AZ-400 Practice Test 6 — 10 Questions

Question 1

Your team uses Azure Pipelines to build and deploy a web app. You want to send a notification to a Microsoft Teams channel when a build fails. What should you configure?

Accepted Answer

Use the built-in Azure Pipelines Teams integration to send a notification on build failure.. Azure Pipelines has a built-in integration with Microsoft Teams that allows you to subscribe to notifications for pipeline events, such as build failures, directly from the Azure DevOps interface. This integration uses a service hook to send adaptive cards to a Teams channel without requiring custom logic or additional tasks.

Answer

Add a task in the pipeline to send an email on failure.

Answer

Create a service hook to trigger an Azure Logic App that sends a Teams message.

Answer

Add a dashboard widget that shows build status.

Question 2

Your team uses Azure DevOps to deploy a Node.js web app to Azure App Service on Linux. The build pipeline runs `npm install` and `npm run build`, then publishes the `dist` folder. The release pipeline uses the 'Azure App Service deploy' task. Recently, deployments fail intermittently with 'ERR_MODULE_NOT_FOUND' for a custom module. The module is listed in `package.json` and is present in the `node_modules` folder on the build agent. What is the most likely cause?

Accepted Answer

The build artifact does not include node_modules; the app requires them at runtime.. The most likely cause is that the build artifact does not include the `node_modules` folder. The build pipeline runs `npm install` and `npm run build`, which installs dependencies on the build agent, but only the `dist` folder is published as the artifact. At deployment time, the Azure App Service on Linux expects the `node_modules` folder to be present in the deployed artifact because it does not automatically run `npm install` for Node.js apps on Linux (unlike Windows-based App Services). Without `node_modules`, the app cannot resolve custom modules at runtime, leading to the `ERR_MODULE_NOT_FOUND` error.

Answer

The 'Azure App Service deploy' task modifies package.json during deployment.

Answer

The 'Azure App Service deploy' task runs npm install on the target, but it fails due to network restrictions.

Answer

The deployment slot's Kudu service fails to sync the dist folder.

Question 3

Your team uses Azure Pipelines to deploy to multiple environments. You need to ensure that deployment to the production environment requires approval from the security team. What should you configure?

Accepted Answer

Add an environment approval check for the production environment. Environment approval checks in Azure Pipelines allow you to require manual approval before a deployment proceeds to a specific environment, such as production. By adding an approval check to the production environment, you ensure that the security team must explicitly approve the deployment, meeting the requirement without modifying the pipeline code or branch policies.

Answer

Add a branch policy to the production branch

Answer

Use a condition in the YAML pipeline to check a variable

Answer

Configure a service connection with restricted permissions

Question 4

Which TWO compliance frameworks are directly supported by Microsoft Purview Compliance Manager for Azure DevOps?

Accepted Answer

ISO 27001. Microsoft Purview Compliance Manager directly supports ISO 27001 and SOC 2 as built-in compliance templates for Azure DevOps. These frameworks are pre-configured with control mappings, assessment templates, and automated testing actions that align with Azure DevOps security and audit capabilities. This allows organizations to continuously monitor and manage compliance posture against these standards without manual configuration.

Answer

HIPAA

Answer

PCI DSS

Answer

FedRAMP High

Question 5

An organization uses Azure DevOps and wants to implement a change management process where all changes to the main branch require approval from a change advisory board (CAB). The CAB members are not part of the development team. How should they configure this?

Accepted Answer

Create a new branch policy on main that requires a minimum number of reviewers from a separate CAB group.. Azure DevOps branch policies allow you to enforce a minimum number of reviewers from a specific security group (e.g., a CAB group) on pull requests targeting the main branch. This ensures that every change to main requires explicit approval from CAB members, who are separate from the development team, without relying on manual processes or altering team membership.

Answer

Set branch permissions to restrict push to main and only allow CAB to approve via manual process.

Answer

Use a service hook to notify CAB when a PR is created, and rely on manual approval.

Answer

Add the CAB as members of the development team and require team review.

Question 6

Your organization uses Microsoft Purview to classify and protect sensitive data. You need to ensure that source code in Azure DevOps repositories containing credit card numbers is detected and flagged. What should you configure?

Accepted Answer

Configure a Microsoft Purview Data Classification scan for Azure DevOps repositories.. Microsoft Purview Data Classification scans can be configured to scan Azure DevOps repositories for sensitive data types, such as credit card numbers, using built-in or custom sensitive information types. This allows the organization to detect and flag source code containing credit card numbers directly within the repository, aligning with the requirement to classify and protect sensitive data under a compliance plan.

Answer

Create a Data Loss Prevention (DLP) policy in Microsoft 365.

Answer

Set up Microsoft Sentinel to monitor Azure DevOps logs.

Answer

Enable Microsoft Defender for Cloud to scan repositories.

Question 7

You are implementing a CI pipeline for a Node.js application. The pipeline must run unit tests and generate code coverage reports. You want to publish the coverage results to Azure DevOps and enforce a minimum coverage threshold of 80%. Which tasks should you use?

Accepted Answer

Use the Publish Code Coverage Results task and configure the threshold in the task settings.. The Publish Code Coverage Results task is specifically designed to publish code coverage data (e.g., Cobertura or JaCoCo XML reports) to Azure DevOps and supports configuring a minimum coverage threshold directly in its settings. This meets both requirements: publishing results and enforcing the 80% threshold. Other tasks like Publish Test Results or Publish Build Artifacts do not natively handle coverage threshold enforcement.

Answer

Use the Publish Test Results task to publish coverage data.

Answer

Use the Publish Build Artifacts task with coverage files.

Answer

Use the Copy Files task to copy coverage files and then the Publish Build Artifacts task.

Question 8

Which TWO features in Azure Pipelines allow you to enforce separation of duties between development and operations teams? (Choose two.)

Accepted Answer

Approvals and checks on environments. Approvals and checks on environments (B) enforce separation of duties by requiring designated approvers (e.g., operations team members) to approve a deployment before it proceeds, ensuring that development cannot directly push to production. Environment security roles (D) allow you to define who can create, view, or manage environments, restricting developers from modifying production environments without operations oversight.

Answer

Pipeline decorators

Answer

Service connections with different scopes

Answer

Branch policies on the main branch

Question 9

Your team uses GitHub repositories and wants to ensure that all code changes are signed by a verified contributor before merging. Which branch protection rule should you enable?

Accepted Answer

Require signed commits. Requiring signed commits ensures that each commit is cryptographically verified using a GPG or S/MIME key linked to the contributor's GitHub account. This enforces non-repudiation and confirms the identity of the author, directly addressing the requirement that all code changes be signed by a verified contributor before merging.

Answer

Require pull request reviews before merging

Answer

Require linear history

Answer

Restrict who can push to matching branches

Question 10

You need to ensure that only specific branches can trigger a release to production in Azure Pipelines. What should you configure?

Accepted Answer

Add a branch filter to the release pipeline's artifact trigger.. A branch filter on the release pipeline's artifact trigger allows you to specify which branches of the source artifact (e.g., a build pipeline) should automatically trigger a release. By configuring this filter to only include branches like 'main' or 'release/*', you ensure that only builds from those specific branches can initiate a release to production, providing precise control over deployment triggers.

Answer

Add an approval gate that requires a manager to approve the release.

Answer

Add a deployment gate that checks the source branch.

Answer

Add a branch filter to the build pipeline trigger.