AZ-400 Multiple Select — 50 Questions

Question 1

Your release pipeline deploys to multiple environments (dev, test, prod). You need to ensure that only authorized users can approve production deployments. Which TWO actions should you take?

Accepted Answer

Add a 'Approval' check on the production environment.. The correct actions to ensure only authorized users can approve production deployments are to add an 'Approval' check on the production environment (option D) and to add a pre-deployment approval to the production stage (option E). Both methods require explicit user approval before deployment proceeds. Option A is incorrect because a manual intervention task pauses the pipeline for interactive validation but does not enforce user authorization checks; it is typically used for prompts, not approval gates. Option B is incorrect because environment permissions control who can create releases or manage environments, not who can approve deployments to production—they manage access at a higher level. Option C is incorrect because deployment gates are automated health checks (e.g., monitoring metrics) that can block deployment based on conditions, but they do not handle user approval; approval is a separate check type.

Answer

Use a manual intervention task in the pipeline.

Answer

Set environment permissions to allow only specific users to create releases.

Answer

Configure deployment gates to check for user approval.

Question 2

Which THREE measures should you implement to protect secrets (e.g., API keys, passwords) used in Azure Pipelines?

Accepted Answer

Mark variables as 'Secret' in pipeline YAML or UI definitions. To protect secrets like API keys and passwords in Azure Pipelines, you should implement three key measures. First, mark variables as 'Secret' in pipeline YAML or UI definitions (Option B). This prevents the secret from being displayed in logs or output. Second, use service connections with managed identity instead of personal access tokens (Option D). Managed identities eliminate the need to store credentials and reduce secret exposure. Third, store secrets in Azure Key Vault and reference them via a Key Vault task (Option E). This centralizes secret management and allows fine-grained access control. Option A is incorrect because storing secrets as plain text in a Git repo, even with restricted access, is insecure—secrets should never be committed to source control. Option C is incorrect because environment variables are not encrypted by default and can be exposed in logs or to other pipeline tasks, making them unsafe for secret passing.

Answer

Store secrets as plain text in a secure Git repo with restricted access

Answer

Use environment variables in the pipeline to pass secrets at runtime

Question 3

A team uses Azure Boards to manage work items. They want to automatically update the state of a work item when a related pull request is merged in Azure Repos. Which TWO actions should they configure to enable this integration?

Accepted Answer

Add a branch policy that requires a linked work item for pull requests.. A branch policy that requires linked work items for pull requests ensures that every PR is associated with a work item. When the PR is merged, Azure Repos automatically updates the state of the linked work item (e.g., from 'Active' to 'Resolved') based on the default or configured transition rules. This integration is built into Azure DevOps without requiring external services.

Answer

Set up a webhook in Azure Repos to call Azure Logic Apps on pull request merge.

Answer

Configure a Service Hooks subscription in Azure DevOps to send pull request merge events to Azure Boards.

Answer

Create an Azure Function that listens for pull request merge events and updates work items via the REST API.

Question 4

Which THREE conditions must be met for you to use the 'Approvals' feature in Azure Pipelines to control deployments to a production environment? (Choose three.)

Accepted Answer

The approver must have the 'Approve pipeline permissions' permission for the environment.. The 'Approvals' feature in Azure Pipelines requires an environment to be defined in the pipeline. You must add an approval check to that environment, which can be done in either a classic release pipeline or a YAML pipeline that references the environment as a resource. Additionally, the approver(s) - whether individual users or groups - must have the 'Approve pipeline permissions' permission on that environment. Without an environment resource, the approval check cannot be configured; without the permission, approval requests cannot be validated.

Answer

The approver must be an individual user, not a group.

Answer

The approval must be configured in the release pipeline's pre-deployment conditions.

Question 5

Which THREE components are required to set up a self-hosted agent pool in Azure Pipelines?

Accepted Answer

The agent software installed on the target machine. The self-hosted agent requires the Azure Pipelines agent software to be installed on the target machine. This software, which includes the agent listener and worker processes, is what registers the machine with the agent pool and executes pipeline jobs. Without the agent software, the machine cannot communicate with Azure Pipelines or run any tasks.

Answer

A deployment group target

Answer

Azure VM extension for Azure Pipelines Agent

Question 6

Your release pipeline deploys a web app to Azure App Service. You need to implement safe deployment practices that minimize downtime and enable quick rollback. Which THREE strategies should you recommend?

Accepted Answer

Deploy to a staging slot first, validate, then swap.. Deploying to a staging slot first allows you to validate the application in a production-like environment without affecting live traffic. Once validated, swapping the staging and production slots ensures zero-downtime deployment by instantly routing all traffic to the validated version. This is a core safe deployment practice for Azure App Service.

Answer

Use rolling deployment with manual step to approve each instance.

Answer

Deploy directly to the production slot.

Question 7

Which TWO approaches can you use to enforce consistent commit message conventions across your GitHub repositories?

Accepted Answer

Use a GitHub Action to validate commit messages on push. GitHub Actions can be configured with a workflow that triggers on `push` events to validate commit messages against a regex pattern, rejecting non-conforming commits. Option D is correct because repository rulesets (or branch protection rules) allow you to define required commit message patterns that must match before a push is accepted, enforced server-side. Both approaches enforce conventions consistently across all contributors.

Answer

Add a .gitattributes file

Answer

Set the default branch to main

Answer

Set up an issue template

Question 8

Which TWO actions should you take to implement a secure build pipeline that uses Azure Key Vault to store secrets? (Choose two.)

Accepted Answer

Grant the Azure DevOps service principal 'Get' and 'List' permissions on the Key Vault.. The Azure DevOps service principal (the identity used by Azure Pipelines) must be granted 'Get' and 'List' permissions on the Key Vault's access policy. This allows the pipeline to retrieve secret values securely without storing credentials in the repository or pipeline configuration. Without these permissions, any attempt to read secrets from the vault will fail with an authorization error.

Answer

Store the Key Vault name and secret names in a secure file in the repository.

Answer

Define secrets as pipeline variables and mark them as secret.

Answer

Use the 'Azure CLI' task to run 'az keyvault secret show' for each secret.

Question 9

Which TWO compliance frameworks are directly supported by Microsoft Purview Compliance Manager for Azure DevOps?

Accepted Answer

ISO 27001. Microsoft Purview Compliance Manager directly supports ISO 27001 and SOC 2 as built-in compliance templates for Azure DevOps. These frameworks are pre-configured with control mappings, assessment templates, and automated testing actions that align with Azure DevOps security and audit capabilities. This allows organizations to continuously monitor and manage compliance posture against these standards without manual configuration.

Answer

HIPAA

Answer

PCI DSS

Answer

FedRAMP High

Question 10

Which TWO features in Azure Pipelines allow you to enforce separation of duties between development and operations teams? (Choose two.)

Accepted Answer

Approvals and checks on environments. Approvals and checks on environments (B) enforce separation of duties by requiring designated approvers (e.g., operations team members) to approve a deployment before it proceeds, ensuring that development cannot directly push to production. Environment security roles (D) allow you to define who can create, view, or manage environments, restricting developers from modifying production environments without operations oversight.

Answer

Pipeline decorators

Answer

Service connections with different scopes

Answer

Branch policies on the main branch

Question 11

Which TWO benefits does using Git LFS (Large File Storage) provide? (Select TWO.)

Accepted Answer

Prevents large files from being stored in the Git history. Git LFS (Large File Storage) prevents large files from being stored directly in the Git repository history (option B). Instead, it stores a small pointer file in the repo while the actual large file content is stored externally, which reduces the size of the Git repository (option E). Options A, C, and D are incorrect because LFS does not automatically compress all files, replace .gitignore, or speed up diff operations for binary files.

Answer

Automatically compresses all files in the repository

Answer

Replaces .gitignore for excluding large files

Answer

Speeds up diff operations for binary files

Question 12

Which TWO tasks can be used to deploy an Azure Web App using YAML pipelines in Azure DevOps?

Accepted Answer

AzureWebApp. The AzureWebApp task is correct because it is the dedicated Azure DevOps YAML pipeline task for deploying code to an Azure Web App (App Service). It supports deployment methods like Web Deploy (msdeploy), Kudu REST API, and ZIP deploy, making it the standard choice for web app deployments.

Answer

CopyFilesOverSSH

Answer

AzureFunctionApp

Answer

AzureVMAppDeployment

Question 13

Your company uses Azure Key Vault to store secrets. Which TWO actions should you take to ensure secure access? (Select TWO.)

Accepted Answer

Restrict access using Key Vault access policies. Restricting access using Key Vault access policies (Option A) is correct because Azure Key Vault uses a granular permission model where you assign specific permissions (e.g., GET, LIST, SET) to individual security principals (users, groups, or service principals) at the vault level. This ensures that only authorized identities can read or manage secrets, keys, and certificates, following the principle of least privilege. Using managed identities (Option B) is correct because they provide an automatically managed identity in Azure AD for applications to authenticate to Key Vault without storing credentials in code or configuration, eliminating the risk of secret leakage.

Answer

Enable HTTP access for performance

Answer

Disable audit logging to reduce exposure

Answer

Enable soft-delete to recover deleted secrets

Question 14

Which TWO actions should a DevOps engineer take to ensure that Azure DevOps pipelines comply with the principle of least privilege for service connections?

Accepted Answer

Create a service principal with permissions scoped to the minimum required Azure resources.. Creating a service principal with permissions scoped to the minimum required Azure resources directly implements the principle of least privilege. By assigning only the necessary roles (e.g., Contributor on a specific resource group) to the service principal used in the service connection, you ensure that the pipeline can only perform actions on those resources, reducing the attack surface. This aligns with Azure RBAC best practices for securing automated deployments.

Answer

Use the Project Collection Build Service account for all pipeline runs.

Answer

Use Workload identity federation to avoid managing secrets.

Answer

Use the same service connection for both build and release pipelines.

Question 15

Your organization is implementing a security compliance plan for Azure DevOps. Which TWO actions should you take to ensure that only authorized users can modify build pipelines?

Accepted Answer

Configure branch policies to require reviews for changes to pipeline YAML files. Branch policies in Azure Repos enforce required reviews for changes to YAML pipeline files stored in the repository. This ensures that any modification to the pipeline definition must be approved by authorized reviewers before merging, preventing unauthorized or accidental changes. Option C is correct because pipeline permissions in Azure DevOps allow you to restrict editing of a pipeline to specific security groups (e.g., 'Build Administrators'), directly controlling who can modify the pipeline through the web interface or API.

Answer

Require all users to use Personal Access Tokens (PATs)

Answer

Enable audit logging for all pipeline changes

Answer

Enable OpenID Connect (OIDC) for pipeline authentication

Question 16

Which TWO GitHub Actions features can be used to enforce deployment approvals for a production environment? (Choose two.)

Accepted Answer

Deployment protection rules that require approval.. Deployment protection rules in GitHub Actions allow you to define required approvals before a workflow job can deploy to an environment. These rules are configured at the environment level and can mandate that a specific number of reviewers approve the deployment, effectively enforcing a manual approval gate for production environments.

Answer

The 'deployment' event trigger in a workflow.

Answer

Branch protection rules that require pull request reviews.

Answer

OpenID Connect (OIDC) for cloud provider authentication.

Question 17

Which TWO practices help improve the efficiency of code reviews? (Choose two.)

Accepted Answer

Keep pull requests small and focused on a single change.. Keeping pull requests small and focused on a single change (Option A) improves code review efficiency because it reduces cognitive load on reviewers, allowing them to understand and evaluate the change quickly without context-switching. Smaller PRs also enable faster feedback loops and easier rollback if issues are found, which aligns with DevOps principles of continuous integration and delivery.

Answer

Include multiple unrelated changes in a single pull request to reduce the number of PRs.

Answer

Assign as many reviewers as possible to ensure thoroughness.

Answer

Require that all team members review every pull request.

Question 18

Which THREE of the following are true about GitHub Actions self-hosted runners?

Accepted Answer

They can have custom software installed.. GitHub Actions self-hosted runners are machines you manage, allowing you to install any custom software, libraries, or tools required by your workflows. Unlike GitHub-hosted runners, which have a fixed set of pre-installed software, self-hosted runners give you full administrative control over the environment, enabling you to meet specific build or test dependencies.

Answer

They are automatically scaled by GitHub.

Answer

They are free and do not incur any costs.

Question 19

Which TWO Azure DevOps features can be used to implement change management processes?

Accepted Answer

Release approval gates.. Release approval gates (Option B) in Azure Pipelines allow you to enforce manual or automated checks before a release proceeds to a stage, implementing change management by requiring sign-offs or validation against external systems. Audit logging (Option C) captures a chronological record of changes to Azure DevOps resources, providing an immutable trail for compliance and change review processes.

Answer

Test plans.

Answer

Project wiki.

Answer

Code search.

Question 20

Your team uses Azure DevOps and needs to ensure that secrets are not exposed in pipeline logs. Which THREE practices should you implement?

Accepted Answer

Use logging commands to mask secrets in scripts. Azure DevOps provides a logging command, `##vso[task.setvariable variable=mySecret;isSecret=true]value`, which masks the variable's value in pipeline logs. This ensures that even if a script echoes the secret, it is replaced with asterisks, preventing accidental exposure during execution.

Answer

Enable pipeline log encryption

Answer

Store secrets in YAML variable files