move the security folder to a separate repository with its own policies.

Answer

Set folder-level permissions to restrict who can modify the folder.