AZ-400 Practice Test 8 — 10 Questions

Question 1

Refer to the exhibit. An Azure DevOps pipeline has the YAML configuration shown. A developer creates a pull request from a feature branch to the develop branch. What will happen?

Accepted Answer

The pipeline does not run automatically. The YAML configuration does not include a `trigger` or `pr` trigger, so by default the pipeline only runs on pushes to branches that have a pipeline configured, not on pull requests. Since the developer creates a PR from a feature branch to develop, and no trigger is defined for the feature branch or PR validation, the pipeline does not run automatically.

Answer

The pipeline runs only if the PR is merged

Answer

The pipeline runs as a CI build on the feature branch

Answer

The pipeline runs as a PR validation build

Question 2

You need to create a pipeline that triggers only when changes are made to files in the 'src/api' folder. Which trigger configuration should you use?

Accepted Answer

trigger: paths: include: - 'src/api/*'. The `trigger: paths: include: - 'src/api/*'` configuration tells Azure Pipelines to only trigger the pipeline when changes are detected in files matching that path pattern. This is the standard way to scope pipeline triggers to specific folders or file patterns in YAML pipelines, ensuring that unrelated changes elsewhere in the repository do not start the pipeline.

Answer

trigger: branches: include: - 'main'

Answer

trigger: paths: exclude: - 'src/api/*'

Answer

trigger: tags: include: - 'v*'

Question 3

Your organization uses GitHub Advanced Security. You need to ensure that secrets detected in pull requests automatically block the PR from merging. What should you configure?

Accepted Answer

Configure a custom secret scanning pattern and set the 'Block pull requests' property.. GitHub Advanced Security allows you to create custom secret scanning patterns with a 'Block pull requests' property. When enabled, this property prevents a pull request from being merged if the custom pattern detects a secret in the PR's changes, directly meeting the requirement to automatically block merging on secret detection.

Answer

Configure a code scanning query to detect secrets.

Answer

Enable secret scanning and set the severity to critical.

Answer

Enable push protection for secret scanning.

Question 4

You are deploying an ARM template using the parameters file shown. The deployment fails with an error that the referenced secret cannot be found. What is the most likely cause?

Accepted Answer

The secret name in the parameters file does not match the actual secret name in Key Vault.. The error 'referenced secret cannot be found' directly indicates that the secret name specified in the parameters file does not match the actual secret name stored in Azure Key Vault. ARM template deployment uses the `reference()` function to retrieve the secret value at deployment time, and if the secret name is misspelled or incorrect, the deployment fails with this specific error.

Answer

The Key Vault does not have an access policy granting the deployment user 'Get' secret permission.

Answer

The resource group 'rg-kv' does not exist.

Answer

The Key Vault is in a different region than the deployment.

Question 5

Your build pipeline uses a hosted agent. You notice that every build starts with a clean workspace, increasing build time. You want to improve performance by caching the Node.js 'node_modules' folder. Which task should you add to the pipeline?

Accepted Answer

Cache task. The Cache task (option D) is correct because it allows you to cache the 'node_modules' folder between pipeline runs on hosted agents, avoiding the need to reinstall dependencies from scratch each time. By specifying a cache key (e.g., based on package-lock.json) and the path to cache, subsequent builds can restore the folder from cache, significantly reducing build time.

Answer

Publish Build Artifacts task

Answer

Copy Files task

Answer

Download Build Artifacts task

Question 6

Your team is migrating from TFVC to Git in Azure Repos. You need to preserve the full history of the TFVC repository, including all branches and changesets. The TFVC repository is large (over 10 GB). Which tool should you use to perform the migration?

Accepted Answer

Use git-tfs to clone the TFVC repository and then push to Azure Repos.. B is correct because git-tfs is specifically designed to bridge TFVC and Git, allowing you to clone a TFVC repository (including all branches, changesets, and history) into a local Git repository, which can then be pushed to Azure Repos. It handles large repositories (over 10 GB) by performing an incremental clone, preserving the full history without manual recreation.

Answer

Manually recreate the commits in a new Git repository.

Answer

Use git-svn to convert TFVC to Git.

Answer

Use the Azure DevOps Migration Tools to export TFVC to Git.

Question 7

Which TWO actions should a DevOps engineer take to ensure that Azure DevOps pipelines comply with the principle of least privilege for service connections?

Accepted Answer

Create a service principal with permissions scoped to the minimum required Azure resources.. Creating a service principal with permissions scoped to the minimum required Azure resources directly implements the principle of least privilege. By assigning only the necessary roles (e.g., Contributor on a specific resource group) to the service principal used in the service connection, you ensure that the pipeline can only perform actions on those resources, reducing the attack surface. This aligns with Azure RBAC best practices for securing automated deployments.

Answer

Use the Project Collection Build Service account for all pipeline runs.

Answer

Use Workload identity federation to avoid managing secrets.

Answer

Use the same service connection for both build and release pipelines.

Question 8

A development team uses Git for source control. They want to ensure that all code changes are reviewed before merging into the main branch. Which branch policy should they configure in Azure Repos?

Accepted Answer

Configure a branch policy that requires a minimum number of reviewers and resolves all comments.. Azure Repos branch policies allow you to enforce that pull requests require a minimum number of reviewers and that all comments are resolved before merging. This directly ensures that all code changes are reviewed and any feedback is addressed, meeting the team's requirement for mandatory code review before merging into the main branch.

Answer

Configure a branch policy that requires commit messages to follow a specific pattern.

Answer

Configure a branch policy that requires a successful build.

Answer

Configure a branch policy that requires linked work items.

Question 9

Refer to the exhibit. A developer runs 'git log --oneline --graph --decorate' and sees the output. Which Git workflow does this history most closely represent?

Accepted Answer

Git Flow. The output of `git log --oneline --graph --decorate` shows multiple long-lived branches (e.g., `develop`, `feature/*`, `release/*`, `hotfix/*`) with periodic merges back to `develop` and `main`. This branching structure with dedicated branches for features, releases, and hotfixes is the hallmark of Git Flow, which uses a strict branching model to manage releases and maintenance in parallel.

Answer

GitLab Flow

Answer

Trunk-based development

Answer

GitHub Flow

Question 10

Your organization is implementing a security compliance plan for Azure DevOps. Which TWO actions should you take to ensure that only authorized users can modify build pipelines?

Accepted Answer

Configure branch policies to require reviews for changes to pipeline YAML files. Branch policies in Azure Repos enforce required reviews for changes to YAML pipeline files stored in the repository. This ensures that any modification to the pipeline definition must be approved by authorized reviewers before merging, preventing unauthorized or accidental changes. Option C is correct because pipeline permissions in Azure DevOps allow you to restrict editing of a pipeline to specific security groups (e.g., 'Build Administrators'), directly controlling who can modify the pipeline through the web interface or API.

Answer

Require all users to use Personal Access Tokens (PATs)

Answer

Enable audit logging for all pipeline changes

Answer

Enable OpenID Connect (OIDC) for pipeline authentication