AZ-400 Configure processes and communications Practice Test 5 — 15 Questions

Question 1

Your Azure DevOps project uses a self-hosted agent pool. Users report that builds are randomly failing with a 'disk full' error. The agents have 50 GB of disk space. What is the most effective way to mitigate this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the 'Clean after build' option on the build pipeline. Enabling 'Clean after build' ensures workspace cleanup after each run, reclaiming disk space to prevent failures. Option A is wrong because adding more agents doesn't free disk space on existing agents. Option B is wrong because 'Clean all build directories' cleans before builds, which may not prevent mid-build disk full errors and can disrupt parallel builds. Option D is wrong because limiting parallel jobs doesn't free disk space; a single build can still consume all available disk space.

Answer

Add more agents to the pool

Answer

Use the 'Clean all build directories' option in the agent configuration

Answer

Set 'Maximum number of parallel jobs' to 1

Question 2

A developer wants to automatically trigger a GitHub Actions workflow when a pull request is opened that targets the 'release' branch. Which trigger should they use?

Accepted Answer

pull_request: branches: [release]. The `pull_request` trigger fires when a pull request is opened, and the `branches: [release]` filter restricts it to PRs targeting the `release` branch. `pull_request_target` also fires on PR open events but runs in the base repository context and is intended for workflows requiring secrets or write access, not as the general PR-open trigger. `push` only fires on pushes to branches, not on PR opens. Therefore, D is correct.

Answer

pull_request_target: branches: [release]

Answer

push: branches: [release]

Answer

workflow_dispatch:

Question 3

Your organization is adopting Microsoft Entra ID for identity management. You need to configure Azure DevOps to trust tokens issued by Entra ID for service connections. Which authentication method should you use?

Accepted Answer

Managed identity. Managed identity (Option B) is correct because it allows Azure DevOps to authenticate to Microsoft Entra ID without storing any credentials, using an identity automatically managed by Azure. This is the recommended approach for service connections when the Azure DevOps agent runs on an Azure resource (e.g., a VM or App Service) that supports managed identities, as it eliminates the need for secret rotation and reduces security risk.

Answer

Service principal with client secret

Answer

OAuth 2.0 authorization code grant

Answer

Personal access token (PAT)

Question 4

Your Azure DevOps pipeline uses a YAML template that includes a step to push a Docker image to Azure Container Registry. The pipeline fails with 'unauthorized: authentication required'. The service connection uses a workload identity federation. What is the most likely cause?

Accepted Answer

The service principal used by the workload identity does not have the 'acrPush' role. The error 'unauthorized: authentication required' indicates that the Docker client could not authenticate with Azure Container Registry. With workload identity federation, the service principal used by the federated credential must have the 'acrPush' role assigned on the ACR scope to push images. Without this role assignment, the authentication token lacks the necessary permissions, even if the identity itself is valid.

Answer

The Docker image tag contains invalid characters

Answer

The Azure Container Registry name is incorrect

Answer

The service connection secret has expired

Question 5

You want to ensure that every commit message in your repository follows a specific format. Which GitHub feature can enforce this?

Accepted Answer

Required status checks with a commit lint action. Required status checks, when combined with a commit lint action in a GitHub Actions workflow, can enforce commit message formatting. The workflow runs on push or pull request events, and the status check must pass before a pull request can be merged, effectively rejecting commits that do not conform to the specified format.

Answer

Webhooks to validate and reject pushes

Answer

Branch protection rules

Answer

GitHub Actions workflow with push trigger

Question 6

Your team uses Azure Boards and wants to automate work item state transitions when code is merged. What should you use?

Accepted Answer

GitHub + Azure Boards integration with automatic work item linking. GitHub + Azure Boards integration, when configured with automatic work item linking, automatically transitions work items (e.g., from 'Active' to 'Resolved') when a pull request is merged. This is achieved through the integration's ability to detect commit messages or PR descriptions containing 'AB#{ID}' or 'Fixes AB#{ID}' patterns, which trigger state changes defined in the Azure Boards project configuration.

Answer

Azure Pipelines with 'Update work item' task

Answer

Branch policy in Azure Repos

Answer

Power Automate with Azure DevOps connector

Question 7

Your Azure DevOps pipeline deploys to multiple environments. You want to require manual approval before production deployment, but only if the deployment originated from a branch other than 'main'. How can you implement this?

Accepted Answer

Add a manual validation task with a condition: ne(variables['Build.SourceBranch'], 'refs/heads/main'). To require manual approval only for non-main branches, add a manual validation task to the production deployment job with a condition checking that the source branch is not main: `ne(variables['Build.SourceBranch'], 'refs/heads/main')`. This pauses the pipeline and waits for approval. Pre-deployment approvals (A) cannot be conditional on branch, and deployment groups (B) are not for manual approval. Branch policies (C) do not apply to pipeline stages.

Answer

Set a pre-deployment approval on the production environment

Answer

Configure a deployment group with approval gates

Answer

Use a branch policy that requires approval for non-main branches

Question 8

You need to automatically create a work item in Azure Boards when a GitHub issue is opened. What is the most efficient way to achieve this?

Accepted Answer

Install the GitHub + Azure Boards integration. The official GitHub + Azure Boards integration provides automatic two-way syncing between GitHub issues and Azure Boards work items. This requires minimal configuration and no custom code. Option B requires writing a GitHub Action and calling the Azure DevOps REST API, which is more complex. Option C involves using Azure Pipelines, which is not designed for this purpose. Option D involves manually configuring a webhook, which is less streamlined than the integration.

Answer

Create a GitHub Action that calls Azure DevOps REST API

Answer

Use Azure Pipelines with a GitHub trigger

Answer

Configure a webhook in GitHub to Azure DevOps

Question 9

Which TWO practices are recommended for managing secrets in Azure Pipelines?

Accepted Answer

Define secret variables in the pipeline UI and mark them as secret. Azure Pipelines allows you to define secret variables in the pipeline UI (or via the Azure DevOps CLI) and mark them as secret. When marked as secret, the value is encrypted at rest, masked in logs, and never exposed to the pipeline YAML or output. This is the recommended practice for managing sensitive data like API keys or passwords directly within the pipeline.

Answer

Use environment variables in the build agent

Answer

Set secret variables in the YAML file with the 'secret' keyword

Answer

Store secrets as plain text in YAML variables

Question 10

Which THREE are benefits of using a monorepo with Azure Repos and CI/CD pipelines?

Accepted Answer

Easier code sharing across projects. A monorepo enables easier code sharing across projects by allowing multiple teams to reference the same source files, libraries, and modules without needing separate package feeds or cross-repo synchronization. In Azure Repos, this means you can use common build artifacts and shared code directly within the same repository, reducing duplication and simplifying collaboration.

Answer

Granular repository-level permissions

Answer

Faster build times due to smaller codebase

Question 11

Which TWO features of GitHub Actions can be used to enforce code quality standards before merging?

Accepted Answer

Branch protection rules with required status checks. Branch protection rules with required status checks (C) enforce that pull requests must pass specific GitHub Actions workflows (e.g., linting, testing, security scans) before merging. Status checks (D) are the actual workflow runs that report pass/fail to the pull request; when required, they block merging until all checks succeed. Together, they ensure code quality gates are met automatically.

Answer

Environments

Answer

Secrets

Answer

Repository variables

Question 12

You applied the above branch policy to a GitHub repository. A developer tries to push a commit to the main branch that is signed with an S/MIME signature. What will happen?

Accepted Answer

The commit is rejected because S/MIME is not in the allowed signature types.. The branch policy in question is configured to allow only GPG or SSH signatures. S/MIME is not listed as an allowed signature type, so the commit is rejected. GitHub's branch protection rules enforce signature requirements based on the allowed signature types specified in the policy.

Answer

The commit is accepted because S/MIME is implicitly allowed.

Answer

The commit is accepted because it is signed.

Answer

The commit is rejected because the policy is in 'block' mode, which blocks all pushes.

Question 13

A developer pushes a commit to a branch named 'releases/v1.0'. What will happen?

Accepted Answer

The pipeline runs automatically on the push.. Azure Pipelines, by default, triggers a pipeline run automatically on any push to any branch unless a trigger filter is explicitly configured. The branch name 'releases/v1.0' is valid and does not contain any characters that would prevent a trigger; dots are allowed in branch names. The pipeline will execute the steps defined in the YAML file for that branch.

Answer

The pipeline runs but fails because the branch name contains a dot.

Answer

The pipeline runs only if a pull request is created.

Answer

The pipeline does not run because the branch is not main.

Question 14

Your team uses Azure Boards to track work items. They want to automatically update the 'Remaining Work' field on a task when a developer completes a pull request linked to that task. Which Azure DevOps feature should you configure?

Accepted Answer

Configure a branch policy to automatically update work items on PR completion.. Azure DevOps branch policies include a setting to automatically update work items linked to a pull request upon completion. Specifically, under branch policy settings, you can enable 'Automatically update work items' which, when a PR is completed, sets the 'Remaining Work' field to zero (or another configured value) for linked tasks. This directly meets the requirement without custom scripting or external services.

Answer

Define a pipeline variable to update the field during build.

Answer

Use a service hook to trigger an Azure Function that updates the work item.

Answer

Create a work item template that sets remaining work.

Question 15

Your Azure DevOps project has multiple teams. You need to ensure that each team's board only shows work items assigned to that team. What should you configure?

Accepted Answer

Configure team settings to set default area paths for each team.. Team settings allow you to configure default area paths for each team, which ensures that the team board only displays work items assigned to those area paths. This effectively scopes the board to the team's work. Option A is wrong because shared queries are custom views and do not affect the default board filtering; they are used for reporting or dashboards, not for team board visibility. Option B is wrong because iteration paths control sprint scheduling and timeboxes, not the visibility of work items on the board; area paths are used for team assignment. Option C is wrong because permissions on area paths control access levels (who can view or edit), not which work items appear on a team board; area path permissions do not filter the board content by team.

Answer

Create a shared query for each team and pin it to the dashboard.

Answer

Assign each team a unique iteration path.

Answer

Set permissions on area paths to restrict access.