AZ-400 Configure processes and communications Practice Test 6 — 15 Questions

Question 1

Your organization uses GitHub Advanced Security. You need to ensure that secrets detected in pull requests automatically block the PR from merging. What should you configure?

Accepted Answer

Configure a custom secret scanning pattern and set the 'Block pull requests' property.. Option A is correct because GitHub Advanced Security allows you to create custom secret scanning patterns with a 'Block pull requests' property. When enabled, this property prevents a pull request from being merged if the custom pattern detects a secret in the PR's changes, directly meeting the requirement to automatically block merging on secret detection.

Answer

Configure a code scanning query to detect secrets.

Answer

Enable secret scanning and set the severity to critical.

Answer

Enable push protection for secret scanning.

Question 2

Which TWO actions are recommended practices for improving communication within a DevOps team?

Accepted Answer

Create a shared team charter with communication norms.. A shared team charter with communication norms establishes explicit expectations for how the team interacts, reducing ambiguity and fostering a culture of transparency and accountability. This practice aligns with DevOps principles of collaboration and shared ownership, ensuring all members understand preferred channels, response times, and escalation paths.

Answer

Use separate documentation repositories for each team.

Answer

Send monthly status reports via email.

Answer

Remove team chat channels to reduce noise.

Question 3

Which THREE practices help ensure that work item tracking is effective in Azure Boards?

Accepted Answer

Link work items to code changes and pull requests.. Linking work items to code changes and pull requests creates a traceable path from requirements to implementation, enabling teams to understand the context of changes and automatically update work item status (e.g., via GitHub integration or Azure Repos). This practice ensures that tracking is effective by providing visibility into which code delivered a specific feature or fix, which is essential for auditability and impact analysis.

Answer

Avoid customizing work item types to maintain consistency.

Answer

Create large work items that cover multiple features.

Question 4

Which TWO Azure DevOps features can be used to automate the process of updating work items when a build or release completes?

Accepted Answer

Pipeline task 'Update work item' from the Azure DevOps extension.. Options B and D are correct. Release gates can update work items based on release status, and the 'Update work item' task can set field values. Option A is wrong because service hooks are for external integrations. Option C is wrong because branch policies are for PRs, not builds. Option E is wrong because work item queries are read-only.

Answer

Service hooks to trigger an Azure function.

Answer

Work item query charts.

Answer

Branch policy with required reviewers.

Question 5

Your team uses a monorepo in Azure Repos. You want to enforce that every PR to the main branch includes a work item link and a specific label. Which branch policy should you configure?

Accepted Answer

Required status check (using a custom build pipeline). Option C is correct because Azure Repos branch policies allow you to enforce 'Required status checks' that can invoke a custom build pipeline. This pipeline can run a script to verify that the PR contains a work item link and a specific label, and fail the check if those conditions are not met. The other options either lack the ability to enforce both conditions or are not designed for custom validation logic.

Answer

Comment requirements

Answer

Check for linked work items

Answer

Build validation

Question 6

You are setting up a CI/CD pipeline for a microservices application deployed to Azure Kubernetes Service (AKS). Your team wants to automatically generate release notes from commit messages and work items. Which Azure DevOps feature should you use?

Accepted Answer

Generate release notes task (from YAML pipeline). The Generate release notes task (from YAML pipeline) is the correct choice because it is specifically designed to automatically generate release notes from commit messages and work items in Azure Pipelines. This task parses the commit history and linked work items between two Git refs (e.g., tags or branches) and outputs a formatted markdown file, which can be published as an artifact or used in a release pipeline. It directly addresses the requirement to derive release notes from commits and work items without manual effort.

Answer

Copy Files task

Answer

Azure Repos Wiki

Answer

Azure Test Plans

Question 7

Your organization uses GitHub for source control and GitHub Actions for CI/CD. You need to implement a branching strategy where every commit to the main branch triggers a build and deployment to a staging environment, but only after a successful pull request review. Which GitHub Actions trigger should you use?

Accepted Answer

pull_request_target with branches: [main] and types: [closed]. Option A is correct because the `pull_request_target` trigger with `types: [closed]` and `branches: [main]` ensures the workflow runs only after a pull request targeting the main branch is closed (merged). This satisfies the requirement of deploying to staging only after a successful pull request review and merge, not on every push. The `pull_request_target` event runs in the context of the base repository, providing access to secrets, which is appropriate for deployment workflows.

Answer

push with branches: [main]

Answer

pull_request with branches: [main]

Answer

workflow_dispatch

Question 8

Your team uses Azure Boards to manage work items. You need to ensure that when a work item is moved to 'Closed', all linked pull requests in Azure Repos are automatically completed. What should you configure?

Accepted Answer

Work item rule (state transition rule). Option D is correct because Azure Boards can be configured with a rule that automates PR completion when a work item state changes. Option A is wrong because branch policies do not react to work item changes. Option B is wrong because service hooks can trigger webhooks but not directly complete PRs; a custom function would be needed. Option C is wrong because the 'Pull Request' tab is informational.

Answer

Service hook to a custom Azure Function

Answer

Work item 'Pull Request' tab

Answer

Branch policy on the target branch

Question 9

Your team uses a Git flow branching strategy with develop and release branches. You want to enforce that only release branches can be merged into main, and all merges into main require a successful deployment to a production-like environment. How should you implement this in Azure Pipelines?

Accepted Answer

YAML pipeline with environment approvals and branch filters on trigger. Option B is correct because environment approvals in YAML pipelines can require manual approval before deployment to production, and branch filters on triggers can restrict to release branches. Option A is wrong because branch policies are for source control, not pipeline deployment. Option C is wrong because build validation runs on PR creation, not on merge. Option D is wrong because 'Check for linked work items' does not enforce branch restrictions.

Answer

Branch policy with required reviewers for main

Answer

Required status check for 'Check for linked work items'

Answer

Build validation policy on main

Question 10

Your team is migrating from on-premises TFS to Azure DevOps Services. You need to ensure that all existing work item history and attachments are preserved. Which migration approach should you use?

Accepted Answer

Use the Azure DevOps Migration Tools (open source). Option C is correct because the Azure DevOps Migration Tools (an open-source project) are specifically designed to migrate work items, including history, attachments, and links, from on-premises TFS to Azure DevOps Services. These tools handle the complex data transformations required to preserve the full fidelity of work item data, which is not possible with simpler export/import methods.

Answer

Export to Excel and import using Azure DevOps Office Integration

Answer

Manually recreate work items in Azure DevOps

Answer

Use the Azure DevOps REST API to migrate work items

Question 11

You are designing a communication strategy for your DevOps team. They use Microsoft Teams for collaboration. You need to automatically notify the team when a release to production fails. Which Azure DevOps integration should you use?

Accepted Answer

Configure a notification subscription in Azure DevOps to send a Teams webhook. Option D is correct because Azure DevOps notification subscriptions can be configured to send alerts to a Teams channel via an incoming webhook. This allows automatic, real-time notifications to the DevOps team when a release to production fails, directly within their collaboration platform.

Answer

Set up an email subscription to the DevOps team

Answer

Create a service hook to call a custom API

Answer

Publish a Wiki page with deployment status

Question 12

Your organization uses GitHub for code and GitHub Actions for CI/CD. You want to enforce that all workflows include a 'codeql-analysis' job for security scanning. What is the best approach?

Accepted Answer

Use GitHub's required workflows feature to mandate specific workflows. GitHub's required workflows feature allows organization owners to enforce that specific workflows (like a CodeQL analysis) run on all repositories in the organization, ensuring consistent security scanning without relying on templates or manual setup. This is the only approach that centrally mandates the workflow's presence and execution across all repositories, even if developers create new workflows or modify existing ones.

Answer

Create a workflow template and add it to the organization's workflow templates directory

Answer

Use branch protection rules to require a status check named 'codeql-analysis'

Answer

Create a custom GitHub Action that runs CodeQL and require it in all workflows

Question 13

Your team uses Azure Boards with a Kanban board. You want to limit the number of work items in the 'In Progress' column to prevent bottlenecks. What should you configure?

Accepted Answer

Column limits on the Kanban board. Column limits on the Kanban board directly enforce work-in-progress (WIP) constraints by capping the number of work items allowed in a specific column, such as 'In Progress'. This prevents bottlenecks by signaling the team to complete existing work before pulling new items, aligning with Lean and Kanban principles. Azure Boards supports this configuration through the board settings, where you can set a maximum limit per column.

Answer

Branch policies

Answer

Backlog level settings

Answer

Work item rules

Question 14

Which TWO actions should you take to ensure that your Azure DevOps pipeline securely manages secrets?

Accepted Answer

Use Azure Key Vault variable groups. Option A is correct because variable groups linked to Azure Key Vault allow secure storage. Option C is correct because secret variables should be set in the pipeline UI or variable groups, not YAML. Option B is wrong because checking secrets into the repository is insecure. Option D is wrong because logging secrets is a security risk. Option E is wrong because storing secrets in the YAML file exposes them in the repository.

Answer

Enable 'Allow scripts to access the system token' and print secrets in logs for debugging

Answer

Store secrets directly in the YAML pipeline file

Answer

Store secrets as plain text in the repository

Question 15

Which THREE practices are recommended for managing technical debt in a DevOps environment?

Accepted Answer

Allocate time for refactoring in each iteration. Option A is correct because allocating time for refactoring in each iteration is a core practice of managing technical debt in a DevOps environment. This ensures that code quality issues are addressed incrementally, preventing debt from accumulating and reducing future maintenance costs. In Agile and DevOps workflows, this is often implemented as a 'refactoring budget' within sprint planning, directly aligning with continuous improvement principles.

Answer

Defer unit tests until after deployment

Answer

Ignore low-priority code smells