AZ-400 Practice Exam 53 — 20 Questions

Question 1

You have the YAML pipeline snippet shown in the exhibit. The first run produces version 1.0.0. What will be the version produced on the third run?

Accepted Answer

1.0.2. The YAML pipeline uses a counter expression `$[counter(format('{0}.{1}', variables['major'], variables['minor']), 0)]` for the patch version. The counter starts at 0 for the first run, producing version 1.0.0. Each subsequent run increments the counter by 1, so the second run produces 1.0.1, and the third run produces 1.0.2. Therefore, option C is correct.

Answer

1.0.1

Answer

1.0.3

Answer

1.0.0

Question 2

Refer to the exhibit. You apply this Azure Policy to a subscription. A developer attempts to deploy a VM with SKU Standard_D2s_v3. What is the result?

Accepted Answer

The deployment is allowed because the SKU matches the pattern.. The policy uses a deny effect with a notMatch condition on the VM SKU field, matching the pattern 'Standard_D*'. Since the attempted SKU 'Standard_D2s_v3' matches the pattern, the condition evaluates to false, so the deny effect does NOT apply. The deployment is allowed. The 'deny' effect only blocks when the condition is true, which would be for SKUs that do NOT match the pattern.

Answer

The deployment is denied only if the VM is in a specific resource group.

Answer

The deployment is denied because the SKU matches the pattern.

Answer

The deployment is allowed and a non-compliance event is logged.

Question 3

You are designing a pipeline that must run tasks in a container. The container needs access to Azure resources using a managed identity. Which two configurations are required? (Choose two.)

Accepted Answer

Enable a system-assigned managed identity on the agent VM.. Enabling a system-assigned managed identity on the agent VM allows the container job to use the Azure Instance Metadata Service (IMDS) endpoint to obtain tokens for authenticating to Azure resources without storing credentials. Option D is incorrect because Azure Pipelines container job resource definitions do not have an 'identity' field; the identity is inherited from the agent VM.

Answer

Use the 'docker login' command in the pipeline.

Answer

Add a service principal connection to the pipeline.

Answer

Set the 'identity' field in the container resource definition.

Answer

Use the Azure CLI task with '–identity' flag.

Question 4

Your team uses GitHub Actions for CI/CD. You need to enforce that all pull requests to the main branch pass a required status check that runs a security scan. The security scan is a GitHub Action that runs on pull_request events. However, the status check is not appearing as required in the branch protection rules. What should you do?

Accepted Answer

Ensure the workflow has a name that matches the status check name in the branch protection rule.. GitHub branch protection rules require the status check name to exactly match the workflow name (or the job name within the workflow) as it appears in the GitHub Actions UI. If the names do not match, the check will not appear as an option in the required status checks list. The security scan action runs on pull_request events, so the status check is generated, but the mismatch prevents it from being selectable as a required check.

Answer

Add 'types: [opened, synchronize]' to the pull_request trigger.

Answer

Change the trigger from 'pull_request' to 'pull_request_target'.

Answer

Use a GitHub App instead of the default GITHUB_TOKEN for the action.

Question 5

Your organization uses GitHub and wants to ensure that all commits to the main branch are associated with a GitHub issue. Which three settings should you configure?

Accepted Answer

Require status checks to pass before merging. Requiring status checks to pass before merging can include a custom status check that validates that a pull request is linked to a GitHub issue, directly enforcing association. Option D is correct because requiring pull request reviews before merging forces all changes to go through a pull request, which must be linked to a GitHub issue to satisfy the review process, ensuring traceability. Option A is incorrect because requiring conversation resolution only ensures comments are resolved, not that commits are associated with an issue. Options C and E are irrelevant to issue association.

Answer

Require conversation resolution before merging

Answer

Allow force pushes

Answer

Allow deletions

Question 6

You are setting up a GitHub Actions workflow to deploy an Azure Resource Manager (ARM) template. The workflow must run whenever a pull request is opened against the main branch. Which trigger should you use?

Accepted Answer

pull_request: branches: [main] types: [opened]. The `pull_request` trigger with `branches: [main]` and `types: [opened]` ensures the workflow runs only when a pull request targeting the `main` branch is newly opened. This is the correct trigger for the stated requirement. Note that `pull_request` events from forks run with limited permissions and do not have access to repository secrets by default, which is a safety measure. If secrets are required for deployment, additional configuration such as using `pull_request_target` (with caution) or environment-scoped secrets would be necessary, but the trigger itself remains `pull_request`.

Answer

pull_request_target: branches: [main]

Answer

workflow_dispatch

Answer

push: branches: [main]

Question 7

Your organization wants to enforce that all commits to the main branch are signed using GPG or S/MIME. Which GitHub feature should you enable?

Accepted Answer

Configure a branch protection rule that requires signed commits.. GitHub branch protection rules include a 'Require signed commits' setting that enforces all commits pushed to the protected branch must be signed with a verified GPG or S/MIME key. This ensures commit integrity and non-repudiation directly at the repository level, without requiring external scripts or API calls.

Answer

Use the GitHub API to check commit signatures after push.

Answer

Enable the 'Include administrators' setting in branch protection.

Answer

Require SSH key authentication for all users.

Question 8

Which TWO actions should you take to implement a gated deployment strategy in Azure Pipelines?

Accepted Answer

Use deployment gates to evaluate metrics like error rate before allowing the next stage.. Deployment gates in Azure Pipelines allow you to define pre-deployment or post-deployment conditions that evaluate external metrics (e.g., error rate from Azure Monitor, Application Insights, or other monitoring systems) before allowing the release to proceed to the next stage. This is a core mechanism for implementing a gated deployment strategy, as it automatically pauses the pipeline until the specified health criteria are met, ensuring that only healthy releases progress. Option E is correct because manual approval checks act as a human-driven gate, requiring explicit sign-off before a deployment proceeds to production, which is a common pattern in gated deployments to add oversight.

Answer

Configure a dashboard to monitor application health.

Answer

Use a multi-stage YAML pipeline.

Answer

Configure a rollback strategy if deployment fails.

Question 9

You are configuring a continuous integration trigger in Azure Pipelines for a repository in Azure Repos. You want to trigger a build for all branches except the 'release' branch. How should you configure the trigger?

Accepted Answer

Set trigger: branches: exclude: - release. In Azure Pipelines YAML triggers, the 'include' list is optional. If no include is specified, all branches are considered for triggering, and the 'exclude' list removes the specified branches. Therefore, 'trigger: branches: exclude: - release' correctly triggers on all branches except 'release'. The marked answer C also works, but D is the simpler and standard configuration.

Answer

Set trigger: branches: include: - main

Answer

Set trigger: branches: include: - '*' exclude: - '*'

Answer

Set trigger: branches: include: - '*' exclude: - release

Question 10

You want to trigger a pipeline automatically when a new tag is pushed to a GitHub repository. Which trigger should you configure in the pipeline YAML?

Accepted Answer

trigger: tags:. The `trigger` block in Azure Pipelines YAML supports a `tags` filter that instructs the pipeline to run automatically when a Git tag matching the specified pattern is pushed. By configuring `trigger: tags: include: ['*']` or a specific tag pattern, the pipeline will start on any new tag push to the GitHub repository, which is the exact requirement.

Answer

pr:

Answer

schedules:

Answer

resources: pipelines:

Question 11

Your organization uses Azure Repos and has multiple Git repositories that share common code. You want to enable code reuse across these repositories without duplicating code. Which strategy should you use?

Accepted Answer

Reference the shared repository as a Git submodule. Git submodules allow you to include a specific commit of a shared repository as a subdirectory within multiple parent repositories, enabling code reuse without duplication. When the shared code is updated, you can pull the latest commit into each parent repository, maintaining a clear link between the parent and the shared codebase. This is the native Git mechanism for referencing external repositories while preserving version control history.

Answer

Use Git subtrees to merge the shared code into each repository

Answer

Publish the shared code as a NuGet package

Answer

Add the shared repository as an upstream source in Azure Artifacts

Question 12

A financial services company uses Azure DevOps and requires that all secrets (e.g., API keys, connection strings) be stored in Azure Key Vault. They have a pipeline that runs automated tests and deploys to staging. The pipeline uses a variable group linked to Key Vault to retrieve secrets. Recently, the pipeline failed with the error: 'Secret 'DbPassword' not found in Key Vault 'kv-prod'. Ensure the secret exists and the service principal has List permission.' The secret exists in the vault. What is the most likely cause?

Accepted Answer

The variable name in the variable group does not exactly match the secret name in Key Vault (case-sensitive).. Variable groups linked to Azure Key Vault in Azure DevOps require an exact case-sensitive match between the variable name in the variable group and the secret name in Key Vault. Even though the secret 'DbPassword' exists in the vault, if the variable group defines the variable as 'dbpassword' or 'DBPassword', the lookup will fail with the 'not found' error. The error message explicitly states the secret was not found, which is the typical symptom of a case mismatch, not a permissions or connectivity issue.

Answer

The variable group is linked to the wrong Key Vault instance.

Answer

The service principal does not have Get permission on the secret.

Answer

The Key Vault is in a different Azure region than the Azure DevOps organization.

Question 13

You need to enforce that every commit in your repository is associated with a work item in Azure Boards. Which mechanism should you use?

Accepted Answer

Configure a branch policy to require linked work items. Azure Repos branch policies include a setting to 'Require linked work items', which enforces that every pull request (and by extension, every commit merged through that PR) is associated with a work item in Azure Boards. This policy is enforced server-side at merge time, ensuring no commit can be merged without a linked work item, regardless of how the commit message is formatted.

Answer

Use commit messages with work item IDs

Answer

Deploy a custom Git hook on the server

Answer

Use the 'Require status checks' policy

Question 14

You have a YAML pipeline that builds a .NET application. You need to ensure that the pipeline uses the .NET SDK version 6.0.x. Which task should you add to the pipeline?

Accepted Answer

UseDotNet@2. The UseDotNet@2 task is the correct choice because it explicitly installs a specific .NET SDK version (6.0.x) on the build agent, ensuring the pipeline uses the required SDK for building the .NET application. This task downloads and caches the SDK, making it available for subsequent tasks like DotNetCoreCLI@2.

Answer

NuGetToolInstaller@1

Answer

DotNetCoreCLI@2

Answer

PowerShell@2

Question 15

Your GitHub organization has multiple repositories that share common CI/CD workflows. You want to centralize these workflows to reduce duplication. Which TWO approaches are valid?

Accepted Answer

Create reusable workflows in a central repository and use the 'uses' keyword in each repository's workflow to reference them.. GitHub Actions supports reusable workflows that can be stored in a central repository and referenced from other repositories using the 'uses' keyword with the syntax 'owner/repo/.github/workflows/workflow.yml@ref'. This allows teams to define common CI/CD logic once and invoke it across multiple repositories, reducing duplication and simplifying maintenance.

Answer

Store the workflows in a central repository and use Git submodules to include them in each repository.

Answer

Use branch protection rules to enforce that all workflows must be reviewed by a central team.

Answer

Publish the workflows as a GitHub Actions workflow library and install it in each repository.

Question 16

Your team uses Azure Boards with a Kanban board. You want to limit the number of work items in the 'In Progress' column to prevent bottlenecks. What should you configure?

Accepted Answer

Column limits on the Kanban board. Column limits on the Kanban board directly enforce work-in-progress (WIP) constraints by capping the number of work items allowed in a specific column, such as 'In Progress'. This prevents bottlenecks by signaling the team to complete existing work before pulling new items, aligning with Lean and Kanban principles. Azure Boards supports this configuration through the board settings, where you can set a maximum limit per column.

Answer

Branch policies

Answer

Backlog level settings

Answer

Work item rules

Question 17

You are designing a release pipeline for a microservices application deployed to Azure Kubernetes Service (AKS). You need to implement a strategy that allows rolling back to the previous version quickly if a deployment fails. The pipeline should also support canary deployments. Which tool or feature should you use?

Accepted Answer

Helm package manager with Helm deploy task.. Helm is the correct choice because it provides native support for rollbacks via `helm rollback`, which can revert a release to a previous revision quickly. Additionally, Helm supports canary deployments through its upgrade strategy (e.g., `--set canary.enabled=true`) and integration with tools like Flagger or Argo Rollouts, enabling fine-grained traffic shifting. The Helm deploy task in Azure Pipelines wraps these capabilities, making it the most suitable tool for both rollback and canary requirements.

Answer

Terraform with Kubernetes provider.

Answer

Azure Pipelines Kubernetes manifest task with kubectl apply.

Answer

Kubectl task with rolling update strategy.

Question 18

Your team is implementing a security and compliance plan for Azure DevOps. Which TWO actions should you take to meet regulatory requirements for audit logging and access control?

Accepted Answer

Enable Azure DevOps audit log to track changes to security policies and user permissions.. Enabling the Azure DevOps audit log (option B) is essential for regulatory compliance because it records changes to security policies, user permissions, and other critical events, providing an immutable trail for forensic analysis and reporting. This directly meets audit logging requirements by capturing who did what and when, which is necessary for standards like SOC 2, ISO 27001, or GDPR.

Answer

Enable anonymous access to project boards for external stakeholders.

Answer

Grant all users Project Collection Administrator role to simplify access management.

Answer

Disable auditing for the project to reduce log volume.

Question 19

Your Azure DevOps pipeline deploys to multiple environments (Dev, Test, Prod) using YAML multi-stage pipelines. The Prod deployment requires manual approval. However, the approval gate shows 'Pending' even after an authorized user approves. What is the most likely cause?

Accepted Answer

The approval gate is configured to require approval on the latest commit, but a newer commit was pushed after the approval.. In Azure DevOps, approvals are associated with a specific pipeline run and its commit. When a new commit is pushed after an approval, it triggers a new pipeline run. The new run has its own approval requirement, so it remains 'Pending' until approved. The previous approval does not carry over to the new run.

Answer

The pipeline run was triggered by a PR merge, and the approval needs to be re-applied after the build completes.

Answer

The build pipeline includes a step that modifies the approval settings.

Answer

The approver is not a member of the security group defined in the approval settings.

Question 20

Your team uses Azure DevOps and wants to enforce that all work items must be linked to a pull request before merging. Additionally, the pull request must be approved by at least two reviewers. Which two branch policies should you enable?

Accepted Answer

Require a minimum number of reviewers. The 'Require a minimum number of reviewers' policy enforces that a pull request must be approved by at least two reviewers before it can be completed. Option C is correct because the 'Check for linked work items' policy ensures that every pull request is associated with a work item, which satisfies the requirement that all work items must be linked to a pull request before merging.

Answer

Automatically update work items

Answer

Build validation

Answer

Comment resolution