AZ-400 Configure processes and communications Practice Test 8 — 15 Questions

Question 1

Your organization uses GitHub for code and GitHub Actions for CI/CD. You want to enforce that all workflows include a 'codeql-analysis' job for security scanning. What is the best approach?

Accepted Answer

Use GitHub's required workflows feature to mandate specific workflows. GitHub's required workflows feature allows organization owners to enforce that specific workflows (like a CodeQL analysis) run on all repositories in the organization, ensuring consistent security scanning without relying on templates or manual setup. This is the only approach that centrally mandates the workflow's presence and execution across all repositories, even if developers create new workflows or modify existing ones.

Answer

Create a workflow template and add it to the organization's workflow templates directory

Answer

Use branch protection rules to require a status check named 'codeql-analysis'

Answer

Create a custom GitHub Action that runs CodeQL and require it in all workflows

Question 2

Your team uses Azure Boards with a Kanban board. You want to limit the number of work items in the 'In Progress' column to prevent bottlenecks. What should you configure?

Accepted Answer

Column limits on the Kanban board. Column limits on the Kanban board directly enforce work-in-progress (WIP) constraints by capping the number of work items allowed in a specific column, such as 'In Progress'. This prevents bottlenecks by signaling the team to complete existing work before pulling new items, aligning with Lean and Kanban principles. Azure Boards supports this configuration through the board settings, where you can set a maximum limit per column.

Answer

Branch policies

Answer

Backlog level settings

Answer

Work item rules

Question 3

Which TWO actions should you take to ensure that your Azure DevOps pipeline securely manages secrets?

Accepted Answer

Use Azure Key Vault variable groups. Option A is correct because linking an Azure Key Vault to a variable group lets the pipeline fetch secrets at runtime from Key Vault, so the secret values are never stored in the pipeline definition and access is governed by Key Vault access policies or RBAC. Option D is correct because secret variables defined in the pipeline UI or in variable groups are encrypted at rest by Azure DevOps, masked in logs, and not exposed in the YAML source, which is the supported way to hold secrets the pipeline needs directly. Option B is wrong because enabling scripts to access the system token and printing secrets to logs deliberately exposes credentials, defeating masking and enabling token theft. Option C is wrong because secrets committed in the YAML pipeline file are stored in source control in plain text and visible to anyone with repo access. Option E is wrong because storing secrets as plain text in the repository exposes them to all readers of the repo and to its history, with no encryption or masking.

Answer

Enable 'Allow scripts to access the system token' and print secrets in logs for debugging

Answer

Store secrets directly in the YAML pipeline file

Answer

Store secrets as plain text in the repository

Question 4

Which THREE practices are recommended for managing technical debt in a DevOps environment?

Accepted Answer

Allocate time for refactoring in each iteration. Options A, C, and D are correct because managing technical debt in a DevOps environment requires proactive and automated quality practices. Allocating time for refactoring each iteration (A) prevents debt accumulation. Automating unit and integration tests (C) ensures early detection of regressions and quality issues. Integrating static code analysis into the CI pipeline (D) provides continuous feedback on code quality and debt indicators. Option B is incorrect because deferring unit tests increases technical debt by delaying detection. Option E is incorrect because ignoring low-priority code smells allows debt to grow, which should be tracked and addressed systematically.

Answer

Defer unit tests until after deployment

Answer

Ignore low-priority code smells

Question 5

Refer to the exhibit. You have this YAML pipeline in an Azure Repos repository. What is the expected behavior when a pull request is created from a feature branch to the main branch?

Accepted Answer

The pipeline does not run automatically on the PR; it must be triggered manually or via branch policy.. The YAML pipeline shown does not include a `pr` trigger, and the `trigger` block only applies to CI (continuous integration) builds on branch pushes, not pull requests. Without a `pr` trigger, Azure Pipelines does not automatically run on pull request creation; it must be triggered manually or via a branch policy configured in the repository settings.

Answer

The pipeline runs twice: once on PR creation and once on merge.

Answer

The pipeline runs automatically on the PR to main, triggered by the pr trigger.

Answer

The pipeline runs when the PR is merged to main, triggered by the trigger block.

Question 6

Your team uses GitHub Flow for feature development. A developer commits directly to the main branch without creating a pull request. Which practice should you enforce to ensure code quality and prevent direct commits?

Accepted Answer

Configure branch protection rules on the main branch to require pull request reviews before merging.. Branch protection rules on the main branch are the GitHub-native mechanism to require pull request reviews before any merge, which directly prevents direct commits. Enabling 'Require a pull request before merging' with a minimum number of approvals blocks the developer's direct push and forces the GitHub Flow review step.

Answer

Require a manual sign-off from a team lead after each commit.

Answer

Set up a .gitignore file to prevent certain file types from being committed.

Answer

Add a CODEOWNERS file that automatically assigns reviewers to any changes.

Question 7

Your team wants to implement a policy that requires all pull requests to have at least one approval from a member of the 'Senior Developers' group before merging. Which mechanism should you use?

Accepted Answer

Create a branch policy on the target branch that requires a minimum number of reviewers from the 'Senior Developers' group.. Azure Repos branch policies allow you to enforce required reviewers on pull requests. By creating a branch policy on the target branch that requires a minimum number of reviewers from the 'Senior Developers' group, you ensure that no pull request can be completed without at least one approval from that group. This directly meets the requirement without relying on file-level ownership or external scripts.

Answer

Add a CODEOWNERS file that designates 'Senior Developers' as owners of all files.

Answer

Configure the pull request dashboard to display required reviewers.

Answer

Set up a build validation policy that runs a script to check approvals.

Question 8

Your company uses Microsoft Teams for collaboration. You want to send notifications to a Teams channel whenever a build pipeline in Azure Pipelines fails. Which approach should you use?

Accepted Answer

Install the Azure Pipelines app for Microsoft Teams and subscribe the channel to pipeline notifications.. The Azure Pipelines app for Microsoft Teams is the officially supported integration that lets you subscribe a Teams channel to pipeline events, including build failures, with rich notifications and actionable cards. Installing the app and configuring the channel subscription is the intended approach. It provides native integration without custom webhooks or email workarounds.

Answer

Configure an email subscription in Azure DevOps to send alerts to the Teams channel email address.

Answer

Set up a webhook in Azure DevOps to post to the Teams channel's incoming webhook URL.

Answer

Use the 'Post to a Microsoft Teams channel' task in the pipeline.

Question 9

Your organization wants to enforce that all commits to the main branch are signed using GPG or S/MIME. Which GitHub feature should you enable?

Accepted Answer

Configure a branch protection rule that requires signed commits.. GitHub branch protection rules include a 'Require signed commits' setting that enforces all commits pushed to the protected branch must be signed with a verified GPG or S/MIME key. This ensures commit integrity and non-repudiation directly at the repository level, without requiring external scripts or API calls.

Answer

Use the GitHub API to check commit signatures after push.

Answer

Enable the 'Include administrators' setting in branch protection.

Answer

Require SSH key authentication for all users.

Question 10

Your team uses GitHub Issues for tracking bugs and features. They want to automatically assign issues to the person who created the pull request that closes the issue. Which GitHub Actions workflow trigger and action should you use?

Accepted Answer

Use the 'issues' event with 'closed' type and an action that assigns the issue to the PR author.. The 'issues' event with 'closed' type triggers a workflow when an issue is closed, and the 'actions/github-script' action can be used to assign the issue to the pull request author by querying the pull request that closed the issue. Option A is incorrect because the 'pull_request' event does not directly close issues; closing an issue is done via a commit or pull request merge. Option C is incorrect because the 'push' event is not related to issue closure. Option D is incorrect because the 'schedule' event is time-based and does not respond to issue closures.

Answer

Use the 'pull_request' event and the 'actions/assign' action to assign the issue.

Answer

Use the 'push' event and call the GitHub API to assign the issue.

Answer

Use the 'schedule' event to periodically check for closed issues and assign them.

Question 11

Which TWO practices help improve the efficiency of code reviews? (Choose two.)

Accepted Answer

Keep pull requests small and focused on a single change.. Keeping pull requests small and focused on a single change (Option A) improves code review efficiency because it reduces cognitive load on reviewers, allowing them to understand and evaluate the change quickly without context-switching. Smaller PRs also enable faster feedback loops and easier rollback if issues are found, which aligns with DevOps principles of continuous integration and delivery.

Answer

Include multiple unrelated changes in a single pull request to reduce the number of PRs.

Answer

Assign as many reviewers as possible to ensure thoroughness.

Answer

Require that all team members review every pull request.

Question 12

Which THREE elements are essential for an effective incident response process in a DevOps environment? (Choose three.)

Accepted Answer

Automated rollback or remediation capabilities.. Automated rollback or remediation capabilities are essential because they enable rapid, consistent recovery from incidents without manual intervention. In a DevOps environment, this is typically implemented through deployment pipelines (e.g., Azure Pipelines) that support automatic rollback to a previous known-good version when health checks fail, or through infrastructure-as-code tools like Terraform that can revert state. This minimizes mean time to recovery (MTTR) and reduces human error during high-pressure situations.

Answer

A blame-free culture that identifies the person at fault.

Answer

Manual approval gates for every change.

Question 13

Which TWO GitHub Actions features can be used to enforce deployment approvals for a production environment? (Choose two.)

Accepted Answer

Deployment protection rules that require approval.. Deployment protection rules in GitHub Actions allow you to define required approvals before a workflow job can deploy to an environment. These rules are configured at the environment level and can mandate that a specific number of reviewers approve the deployment, effectively enforcing a manual approval gate for production environments.

Answer

The 'deployment' event trigger in a workflow.

Answer

Branch protection rules that require pull request reviews.

Answer

OpenID Connect (OIDC) for cloud provider authentication.

Question 14

You are a DevOps engineer for a large enterprise that uses GitHub Enterprise Cloud. The development team follows a GitFlow branching strategy with develop, feature, release, and main branches. The release branch is created from develop when a release is ready. After testing, the release branch is merged into main and then tagged. However, the team frequently forgets to merge release branches back into develop, causing hotfixes applied to main to not be in develop. You need to implement an automated process to ensure that after a release branch is merged into main, the changes are also merged back into develop. The solution must not require manual intervention and must handle merge conflicts gracefully by opening a pull request for conflict resolution. Which approach should you use?

Accepted Answer

Create a GitHub Actions workflow that triggers on push to main, attempts to merge main into develop, and if conflicts occur, opens a pull request for manual resolution.. It uses a GitHub Actions workflow triggered on pushes to main to automatically merge main into develop. If conflicts arise, the workflow opens a pull request for manual resolution, ensuring no changes are lost and the process remains automated without manual intervention.

Answer

Configure a branch protection rule on main that requires a pull request to merge into develop.

Answer

Create a scheduled workflow that runs daily and merges main into develop if there are no conflicts.

Answer

Set up a webhook in GitHub that calls an Azure Function to merge main into develop.

Question 15

Your organization uses Azure DevOps Services. The development team uses feature branches and pull requests to merge changes into the main branch. You need to implement a policy that ensures every pull request has at least two approvals from the 'Senior Developers' group, and the build must succeed before merging. Additionally, any comment on the pull request must be resolved before merging. The policy should apply to the main branch only. You have already created the 'Senior Developers' group in Azure DevOps. What should you do?

Accepted Answer

Add a branch policy on the main branch that requires a minimum of two reviewers from 'Senior Developers', a successful build, and that all comments are resolved.. Azure DevOps branch policies allow you to enforce specific requirements on pull requests targeting a branch. By configuring a branch policy on the main branch, you can require a minimum number of reviewers from a specific group (e.g., 'Senior Developers'), a successful build, and that all comments are resolved before merging. This directly meets all the stated requirements.

Answer

Configure the team's settings to require approvals for all pull requests.

Answer

Set up a build validation policy on the main branch that runs the pipeline and fails if comments are unresolved.

Answer

Configure the repository's pull request settings to require approvals and comment resolution.