AZ-400 Practice Exam 51 — 20 Questions

Question 1

Your team uses Azure Pipelines to deploy a Node.js application. Recently, deployments have been failing intermittently due to a missing npm package. The pipeline runs successfully on the local agent but fails on the hosted agent. Which instrumentation strategy should you implement to identify the root cause?

Accepted Answer

Enable verbose logging for the npm install task and compare the output between pipeline runs.. Option A is correct because enabling verbose logging and comparing the npm install output between agents can reveal differences in package resolution. Option B is wrong because pipeline caching would mask the issue. Option C is wrong because telemetry from the application does not capture build-time dependency issues. Option D is wrong because self-hosted agents would not match the hosted environment.

Answer

Replace the hosted agent with a self-hosted agent.

Answer

Configure Application Insights for the Node.js app to monitor runtime errors.

Answer

Add a pipeline cache task for npm packages to ensure consistent restore.

Question 2

You are designing an instrumentation strategy for a microservices application deployed to Azure Kubernetes Service (AKS) using Azure Pipelines. The application emits custom metrics using OpenTelemetry. You need to ensure that all pipeline-related events (build, release, and test results) are correlated with application telemetry to enable end-to-end traceability. What should you do?

Accepted Answer

Set a unique Correlation ID in the pipeline variables and pass it to the application's OpenTelemetry instrumentation as a span attribute.. Option C is correct because using the Correlation ID in both pipeline variables and OpenTelemetry spans enables correlation. Option A is wrong because Azure Monitor logs don't correlate with pipeline data. Option B is wrong because Application Insights alone doesn't pull pipeline data. Option D is wrong because pipeline artifacts don't include telemetry.

Answer

Configure Application Insights to ingest pipeline telemetry via a custom exporter.

Answer

Store pipeline logs in an Azure Log Analytics workspace and query them together with application metrics.

Answer

Use Azure Pipelines' Checks feature to enforce deployment gates based on application metrics.

Question 3

Your team uses GitHub Actions for CI/CD. You need to collect and analyze build and deployment logs centrally to identify recurring failures. Which service should you use to ingest and query these logs?

Accepted Answer

Azure Log Analytics. Option A is correct because Azure Log Analytics can ingest logs from GitHub Actions via connectors or API. Option B is wrong because Application Insights is for application monitoring, not CI/CD logs. Option C is wrong because GitHub Insights is a reporting feature, not a log analytics platform. Option D is wrong because Azure Monitor Alerts is for alerting, not storage/query.

Answer

Azure Monitor Alerts

Answer

GitHub Insights

Answer

Application Insights

Question 4

Your organization uses Azure Pipelines with multiple release stages. You need to instrument the pipeline to capture the duration of each stage and the number of failed tasks. Which TWO approaches should you use?

Accepted Answer

Use the Azure DevOps REST API to retrieve pipeline run statistics after each run.. Options A and D are correct. Option A: REST API can query pipeline run details including stage durations and failures. Option D: Custom logging in tasks writes to the console, which is captured in pipeline logs. Option B is wrong because it only gives a summary, not per-stage. Option C is wrong because it's a deployment pattern, not instrumentation. Option E is wrong because it's about notifications, not data collection.

Answer

Configure pipeline notifications for failed tasks.

Answer

Implement a 'runOnce' deployment strategy to ensure sequential stages.

Answer

Enable the 'Summary' tab in the pipeline run to view stage durations.

Question 5

You are building a comprehensive instrumentation strategy for a large-scale Azure DevOps environment. You need to ensure that all pipeline events (build, release, test) are automatically tracked and correlated with application performance data. Which THREE components should you include?

Accepted Answer

A shared Correlation ID that flows from pipeline to application.. Options A, D, and E are correct. Option A: OpenTelemetry SDK in the application collects performance data with correlation IDs. Option D: Custom pipeline tasks emit telemetry to Application Insights. Option E: Using the same Correlation ID across pipeline and application enables correlation. Option B is wrong because Azure Boards does not track pipeline events. Option C is wrong because Azure Monitor Workbooks are visualization tools, not data collection.

Answer

Azure Monitor Workbooks to visualize pipeline data.

Answer

Azure Boards to track pipeline run metadata.

Question 6

Refer to the exhibit. You deploy this ARM template to create a Log Analytics workspace and a saved search. After deployment, you notice that the saved search returns no results even though there are failed pipeline runs. What is the most likely reason?

Accepted Answer

The custom table 'AzureDevOpsPipelineEvents_CL' does not exist in the workspace.. Option C is correct because the query uses a custom log table 'AzureDevOpsPipelineEvents_CL' which requires a custom table or data connector to be created first. Option A is wrong because the apiVersion is valid for workspace. Option B is wrong because the API version for savedSearches is valid. Option D is wrong because the category is just a label.

Answer

The savedSearch API version is not supported.

Answer

The Log Analytics workspace API version is incorrect.

Answer

The category 'Azure Pipelines' is misspelled.

Question 7

You are deploying a Java application to Azure App Service using Azure Pipelines. You want to automatically capture JVM metrics (heap usage, garbage collection) and correlate them with deployment events. What should you do?

Accepted Answer

Enable Application Insights Java agent in the App Service.. Option A is correct because Application Insights Java agent automatically collects JVM metrics and can be correlated with deployment markers. Option B is wrong because App Service logs don't include JVM metrics. Option C is wrong because diagnostic settings are for Azure resource logs, not JVM. Option D is wrong because Visual Studio profiler is not a production monitoring tool.

Answer

Use Azure Monitor diagnostic settings for the App Service.

Answer

Attach a profiler from Visual Studio to the App Service process.

Answer

Configure App Service diagnostic logs to capture stdout/stderr.

Question 8

You are the DevOps lead for a fintech company. The organization uses a multi-tenant Azure DevOps environment with hundreds of pipelines. The compliance team requires that every pipeline run must be auditable with the following attributes captured: who triggered the run, what code changes were included, which artifacts were produced, and whether any secrets (e.g., Azure Key Vault references) were accessed during the run. Additionally, all audit data must be retained for 7 years and be queryable within 5 minutes of a pipeline completion. Current state: pipelines use Azure Key Vault for secrets, and YAML pipelines are defined with variables referencing Key Vault. You need to design an instrumentation strategy to meet these requirements. What should you do?

Accepted Answer

Enable Azure DevOps Audit Streams to send audit events to a Log Analytics workspace. Configure a Log Analytics workspace with 7-year retention. Create a dashboard and alert rules for compliance.. Option A is correct because using Azure DevOps Audit Streams to send events to a Log Analytics workspace provides long-term retention and near real-time querying. Azure DevOps Audit logs capture all required attributes including pipeline runs, secret access, and user identity. Application Insights (B) is for application telemetry, not pipeline audit. Event Grid (C) is event-driven but doesn't store historical data for 7 years query. Pipeline artifacts (D) don't include audit trail of who triggered or secret access.

Answer

Use Azure Event Grid to subscribe to pipeline run events and store them in Azure Cosmos DB with TTL for 7 years.

Answer

Add a step at the end of each pipeline to upload pipeline logs as pipeline artifacts with a retention policy of 7 years.

Answer

Instrument each pipeline with custom tasks that send telemetry to Application Insights. Set Application Insights to 7-year retention.

Question 9

Your team is implementing a security and compliance plan for Azure DevOps. Which TWO actions should you take to meet regulatory requirements for audit logging and access control?

Accepted Answer

Enable Azure DevOps audit log to track changes to security policies and user permissions.. Enabling the Azure DevOps audit log (option B) is essential for regulatory compliance because it records changes to security policies, user permissions, and other critical events, providing an immutable trail for forensic analysis and reporting. This directly meets audit logging requirements by capturing who did what and when, which is necessary for standards like SOC 2, ISO 27001, or GDPR.

Answer

Enable anonymous access to project boards for external stakeholders.

Answer

Grant all users Project Collection Administrator role to simplify access management.

Answer

Disable auditing for the project to reduce log volume.

Question 10

Your team is migrating from Jenkins to Azure Pipelines. You have a Jenkins pipeline that builds a Java application, runs unit tests, performs static code analysis with SonarQube, packages the application as a WAR file, and deploys to a Tomcat server. You need to replicate this pipeline in Azure Pipelines using YAML. The build and deployment must be triggered by commits to the main branch. You also need to ensure that the SonarQube analysis results are published to the SonarQube server and that the pipeline breaks if the quality gate fails. The Tomcat server is on-premises and requires a service connection. Which YAML pipeline structure should you use?

Accepted Answer

Use the Maven task with SonarQube goals (sonar:sonar) for analysis, then use the Copy Files task and Windows Machine File Copy task to deploy to the on-premises Tomcat server.. Option C is correct because it uses Maven for build/test, SonarQubePrepare/Analyze tasks (or Maven with SonarQube goals), and a CopyFiles/WindowsMachineFileCopy task for on-premises deployment. Option A is wrong because SSH tasks may not work for Tomcat deployment directly. Option B is wrong because Azure App Service is not on-premises. Option D is wrong because it uses PowerShell to copy files, which is less maintainable and doesn't leverage Azure Pipelines tasks.

Answer

Use the Maven task to build and test, and use the Azure Web App task to deploy to Azure App Service.

Answer

Use the Maven task to build, then use PowerShell to copy the WAR file to the Tomcat server via Invoke-Command.

Answer

Use the Maven task to build and test, and use SSH tasks to copy the WAR file to the Tomcat server and restart the service.

Question 11

You are responsible for a release pipeline that deploys a containerized application to Azure Kubernetes Service (AKS). The pipeline currently builds and pushes a Docker image to Azure Container Registry (ACR) and then updates the Kubernetes manifest. You need to implement a rollback strategy in case the deployment fails. The rollback should revert to the previous known good version of the application. Which approach should you use?

Accepted Answer

Use the Kubernetes task with the 'rollback' option, which runs 'kubectl rollout undo' on the deployment.. Using Kubernetes native rollback with 'kubectl rollout undo' is the simplest. Option B uses Helm rollback, which is similar but adds complexity. Option C relies on ACR tags, which is not immediate. Option D requires manual re-run.

Answer

Keep the previous Docker image tag in ACR and update the manifest to point to it manually.

Answer

Rerun the previous successful pipeline run.

Answer

Use Helm to manage releases and rollback using 'helm rollback' command.

Question 12

Your team uses Azure Pipelines to build a Node.js application. The build pipeline runs linting, unit tests, and creates a production build. You want to ensure that the pipeline fails if the test coverage drops below 80%. You need to implement this check. What should you do?

Accepted Answer

Add a 'Publish Test Results' task with code coverage enabled, then use a 'Script' task that reads the coverage report and fails if below 80%.. Option A is correct: The 'Publish Test Results' task can publish coverage results, and you can use a 'Check for coverage' task or script to fail the pipeline. Option B is incorrect because the task itself does not enforce a minimum coverage. Option C is incorrect because pipeline variables cannot enforce coverage thresholds. Option D is incorrect because code coverage is not a branch policy.

Answer

Configure a pipeline variable 'CoverageThreshold' and use it in a gate.

Answer

Set a branch policy that requires code coverage to be at least 80%.

Answer

Use the 'Visual Studio Test' task with code coverage enabled and set the 'Minimum coverage' option.

Question 13

Your organization uses GitHub Actions for CI/CD. You have a workflow that deploys to Azure App Service. The deployment uses a publish profile secret stored as a GitHub secret. You want to improve security by using OpenID Connect (OIDC) to authenticate to Azure without storing secrets. What should you do?

Accepted Answer

Configure the GitHub workflow to use the 'azure/login' action with OIDC, and set up a federated identity credential in Microsoft Entra ID for the GitHub environment.. Option B is correct: Configuring OIDC with Azure AD (now Microsoft Entra ID) app registration and federated credentials allows token-based authentication without secrets. Option A is incorrect because GitHub secrets are still secrets. Option C is incorrect because Azure AD is not required to be replaced; OIDC works with it. Option D is incorrect because the Azure/login action supports OIDC.

Answer

Remove the secret and use Azure AD Managed Identity directly from the GitHub runner.

Answer

Replace the publish profile secret with an Azure service principal secret stored as a GitHub secret.

Answer

Use the 'Azure App Service Deploy' task with the 'Publish Profile' parameter set to an empty string.

Question 14

Your company is migrating from on-premises Jenkins to Azure Pipelines. You have a Jenkins pipeline that builds a C++ application using MSBuild. The build environment requires specific Visual Studio components and SDKs. You need to set up a build agent in Azure Pipelines that matches the Jenkins environment. You want to minimize administrative overhead and ensure the agent is always up to date with the latest patches. What should you do?

Accepted Answer

Use a Microsoft-hosted agent with the 'windows-2022' image that includes Visual Studio Build Tools.. Option C is correct because Microsoft-hosted agents come with Visual Studio pre-installed and are automatically maintained. Option A is incorrect because custom images require maintenance. Option B is incorrect because Azure VM agents require manual updates. Option D is incorrect because container agents need custom image management.

Answer

Use a self-hosted agent on an Azure VM with a custom image that includes Visual Studio and SDKs.

Answer

Deploy a container-based agent using a Docker image that includes Visual Studio.

Answer

Provision a self-hosted agent on an Azure VM and install required components manually.

Question 15

Your organization uses Azure DevOps. You have a classic release pipeline that deploys to multiple stages: Dev, QA, and Prod. Each stage has a pre-deployment approval gate. Recently, the QA team complained that they are not receiving approval notifications. You have verified that the approval configuration is correct and the approvers are members of the 'QA Approvers' group. The release pipeline is set to send email notifications to the approvers. However, the QA approvers report they do not receive any emails when a release is pending their approval. What should you check first?

Accepted Answer

Verify that the organization-level notification settings allow email notifications for approvals.. Option A is correct because the most common cause of missing notifications is incorrect email settings in the Azure DevOps organization. Option B is wrong because the notification is sent by Azure DevOps, not via a separate pipeline. Option C is wrong because the pipeline does not have a separate notification step. Option D is wrong because the approval step is already on the stage; the issue is notification delivery.

Answer

Ask the QA team to check their spam folder.

Answer

Add a 'Send email' task in the pipeline before the approval gate.

Answer

Check the 'Release Pipeline' logs for a warning about email delivery failure.

Question 16

Your team is using Azure Pipelines to deploy a web application to Azure App Service. The application uses a configuration file (appsettings.json) that contains environment-specific settings. You need to manage these settings across development, staging, and production environments without exposing secrets in the source code. The pipeline should automatically replace the settings during deployment. What should you configure?

Accepted Answer

Use the 'File Transform' task in the release pipeline to replace tokens in the configuration file with variables defined in pipeline variable groups.. Option A is correct: Use the 'File Transform' task to substitute variables from pipeline variables or variable groups. Option B is incorrect because build configuration transforms are for .NET projects and require specific setup. Option C is incorrect because environment variables are not directly used for file transforms. Option D is incorrect because Azure App Service application settings are for the runtime, not for transforming configuration files during deployment.

Answer

Create separate build configurations for each environment and use the 'Transform Web.config' task.

Answer

Use the 'Azure App Service Deploy' task with the 'Use Web Deploy' option and configure parameterization.

Answer

Set environment variables in the Azure App Service and read them in the application code.

Question 17

Your team uses GitHub Actions for CI/CD. You have a workflow that builds and deploys a Node.js application to Azure App Service. The workflow uses the 'azure/webapps-deploy@v2' action. You notice that the deployment often fails with a 403 error during the 'Deploy to Azure' step. The error message indicates that the publish profile credentials are invalid. You have stored the publish profile as a secret in the repository. The secret name is AZURE_WEBAPP_PUBLISH_PROFILE. The workflow step uses the secret correctly. However, the secret value might have been rotated. You need to ensure that the deployment works reliably. What should you do?

Accepted Answer

Use OpenID Connect with a service principal instead of publish profile.. Option C is correct because using a service principal with a managed identity or Azure AD application is more secure and reliable than publish profile. Option A is wrong because checking the log does not fix the issue. Option B is wrong because using a different action still relies on the same secret. Option D is wrong because the secret is already defined; recreating it does not guarantee it will work if the underlying credentials are rotated.

Answer

Check the workflow run log for the exact error and update the secret accordingly.

Answer

Replace the 'azure/webapps-deploy' action with 'Azure/cli' action and run az webapp deployment source config-zip.

Answer

Recreate the secret in GitHub by deleting and adding it again with the same value.

Question 18

Your organization uses GitHub Flow for source control with a monorepo containing multiple microservices. Each microservice has its own build and test workflow. You need to design a CI/CD strategy that builds and tests only the services affected by a pull request to reduce build times and resource usage. You also need to ensure that all pull requests to the main branch pass required checks before merging. What should you implement?

Accepted Answer

Use separate workflows for each microservice with path filters (on: pull_request paths:) so that only workflows with changed files are triggered.. Option C is correct: GitHub Actions path filters trigger workflows only when files in specific paths change. Option A is incorrect because building all services every time is wasteful. Option B is incorrect because a single workflow for all services would be monolithic and hard to maintain. Option D is incorrect because manual triggering defeats automation.

Answer

Use a single workflow that builds and tests all microservices on every push to any branch.

Answer

Set up a webhook that triggers builds manually per service based on pull request comments.

Answer

Create a single workflow that uses a matrix strategy to build and test each microservice, and run it on every pull request.

Question 19

You are designing a release pipeline for a microservices application deployed to Azure Kubernetes Service (AKS). Each microservice has its own build pipeline that produces a container image. You need a single release pipeline that can deploy multiple microservices in a coordinated manner, but you want to avoid rebuilding the deployment pipeline for each microservice. The deployment should use Helm charts. What should you do?

Accepted Answer

Create a single release pipeline that consumes multiple build artifacts (one per microservice) and uses a Helm chart per microservice, deploying them in stages.. Option B is correct because a single release pipeline can use multiple artifacts and deploy them sequentially or in parallel. Option A is incorrect because separate pipelines for each microservice lack coordination. Option C is incorrect because a multi-stage pipeline per microservice still duplicates. Option D is incorrect because a single build pipeline would couple all builds.

Answer

Create a separate release pipeline for each microservice and trigger them in sequence using pipeline completion triggers.

Answer

Create a single build pipeline that produces all container images, then a release pipeline that deploys the single artifact.

Answer

Create a single multi-stage YAML pipeline that builds and deploys all microservices together.

Question 20

Your organization uses Azure Pipelines and wants to implement a continuous feedback loop by collecting user analytics from the production environment and automatically creating work items in Azure Boards for critical issues. You need to design a solution that integrates monitoring data with the pipeline. What should you do?

Accepted Answer

Set up Azure Monitor alerts based on Application Insights data, and configure the alerts to invoke a webhook that calls the Azure Boards REST API to create a work item.. Option C is correct: Azure Monitor alerts can trigger webhooks that call Azure DevOps REST API to create work items. Option A is incorrect because release logs are not for user analytics. Option B is incorrect because manual creation is not automated. Option D is incorrect because Power BI is for reporting, not automated issue creation.

Answer

Use Power BI to visualize Application Insights data and set up data-driven alerts that send emails to the team.

Answer

Configure the release pipeline to output logs to Azure Monitor and use Log Analytics to create work items.

Answer

Use Azure Application Insights to collect user analytics, and manually review dashboards to create work items.