AZ-400 Configure processes and communications — 50 Questions

Question 1

You are designing the communication strategy for a large team using Azure DevOps. The team uses a Kanban board and wants to automatically notify stakeholders when work items are moved to 'Done'. Which Azure DevOps feature should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the built-in email subscription for work item changes.. Both A and D can be used to notify stakeholders when work items move to Done. Built-in email subscriptions (A) send email notifications to the configured recipients, while service hooks (D) can send webhook events to external systems for further processing. Without a requirement for external integration, both are equally valid. To make D the only correct answer, the question must clarify that stakeholders are external or that a third-party integration is needed.

Answer

Set up a pipeline notification for the work item.

Answer

Configure team alerts in the project settings.

Question 2

Your Azure DevOps environment uses Microsoft Entra ID for authentication. You need to ensure that users from a partner organization can access only a specific Azure Boards project without being added to your tenant as guests. What should you do?

Accepted Answer

Invite the partner users as Microsoft Entra B2B guests and assign them to the project.. Microsoft Entra B2B collaboration allows you to invite external users as guests, granting them access to specific resources like an Azure Boards project without creating full member accounts in your directory. While they are added to the tenant as guest accounts, they have restricted permissions and are not full members. This meets the requirement of restricting access to only that project when the intent is to avoid full membership.

Answer

Issue OAuth 2.0 tokens to the partner users.

Answer

Configure Microsoft Entra ID identity protection to allow the partner IP range.

Answer

Create service principals for the partner users.

Question 3

Refer to the exhibit. The JSON above shows a branch policy configuration for the main branch in Azure Repos. A developer pushes a third commit to an existing pull request after two reviewers have already approved. What happens?

Accepted Answer

The existing approvals remain valid because dismiss_stale_reviews is false.. In Azure Repos, the 'Block on last push' policy (require_last_push_approval) only revokes an approval from the user who made the most recent push, preventing them from approving their own changes. It does not invalidate approvals from other reviewers. The setting that resets all approvals when new commits are pushed is 'Reset code reviewer votes when there are new changes' (dismiss_stale_reviews). Since dismiss_stale_reviews is false in the given configuration, the two existing approvals remain valid when the developer pushes a third commit.

Answer

The pull request is automatically merged because allowed merge types include squash.

Answer

The approvals are dismissed because require_last_push_approval is true.

Answer

The pull request is blocked because the merge type is not allowed.

Question 4

Your team uses Azure Repos and wants to enforce that every commit message includes a work item ID. Which policy should you configure?

Accepted Answer

Branch policy to require linked work items.. Azure Repos' 'Require linked work items' branch policy only requires a linked work item on the pull request, not a work item ID in each commit message. Branch policies do not inspect commit message text. A pre-push Git hook is client-side and can be bypassed, so it is not a reliable policy. Therefore, none of the listed options meets the stated requirement.

Answer

Repository settings to restrict file paths.

Answer

Branch policy to require a minimum comment length.

Answer

Pre-push Git hook.

Question 5

Your team uses GitHub Discussions for Q&A. You notice that many questions go unanswered. Which two actions can improve response rates? (Choose two.)

Accepted Answer

Create a template for new discussions to guide users.. Providing a template for new discussions guides users to include essential details (e.g., environment, error logs, steps to reproduce), which reduces ambiguity and makes it easier for community members to provide accurate answers. This directly increases the likelihood of receiving responses by setting clear expectations and reducing back-and-forth clarification. Additionally, assigning a team of maintainers to monitor unanswered discussions ensures that questions are actively followed up on, either by maintainers answering them or by prompting others to respond, thereby reducing the number of questions that go unanswered.

Answer

Limit the number of discussion categories to one.

Answer

Automatically close discussions that are unanswered for 7 days.

Answer

Convert unanswered discussions to issues.

Question 6

You execute the above Azure CLI command. A pipeline YAML references the variable group 'Config' and uses the variable 'env'. However, the pipeline fails because the variable 'env' is not found. What is the most likely reason?

Accepted Answer

The variable group 'Config' is not linked to the pipeline.. In Azure Pipelines, variable names are case-insensitive. A casing mismatch between the variable group and the YAML reference would not cause the variable to be 'not found'. The most likely reason is that the variable group 'Config' is not linked or the pipeline is not authorized to use it, so its variables (including 'env') are not available in the pipeline.

Answer

The variable 'env' is a secret variable and cannot be used in YAML.

Answer

The variable name is case-sensitive; the YAML uses 'Env' instead of 'env'.

Answer

The variable group is scoped to a specific branch, and the pipeline is running on a different branch.

Question 7

Your team uses a monorepo in Azure Repos. You want to enforce that every PR to the main branch includes a work item link and a specific label. Which branch policy should you configure?

Accepted Answer

Build validation. Azure Repos branch policy 'Build validation' lets you require a custom build pipeline to succeed before a pull request can complete. This pipeline can run a script that uses the Azure DevOps REST API to verify the PR has a linked work item and a specific label, and fail the build if those conditions are not met. 'Check for linked work items' only enforces work item links but not labels. 'Comment requirements' is unrelated. 'Required status check' is not a native Azure Repos policy; 'Status check' policies are for requiring external statuses and do not directly invoke a build pipeline.

Answer

Comment requirements

Answer

Check for linked work items

Answer

Required status check (using a custom build pipeline)

Question 8

Your organization uses GitHub Actions for CI/CD. A workflow that deploys to production uses a secret stored in GitHub Actions secrets. The secret is exposed in the logs due to a debug step. What is the most effective way to prevent future exposure?

Accepted Answer

Remove the debug step from the workflow.. Secret scanning and push protection are designed to detect and block secrets in committed code, not in workflow logs. To prevent future exposure from a debug step, the most effective action is to remove the debug step, which addresses the root cause. While masking with ::add-mask:: can hide the secret value, it does not prevent the step from trying to log the secret. Deleting and rotating the secret is necessary for remediation, but does not prevent future log exposure.

Answer

Use the ::add-mask:: command in the workflow to mask the secret in logs.

Answer

Delete the compromised secret and create a new one.

Answer

Enable secret scanning and push protection for the repository.

Question 9

Your team uses Azure Boards and wants to automatically update the work item state when a pull request is merged. The policy should require a successful build before merging and update the work item to 'Resolved' on merge. Which branch policy should you configure?

Accepted Answer

Automatically update work items. In Azure DevOps, 'Automatically update work items' updates linked work item states on merge, while 'Build validation' enforces a successful build before merge. These are separate policies. Therefore, the question has no correct answer among the given options.

Answer

Require a minimum number of reviewers

Answer

Comment resolution

Answer

Check for linked work items

Question 10

Your team is adopting GitHub Discussions for community Q&A. You want to ensure that only maintainers can create new discussion categories, but any authenticated user can create discussion posts within existing categories. How should you configure this?

Accepted Answer

Only maintainers can create categories; any authenticated user can create posts.. GitHub Discussions natively separates permissions for creating categories from permissions for creating posts. Category creation is restricted to users with maintain or admin access to the repository. To allow any authenticated user to create posts, a repository administrator must enable the 'Allow any authenticated user to create discussion posts' setting in the discussions options. This satisfies the requirement without affecting category creation permissions.

Answer

Enable discussions at the organization level and set permissions.

Answer

Configure branch protection to enforce maintainer-only posting.

Answer

Use a GitHub Action to approve discussion posts.

Question 11

Your team uses Azure DevOps and wants to automate the creation of a bug work item when a release pipeline fails. Which two actions should you take?

Accepted Answer

Configure a Service Hook to create a work item when a release stage fails.. Service Hooks are a valid method to create a work item on release failure. However, the built-in task is called 'Create Work Item', not 'Create Work Item on Failure'. To achieve the desired automation, you would add a 'Create Work Item' task and set its Control Options to run only when a previous task fails. Since option D incorrectly names the task, it is not correct. The question asks for two actions, but among the given options, only B is a valid action. Therefore, the question is flawed because there is no second correct option.

Answer

Set a scheduled trigger for the release pipeline.

Answer

Add a build completion trigger to the release pipeline.

Answer

Add the 'Create work item on failure' task to the release pipeline.

Answer

Configure a pre-deployment approval.

Question 12

Your team uses GitHub and wants to implement a policy that requires all pull requests to have a successful status check from a GitHub Actions workflow that runs unit tests. Additionally, the policy should require that the PR author is not allowed to merge their own PR. The repository is for a critical application and the main branch is protected. You need to configure the branch protection rules. Which combination of settings should you use?

Accepted Answer

Enable 'Require pull request reviews before merging' with 1 approval, and enable 'Require status checks to pass before merging' with the unit test check required.. It combines two essential protections: requiring at least one approval prevents the PR author from merging their own PR (since the author cannot self-approve), and requiring the unit test status check to pass ensures that only code with successful automated tests can be merged into the protected main branch. This directly satisfies both policy requirements.

Answer

Enable 'Require pull request reviews before merging' with 2 approvals, and enable 'Allow force pushes'.

Answer

Enable 'Require pull request reviews before merging' with 1 approval from a specific team, and disable 'Require status checks'.

Answer

Enable 'Require code owner review' and 'Require status checks to pass before merging'.

Question 13

A team uses Azure Boards and wants to ensure that work items moved to the 'Done' state require a completed code review. What should they configure?

Accepted Answer

Add a work item rule in the process template to require a code review for the 'Done' transition.. Azure Boards allows you to define work item rules within the process template that enforce specific conditions on state transitions. By adding a rule to the 'Done' transition that requires a completed code review (e.g., via a custom field or check), you ensure work items cannot be moved to 'Done' without meeting that prerequisite. This is done through the inherited process customization in Azure DevOps, where you can add rules to the work item type's state transition.

Answer

Modify the work item type definition to add a custom field for code review status.

Answer

Use a tag to mark work items as code-reviewed before moving to 'Done'.

Answer

Configure branch policies in Azure Repos to require pull request approvals.

Question 14

During a sprint review, stakeholders complain that they don't receive notifications about completed work items. The team uses Azure Boards with a custom notification subscription. What is the most likely cause?

Accepted Answer

The subscription's 'Deliver to' filter excludes stakeholders.. The most likely cause is that the custom notification subscription's 'Deliver to' filter is configured to exclude stakeholders. In Azure Boards, notification subscriptions can have filters that restrict delivery to specific groups or roles, and if stakeholders are not included in the filter, they will not receive notifications even if the subscription is active. This directly addresses the complaint that stakeholders are not getting notified about completed work items.

Answer

Email notifications are disabled at the organization level.

Answer

The subscription is set to deliver only to the team members.

Answer

The subscription was automatically disabled after the first notification.

Question 15

A multinational company uses Azure DevOps with a single project. The project has multiple teams in different time zones. They want to customize the process to reflect different working days for each team. What is the recommended approach?

Accepted Answer

Use the same process and configure working days in the team settings for each team.. Azure DevOps allows each team to have its own working days configured in team settings, independent of the process template. This enables teams in different time zones to define their own non-working days without modifying the shared process, which would affect all teams using that process.

Answer

Create a custom process for each time zone and assign teams accordingly.

Answer

Use the same process but create separate areas for each team, then configure working days per area path.

Answer

Use the same process and configure capacity planning for each team to account for time off.

Question 16

A team uses Azure Repos with a Git branching strategy that includes feature branches. They want to ensure that all feature branches are deleted automatically after the pull request is completed. What should they do?

Accepted Answer

Enable 'Automatically delete source branch' in the branch policy.. Azure Repos branch policies include an 'Automatically delete source branch' checkbox. When enabled, the source branch (e.g., a feature branch) is automatically deleted once the pull request is completed (merged or abandoned). This enforces cleanup without manual intervention, directly meeting the requirement.

Answer

Enable 'Create a merge commit' option in the branch policy.

Answer

Configure branch retention policy in the pipeline to delete branches after build.

Answer

Create a work item to remind developers to delete branches after merge.

Question 17

An organization uses Azure DevOps and wants to implement a change management process where all changes to the main branch require approval from a change advisory board (CAB). The CAB members are not part of the development team. How should they configure this?

Accepted Answer

Create a new branch policy on main that requires a minimum number of reviewers from a separate CAB group.. Azure DevOps branch policies allow you to enforce a minimum number of reviewers from a specific security group (e.g., a CAB group) on pull requests targeting the main branch. This ensures that every change to main requires explicit approval from CAB members, who are separate from the development team, without relying on manual processes or altering team membership.

Answer

Set branch permissions to restrict push to main and only allow CAB to approve via manual process.

Answer

Use a service hook to notify CAB when a PR is created, and rely on manual approval.

Answer

Add the CAB as members of the development team and require team review.

Question 18

Which TWO actions help improve communication and collaboration in a distributed Azure DevOps team?

Accepted Answer

Maintain a shared wiki with project documentation and decisions.. A shared wiki (e.g., Azure DevOps Wiki) provides a single source of truth for project documentation and decisions, accessible asynchronously—critical for distributed teams. Additionally, scheduling daily stand-up meetings at a time that works for all time zones ensures regular synchronous alignment and promotes collaboration. Multiple chat channels can fragment discussions, long email threads are hard to follow, and avoiding PR comments removes a key asynchronous review/discussion mechanism.

Answer

Use multiple chat channels for each topic to organize discussions.

Answer

Use long email threads for decision-making to ensure full documentation.

Answer

Avoid using pull request comments to reduce noise.

Question 19

Which THREE steps are essential when customizing an Azure DevOps process?

Accepted Answer

Add custom fields to work item types.. Customizing work item types by adding custom fields is a fundamental step in tailoring Azure DevOps processes to capture project-specific data. This is done through the inherited process model, which allows you to extend system processes without modifying the base definitions, ensuring upgrades and maintenance remain supported.

Answer

Use Hosted XML process model to customize.

Answer

Directly modify the 'Agile' system process.

Question 20

You are the Azure DevOps administrator for a large enterprise with multiple projects using the Scrum process. The organization has recently adopted a new compliance policy requiring that all work items of type 'Epic' must be approved by a compliance officer before they can be moved to the 'Committed' state. The compliance officers are external to the development teams and should not have direct access to modify work items. You need to implement this requirement with minimal administrative overhead. The current process has the following states for Epics: New, Proposed, Committed, In Progress, Done. The desired flow is: from 'Proposed' to 'Committed', a compliance officer must approve the transition. Compliance officers are part of a security group named 'Compliance Officers'. They should be able to approve the transition without having to edit the work item directly. What should you do?

Accepted Answer

In the process template for Epic, add a work item rule on the transition from 'Proposed' to 'Committed' that requires approval from a member of the 'Compliance Officers' group.. Azure DevOps process templates allow you to add work item rules on state transitions. By adding a rule on the 'Proposed' to 'Committed' transition for the Epic work item type that requires approval from a member of the 'Compliance Officers' group, you enforce the compliance policy without granting those officers direct edit permissions. This leverages built-in approval gates within the work item tracking system, minimizing administrative overhead.

Answer

Use a service hook to send an email to the compliance officers when an Epic is moved to 'Proposed', and rely on them to manually approve the transition.

Answer

Modify the Epic work item type to add a field 'Compliance Approval' and set the compliance officer as a required reviewer in the field settings.

Answer

Configure a branch policy on the main branch that requires approval from the 'Compliance Officers' group for pull requests.