AZ-400 Design and implement a DevOps infrastructure — 20 Questions

Question 1

A team wants to enforce that all Azure resource groups in a subscription are tagged with 'CostCenter' and 'Environment'. They need a solution that automatically applies these tags to any new resource group and ensures compliance without manual intervention. What should they use?

Accepted Answer

Azure Policy. Azure Policy is the correct choice because it allows you to define and enforce tagging rules at scale. By creating a policy that requires 'CostCenter' and 'Environment' tags on resource groups, and setting the policy effect to 'deny' or 'append' (to automatically add missing tags), any new resource group creation that violates the policy is blocked or automatically remediated, ensuring compliance without manual intervention.

Answer

Azure RBAC

Answer

Azure Blueprints

Answer

Azure Resource Graph

Question 2

A company uses Azure DevOps for CI/CD. They have multiple pipelines that deploy to different environments. They want to ensure that secrets like API keys are not exposed in pipeline logs. What is the best approach?

Accepted Answer

Create a Variable Group linked to Azure Key Vault. Option C is correct because Variable Groups linked to Azure Key Vault securely store secrets and can be referenced in pipelines without exposing values. Option A is wrong because pipeline variables can be set as secret but still need secure storage. Option B is wrong because Azure App Configuration can store secrets but is less integrated for secret management. Option D is wrong because environment secrets are for Kubernetes, not general pipeline secrets.

Answer

Use Azure App Configuration with Key Vault references

Answer

Use Azure Kubernetes Service secrets

Answer

Use pipeline variables marked as 'secret'

Question 3

A company uses Azure Pipelines to build a .NET Core application. The build takes 45 minutes due to dependency restoration. They want to reduce build time. What is the most effective strategy?

Accepted Answer

Cache the NuGet packages and enable caching in the pipeline. Caching NuGet packages in Azure Pipelines is the most effective strategy because dependency restoration is the primary bottleneck, often downloading hundreds of packages from nuget.org. By caching the ~/.nuget/packages folder, subsequent builds skip the network download entirely, reducing the 45-minute build time to minutes. This directly addresses the root cause—repetitive package restoration—without requiring additional infrastructure or parallelism.

Answer

Use parallel jobs in the pipeline

Answer

Use a self-hosted agent with more CPU

Answer

Enable incremental builds

Question 4

A team wants to automatically destroy a temporary test environment after a pull request is merged or closed. What Azure DevOps feature should they use?

Accepted Answer

Environment with post-deployment approvals. Option A is correct because Azure DevOps Environments support post-deployment approvals and can be configured with a deployment job that automatically triggers resource cleanup when a pull request is merged or closed. By defining a 'destroy' job in the YAML pipeline that runs only on the 'post-deployment' trigger of an environment, the team can tear down the temporary test environment without manual intervention.

Answer

Branch policy with required reviewers

Answer

Pipeline trigger on branch deletion

Answer

Service hook to Azure Functions

Question 5

A company uses Azure Pipelines to deploy a web app to Azure App Service. They want to ensure that the deployment is first validated in a staging slot before swapping to production. What should they configure?

Accepted Answer

Use deployment slots in the App Service and configure auto-swap. Option C is correct because Azure App Service deployment slots allow you to deploy a web app to a staging slot, validate it, and then swap it to production with zero downtime. Auto-swap automates this process by swapping the staging slot into production after a successful deployment, ensuring validation occurs before the production slot receives the new code.

Answer

Create two separate pipelines for staging and production

Answer

Use Azure Traffic Manager to route traffic

Answer

Use an App Service plan with multiple instances

Question 6

A team uses Terraform to manage Azure infrastructure. They want to store the Terraform state file securely and enable collaboration. What is the recommended approach?

Accepted Answer

Store the state file in an Azure Storage account with state locking enabled. Storing the Terraform state file in an Azure Storage account with state locking enabled is the recommended approach because it provides a centralized, durable backend that supports native state locking via Azure Blob Storage leases. This prevents concurrent modifications and state corruption, enabling safe collaboration among team members. Azure Storage also offers encryption at rest and access control via RBAC, aligning with security best practices for infrastructure-as-code.

Answer

Store the state file in a local folder and commit to Git

Answer

Store the state file in Terraform Cloud

Answer

Store the state file in a Git repository with manual locking

Question 7

A company uses Azure DevOps to manage code. They want to enforce that all changes to the main branch must go through a pull request with at least two reviewers. What should they configure?

Accepted Answer

Branch policy on the main branch. Branch policies in Azure DevOps allow you to enforce requirements on pull requests targeting a specific branch. By configuring a branch policy on the main branch, you can require a minimum number of reviewers (e.g., two) and mandate that all changes must go through a pull request. This ensures that no direct commits bypass the review process.

Answer

Add a tag to the main branch

Answer

Repository permissions

Answer

Configure a service hook

Question 8

A company uses Azure Pipelines to deploy microservices to Azure Kubernetes Service (AKS). They want to implement a canary deployment strategy. What should they use?

Accepted Answer

Use Kubernetes native deployment strategies with multiple replica sets and traffic splitting. Option A is correct because Kubernetes natively supports canary deployments by running multiple replica sets of the same application and using a service mesh or ingress controller (e.g., Istio, NGINX Ingress) to split traffic between the stable and canary versions. Azure Pipelines can orchestrate this by updating the canary deployment and adjusting traffic weights gradually, enabling controlled rollouts and rollbacks without external routing services.

Answer

Use Azure Front Door to route traffic between clusters

Answer

Use deployment slots in Azure App Service

Answer

Use Azure Container Instances as a staging environment

Question 9

Which THREE of the following are valid methods to securely store and use secrets in Azure DevOps pipelines?

Accepted Answer

Azure Key Vault task in the pipeline. Option A is correct because the Azure Key Vault task in a pipeline allows you to fetch secrets directly from an Azure Key Vault instance during pipeline execution. This task retrieves secret values as pipeline variables, ensuring they are never exposed in logs or YAML files, and it supports both Azure Resource Manager and service principal authentication for secure access.

Answer

Azure App Configuration with Key Vault references

Answer

Storing secrets in a pipeline YAML file with encryption

Question 10

Which TWO of the following are benefits of using Infrastructure as Code (IaC) over manual infrastructure management?

Accepted Answer

Consistent environment provisioning. Options B and C are correct. Option B is correct because IaC ensures consistent environments. Option C is correct because IaC reduces configuration drift. Option A is wrong because IaC does not reduce cost. Option D is wrong because IaC requires training. Option E is wrong because IaC does not eliminate testing.

Answer

Removes the need for testing

Answer

Eliminates the need for documentation

Answer

Lower infrastructure costs

Question 11

Which THREE of the following are prerequisites for implementing a CI/CD pipeline for a .NET Core application?

Accepted Answer

Build agent (Microsoft-hosted or self-hosted). A build agent is required to execute the pipeline tasks, such as compiling code, running tests, and packaging artifacts. Microsoft-hosted agents provide a pre-configured environment with common tools, while self-hosted agents allow custom configurations and access to on-premises resources. Without a build agent, the CI/CD pipeline cannot perform any automated build or deployment steps.

Answer

Unit test framework

Answer

Docker container registry

Question 12

Which TWO of the following are valid ways to trigger a pipeline in Azure DevOps when a pull request is created?

Accepted Answer

Pull request trigger in YAML pipeline. Option A is correct because Azure DevOps YAML pipelines support a `pr` trigger that automatically runs the pipeline when a pull request is created or updated. This trigger is defined directly in the YAML file and can be scoped to specific branches or paths, making it a native and flexible way to respond to PR events.

Answer

Scheduled trigger

Answer

Continuous integration trigger

Answer

Pipeline completion trigger

Question 13

An Azure Policy is defined as shown in the exhibit. You attempt to create a storage account with HTTPS traffic only set to false. What will happen?

Accepted Answer

The creation will be denied with an error message. The Azure Policy in the exhibit uses a 'Deny' effect for the condition that storage accounts must have HTTPS traffic enabled. When you attempt to create a storage account with 'HTTPS traffic only' set to false, the policy evaluation detects a non-compliant resource and denies the creation request, returning an error message. This is because the 'Deny' effect blocks the resource deployment entirely, preventing the non-compliant configuration from being provisioned.

Answer

The policy will only apply if the storage account is in a specific resource group

Answer

The storage account will be created but HTTPS will be enforced

Answer

The storage account will be created and an audit event will be logged

Question 14

You run the Azure CLI command shown in the exhibit. What is the output?

Accepted Answer

A table showing VM names and resource groups for VMs in eastus. The Azure CLI command `az vm list --query "[?location=='eastus'].{Name:name, ResourceGroup:resourceGroup}" --output table` filters virtual machines to only those in the 'eastus' location, then projects the 'name' and 'resourceGroup' properties into a table. The `--query` parameter uses JMESPath syntax, which is correct here, and the `--output table` formats the result as a table. Therefore, the output is a table showing VM names and resource groups for VMs in eastus.

Answer

An error because the query syntax is incorrect

Answer

A list of all VMs in the subscription

Answer

A list of all VMs in the westus location

Question 15

Your organization uses Azure DevOps to manage a large-scale microservices application deployed to Azure Kubernetes Service (AKS). The application consists of 20 microservices, each with its own code repository and CI/CD pipeline. Recently, the team has been experiencing frequent build failures due to dependency conflicts between microservices when multiple pipelines run simultaneously and try to use the same build agent. The team is using Microsoft-hosted agents with a single agent pool. The builds take an average of 30 minutes each, and there are often 10+ builds queued at the same time. The team wants to reduce build failures and improve build throughput without significant increase in cost. What should they do?

Accepted Answer

Provision self-hosted agents on Azure VMs with dedicated agent pools for each microservice. Option C is correct because provisioning self-hosted agents on Azure VMs with dedicated agent pools for each microservice eliminates dependency conflicts by isolating build environments. This approach also improves throughput by allowing parallel builds without contention, and using Azure VMs (e.g., spot instances or reserved instances) can be cost-effective compared to scaling Microsoft-hosted parallel jobs, which incur per-minute charges.

Answer

Reduce the number of agents to 5 to avoid conflicts

Answer

Move all microservices into a single repository and use a single pipeline

Answer

Increase the number of parallel jobs in the agent pool to 20

Question 16

A team is designing a release pipeline for a .NET Core web application. They want to deploy to Azure App Service using a blue-green deployment strategy to minimize downtime. Which Azure App Service feature should they use to implement this?

Accepted Answer

Use deployment slots with swap operation.. Deployment slots in Azure App Service support swap operations that enable blue-green deployment by swapping the production slot with a staging slot. This minimizes downtime because the swap is warm-up and validation is done in the staging slot before traffic is redirected, and the swap itself is instantaneous under the hood. No external load balancer or traffic manager is needed because the swap operation handles the routing internally.

Answer

Use Azure Load Balancer in front of two separate App Services.

Answer

Configure auto-scaling rules.

Answer

Use Azure Traffic Manager to route traffic between slots.

Question 17

An organization uses an on-premises Jenkins server to build Docker images and push them to Azure Container Registry (ACR). The security team requires that all images be scanned for vulnerabilities before deployment. The DevOps team needs to automate this scanning after each push. What is the most efficient way to meet this requirement?

Accepted Answer

Create an ACR task that runs a vulnerability scanner triggered by image push events.. Option D is correct because ACR Tasks natively support automated vulnerability scanning via integration with Azure Security Center or third-party scanners like Trivy. By creating an ACR task that triggers on image push events, the organization can scan images immediately after they are pushed without additional infrastructure or manual intervention. This approach is event-driven, serverless, and aligns with the requirement to automate scanning after each push.

Answer

Use Azure Policy to enforce vulnerability scanning.

Answer

Configure a Jenkins job to scan images before pushing to ACR.

Answer

Configure a webhook in ACR to notify Jenkins to scan the image.

Question 18

A DevOps engineer needs to ensure that only approved Azure Resource Manager (ARM) templates are used for deployments. They want to enforce this at the subscription level. Which Azure service should they use?

Accepted Answer

Azure Policy. Azure Policy is the correct service because it allows you to create, assign, and manage policies that enforce specific rules on your Azure resources. By using a built-in or custom policy definition (e.g., 'Allowed resource types' or 'Audit if ARM template is not from approved location'), you can restrict ARM template deployments at the subscription level. Azure Policy evaluates all resource creation and update requests against these rules, blocking or auditing any non-compliant ARM template usage.

Answer

Azure Role-Based Access Control (RBAC)

Answer

Azure Blueprints

Answer

Azure Management Groups

Question 19

A company uses Azure DevOps for CI/CD. They have a multi-stage YAML pipeline that builds a Java application, runs unit tests, and deploys to a test environment. The test environment uses an Azure SQL Database. The pipeline currently runs successfully but the team notices that the test database schema is not always up-to-date. They want to apply database migrations automatically as part of the pipeline. Which tool or task should they integrate?

Accepted Answer

Integrate Flyway or similar database migration tool in the pipeline.. Option D is correct because Flyway is a dedicated database migration tool that integrates seamlessly with Azure DevOps pipelines, allowing you to version-control and apply schema changes automatically. Unlike ad-hoc scripts, Flyway tracks which migrations have been applied, ensuring the test database schema is always up-to-date without manual intervention.

Answer

Use the Azure SQL Database deployment task to run a SQL script manually.

Answer

Use Azure SQL Database backup and restore to update the schema.

Answer

Add a PowerShell task that runs SQLCMD.

Question 20

A company is designing an Azure DevOps strategy for a microservices application. They need to ensure that each microservice can be built, tested, and deployed independently. They also want to reuse pipeline components across services. Which TWO practices should they implement?

Accepted Answer

Use pipeline templates to define common build and test steps.. Option D is correct because pipeline templates in Azure DevOps allow you to define reusable YAML snippets for common build and test steps, enabling consistency across microservices without duplicating code. Option E is correct because multi-stage YAML pipelines with separate definitions per microservice ensure each service can be built, tested, and deployed independently, aligning with microservices architecture principles.

Answer

Publish all microservice artifacts to the same Azure Artifacts feed.

Answer

Store all pipeline variables in a single variable group.

Answer

Create a single pipeline that handles all microservices.