AZ-400 Configure processes and communications Practice Test 4 — 15 Questions

Question 1

A company uses Microsoft Entra ID for identity. They want to enforce that all code changes in Azure Repos require a linked work item and a successful policy evaluation. Which branch policy should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Require work item linking in the branch policy.. Requiring work item linking in the branch policy ensures that every pull request (PR) in Azure Repos must be associated with a work item (e.g., user story, bug) before it can be completed. Combined with a successful policy evaluation (e.g., build validation, required reviewers), this enforces traceability and compliance for all code changes.

Answer

Set the merge strategy to squash merge.

Answer

Enable 'Automatically include reviewers'.

Answer

Enforce a minimum number of comments.

Question 2

Your team wants to automatically assign a code reviewer from a specific security group when a pull request modifies files in a 'security' folder. Which Azure DevOps feature should you use?

Accepted Answer

Add a required reviewer policy for the branch.. Azure DevOps branch policies include a 'Required reviewers' policy that can be configured with a path filter. By specifying the path 'security' and adding the security group as required reviewers, the system will automatically add those reviewers to any pull request that modifies files in that folder. This is the built-in feature designed for this scenario. A CODEOWNERS file can also suggest reviewers based on file paths, but it is not a branch policy and does not enforce that the review must occur.

Answer

Enable 'Automatically approve' for security group.

Answer

Code ownership policy with automatic reviewer assignment.

Answer

Branch policy with minimum number of reviewers.

Question 3

Your organization uses GitHub Copilot for pull request summaries. However, the summaries sometimes miss security-related changes. What should you recommend?

Accepted Answer

Provide custom instructions to Copilot to emphasize security analysis.. GitHub Copilot's pull request summaries can be customized using custom instructions to prioritize security analysis. By providing specific directives in the repository's `.github/copilot-instructions.md` file or through the Copilot settings, you can instruct the AI to explicitly highlight security-related changes, such as those involving authentication, encryption, or input validation. This ensures the generated summaries are more aligned with your organization's security review requirements without disabling the tool.

Answer

Configure Copilot to ignore non-security files.

Answer

Disable Copilot and rely on manual review.

Answer

Switch to a different AI model specialized in security.

Question 4

Your team uses Azure Boards with a custom process. You need to ensure that when a bug is closed, it automatically triggers a new release pipeline. Which approach should you use?

Accepted Answer

Set up a Service Hook from Azure Boards to Azure Pipelines.. Service Hooks in Azure DevOps allow you to integrate Azure Boards with Azure Pipelines by subscribing to events like 'work item updated' or 'work item state changed'. When a bug is closed (state changed to 'Closed'), a Service Hook can automatically trigger a release pipeline, enabling event-driven automation without polling or custom code. This is the correct approach because it directly connects the work item state change to pipeline execution.

Answer

Configure a CI trigger in the release pipeline.

Answer

Add a release gate that checks for closed bugs.

Answer

Create an Azure Function that polls work items.

Question 5

Your team uses GitFlow and wants to enforce that all feature branches are deleted after merging to develop. Which automation should you implement?

Accepted Answer

Enable the 'Automatically delete source branches' policy in the branch policy.. The 'Automatically delete source branches' policy in Azure Repos branch policies automatically removes a feature branch once its pull request is completed into the target branch (e.g., develop). This directly enforces the GitFlow requirement without manual intervention or pipeline scripting, as it is a native repository-level setting.

Answer

Use a post-merge script in the pipeline.

Answer

Train developers to delete branches manually.

Answer

Configure branch retention policies in Azure Repos.

Question 6

Your organization uses Microsoft Teams for communication. You want to send a notification to a Teams channel when a release pipeline fails. Which action should you configure?

Accepted Answer

Add the 'Microsoft Teams Notification' task to the pipeline.. The 'Microsoft Teams Notification' task is a built-in Azure DevOps pipeline task that directly sends customizable notifications to a specified Teams channel when a pipeline event (such as failure) occurs. It requires no external configuration or additional services, making it the simplest and most appropriate choice for sending failure notifications from a release pipeline to Teams.

Answer

Configure an email notification to the team.

Answer

Use Azure Monitor alerts to send to Teams.

Answer

Add a Service Hook endpoint for Teams.

Question 7

Your team uses GitHub Actions for CI/CD. You need to enforce that all workflows use approved actions from a private marketplace. Which GitHub feature should you configure?

Accepted Answer

Set the Actions permissions to 'Allow only specified actions'.. The 'Allow only specified actions' setting in GitHub Actions permissions allows you to restrict workflow execution to a curated list of actions from a private marketplace or specific verified publishers. This enforces governance by preventing the use of unapproved actions, which is critical for compliance and security in enterprise CI/CD pipelines.

Answer

Use environment secrets to store allowed action names.

Answer

Require self-hosted runners.

Answer

Configure OpenID Connect (OIDC) for Actions.

Question 8

Your team wants to include a manual validation step before deploying to production. Which Azure Pipelines feature should they use?

Accepted Answer

Pre-deployment conditions with approval gates.. Pre-deployment conditions with approval gates allow you to require manual approval before a release is deployed to a specific stage, such as production. This is the correct feature because it explicitly pauses the pipeline before deployment and waits for designated approvers to validate the build, meeting the requirement for a manual validation step. Environment checks are a broader feature that can include both automated checks and manual approvals; however, the specific configuration for requiring manual approval in a release pipeline is pre-deployment conditions with approval gates.

Answer

Pipeline decorators.

Answer

Environment checks.

Answer

Post-deployment gates.

Question 9

Which TWO options are valid ways to communicate build status from Azure Pipelines to external stakeholders?

Accepted Answer

Configure a Service Hook to post to a Slack channel.. Service Hooks in Azure Pipelines allow integration with external services like Slack by triggering HTTP POST requests containing build status payloads. Additionally, Azure Pipelines provides built-in email notifications for specific events, such as build completion or failure, which can be configured to send status updates to stakeholders. Both are standard, officially supported features. Options like using a release pipeline to call Twilio are possible but are not standard built-in methods, so they are not considered 'valid ways' in this context.

Answer

Create a work item in Azure Boards for each build.

Answer

Export pipeline logs to Power BI for reporting.

Answer

Use a release pipeline to send SMS via Twilio.

Question 10

Which THREE practices improve the efficiency of code review processes in GitHub?

Accepted Answer

Enable required status checks to pass before merging.. Enabling required status checks ensures that automated tests, builds, or other validation steps must pass before a pull request can be merged. This enforces quality gates directly in the branch protection rules, preventing broken code from being merged and reducing manual review overhead.

Answer

Allow direct pushes to main for urgent fixes.

Answer

Require at least 5 reviewers for every PR.

Question 11

Which TWO Azure DevOps features can be used to implement change management processes?

Accepted Answer

Release approval gates.. Release approval gates (Option B) in Azure Pipelines allow you to enforce manual or automated checks before a release proceeds to a stage, implementing change management by requiring sign-offs or validation against external systems. Audit logging (Option C) captures a chronological record of changes to Azure DevOps resources, providing an immutable trail for compliance and change review processes.

Answer

Test plans.

Answer

Project wiki.

Answer

Code search.

Question 12

You are reviewing a branch protection rule JSON for a GitHub repository. Developers complain that they cannot merge pull requests. What is the most likely cause?

Accepted Answer

The signed commit requirement is enforced but developers are not signing commits.. When a branch protection rule requires signed commits, any pull request containing unsigned commits will be blocked from merging. GitHub verifies commit signatures using GPG or S/MIME, and if developers are not signing their commits, the merge will fail regardless of other settings.

Answer

The required approving review count is set to 1.

Answer

Rebase merging is disabled.

Answer

Squash merge is the only allowed method.

Question 13

You run the PowerShell command shown in the exhibit. The virtual network already exists. What is the outcome?

Accepted Answer

The virtual network's tags are updated to the specified tags.. The `New-AzResource` cmdlet can create a new resource or update an existing resource. If the virtual network already exists, the cmdlet updates it, including applying the specified tags. The `-Force` parameter suppresses confirmation prompts and does not determine create vs. update behavior.

Answer

The virtual network is deleted and recreated.

Answer

An error occurs because the virtual network already exists.

Answer

A new virtual network with a different name is created.

Question 14

You are deploying an ARM template using the parameters file shown. The deployment fails with an error that the referenced secret cannot be found. What is the most likely cause?

Accepted Answer

The secret name in the parameters file does not match the actual secret name in Key Vault.. The error 'referenced secret cannot be found' directly indicates that the secret name specified in the parameters file does not match the actual secret name stored in Azure Key Vault. ARM template deployment uses the `reference()` function to retrieve the secret value at deployment time, and if the secret name is misspelled or incorrect, the deployment fails with this specific error.

Answer

The Key Vault does not have an access policy granting the deployment user 'Get' secret permission.

Answer

The resource group 'rg-kv' does not exist.

Answer

The Key Vault is in a different region than the deployment.

Question 15

Your team uses GitHub Flow and wants to enforce that all pull requests require at least one approval before merging to the main branch. Which branch protection rule should you configure?

Accepted Answer

Require a pull request before merging with at least 1 approval. It directly enforces the requirement for at least one approval before merging. 'Require a pull request before merging' must be enabled, and within that, 'Required approvals' should be set to 1. Option A (status checks) verifies CI passes, not approvals. Option B restricts who can push to branches, which is unrelated to approval requirements. Option D (linear history) enforces a linear commit history but does not mandate approvals.

Answer

Require status checks to pass before merging

Answer

Restrict who can push to matching branches

Answer

Require linear history