AZ-400 Configure processes and communications Practice Test 2 — 15 Questions

Question 1

Your team uses Azure Boards to track work items. They want to automatically update the 'Remaining Work' field on a task when a developer completes a pull request linked to that task. Which Azure DevOps feature should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a branch policy to automatically update work items on PR completion.. Azure DevOps branch policies include a setting to automatically update work items linked to a pull request upon completion. Specifically, under branch policy settings, you can enable 'Automatically update work items' which, when a PR is completed, sets the 'Remaining Work' field to zero (or another configured value) for linked tasks. This directly meets the requirement without custom scripting or external services.

Answer

Define a pipeline variable to update the field during build.

Answer

Use a service hook to trigger an Azure Function that updates the work item.

Answer

Create a work item template that sets remaining work.

Question 2

Which TWO Azure DevOps features can be used to automate the process of updating work items when a build or release completes?

Accepted Answer

Pipeline task 'Update work item' from the Azure DevOps extension.. Option A is correct because the 'Update work item' pipeline task, provided by the Azure DevOps extension, can be added directly into a build or release pipeline and configured to modify work item fields (such as State, Integrated in Build, or custom fields) automatically when the pipeline runs to completion. Option B is correct because service hooks in Azure DevOps can subscribe to build/release completion events and invoke an Azure Function, which can then call the Work Item Tracking REST API to update the relevant work items programmatically. Option C is incorrect because release gates are pre/post-deployment conditions that evaluate health signals (like REST API, Azure Monitor, or work item queries) to allow or block a deployment, not actions that update work items. Option D is incorrect because work item query charts are read-only visualizations of query results and cannot trigger or perform updates. Option E is incorrect because branch policies with required reviewers enforce pull request approval requirements and do not update work items when a build or release completes.

Answer

Release gates with work item update actions.

Answer

Work item query charts.

Answer

Branch policy with required reviewers.

Question 3

Your team uses a monorepo in Azure Repos. You want to enforce that every PR to the main branch includes a work item link and a specific label. Which branch policy should you configure?

Accepted Answer

Build validation. Azure Repos branch policy 'Build validation' lets you require a custom build pipeline to succeed before a pull request can complete. This pipeline can run a script that uses the Azure DevOps REST API to verify the PR has a linked work item and a specific label, and fail the build if those conditions are not met. 'Check for linked work items' only enforces work item links but not labels. 'Comment requirements' is unrelated. 'Required status check' is not a native Azure Repos policy; 'Status check' policies are for requiring external statuses and do not directly invoke a build pipeline.

Answer

Comment requirements

Answer

Check for linked work items

Answer

Required status check (using a custom build pipeline)

Question 4

Your team uses a Git flow branching strategy with develop and release branches. You want to enforce that only release branches can be merged into main, and all merges into main require a successful deployment to a production-like environment. How should you implement this in Azure Pipelines?

Accepted Answer

YAML pipeline with environment approvals and branch filters on trigger. To enforce that only release branches can merge into main and that merges require a successful deployment to a production-like environment, you need a YAML pipeline that uses an environment with approval/check gates and a branch filter on the trigger. The environment's checks (approvals, business hours, etc.) run before deployment, and the branch filter ensures the pipeline only triggers for release branches. This combination enforces both the branch restriction and the deployment gate.

Answer

Branch policy with required reviewers for main

Answer

Required status check for 'Check for linked work items'

Answer

Build validation policy on main

Question 5

Which TWO approaches can you use to enforce consistent commit message conventions across your GitHub repositories?

Accepted Answer

Use a GitHub Action to validate commit messages on push. Option B is correct because a GitHub Action can run on the push event and execute a script or marketplace action that parses each commit message against a regex or Conventional Commits specification, failing the workflow when a message does not match and thereby enforcing the convention. Option D is correct because GitHub repository rulesets (repository rules) support a required commit message pattern using a regular expression, which blocks pushes containing non-conforming commit messages before they land on the protected branch. Option A is not correct because .gitattributes controls attributes such as line-ending normalization, diff drivers, and merge strategies, not commit message content. Option C is not correct because renaming or setting the default branch to main only affects branch naming and has no effect on commit message validation. Option E is not correct because an issue template standardizes the structure of new issues, not the format of commit messages.

Answer

Add a .gitattributes file

Answer

Set the default branch to main

Answer

Set up an issue template

Question 6

Your team uses Azure Boards to manage work items. They want to automatically update the status of a work item to 'Resolved' when a pull request that contains the work item ID is merged. Which feature should you configure?

Accepted Answer

Enable the 'Automatically update work item status' setting in the repository's pull request configuration.. Azure Boards provides a repository setting called 'Automatically update work item status' that, when enabled, automatically transitions linked work items to a specified state (e.g., Resolved) when a pull request is merged. This feature is part of the integration between Azure Repos and Azure Boards, and it eliminates the need for manual updates or custom service hooks.

Answer

Instruct developers to manually update the work item after merging.

Answer

Set up a branch policy that requires linked work items.

Answer

Create a service hook to call Azure DevOps REST API on pull request merge.

Question 7

Your organization uses GitHub Actions for CI/CD. A workflow that deploys to production uses a secret stored in GitHub Actions secrets. The secret is exposed in the logs due to a debug step. What is the most effective way to prevent future exposure?

Accepted Answer

Remove the debug step from the workflow.. Secret scanning and push protection are designed to detect and block secrets in committed code, not in workflow logs. To prevent future exposure from a debug step, the most effective action is to remove the debug step, which addresses the root cause. While masking with ::add-mask:: can hide the secret value, it does not prevent the step from trying to log the secret. Deleting and rotating the secret is necessary for remediation, but does not prevent future log exposure.

Answer

Use the ::add-mask:: command in the workflow to mask the secret in logs.

Answer

Delete the compromised secret and create a new one.

Answer

Enable secret scanning and push protection for the repository.

Question 8

Your team uses trunk-based development with short-lived feature branches. You notice that code reviews often delay merging because reviewers are not available. What is the best way to reduce review latency while maintaining quality?

Accepted Answer

Encourage pair programming or mob programming to review code in real-time.. Pair or mob programming shifts code review into the act of writing code itself, so at least one other developer has already seen and validated the change in real time. This eliminates the asynchronous wait for a reviewer to become available, which is the actual bottleneck in trunk-based development with short-lived branches. Quality is preserved because multiple sets of eyes are on the code before it ever reaches a pull request.

Answer

Enable auto-merge for pull requests that have passed all checks.

Answer

Require only one reviewer instead of two.

Answer

Create a separate review team that only handles pull requests.

Question 9

Your team uses Azure Pipelines to deploy a web app. They want to automatically roll back the deployment if the post-deployment smoke tests fail. What is the recommended approach?

Accepted Answer

Use a deployment gate with a monitoring tool that automatically initiates a rollback if health check fails.. Azure Pipelines supports deployment gates that can integrate with monitoring tools (e.g., Azure Monitor, Application Insights) to evaluate health metrics after deployment. If the gate detects a failure (e.g., a smoke test health check fails), it can automatically trigger a rollback to the previous stable version, ensuring zero manual intervention and faster recovery.

Answer

Define an approval gate that requires manual sign-off after deployment.

Answer

Set up a manual intervention step in the pipeline to decide rollback.

Answer

Configure a release variable that toggles between deployment slots.

Question 10

Your team uses Azure Boards and wants to automatically update the work item state when a pull request is merged. The policy should require a successful build before merging and update the work item to 'Resolved' on merge. Which branch policy should you configure?

Accepted Answer

Automatically update work items. In Azure DevOps, 'Automatically update work items' updates linked work item states on merge, while 'Build validation' enforces a successful build before merge. These are separate policies. Therefore, the question has no correct answer among the given options.

Answer

Require a minimum number of reviewers

Answer

Comment resolution

Answer

Check for linked work items

Question 11

Your team is adopting GitHub Discussions for community Q&A. You want to ensure that only maintainers can create new discussion categories, but any authenticated user can create discussion posts within existing categories. How should you configure this?

Accepted Answer

Only maintainers can create categories; any authenticated user can create posts.. GitHub Discussions natively separates permissions for creating categories from permissions for creating posts. Category creation is restricted to users with maintain or admin access to the repository. To allow any authenticated user to create posts, a repository administrator must enable the 'Allow any authenticated user to create discussion posts' setting in the discussions options. This satisfies the requirement without affecting category creation permissions.

Answer

Enable discussions at the organization level and set permissions.

Answer

Configure branch protection to enforce maintainer-only posting.

Answer

Use a GitHub Action to approve discussion posts.

Question 12

Your organization uses GitHub and wants to implement a policy that requires all pull requests to be approved by at least two members of the 'security-team' team before merging. The 'security-team' team is a child team of 'engineering'. Which branch protection rule setting should you use?

Accepted Answer

Use the 'Require pull request reviews before merging' rule and set 'Required reviewers' to the security team.. 'Require pull request reviews before merging' with 'Required reviewers' set to the security team. This configuration enables branch protection to enforce reviews from that specific team. To require approval from at least two members, you must also set the 'Required number of reviewers' to 2 within the same branch protection rule. Option A is unrelated to reviewer requirements. Option C only sets a minimum number of reviewers without specifying which team, so it could allow any approver. Option D requires a CODEOWNERS file and only applies to file patterns owned by the team, not all pull requests. Therefore, B is the foundational setting needed to achieve the policy.

Answer

Enable 'Dismiss stale pull request approvals when new commits are pushed'.

Answer

Require a minimum number of reviewers and set it to 2.

Answer

Require code owner review and add the security team as code owners.

Question 13

Your organization uses GitHub and wants to ensure that all commits to the main branch are associated with a GitHub issue. Which three settings should you configure?

Accepted Answer

Require status checks to pass before merging. Option B, 'Require status checks to pass before merging,' is correct because branch protection rules can enforce a status check that validates commit messages or PR metadata against a linked GitHub issue, blocking merges when the association is missing. Option D, 'Require pull request reviews before merging,' is correct because requiring PRs (with reviews) forces changes to go through a pull request where the issue link can be verified and enforced before merging into main. Together, these settings ensure commits reach main only through reviewed PRs that pass the issue-association check. Option A, 'Require conversation resolution before merging,' only ensures review comments are resolved and does not verify issue linkage. Option C, 'Allow force pushes,' is unrelated and actually weakens protection by permitting history rewriting. Option E, 'Allow deletions,' is unrelated and would permit the protected branch to be deleted, which is the opposite of the desired control.

Answer

Require conversation resolution before merging

Answer

Allow force pushes

Answer

Allow deletions

Question 14

Your team uses Azure DevOps and wants to automate the creation of a bug work item when a release pipeline fails. Which two actions should you take?

Accepted Answer

Configure a Service Hook to create a work item when a release stage fails.. Service Hooks are a valid method to create a work item on release failure. However, the built-in task is called 'Create Work Item', not 'Create Work Item on Failure'. To achieve the desired automation, you would add a 'Create Work Item' task and set its Control Options to run only when a previous task fails. Since option D incorrectly names the task, it is not correct. The question asks for two actions, but among the given options, only B is a valid action. Therefore, the question is flawed because there is no second correct option.

Answer

Set a scheduled trigger for the release pipeline.

Answer

Add a build completion trigger to the release pipeline.

Answer

Add the 'Create work item on failure' task to the release pipeline.

Answer

Configure a pre-deployment approval.

Question 15

Refer to the exhibit. You are reviewing an Azure DevOps YAML pipeline. The pipeline is configured with a webhook trigger from GitHub for pull request opened events. However, the pipeline does not trigger when a PR is opened. What is the most likely cause?

Accepted Answer

The webhook subscription is not configured in GitHub.. The most likely cause is that the webhook subscription is not configured in GitHub. Azure DevOps YAML pipelines with webhook triggers require an explicit webhook to be set up in the GitHub repository to send events (like pull request opened) to Azure DevOps. Without this subscription, Azure DevOps never receives the event, so the pipeline cannot trigger.

Answer

The webhook name does not match the service connection.

Answer

The pipeline lacks an agent pool specification.

Answer

The webhook filter is incorrect; 'opened' should be 'created'.