AZ-400 Configure processes and communications Practice Test 6 — 15 Questions

Question 1

You are reviewing a branch protection rule JSON for a GitHub repository. Developers complain that they cannot merge pull requests. What is the most likely cause?

Accepted Answer

The signed commit requirement is enforced but developers are not signing commits.. When a branch protection rule requires signed commits, any pull request containing unsigned commits will be blocked from merging. GitHub verifies commit signatures using GPG or S/MIME, and if developers are not signing their commits, the merge will fail regardless of other settings.

Answer

The required approving review count is set to 1.

Answer

Rebase merging is disabled.

Answer

Squash merge is the only allowed method.

Question 2

You run the PowerShell command shown in the exhibit. The virtual network already exists. What is the outcome?

Accepted Answer

The virtual network's tags are updated to the specified tags.. The `New-AzResource` cmdlet can create a new resource or update an existing resource. If the virtual network already exists, the cmdlet updates it, including applying the specified tags. The `-Force` parameter suppresses confirmation prompts and does not determine create vs. update behavior.

Answer

The virtual network is deleted and recreated.

Answer

An error occurs because the virtual network already exists.

Answer

A new virtual network with a different name is created.

Question 3

You are deploying an ARM template using the parameters file shown. The deployment fails with an error that the referenced secret cannot be found. What is the most likely cause?

Accepted Answer

The secret name in the parameters file does not match the actual secret name in Key Vault.. The error 'referenced secret cannot be found' directly indicates that the secret name specified in the parameters file does not match the actual secret name stored in Azure Key Vault. ARM template deployment uses the `reference()` function to retrieve the secret value at deployment time, and if the secret name is misspelled or incorrect, the deployment fails with this specific error.

Answer

The Key Vault does not have an access policy granting the deployment user 'Get' secret permission.

Answer

The resource group 'rg-kv' does not exist.

Answer

The Key Vault is in a different region than the deployment.

Question 4

Your team uses GitHub Flow and wants to enforce that all pull requests require at least one approval before merging to the main branch. Which branch protection rule should you configure?

Accepted Answer

Require a pull request before merging with at least 1 approval. GitHub branch protection's 'Require a pull request before merging' setting, with 'Require approvals' set to at least 1, enforces that changes to main go through a PR with a reviewer sign-off. This directly matches the requirement for at least one approval before merge. Status checks, push restrictions, and linear history address different concerns and do not enforce human approval.

Answer

Require status checks to pass before merging

Answer

Restrict who can push to matching branches

Answer

Require linear history

Question 5

Your Azure DevOps project uses a self-hosted agent pool. Users report that builds are randomly failing with a 'disk full' error. The agents have 50 GB of disk space. What is the most effective way to mitigate this issue?

Accepted Answer

Enable the 'Clean after build' option on the build pipeline. Enabling 'Clean after build' ensures workspace cleanup after each run, reclaiming disk space to prevent failures. Option A is wrong because adding more agents doesn't free disk space on existing agents. Option B is wrong because 'Clean all build directories' cleans before builds, which may not prevent mid-build disk full errors and can disrupt parallel builds. Option D is wrong because limiting parallel jobs doesn't free disk space; a single build can still consume all available disk space.

Answer

Add more agents to the pool

Answer

Use the 'Clean all build directories' option in the agent configuration

Answer

Set 'Maximum number of parallel jobs' to 1

Question 6

A developer wants to automatically trigger a GitHub Actions workflow when a pull request is opened that targets the 'release' branch. Which trigger should they use?

Accepted Answer

pull_request: branches: [release]. The `pull_request` trigger fires when a pull request is opened, and the `branches: [release]` filter restricts it to PRs targeting the `release` branch. `pull_request_target` also fires on PR open events but runs in the base repository context and is intended for workflows requiring secrets or write access, not as the general PR-open trigger. `push` only fires on pushes to branches, not on PR opens. Therefore, D is correct.

Answer

pull_request_target: branches: [release]

Answer

push: branches: [release]

Answer

workflow_dispatch:

Question 7

Your Azure DevOps pipeline uses a YAML template that includes a step to push a Docker image to Azure Container Registry. The pipeline fails with 'unauthorized: authentication required'. The service connection uses a workload identity federation. What is the most likely cause?

Accepted Answer

The service principal used by the workload identity does not have the 'acrPush' role. The error 'unauthorized: authentication required' indicates that the Docker client could not authenticate with Azure Container Registry. With workload identity federation, the service principal used by the federated credential must have the 'acrPush' role assigned on the ACR scope to push images. Without this role assignment, the authentication token lacks the necessary permissions, even if the identity itself is valid.

Answer

The Docker image tag contains invalid characters

Answer

The Azure Container Registry name is incorrect

Answer

The service connection secret has expired

Question 8

You want to ensure that every commit message in your repository follows a specific format. Which GitHub feature can enforce this?

Accepted Answer

Required status checks with a commit lint action. Required status checks, when combined with a commit lint action in a GitHub Actions workflow, can enforce commit message formatting. The workflow runs on push or pull request events, and the status check must pass before a pull request can be merged, effectively rejecting commits that do not conform to the specified format.

Answer

Webhooks to validate and reject pushes

Answer

Branch protection rules

Answer

GitHub Actions workflow with push trigger

Question 9

Your team uses Azure Boards and wants to automate work item state transitions when code is merged. What should you use?

Accepted Answer

GitHub + Azure Boards integration with automatic work item linking. GitHub + Azure Boards integration, when configured with automatic work item linking, automatically transitions work items (e.g., from 'Active' to 'Resolved') when a pull request is merged. This is achieved through the integration's ability to detect commit messages or PR descriptions containing 'AB#{ID}' or 'Fixes AB#{ID}' patterns, which trigger state changes defined in the Azure Boards project configuration.

Answer

Azure Pipelines with 'Update work item' task

Answer

Branch policy in Azure Repos

Answer

Power Automate with Azure DevOps connector

Question 10

Your Azure DevOps pipeline deploys to multiple environments. You want to require manual approval before production deployment, but only if the deployment originated from a branch other than 'main'. How can you implement this?

Accepted Answer

Add a manual validation task with a condition: ne(variables['Build.SourceBranch'], 'refs/heads/main'). To require manual approval only for non-main branches, add a manual validation task to the production deployment job with a condition checking that the source branch is not main: `ne(variables['Build.SourceBranch'], 'refs/heads/main')`. This pauses the pipeline and waits for approval. Pre-deployment approvals (A) cannot be conditional on branch, and deployment groups (B) are not for manual approval. Branch policies (C) do not apply to pipeline stages.

Answer

Set a pre-deployment approval on the production environment

Answer

Configure a deployment group with approval gates

Answer

Use a branch policy that requires approval for non-main branches

Question 11

You need to automatically create a work item in Azure Boards when a GitHub issue is opened. What is the most efficient way to achieve this?

Accepted Answer

Install the GitHub + Azure Boards integration. The GitHub + Azure Boards integration is a built-in, officially supported connector that automatically links GitHub repositories to Azure Boards and can create work items from GitHub issues with minimal configuration. It is the most efficient method because it requires no custom code, no webhook scripting, and no pipeline setup—just install the integration from the Azure DevOps Marketplace and authorize it.

Answer

Create a GitHub Action that calls Azure DevOps REST API

Answer

Use Azure Pipelines with a GitHub trigger

Answer

Configure a webhook in GitHub to Azure DevOps

Question 12

Which TWO practices are recommended for managing secrets in Azure Pipelines?

Accepted Answer

Define secret variables in the pipeline UI and mark them as secret. Option A is correct because defining variables in the pipeline UI (Library variable groups or pipeline variables) and marking them as secret encrypts them at rest and masks their values in logs, which is the built-in Azure Pipelines mechanism for handling sensitive values. Option C is correct because Azure Key Vault is the recommended centralized secret store, and Azure Pipelines can link a Key Vault as a variable group so secrets are fetched at runtime and never persisted in the pipeline definition. Option B is not recommended because plain environment variables on the build agent are not encrypted or masked and can leak into logs or be read by other processes. Option D is wrong because there is no 'secret' keyword for variables in YAML; secrets must come from the UI, variable groups, or Key Vault. Option E is wrong because storing secrets as plain text in YAML exposes them in source control and build logs.

Answer

Use environment variables in the build agent

Answer

Set secret variables in the YAML file with the 'secret' keyword

Answer

Store secrets as plain text in YAML variables

Question 13

Which THREE are benefits of using a monorepo with Azure Repos and CI/CD pipelines?

Accepted Answer

Easier code sharing across projects. Option C is correct because a monorepo places all projects in a single repository, so shared libraries, utilities, and interfaces can be referenced directly rather than published and consumed as versioned packages across multiple repos. Option D is correct because dependencies between components are resolved from one consistent source tree, avoiding version-skew and cross-repo package coordination that complicates dependency management. Option E is correct because a single commit can change multiple components together, so a cross-component change lands atomically and CI/CD can validate the whole change set in one pipeline run. Option A is not a benefit of a monorepo; granular repository-level permissions are actually harder because everything lives in one repo, and Azure Repos permissions are typically applied at repo, branch, or path level rather than per project. Option B is not a benefit either, since a monorepo is a larger codebase and builds are not inherently faster; faster builds usually require path filters, incremental builds, or pipeline caching rather than resulting from the monorepo itself.

Answer

Granular repository-level permissions

Answer

Faster build times due to smaller codebase

Question 14

Which TWO features of GitHub Actions can be used to enforce code quality standards before merging?

Accepted Answer

Branch protection rules with required status checks. Branch protection rules with required status checks (C) enforce that pull requests must pass specific GitHub Actions workflows (e.g., linting, testing, security scans) before merging. Status checks (D) are the actual workflow runs that report pass/fail to the pull request; when required, they block merging until all checks succeed. Together, they ensure code quality gates are met automatically.

Answer

Environments

Answer

Secrets

Answer

Repository variables

Question 15

A developer pushes a commit to a branch named 'releases/v1.0'. What will happen?

Accepted Answer

The pipeline runs automatically on the push.. Azure Pipelines, by default, triggers a pipeline run automatically on any push to any branch unless a trigger filter is explicitly configured. The branch name 'releases/v1.0' is valid and does not contain any characters that would prevent a trigger; dots are allowed in branch names. The pipeline will execute the steps defined in the YAML file for that branch.

Answer

The pipeline runs but fails because the branch name contains a dot.

Answer

The pipeline runs only if a pull request is created.

Answer

The pipeline does not run because the branch is not main.