AZ-400 Practice Exam 56 — 20 Questions

Question 1

Your organization uses Azure DevOps Server (on-premises) and plans to migrate to Azure DevOps Services. You have hundreds of classic build and release pipelines. You need to design a migration strategy that minimizes downtime and allows for a gradual transition. The team wants to use the new YAML-based pipelines after migration. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Export the classic pipeline definitions as JSON, and manually recreate them as YAML pipelines in Azure DevOps Services.. Exporting classic pipeline definitions as JSON and manually recreating them as YAML pipelines in Azure DevOps Services allows for a gradual migration, minimizing downtime. The team can convert pipelines incrementally, ensuring familiarity with YAML syntax and validating each pipeline before moving the next. Option B is wrong because recreating all pipelines from scratch is inefficient, error-prone, and does not leverage the existing pipeline logic. Option C is wrong because the Azure DevOps Migration Tools are designed for data migration (work items, repos, etc.) and do not automatically convert classic pipelines to YAML. Option D is wrong because migrating pipelines as classic first and then planning a separate conversion project delays the adoption of YAML and introduces additional rework.

Answer

Recreate all pipelines from scratch using YAML in the new organization.

Answer

Use the Azure DevOps Migration Tools to automatically convert classic pipelines to YAML.

Answer

Migrate all pipelines as-is (classic) and then plan a separate project to convert them to YAML.

Question 2

Which THREE are benefits of using a monorepo with Azure Repos and CI/CD pipelines?

Accepted Answer

Easier code sharing across projects. A monorepo enables easier code sharing across projects by allowing multiple teams to reference the same source files, libraries, and modules without needing separate package feeds or cross-repo synchronization. In Azure Repos, this means you can use common build artifacts and shared code directly within the same repository, reducing duplication and simplifying collaboration.

Answer

Granular repository-level permissions

Answer

Faster build times due to smaller codebase

Question 3

You need to implement a strategy to manage secrets for your multi-stage YAML pipeline. The pipeline runs on Microsoft-hosted agents. Which approach should you use to securely pass secrets to pipeline tasks?

Accepted Answer

Use pipeline variables with 'secret: true' and reference them as $(variableName).. Azure Pipelines supports secret pipeline variables that are encrypted at rest and never exposed in logs or output. By defining a variable with `secret: true` in the YAML or via the UI, you can reference it securely as `$(variableName)` in tasks, ensuring the secret value is masked during execution.

Answer

Define the secrets as environment variables in the pipeline YAML directly.

Answer

Use the Azure Key Vault task to download secrets and then pass them as parameters.

Answer

Store secrets in a file in the repository and read it during the build.

Question 4

Which TWO of the following are valid ways to trigger a pipeline in Azure DevOps when a pull request is created?

Accepted Answer

Pull request trigger in YAML pipeline. Azure DevOps YAML pipelines support a `pr` trigger that automatically runs the pipeline when a pull request is created or updated. This trigger is defined directly in the YAML file and can be scoped to specific branches or paths, making it a native and flexible way to respond to PR events.

Answer

Scheduled trigger

Answer

Continuous integration trigger

Answer

Pipeline completion trigger

Question 5

Refer to the exhibit. You are reviewing the branch policies for the main branch in Azure Repos. The team reports that while the branch naming policy works, the approval policy does not block pull requests when only one person approves. What is the most likely cause?

Accepted Answer

The policy is not applied to the main branch. Option B is correct. If the minimum approver count policy is configured for a branch other than `main` (or is scoped to a different branch pattern), it will not apply to pull requests targeting `main`. The branch naming policy works because that is a repository-level setting that applies to all branches. There is no 'project-level' branch policy override in Azure Repos; branch policies are scoped to specific branches or patterns, and if multiple policies apply, all must be satisfied. A separate policy on main that allows one approval would not override an all-branches policy requiring two approvals — the stricter policy would still block. Therefore, the cause must be that the approval policy simply does not apply to main.

Answer

The policy is disabled in the settings

Answer

The main branch has a separate branch policy override that allows one approval

Answer

The 'creatorVoteCounts' setting is false, so the creator's approval is not counted

Question 6

A company's Azure DevOps project uses a custom agent pool with self-hosted agents. The security team discovers that pipeline runs can access secrets stored in Azure Key Vault, but the team wants to ensure that secrets are only accessible to approved pipelines. Which configuration should the team implement?

Accepted Answer

Use a library variable group linked to Key Vault and configure pipeline permissions with branch control.. The correct configuration is to create a library variable group linked to Azure Key Vault and then use pipeline permissions to grant access only to approved pipelines. This restricts secret access at the pipeline level. Branch-specific restrictions are not available on variable groups; to limit access by branch, the pipeline YAML must conditionally include the variable group (e.g., using an `if` expression based on the source branch) or separate pipelines must be used.

Answer

Store secrets directly in pipeline variables and use 'Make secrets available to all pipelines' setting.

Answer

Assign pipeline-level permissions to the Key Vault using Azure RBAC.

Answer

Limit the number of agents in the custom agent pool.

Question 7

You are reviewing an Azure Policy definition applied to an Azure DevOps project. The project has a build pipeline that deploys to production. What is the effect of this policy on the build pipeline?

Accepted Answer

The policy audits the pipeline but does not enforce any mandatory reviewers.. Azure Policy definitions applied to Azure DevOps projects use the 'audit' effect by default for policy types that do not support 'deny' or 'enforce' on build pipelines. Since the policy in question does not specify a mandatory reviewer requirement with enforcement, it only audits the pipeline's compliance without blocking execution. Therefore, the pipeline runs regardless, and the policy logs a compliance state.

Answer

The policy blocks the pipeline from running if fewer than two reviewers approve.

Answer

The policy requires two reviewers and blocks the pipeline if not met.

Answer

The policy does not apply to build pipelines because the field type is teamProjects.

Question 8

Refer to the exhibit. You have a YAML pipeline that references a repository resource with a tag. When will this pipeline trigger?

Accepted Answer

When changes are pushed to the main branch of the current repository.. By default, a YAML pipeline triggers on changes to the main branch of the repository where the pipeline definition resides, even when a repository resource with a tag is referenced. The tag in the repository resource only controls which version of the resource is used at runtime, not the trigger behavior. Without an explicit trigger section, the pipeline uses the default CI trigger on the main branch of the self-repo.

Answer

When a new tag v1.0 is pushed to the referenced repository.

Answer

When changes are pushed to any branch of the referenced repository.

Answer

The pipeline will never trigger because no trigger is defined.

Question 9

Your organization uses GitHub Enterprise and wants to prevent secrets (e.g., API keys) from being pushed to any repository. Which GitHub feature should you enable?

Accepted Answer

Push protection for secret scanning. Push protection for secret scanning (Option C) is the correct answer because it actively blocks pushes that contain known secrets (e.g., API keys, tokens) at the client side, preventing them from ever reaching the remote repository. This is a dedicated feature of GitHub Advanced Security that integrates with pre-receive hooks to scan commits in real time, rejecting the push if a secret pattern is detected. It is specifically designed to prevent secrets from being pushed, unlike passive scanning which only alerts after the fact.

Answer

Repository rulesets

Answer

GitHub Advanced Security secret scanning

Answer

Branch protection rules requiring signed commits

Question 10

Which THREE of the following are best practices for managing secrets in Azure Pipelines? (Select THREE.)

Accepted Answer

Use Azure Key Vault to store secrets and link them to variable groups.. Azure Key Vault is the recommended service for securely storing and managing secrets, keys, and certificates. By linking a Key Vault to a variable group in Azure Pipelines, you can reference secrets without exposing them in YAML or logs, and the pipeline retrieves them at runtime using a managed identity or service principal. This approach ensures secrets are never hardcoded and access can be audited and controlled centrally.

Answer

Hardcode secrets directly in the YAML file and use variable substitution at runtime.

Answer

Enable 'Allow scripts to access the OAuth token' for all build pipelines.

Question 11

Refer to the exhibit. You have this Azure Pipelines YAML definition. The pipeline runs manually, but you want it to automatically trigger on every push to the main branch and also build pull requests targeting main. Which change should you make?

Accepted Answer

Replace 'triggers: ["none"]' with 'triggers: ["main"]' and 'pr: ["none"]' with 'pr: ["main"]'.. In Azure Pipelines YAML, setting `triggers: ['none']` explicitly disables CI triggers, and `pr: ['none']` disables PR triggers. To enable automatic builds on every push to main and on pull requests targeting main, you must replace these with `triggers: ['main']` and `pr: ['main']`, which configures both CI and PR triggers for the main branch.

Answer

Remove the 'triggers' and 'pr' sections entirely.

Answer

Set 'triggers' to '["main"]' and 'pr' to '["none"]'.

Answer

Set 'triggers' to 'none' and 'pr' to 'none'.

Question 12

Match each Azure Monitor feature to its use case.

Accepted Answer

Log Analytics: Collects and queries log data from Azure resources.. The correct matches are Log Analytics for log collection and querying, Application Insights for live web application monitoring, and Azure Monitor Metrics for numeric performance data. The distractors swap the definitions of Log Analytics and Application Insights.

Answer

Log Analytics: Monitors live web applications.

Answer

Application Insights: Collects and queries log data.

Question 13

Match each Azure Test Plans concept to its definition.

Accepted Answer

Test Plan: A container for test suites and test cases that specifies test settings and test configurations.. In Azure Test Plans, a Test Plan is a container for test suites and test cases with settings. A Test Suite groups test cases. A Test Case has steps and expected results. A Test Run is an execution of test cases. A Test Point is a test case with a specific configuration.

Answer

Test Suite: A set of steps and expected results to validate a feature.

Answer

Test Case: A collection of test cases grouped together for execution.

Question 14

Your organization uses GitHub Enterprise and requires that all commits to the main branch are signed with a GPG key verified by your organization. Developers are getting errors when pushing signed commits. What is the most likely cause?

Accepted Answer

The developer's GPG key is not uploaded to their GitHub account or not verified.. GitHub requires that the GPG key used to sign a commit be uploaded to the user's GitHub account and marked as verified. If the key is missing or unverified, GitHub cannot confirm the signature's authenticity, causing the push to be rejected when branch protection rules enforce signed commits.

Answer

The branch protection rule requires a linear history.

Answer

The developer's email in the commit does not match any email on their GitHub account.

Answer

The developer's SSH key is not added to their GitHub account.

Question 15

Your organization uses GitHub Actions for CI/CD. You need to ensure that secrets used in workflows are not exposed in logs. What should you do?

Accepted Answer

Store the secret in GitHub Secrets and reference it as ${{ secrets.SECRET_NAME }}.. GitHub Secrets are encrypted environment variables that are automatically masked in workflow logs. When you reference a secret using the `${{ secrets.SECRET_NAME }}` syntax, GitHub Actions ensures the value is never printed in plain text, even if the workflow attempts to echo it. This is the built-in, secure method for handling sensitive data in CI/CD pipelines.

Answer

Encrypt the secret with a password before using it.

Answer

Use the 'echo' command to output the secret and then delete the log.

Answer

Disable logging on the self-hosted runner.

Question 16

Your company uses Microsoft Defender for Cloud to monitor Azure DevOps environments. You receive an alert that a service principal has excessive permissions. What is the first step you should take to investigate and remediate?

Accepted Answer

Review the Microsoft Entra ID audit logs for the service principal.. Reviewing the Microsoft Entra ID audit logs is the correct first step because it allows you to investigate the service principal's activity, such as which resources it accessed, when, and from where, before taking any remediation action. This forensic analysis is essential to understand the scope of the excessive permissions and to ensure that reducing permissions or other actions do not inadvertently disrupt legitimate operations. Without this step, you risk breaking functionality or missing evidence of misuse.

Answer

Reduce the service principal's permissions to the minimum required.

Answer

Immediately delete the service principal.

Answer

Reset the service principal's credentials.

Question 17

Refer to the exhibit. A developer queues a build with a variable 'BuildConfiguration' set to 'Release'. The pipeline definition has a default variable 'BuildConfiguration' set to 'Debug' and does not allow overrides at queue time. What will be the value of 'BuildConfiguration' during the build?

Accepted Answer

Debug. The pipeline definition does not allow overrides at queue time, so the variable value passed in the queue command is ignored; the default value 'Debug' is used.

Answer

Release

Answer

null

Answer

The build fails with an error

Question 18

Refer to the exhibit. An Azure DevOps administrator has configured the branch policy for the main branch as shown. A developer attempts to push a commit directly to the main branch. What will happen?

Accepted Answer

The push is rejected because branch policies require a pull request. The branch policy for the main branch requires that all changes be submitted via a pull request. When a developer attempts to push a commit directly to main, Azure Repos enforces this policy by rejecting the push. The push is blocked at the server level before any build validation or other checks occur.

Answer

The push triggers the build validation pipeline

Answer

The push is allowed because allowForcePush is false

Answer

The push is allowed because requireLinearHistory is false

Question 19

Your team uses Azure Pipelines to build a .NET application. You notice that the build takes 15 minutes because of dependency restoration. You want to cache the NuGet packages to speed up subsequent builds. Which task should you add to your pipeline?

Accepted Answer

Cache task with a key based on the package lock file. The Cache task (D) is the correct choice because it allows you to cache the NuGet packages folder (typically `~/.nuget/packages`) based on a key derived from the package lock file (e.g., `packages.lock.json`). This ensures that when the lock file hasn't changed, the cached packages are restored from the pipeline cache instead of being downloaded from the NuGet feed, significantly reducing build time. The key is computed from the lock file's content hash, so any change in dependencies automatically invalidates the cache.

Answer

DownloadBuildArtifacts task

Answer

NuGet restore task with the 'noCache' option set to false

Answer

DotNetCoreCLI task with the 'restore' command

Question 20

Which THREE of the following are valid methods to securely store and use secrets in Azure DevOps pipelines?

Accepted Answer

Azure Key Vault task in the pipeline. The Azure Key Vault task in a pipeline allows you to fetch secrets directly from an Azure Key Vault instance during pipeline execution. This task retrieves secret values as pipeline variables, ensuring they are never exposed in logs or YAML files, and it supports both Azure Resource Manager and service principal authentication for secure access.

Answer

Azure App Configuration with Key Vault references

Answer

Storing secrets in a pipeline YAML file with encryption