AZ-400 Practice Exam 52 — 20 Questions

Question 1

Your team uses GitHub Actions to build and deploy a Node.js application to Azure Functions. You need to implement a CI/CD pipeline that automatically deploys to a staging environment on every push to the main branch, and then promotes to production after a manual approval via GitHub Environments. The pipeline must also run unit tests and linting. You want to use the official Azure actions. What should you do?

Accepted Answer

Create a single GitHub Actions workflow with multiple jobs. Use a job for build and test, then a job for deploy to staging, and a job for deploy to production with an environment that requires approval.. Option C is correct because it uses a single workflow with jobs for build, test, and deploy, and uses environments for staging and production with required reviewers. Option A is incorrect because GitHub Actions does not use multi-stage YAML. Option B is incorrect because separate workflows cannot share artifacts easily. Option D is incorrect because Azure Pipelines is not GitHub Actions.

Answer

Create two separate workflows: one for CI (build, test, deploy staging) and one for CD (deploy production) that triggers manually.

Answer

Use a single workflow with a step that deploys to staging and then to production, using a condition to require manual approval via GitHub Issues.

Answer

Use Azure Pipelines with a multi-stage YAML pipeline that includes a stage for staging and a stage for production with pre-deployment approvals.

Question 2

Your organization uses GitHub for source control and Azure Pipelines for CI/CD. You have a monorepo with multiple projects. You need to design a pipeline that only builds and tests the projects that have changed in each commit. You want to minimize build time and avoid unnecessary runs. The pipeline should also handle dependencies between projects. Which approach should you use?

Accepted Answer

Configure path filters in the pipeline trigger, and use a custom script to detect dependencies and build only affected projects plus their dependents. Using path filters with dependency detection is efficient. Option B builds all projects, wasting time. Option C builds changed projects but ignores dependencies. Option D uses manual triggers, which is not automated.

Answer

Create a single pipeline that builds all projects on every commit

Answer

Use a single pipeline with a condition that checks which files changed and runs only the corresponding job

Answer

Create separate pipelines for each project and trigger them manually

Question 3

Your company uses Microsoft Sentinel for security monitoring. Azure DevOps pipelines deploy resources to production. You need to create an automated response that triggers when Sentinel detects a high-severity alert related to unauthorized pipeline changes. The response should temporarily disable the service connection used by the pipeline and notify the security team. What should you do?

Accepted Answer

Create a Sentinel playbook using Azure Logic Apps that calls the Azure DevOps REST API to update the service connection status.. Option C is correct because Sentinel playbooks (based on Logic Apps) can automate responses, including disabling service connections via Azure DevOps REST API. Option A is wrong because alerts alone don't run actions. Option B is wrong because service hooks trigger on events, not Sentinel alerts. Option D is wrong because Azure Policy can't disable service connections.

Answer

Configure a Sentinel analytics rule with the alert and use automated response to send an email.

Answer

Set up an Azure DevOps service hook that triggers on pipeline events.

Answer

Use Azure Policy to deny changes to service connections.

Question 4

You are designing a build pipeline for a Python application that uses multiple third-party packages from the public PyPI repository. Your organization has security policies that require all build dependencies to be scanned for known vulnerabilities before being used. The build pipeline runs on Microsoft-hosted agents. You need to integrate vulnerability scanning into the build pipeline with minimal overhead and without storing credentials in the pipeline. What should you do?

Accepted Answer

Add a dependency scanning task from the Azure DevOps marketplace to the build pipeline.. Option A is correct: Dependency scanning task (e.g., WhiteSource Bolt or GitHub Dependabot) integrates easily without credentials. Option B is incorrect because storing credentials in variables is not recommended. Option C is incorrect because custom scripts require maintenance and may not integrate well. Option D is incorrect because manual scanning defeats automation.

Answer

Configure a service connection to a private vulnerability database and use a script to scan.

Answer

Write a custom script that uses pip audit to scan the requirements.txt file.

Answer

Use a pre-build validation step in the pipeline to manually review dependencies.

Question 5

Your organization uses Azure Repos for source control and Azure Pipelines for CI/CD. You need to implement a policy that ensures every commit to the main branch is built and passes all tests before it can be merged. The team uses feature branches for development. What is the most efficient way to enforce this?

Accepted Answer

Configure a branch policy on the main branch that requires a successful build from a pull request trigger.. Option A is correct because branch policies on the main branch can require a successful build before merging. Option B is incorrect because pipeline triggers don't enforce merge requirements. Option C is incorrect because manual builds don't enforce. Option D is incorrect because it doesn't enforce before merge.

Answer

Require developers to manually run the pipeline before merging.

Answer

Use a pre-merge validation pipeline that runs on pull requests but does not block merging.

Answer

Set up a CI trigger on the main branch to run the pipeline on every commit.

Question 6

Your team uses GitHub Enterprise with GitHub Actions. Compliance requires that all contributors sign commits with a verified GPG key. You have enabled 'Require signed commits' on the repository. However, a developer reports that their commits are being rejected even though they have configured a GPG key. The error says 'Commit must have a valid signature.' The developer's GPG key is listed in their GitHub account settings. What is the most likely cause?

Accepted Answer

The developer's local Git email does not match the email associated with the GPG key in GitHub.. Option B is correct because GitHub requires the commit to be signed with the GPG key associated with the committer's email. If the email in the git config doesn't match the one in GitHub, the signature is considered unverified. Option A is wrong because SSH keys are not used for commit signing. Option C is wrong because GitHub supports GPG signing. Option D is wrong because the key is already associated.

Answer

The developer's GPG key has expired.

Answer

The developer's GPG key is not uploaded to GitHub.

Answer

GitHub only supports S/MIME, not GPG.

Question 7

Your Azure DevOps environment uses Microsoft Entra ID for authentication. You need to ensure that users from a partner organization can access only a specific Azure Boards project without being added to your tenant as guests. What should you do?

Accepted Answer

Invite the partner users as Microsoft Entra B2B guests and assign them to the project.. Option B is correct because Microsoft Entra B2B collaboration allows you to invite external users as guests, granting them access to specific resources like an Azure Boards project without fully adding them to your tenant. This meets the requirement of restricting access to only that project while avoiding permanent guest accounts in your directory.

Answer

Issue OAuth 2.0 tokens to the partner users.

Answer

Configure Microsoft Entra ID identity protection to allow the partner IP range.

Answer

Create service principals for the partner users.

Question 8

Which TWO are true about Azure Pipelines YAML templates? (Choose two.)

Accepted Answer

Template expressions are evaluated at compile time.. Option B is correct because template expressions in Azure Pipelines YAML are evaluated at compile time, before the pipeline runs. This allows the template to inject variables, conditions, and other logic into the pipeline definition statically, ensuring that the final pipeline structure is fully resolved before execution begins.

Answer

Templates must be stored in the same repository as the main pipeline.

Answer

Templates require parameters to be defined.

Answer

Templates can only define a single job.

Question 9

Which TWO of the following are valid ways to trigger a release pipeline in Azure DevOps? (Select TWO.)

Accepted Answer

Continuous deployment trigger after a build completes.. Option A is correct because Azure DevOps release pipelines can be configured with a continuous deployment trigger that automatically creates a release whenever a build artifact is successfully produced. This is a core feature for enabling automated delivery pipelines, where the release is triggered immediately after the build pipeline completes, ensuring rapid feedback and deployment.

Answer

Source version trigger.

Answer

Manual trigger via the 'Create release' button.

Answer

Pull request trigger.

Question 10

You need to integrate Azure Pipelines with GitHub to trigger a build when a release is published in GitHub. Which trigger type should you use in the pipeline?

Accepted Answer

resources:
  repositories:
    - repository: self
      type: github
      trigger:
        release: true. Option C is correct because Azure Pipelines supports a GitHub release trigger through the `resources` definition, where you specify a `trigger` with `release: true` under the repository configuration. This tells the pipeline to automatically start a build whenever a new release is published in the linked GitHub repository, which directly matches the requirement.

Answer

pr:

Answer

trigger:

Answer

schedules:

Question 11

Which THREE are valid deployment patterns for Kubernetes? (Choose three.)

Accepted Answer

Canary deployment. A canary deployment is a valid Kubernetes deployment pattern where a small subset of users (the 'canary') receives the new version of an application before a full rollout. This allows monitoring for issues with minimal impact, and Kubernetes supports this via techniques like multiple Deployments with shared labels and service mesh traffic splitting (e.g., Istio). It is a core strategy for progressive delivery in Kubernetes.

Answer

A/B testing deployment

Answer

Helm deployment

Question 12

Your team uses GitHub Issues to track work. You want to enforce that all new issues include a specific set of labels based on the issue type (bug, feature, task). What is the most efficient way to achieve this?

Accepted Answer

Create YAML-based issue forms in the .github/ISSUE_TEMPLATE folder.. Option C is correct because GitHub issue forms, defined as YAML files in the .github/ISSUE_TEMPLATE folder, allow you to create structured templates that can enforce required fields, including mandatory label assignments. When a user submits an issue via a form, the labels specified in the template are automatically applied, ensuring consistency without manual intervention or additional automation.

Answer

Configure branch protection rules to require label assignments.

Answer

Use a CODEOWNERS file to auto-assign labels.

Answer

Set up a repository ruleset to restrict label modifications.

Question 13

Which THREE are valid security best practices for Azure Pipelines? (Choose three.)

Accepted Answer

Restrict agent pool permissions to only necessary users. Option A is correct because restricting agent pool permissions to only necessary users follows the principle of least privilege, reducing the attack surface by ensuring only authorized personnel can register, manage, or use build agents. This prevents unauthorized access that could lead to code injection or credential theft.

Answer

Store secrets as plain text in YAML files

Answer

Run build agents on domain controllers

Question 14

A team wants to automatically destroy a temporary test environment after a pull request is merged or closed. What Azure DevOps feature should they use?

Accepted Answer

Environment with post-deployment approvals. Option A is correct because Azure DevOps Environments support post-deployment approvals and can be configured with a deployment job that automatically triggers resource cleanup when a pull request is merged or closed. By defining a 'destroy' job in the YAML pipeline that runs only on the 'post-deployment' trigger of an environment, the team can tear down the temporary test environment without manual intervention.

Answer

Branch policy with required reviewers

Answer

Pipeline trigger on branch deletion

Answer

Service hook to Azure Functions

Question 15

Which THREE of the following are true about GitHub Actions self-hosted runners?

Accepted Answer

They can have custom software installed.. Option A is correct because GitHub Actions self-hosted runners are machines you manage, allowing you to install any custom software, libraries, or tools required by your workflows. Unlike GitHub-hosted runners, which have a fixed set of pre-installed software, self-hosted runners give you full administrative control over the environment, enabling you to meet specific build or test dependencies.

Answer

They are automatically scaled by GitHub.

Answer

They are free and do not incur any costs.

Question 16

Your organization uses GitHub Copilot for pull request summaries. However, some developers report that the summaries are inaccurate. What should you do to improve the quality of Copilot-generated pull request summaries?

Accepted Answer

Ask developers to write clear, structured PR titles and descriptions.. Option B is correct because GitHub Copilot for pull request summaries relies on the PR title and description as primary input to generate accurate summaries. Clear, structured titles and descriptions provide better context for the AI model, reducing ambiguity and improving summary quality. Detailed commit messages (Option A) are not directly used by Copilot for PR summaries, as it focuses on the PR-level metadata.

Answer

Encourage developers to write more detailed commit messages.

Answer

Disable Copilot for pull requests and use manual summaries.

Answer

Provide a link to a documentation wiki in the PR description.

Question 17

Your team uses Azure Boards with a custom process. You need to ensure that when a bug is closed, it automatically triggers a new release pipeline. Which approach should you use?

Accepted Answer

Set up a Service Hook from Azure Boards to Azure Pipelines.. Service Hooks in Azure DevOps allow you to integrate Azure Boards with Azure Pipelines by subscribing to events like 'work item updated' or 'work item state changed'. When a bug is closed (state changed to 'Closed'), a Service Hook can automatically trigger a release pipeline, enabling event-driven automation without polling or custom code. This is the correct approach because it directly connects the work item state change to pipeline execution.

Answer

Configure a CI trigger in the release pipeline.

Answer

Add a release gate that checks for closed bugs.

Answer

Create an Azure Function that polls work items.

Question 18

Your team uses GitHub Actions for CI/CD. You need to ensure that secrets used in workflows are automatically rotated every 90 days. What is the best approach?

Accepted Answer

Use a script that calls the GitHub API to update the secret and run it in a scheduled workflow.. Option B is correct because it uses the GitHub API within a scheduled workflow to programmatically rotate secrets, ensuring automation without manual intervention. This approach directly addresses the requirement for automatic rotation every 90 days by generating new secret values and updating the repository or organization secrets via the API.

Answer

Use OpenID Connect (OIDC) to authenticate.

Answer

Manually update the secrets every 90 days.

Answer

Store secrets as environment secrets and configure expiration.

Question 19

Your team uses Azure Repos and wants to enforce that every commit message includes a work item ID. Which policy should you configure?

Accepted Answer

Branch policy to require linked work items.. Option C is correct because Azure Repos branch policies include a 'Require linked work items' setting that enforces every commit in a pull request to be associated with a work item. This ensures commit messages reference a work item ID, as the policy blocks pull requests without linked work items, directly meeting the requirement.

Answer

Repository settings to restrict file paths.

Answer

Branch policy to require a minimum comment length.

Answer

Pre-push Git hook.

Question 20

You are deploying an ARM template using the parameters file shown. The deployment fails with an error that the referenced secret cannot be found. What is the most likely cause?

Accepted Answer

The secret name in the parameters file does not match the actual secret name in Key Vault.. Option A is correct because the error 'referenced secret cannot be found' directly indicates that the secret name specified in the parameters file does not match the actual secret name stored in Azure Key Vault. ARM template deployment uses the `reference()` function to retrieve the secret value at deployment time, and if the secret name is misspelled or incorrect, the deployment fails with this specific error.

Answer

The Key Vault does not have an access policy granting the deployment user 'Get' secret permission.

Answer

The resource group 'rg-kv' does not exist.

Answer

The Key Vault is in a different region than the deployment.