AZ-400 Practice Test 8 — 10 Questions

Question 1

Which TWO tasks can be used to deploy an Azure Web App using YAML pipelines in Azure DevOps?

Accepted Answer

AzureWebApp. The AzureWebApp task is correct because it is the dedicated Azure DevOps YAML pipeline task for deploying code to an Azure Web App (App Service). It supports deployment methods like Web Deploy (msdeploy), Kudu REST API, and ZIP deploy, making it the standard choice for web app deployments.

Answer

CopyFilesOverSSH

Answer

AzureFunctionApp

Answer

AzureVMAppDeployment

Question 2

Your team uses GitHub for source control and Azure Pipelines for CI/CD. You need to ensure that only pull requests from specific branches trigger a build pipeline. Which trigger configuration should you use?

Accepted Answer

pr:
  branches:
    include:
      - main
      - develop. The `pr` trigger in Azure Pipelines controls which pull requests trigger a pipeline. By using `branches` with `include`, you specify that only PRs targeting the `main` and `develop` branches should trigger the build. This directly meets the requirement to restrict PR triggers to specific branches.

Answer

pr:
  paths:
    include:
      - main
      - develop

Answer

pr:
  branches:
    only:
      - main

Answer

trigger:
  branches:
    include:
      - main
      - develop

Question 3

Your company uses Azure Key Vault to store secrets. Which TWO actions should you take to ensure secure access? (Select TWO.)

Accepted Answer

Restrict access using Key Vault access policies. Restricting access using Key Vault access policies (Option A) is correct because Azure Key Vault uses a granular permission model where you assign specific permissions (e.g., GET, LIST, SET) to individual security principals (users, groups, or service principals) at the vault level. This ensures that only authorized identities can read or manage secrets, keys, and certificates, following the principle of least privilege. Using managed identities (Option B) is correct because they provide an automatically managed identity in Azure AD for applications to authenticate to Key Vault without storing credentials in code or configuration, eliminating the risk of secret leakage.

Answer

Enable HTTP access for performance

Answer

Disable audit logging to reduce exposure

Answer

Enable soft-delete to recover deleted secrets

Question 4

Your team uses Azure Pipelines to build a React application. The build process runs npm install, npm test, and npm run build. The build succeeds, but the application loads slowly in the browser due to large bundle sizes. What should you add to the pipeline to optimize the build?

Accepted Answer

Add a step to run Webpack bundle analyzer and implement code splitting.. The issue is large bundle sizes causing slow load times. Running Webpack bundle analyzer identifies which modules contribute most to the bundle, and implementing code splitting (e.g., dynamic imports or React.lazy) allows splitting the bundle into smaller chunks loaded on demand, reducing initial payload size.

Answer

Add a step to cache the node_modules folder.

Answer

Add a step to minify JavaScript using Terser.

Answer

Add a step to run additional unit tests to catch performance issues.

Question 5

Your release pipeline uses Azure Kubernetes Service (AKS) and Helm charts. You need to roll back to a previous release quickly if the new release fails health checks. What is the BEST approach?

Accepted Answer

Use Helm rollback command.. Helm provides a built-in `helm rollback ` command that reverts a release to a previous revision in a single, atomic operation. This is the fastest and most reliable method for rolling back a failed Helm-based deployment on AKS, as it directly restores the exact Kubernetes manifests and configuration from the specified revision without manual intervention.

Answer

Manually redeploy the previous Helm chart version.

Answer

Use a canary deployment strategy.

Answer

Use a Kubernetes Deployment rollout undo.

Question 6

Your team uses GitHub and wants to automatically detect exposed credentials in code. Which GitHub feature should you enable?

Accepted Answer

Secret scanning.. Secret scanning is the correct GitHub feature because it is specifically designed to automatically detect exposed credentials, tokens, and other secrets in code repositories. It scans for known patterns of sensitive data, such as AWS keys, GitHub tokens, and private keys, and alerts repository administrators when a match is found. This directly addresses the requirement to detect exposed credentials without needing custom workflows or additional configuration.

Answer

Code scanning.

Answer

Dependabot.

Answer

GitHub Actions.

Question 7

Refer to the exhibit. An Azure DevOps pipeline has the YAML configuration shown. A developer creates a pull request from a feature branch to the develop branch. What will happen?

Accepted Answer

The pipeline does not run automatically. The YAML configuration does not include a `trigger` or `pr` trigger, so by default the pipeline only runs on pushes to branches that have a pipeline configured, not on pull requests. Since the developer creates a PR from a feature branch to develop, and no trigger is defined for the feature branch or PR validation, the pipeline does not run automatically.

Answer

The pipeline runs only if the PR is merged

Answer

The pipeline runs as a CI build on the feature branch

Answer

The pipeline runs as a PR validation build

Question 8

You need to create a pipeline that triggers only when changes are made to files in the 'src/api' folder. Which trigger configuration should you use?

Accepted Answer

trigger: paths: include: - 'src/api/*'. The `trigger: paths: include: - 'src/api/*'` configuration tells Azure Pipelines to only trigger the pipeline when changes are detected in files matching that path pattern. This is the standard way to scope pipeline triggers to specific folders or file patterns in YAML pipelines, ensuring that unrelated changes elsewhere in the repository do not start the pipeline.

Answer

trigger: branches: include: - 'main'

Answer

trigger: paths: exclude: - 'src/api/*'

Answer

trigger: tags: include: - 'v*'

Question 9

Your organization uses GitHub Advanced Security. You need to ensure that secrets detected in pull requests automatically block the PR from merging. What should you configure?

Accepted Answer

Configure a custom secret scanning pattern and set the 'Block pull requests' property.. GitHub Advanced Security allows you to create custom secret scanning patterns with a 'Block pull requests' property. When enabled, this property prevents a pull request from being merged if the custom pattern detects a secret in the PR's changes, directly meeting the requirement to automatically block merging on secret detection.

Answer

Configure a code scanning query to detect secrets.

Answer

Enable secret scanning and set the severity to critical.

Answer

Enable push protection for secret scanning.

Question 10

You are deploying an ARM template using the parameters file shown. The deployment fails with an error that the referenced secret cannot be found. What is the most likely cause?

Accepted Answer

The secret name in the parameters file does not match the actual secret name in Key Vault.. The error 'referenced secret cannot be found' directly indicates that the secret name specified in the parameters file does not match the actual secret name stored in Azure Key Vault. ARM template deployment uses the `reference()` function to retrieve the secret value at deployment time, and if the secret name is misspelled or incorrect, the deployment fails with this specific error.

Answer

The Key Vault does not have an access policy granting the deployment user 'Get' secret permission.

Answer

The resource group 'rg-kv' does not exist.

Answer

The Key Vault is in a different region than the deployment.