AZ-400 Practice Exam 52 — 20 Questions

Question 1

Your CI pipeline includes a step that runs unit tests. You want to fail the pipeline if code coverage drops below 80%, but continue if tests pass with lower coverage. How should you configure the test step?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the 'PublishCodeCoverageResults' task with a 'codeCoverageThreshold' setting.. The 'PublishCodeCoverageResults' task with a 'codeCoverageThreshold' setting is correct because it allows you to define a minimum coverage percentage (e.g., 80%) and fail the pipeline if that threshold is not met, while still allowing the pipeline to continue if tests pass but coverage is lower. This task evaluates the coverage report after tests run and enforces the threshold as a build failure condition, not a test failure.

Answer

Configure a quality gate in the release pipeline to check coverage.

Answer

Add a script task that reads the coverage report and prints a warning.

Answer

Use the VSTest task with the 'codeCoverageEnabled' option set to true.

Question 2

Your organization uses GitHub Copilot for pull request summaries. However, the summaries sometimes miss security-related changes. What should you recommend?

Accepted Answer

Provide custom instructions to Copilot to emphasize security analysis.. GitHub Copilot's pull request summaries can be customized using custom instructions to prioritize security analysis. By providing specific directives in the repository's `.github/copilot-instructions.md` file or through the Copilot settings, you can instruct the AI to explicitly highlight security-related changes, such as those involving authentication, encryption, or input validation. This ensures the generated summaries are more aligned with your organization's security review requirements without disabling the tool.

Answer

Configure Copilot to ignore non-security files.

Answer

Disable Copilot and rely on manual review.

Answer

Switch to a different AI model specialized in security.

Question 3

Refer to the exhibit. You deploy this ARM template to create a Log Analytics workspace and a saved search. After deployment, you notice that the saved search returns no results even though there are failed pipeline runs. What is the most likely reason?

Accepted Answer

The custom table 'AzureDevOpsPipelineEvents_CL' does not exist in the workspace.. The query uses a custom log table 'AzureDevOpsPipelineEvents_CL' which requires a custom table or data connector to be created first. Option A is wrong because the savedSearch API version is valid. Option B is wrong because the workspace API version is valid. Option D is wrong because the category is just a label.

Answer

The savedSearch API version is not supported.

Answer

The Log Analytics workspace API version is incorrect.

Answer

The category 'Azure Pipelines' is misspelled.

Question 4

Your team uses Azure DevOps for CI/CD. You want to ensure that only code from the main branch is deployed to production. The release pipeline has a pre-deployment condition that requires approval. However, you notice that a release created from a feature branch was approved and deployed. What is the most likely cause?

Accepted Answer

The pre-deployment condition did not include a branch filter on the artifact.. The pre-deployment condition in Azure DevOps release pipelines can include a branch filter on the artifact to restrict which branches trigger a release. If this filter is not configured, any release—regardless of the source branch—can proceed through the approval gate. Since the feature branch release was approved and deployed, the most likely cause is that the pre-deployment condition lacked a branch filter to enforce that only artifacts from the main branch are eligible.

Answer

The deployment queue settings were set to 'Deploy all in parallel'.

Answer

The artifact was published from a build pipeline that allowed any branch.

Answer

The pre-deployment condition was set to 'After release' instead of 'Before deployment'.

Question 5

A development team is transitioning from a centralized version control system to Git in Azure Repos. The team lead wants to ensure that the branch structure supports both feature development and hotfix releases, with the ability to stabilize a release candidate before final deployment. Which branch strategy should the team implement?

Accepted Answer

Use Git Flow with feature, develop, release, and main branches.. Git Flow is the correct choice because it explicitly supports feature development, release stabilization, and hotfix releases through its structured branch hierarchy. The release branch allows the team to stabilize a release candidate before merging to main, while hotfix branches can be created from main for urgent fixes. This aligns perfectly with the requirement for both feature development and hotfix releases with release candidate stabilization.

Answer

Use trunk-based development with short-lived feature branches that merge directly to main.

Answer

Use a forking workflow where each developer forks the repository and creates pull requests.

Answer

Use GitHub Flow with feature branches and pull requests directly to main.

Question 6

Your build pipeline uses the 'NuGetCommand@2' task to restore NuGet packages. You want to use packages from an Azure Artifacts feed that requires authentication. How should you configure the pipeline to authenticate with the feed?

Accepted Answer

Add a 'NuGetAuthenticate@1' task before the NuGet restore task.. The 'NuGetAuthenticate@1' task is the correct way to authenticate with Azure Artifacts feeds in a pipeline because it automatically handles credential acquisition using the built-in Azure Artifacts credential provider. It works without needing to store or manage Personal Access Tokens (PATs) manually, and it integrates seamlessly with the pipeline's identity (e.g., the project collection build service). This task must be placed before the 'NuGetCommand@2' restore task to ensure the credentials are available for package restoration.

Answer

Store the Personal Access Token (PAT) in a variable and use it in the NuGet config.

Answer

Create an Azure Artifacts service connection and select it in the NuGet task.

Answer

Install the NuGet credential provider on the agent manually.

Question 7

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data in Azure DevOps repositories. The compliance team has identified that source code containing credit card numbers (PCI data) was accidentally committed to a public repository. You need to implement a solution that meets the following requirements: (1) Automatically scan all new commits in Azure Repos for sensitive data types like credit card numbers. (2) If sensitive data is detected, automatically block the push and notify the security team. (3) The solution must be integrated with Microsoft Purview and Azure DevOps.

Option A: Enable Microsoft Purview Data Loss Prevention for Azure DevOps, which automatically scans and blocks pushes containing sensitive data.

Option B: Configure a branch policy in Azure Repos that runs a custom Azure Function via a service hook when a push occurs, and the function uses Purview APIs to scan the commit.

Option C: Use GitHub Advanced Security secret scanning for Azure Repos, and configure a webhook to notify the security team.

Option D: Install a third-party extension from Azure DevOps Marketplace that provides content scanning and configure it to block pushes.

Which option is the most appropriate and efficient?

Accepted Answer

Enable Microsoft Purview Data Loss Prevention for Azure DevOps, which automatically scans and blocks pushes containing sensitive data. Microsoft Purview DLP for Azure DevOps (currently in preview) provides native integration to automatically scan commits for sensitive data types like credit card numbers and block the push if detected, meeting all requirements natively without custom development. Option B describes a custom Azure Function approach which is more complex and not native, and may not integrate as seamlessly with Purview. Option C uses GitHub Advanced Security, which is not available for Azure Repos (it's for GitHub repositories). Option D relies on a third-party extension, which may not have native Purview integration and could be less reliable. Therefore, Option A is the most appropriate and efficient solution.

Answer

Configure a branch policy in Azure Repos that runs a custom Azure Function via a service hook when a push occurs, and the function uses Purview APIs to scan the commit

Answer

Use GitHub Advanced Security secret scanning for Azure Repos, and configure a webhook to notify the security team

Answer

Install a third-party extension from Azure DevOps Marketplace that provides content scanning and configure it to block pushes

Question 8

Your team uses Azure Boards with a custom process. You need to ensure that when a bug is closed, it automatically triggers a new release pipeline. Which approach should you use?

Accepted Answer

Set up a Service Hook from Azure Boards to Azure Pipelines.. Service Hooks in Azure DevOps allow you to integrate Azure Boards with Azure Pipelines by subscribing to events like 'work item updated' or 'work item state changed'. When a bug is closed (state changed to 'Closed'), a Service Hook can automatically trigger a release pipeline, enabling event-driven automation without polling or custom code. This is the correct approach because it directly connects the work item state change to pipeline execution.

Answer

Configure a CI trigger in the release pipeline.

Answer

Add a release gate that checks for closed bugs.

Answer

Create an Azure Function that polls work items.

Question 9

You need to automatically run a pipeline when a new tag is pushed to the repository. Which trigger configuration should you use?

Accepted Answer

Tags trigger. Tags trigger allows running pipelines when a tag is pushed or updated. Option B (Schedule trigger) is incorrect because it runs on a predefined schedule, not on tag events. Option C (PR trigger) is incorrect because it triggers on pull request actions, not on tags. Option D (CI trigger with branch filters) is incorrect because CI trigger monitors branches, not tags; even with branch filters it does not respond to tags.

Answer

Schedule trigger

Answer

PR trigger

Answer

CI trigger with branch filters

Question 10

You are designing a centralized logging strategy for multiple microservices hosted in Azure Kubernetes Service (AKS). Each microservice writes logs in JSON format to stdout/stderr. The operations team needs to query logs across all services and correlate them with application performance metrics. Which solution provides the best integration?

Accepted Answer

Enable Container Insights in Azure Monitor to collect stdout/stderr logs and metrics into a Log Analytics workspace.. Container Insights in Azure Monitor is the best solution because it natively collects stdout/stderr logs from AKS containers and correlates them with performance metrics (CPU, memory, disk, network) in a single Log Analytics workspace. This enables the operations team to query logs across all microservices using KQL and join them with metrics for end-to-end troubleshooting, without additional infrastructure or data movement.

Answer

Configure AKS to send logs to Azure Blob Storage and use Azure Storage Analytics for querying.

Answer

Stream logs to Azure Event Hubs and then to Azure Data Explorer for analysis.

Answer

Deploy the Application Insights agent as a DaemonSet in AKS and send logs directly to Application Insights.

Question 11

Your team deploys a web application to Azure App Service using Azure Pipelines. The application requires a configuration file that contains connection strings and app settings. You need to ensure that the configuration is environment-specific and that sensitive values are not exposed in the pipeline logs. The configuration file is stored in a Git repository with different branches for each environment. You also need to support local development with the same configuration approach. Which strategy should you use?

Accepted Answer

Store environment-specific settings in Azure App Service configuration, and use variable groups in Azure Pipelines for secrets. Use token replacement in the config file during deployment.. The recommended approach is to store environment-specific settings (non-secret) in Azure App Service configuration settings, and store secrets in Azure Pipelines variable groups. During deployment, use token replacement in the config file to replace placeholders with actual values. This ensures secrets are not exposed in logs or stored in the repository, and supports local development by using config transforms. Option A exposes secrets by storing them in the repository. Option B uses a single config file and sticky settings, which does not address environment-specific configurations and can be insecure. Option D relies on branch-based pipeline variables, which may not support local development and can lead to secrets exposure in logs if not properly handled.

Answer

Store all settings, including secrets, in the config file in each branch. Use a script to replace tokens.

Answer

Use Azure App Service slots with sticky settings and store all settings in a single config file committed to the repository.

Answer

Use the same config file for all environments and override settings using pipeline variables based on branch name.

Question 12

Which TWO are true about Azure Pipelines YAML templates? (Choose two.)

Accepted Answer

Template expressions are evaluated at compile time.. Template expressions in Azure Pipelines YAML are evaluated at compile time, before the pipeline runs. This allows the template to inject variables, conditions, and other logic into the pipeline definition statically, ensuring that the final pipeline structure is fully resolved before execution begins.

Answer

Templates must be stored in the same repository as the main pipeline.

Answer

Templates require parameters to be defined.

Answer

Templates can only define a single job.

Question 13

Which TWO actions should you take to ensure that your Git repository in Azure Repos remains performant as it grows?

Accepted Answer

Use shallow clones in CI/CD pipelines.. Shallow clones fetch only the most recent commit history rather than the entire repository history, which significantly reduces the amount of data transferred and stored during CI/CD pipeline runs. This keeps pipeline execution fast and avoids performance degradation as the repository grows. Azure Repos and Azure Pipelines support shallow clone options via the `--depth` parameter in Git commands or through pipeline YAML settings.

Answer

Store large binary files directly in the repository.

Answer

Keep all branches indefinitely to preserve history.

Answer

Encourage developers to commit all changes in a single commit per day.

Question 14

Refer to the exhibit. A team wants to release version 1.0 from the main branch. They notice that the tag v1.0 is already on the current main commit. However, they also see that the origin/feature/experiment branch has commits that are not merged into main. What is the most likely scenario?

Accepted Answer

The experiment branch contains experimental work that was not intended for release; the tag v1.0 correctly marks the release on main.. The tag v1.0 is on the current main commit (9a8b7c6). The feature/experiment branch (1a2b3c4) is a child of the initial commit, but it is not merged into main. The main branch has commits that are ahead of the experiment branch. The team wants to release v1.0 from main; the tag already exists. The presence of the experiment branch not merged suggests that it was not intended for this release. The most likely scenario is that the experiment branch was created from an older commit and is not ready for release, so it was not merged. The release v1.0 is correctly tagged on main.

Answer

The team should delete the experiment branch because it is not merged.

Answer

The tag v1.0 was applied to the wrong commit; it should be on the merge commit of the experiment branch.

Answer

The main branch is missing the experiment branch commits; a merge is required before release.

Question 15

Your organization uses GitHub for source control. You need to enforce that all pull requests require at least one approval and that branches must be up to date with the base branch before merging. Which branch protection rule settings should you enable?

Accepted Answer

Require a pull request before merging and require branches to be up to date. GitHub branch protection rules allow you to enforce both that pull requests require at least one approval and that branches are up to date with the base branch before merging. The 'Require a pull request before merging' setting ensures that changes cannot be pushed directly to the protected branch and must go through a PR with required approvals. The 'Require branches to be up to date' setting (under 'Require status checks to pass before merging') ensures that the branch is tested against the latest base branch code, preventing stale merges.

Answer

Require branches to be up to date only

Answer

Require a pull request before merging only

Answer

Require status checks to pass before merging only

Question 16

A company uses Azure DevOps and has a security policy that all pipeline runs must use a specific service connection scoped to a resource group. A developer reports that a pipeline fails with the error: 'The service connection does not have permission to access the resource.' What is the most likely cause?

Accepted Answer

The service principal used by the service connection does not have the required role assignment on the resource group.. The error 'The service connection does not have permission to access the resource' indicates that the service principal associated with the service connection lacks the necessary Azure RBAC role assignment on the target resource group. In Azure DevOps, a service connection authenticates via a service principal, and that principal must have a role (e.g., Contributor) explicitly assigned at the resource group scope to perform actions like deploying resources. Without this role assignment, the pipeline fails with an access-denied error.

Answer

The Azure subscription linked to the service connection is disabled.

Answer

The service connection name is misspelled in the pipeline YAML.

Answer

The variable group in the library does not include the service connection ID.

Question 17

Your organization uses Azure DevOps and Azure Policy to enforce compliance. You need to ensure that all Azure resources deployed by Azure DevOps pipelines have specific tags (e.g., CostCenter and Environment) applied. Which TWO approaches can achieve this? (Choose TWO.)

Accepted Answer

Create an Azure Policy with the 'deny' effect that requires the tags to be present at resource creation.. An Azure Policy with the 'deny' effect prevents the creation of any resource that does not include the required tags (e.g., CostCenter and Environment). This enforces compliance at the moment of deployment, blocking non-compliant resources from being provisioned by Azure DevOps pipelines. Option D is correct because adding a pipeline task (using Azure CLI or PowerShell) after resource creation programmatically applies the required tags, ensuring resources are tagged even if the initial deployment omitted them.

Answer

Configure the service connection to only allow deployments with tags.

Answer

Create an Azure Policy with the 'audit' effect to report non-compliant resources.

Answer

Configure a branch policy on the main branch to require tag verification in pull requests.

Question 18

Your build pipeline uses a self-hosted agent. The agent is running low on disk space. You need to clean up the agent's working directory after each build. Which option should you configure in the pipeline?

Accepted Answer

Use the 'clean' parameter in the checkout step of the YAML pipeline.. The `clean` parameter in the YAML checkout step is the native, built-in way to instruct the agent to delete the sources directory before or after the build. Setting `clean: true` or `clean: all` ensures the working directory is purged, directly addressing the low disk space issue without requiring additional tasks or marketplace extensions.

Answer

Set the 'Clean' option to 'Sources' in the pipeline settings.

Answer

Add a 'Delete Files' task at the end of the pipeline to delete the sources directory.

Answer

Add a 'Cleanup' task from the marketplace to clean the agent.

Question 19

An organization has multiple Git repositories. Developers often forget to update the repository README file after making changes. What is the most effective way to ensure the README is always up-to-date?

Accepted Answer

Add a task in the CI pipeline that checks if the README was modified. Adding a task in the CI pipeline that checks whether the README was modified directly enforces that developers include README updates in the same pull request that contains code changes. This ensures the README stays current with the codebase. In Azure Repos, CI pipelines can easily validate file changes using scripts or tasks. Option C (repository template) only ensures a README exists for new repositories but does not enforce updates after initial creation, so it does not address the core issue of keeping the README up-to-date over time.

Answer

Apply a label to PRs that touch certain files and require review

Answer

Use a repository template with a mandatory README file structure

Answer

Require a pull request comment that confirms README update

Question 20

Which TWO Azure DevOps features can be used to automate the process of updating work items when a build or release completes?

Accepted Answer

Pipeline task 'Update work item' from the Azure DevOps extension.. The 'Update work item' pipeline task, available via the Azure DevOps Extension, directly modifies work items as part of a build or release pipeline, providing native automation. Option B is correct because service hooks can trigger external processes (e.g., an Azure function) that update work items via the REST API, offering flexibility for custom logic. Option C is incorrect because release gates are designed to evaluate conditions (e.g., quality checks) and do not include built-in actions to directly update work items. Options D and E are unrelated; query charts are for visualization, and branch policies with required reviewers enforce code review, not work item updates.

Answer

Release gates with work item update actions.

Answer

Work item query charts.

Answer

Branch policy with required reviewers.