AZ-400 Practice Test 9 — 10 Questions

Question 1

Your build pipeline uses a hosted agent. You notice that every build starts with a clean workspace, increasing build time. You want to improve performance by caching the Node.js 'node_modules' folder. Which task should you add to the pipeline?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cache task. The Cache task (option D) is correct because it allows you to cache the 'node_modules' folder between pipeline runs on hosted agents, avoiding the need to reinstall dependencies from scratch each time. By specifying a cache key (e.g., based on package-lock.json) and the path to cache, subsequent builds can restore the folder from cache, significantly reducing build time.

Answer

Publish Build Artifacts task

Answer

Copy Files task

Answer

Download Build Artifacts task

Question 2

Your team is migrating from TFVC to Git in Azure Repos. You need to preserve the full history of the TFVC repository, including all branches and changesets. The TFVC repository is large (over 10 GB). Which tool should you use to perform the migration?

Accepted Answer

Use git-tfs to clone the TFVC repository and then push to Azure Repos.. B is correct because git-tfs is specifically designed to bridge TFVC and Git, allowing you to clone a TFVC repository (including all branches, changesets, and history) into a local Git repository, which can then be pushed to Azure Repos. It handles large repositories (over 10 GB) by performing an incremental clone, preserving the full history without manual recreation.

Answer

Manually recreate the commits in a new Git repository.

Answer

Use git-svn to convert TFVC to Git.

Answer

Use the Azure DevOps Migration Tools to export TFVC to Git.

Question 3

Which TWO actions should a DevOps engineer take to ensure that Azure DevOps pipelines comply with the principle of least privilege for service connections?

Accepted Answer

Create a service principal with permissions scoped to the minimum required Azure resources.. Creating a service principal with permissions scoped to the minimum required Azure resources directly implements the principle of least privilege. By assigning only the necessary roles (e.g., Contributor on a specific resource group) to the service principal used in the service connection, you ensure that the pipeline can only perform actions on those resources, reducing the attack surface. This aligns with Azure RBAC best practices for securing automated deployments.

Answer

Use the Project Collection Build Service account for all pipeline runs.

Answer

Use Workload identity federation to avoid managing secrets.

Answer

Use the same service connection for both build and release pipelines.

Question 4

A development team uses Git for source control. They want to ensure that all code changes are reviewed before merging into the main branch. Which branch policy should they configure in Azure Repos?

Accepted Answer

Configure a branch policy that requires a minimum number of reviewers and resolves all comments.. Azure Repos branch policies allow you to enforce that pull requests require a minimum number of reviewers and that all comments are resolved before merging. This directly ensures that all code changes are reviewed and any feedback is addressed, meeting the team's requirement for mandatory code review before merging into the main branch.

Answer

Configure a branch policy that requires commit messages to follow a specific pattern.

Answer

Configure a branch policy that requires a successful build.

Answer

Configure a branch policy that requires linked work items.

Question 5

Refer to the exhibit. A developer runs 'git log --oneline --graph --decorate' and sees the output. Which Git workflow does this history most closely represent?

Accepted Answer

Git Flow. The output of `git log --oneline --graph --decorate` shows multiple long-lived branches (e.g., `develop`, `feature/*`, `release/*`, `hotfix/*`) with periodic merges back to `develop` and `main`. This branching structure with dedicated branches for features, releases, and hotfixes is the hallmark of Git Flow, which uses a strict branching model to manage releases and maintenance in parallel.

Answer

GitLab Flow

Answer

Trunk-based development

Answer

GitHub Flow

Question 6

Your organization is implementing a security compliance plan for Azure DevOps. Which TWO actions should you take to ensure that only authorized users can modify build pipelines?

Accepted Answer

Configure branch policies to require reviews for changes to pipeline YAML files. Branch policies in Azure Repos enforce required reviews for changes to YAML pipeline files stored in the repository. This ensures that any modification to the pipeline definition must be approved by authorized reviewers before merging, preventing unauthorized or accidental changes. Option C is correct because pipeline permissions in Azure DevOps allow you to restrict editing of a pipeline to specific security groups (e.g., 'Build Administrators'), directly controlling who can modify the pipeline through the web interface or API.

Answer

Require all users to use Personal Access Tokens (PATs)

Answer

Enable audit logging for all pipeline changes

Answer

Enable OpenID Connect (OIDC) for pipeline authentication

Question 7

Refer to the exhibit. The pipeline YAML includes an Azure CLI script that sets an app setting on a Web App. The pipeline fails with an authentication error. What is the most likely cause?

Accepted Answer

The pipeline does not have an Azure service connection configured for authentication.. The Azure CLI script in the pipeline attempts to run `az webapp config appsettings set`, which requires authentication to Azure. Without an Azure service connection configured in the pipeline, there is no authenticated session or service principal to authorize the command, resulting in an authentication error. The service connection provides the necessary credentials (e.g., via Azure AD) for the pipeline to interact with Azure resources.

Answer

The resource group name is incorrect.

Answer

The DEPLOYMENT_SLOT setting name is invalid.

Answer

The script syntax is invalid.

Question 8

You are a DevOps engineer for a company developing a mobile application. The source code is stored in Azure Repos (Git). The team uses trunk-based development with short-lived feature branches. Recently, developers have reported that their feature branch builds are taking over 30 minutes, whereas the main branch builds complete in under 10 minutes. The pipeline is defined in a YAML file and includes steps to restore NuGet packages, compile, run unit tests, and perform code analysis. The pipeline also publishes build artifacts. The main branch has a branch policy that requires a successful build before merging. The feature branches do not have branch policies. All builds run on Microsoft-hosted agents. Upon investigation, you notice that the feature branch builds are restoring all NuGet packages from scratch each time, while main branch builds use cached packages. Additionally, the code analysis tool is scanning the entire codebase, not just the changed files. You need to reduce the feature branch build time to under 15 minutes without compromising code quality. Which course of action should you take?

Accepted Answer

Enable pipeline caching for NuGet packages and configure the code analysis step to scan only changed files using path filters.. It directly addresses the two root causes of the slow feature branch builds: uncached NuGet package restores and full-codebase code analysis. Enabling pipeline caching (using the Cache@2 task) stores the NuGet packages folder (typically ~/.nuget/packages) and restores it on subsequent runs, eliminating redundant downloads. Configuring the code analysis step with path filters (e.g., using the 'changedFiles' condition or a custom script) ensures only modified files are scanned, drastically reducing analysis time without sacrificing quality.

Answer

Configure a self-hosted agent with pre-installed dependencies and a larger disk for faster I/O.

Answer

Remove the code analysis step from feature branch builds and only run it on main branch builds.

Answer

Increase the agent VM size to a more powerful SKU for feature branch builds.

Question 9

You have a YAML pipeline that builds a Java project using Maven. The pipeline uses a private artifact feed in Azure Artifacts. You need to authenticate to the feed from the pipeline. Which authentication method should you use?

Accepted Answer

Use the 'MavenAuthenticate' task with a settings.xml file.. The 'MavenAuthenticate' task is specifically designed to authenticate Maven builds against Azure Artifacts feeds. It injects credentials into a settings.xml file, which Maven uses to resolve dependencies from the private feed. This task handles the OAuth token exchange required for Azure DevOps authentication.

Answer

Use the 'PipAuthenticate' task with a pip.conf file.

Answer

Use the 'npmAuthenticate' task with a .npmrc file.

Answer

Use the 'NuGetAuthenticate' task with a nuget.config file.

Question 10

Which TWO GitHub Actions features can be used to enforce deployment approvals for a production environment? (Choose two.)

Accepted Answer

Deployment protection rules that require approval.. Deployment protection rules in GitHub Actions allow you to define required approvals before a workflow job can deploy to an environment. These rules are configured at the environment level and can mandate that a specific number of reviewers approve the deployment, effectively enforcing a manual approval gate for production environments.

Answer

The 'deployment' event trigger in a workflow.

Answer

Branch protection rules that require pull request reviews.

Answer

OpenID Connect (OIDC) for cloud provider authentication.