AZ-400 Configure processes and communications Practice Test 8 — 15 Questions

Question 1

Which TWO practices help improve the efficiency of code reviews? (Choose two.)

Accepted Answer

Keep pull requests small and focused on a single change.. Keeping pull requests small and focused on a single change (Option A) improves code review efficiency because it reduces cognitive load on reviewers, allowing them to understand and evaluate the change quickly without context-switching. Smaller PRs also enable faster feedback loops and easier rollback if issues are found, which aligns with DevOps principles of continuous integration and delivery.

Answer

Include multiple unrelated changes in a single pull request to reduce the number of PRs.

Answer

Assign as many reviewers as possible to ensure thoroughness.

Answer

Require that all team members review every pull request.

Question 2

Which THREE elements are essential for an effective incident response process in a DevOps environment? (Choose three.)

Accepted Answer

Automated rollback or remediation capabilities.. Automated rollback or remediation capabilities are essential because they enable rapid, consistent recovery from incidents without manual intervention. In a DevOps environment, this is typically implemented through deployment pipelines (e.g., Azure Pipelines) that support automatic rollback to a previous known-good version when health checks fail, or through infrastructure-as-code tools like Terraform that can revert state. This minimizes mean time to recovery (MTTR) and reduces human error during high-pressure situations.

Answer

A blame-free culture that identifies the person at fault.

Answer

Manual approval gates for every change.

Question 3

Which TWO GitHub Actions features can be used to enforce deployment approvals for a production environment? (Choose two.)

Accepted Answer

Deployment protection rules that require approval.. Deployment protection rules in GitHub Actions allow you to define required approvals before a workflow job can deploy to an environment. These rules are configured at the environment level and can mandate that a specific number of reviewers approve the deployment, effectively enforcing a manual approval gate for production environments.

Answer

The 'deployment' event trigger in a workflow.

Answer

Branch protection rules that require pull request reviews.

Answer

OpenID Connect (OIDC) for cloud provider authentication.

Question 4

You are a DevOps engineer for a large enterprise that uses GitHub Enterprise Cloud. The development team follows a GitFlow branching strategy with develop, feature, release, and main branches. The release branch is created from develop when a release is ready. After testing, the release branch is merged into main and then tagged. However, the team frequently forgets to merge release branches back into develop, causing hotfixes applied to main to not be in develop. You need to implement an automated process to ensure that after a release branch is merged into main, the changes are also merged back into develop. The solution must not require manual intervention and must handle merge conflicts gracefully by opening a pull request for conflict resolution. Which approach should you use?

Accepted Answer

Create a GitHub Actions workflow that triggers on push to main, attempts to merge main into develop, and if conflicts occur, opens a pull request for manual resolution.. It uses a GitHub Actions workflow triggered on pushes to main to automatically merge main into develop. If conflicts arise, the workflow opens a pull request for manual resolution, ensuring no changes are lost and the process remains automated without manual intervention.

Answer

Configure a branch protection rule on main that requires a pull request to merge into develop.

Answer

Create a scheduled workflow that runs daily and merges main into develop if there are no conflicts.

Answer

Set up a webhook in GitHub that calls an Azure Function to merge main into develop.

Question 5

Your organization uses Azure DevOps Services. The development team uses feature branches and pull requests to merge changes into the main branch. You need to implement a policy that ensures every pull request has at least two approvals from the 'Senior Developers' group, and the build must succeed before merging. Additionally, any comment on the pull request must be resolved before merging. The policy should apply to the main branch only. You have already created the 'Senior Developers' group in Azure DevOps. What should you do?

Accepted Answer

Add a branch policy on the main branch that requires a minimum of two reviewers from 'Senior Developers', a successful build, and that all comments are resolved.. Azure DevOps branch policies allow you to enforce specific requirements on pull requests targeting a branch. By configuring a branch policy on the main branch, you can require a minimum number of reviewers from a specific group (e.g., 'Senior Developers'), a successful build, and that all comments are resolved before merging. This directly meets all the stated requirements.

Answer

Configure the team's settings to require approvals for all pull requests.

Answer

Set up a build validation policy on the main branch that runs the pipeline and fails if comments are unresolved.

Answer

Configure the repository's pull request settings to require approvals and comment resolution.

Question 6

A developer reports that their Azure DevOps pipeline is failing with 'Access denied' when trying to push to a protected branch. The branch policy requires a successful build and approval from the 'Code Owners' group. The developer is a member of 'Contributors' but not 'Code Owners'. What is the most likely cause?

Accepted Answer

The developer is not in the 'Code Owners' group allowed to bypass the policy.. The branch policy requires membership in the 'Code Owners' group to push directly to the branch. The developer is not a member, so they get 'Access denied'. Option A (invalid characters) would cause a different error. Option B (pipeline service principal lacking permission) is unrelated to the developer's push. Option C (lacking 'Contribute' permissions at project level) is less specific and would result in a different error; the error here is specifically due to branch policy enforcement.

Answer

The branch name contains invalid characters.

Answer

The pipeline's service principal lacks 'Create Branch' permission.

Answer

The developer lacks 'Contribute' permissions at the project level.

Question 7

Your organization uses GitHub and wants to enforce that all commits to the main branch are signed with a GPG key that is verified against the user's GitHub account. Additionally, you want to block unsigned commits even if the committer is a repository admin. Which configuration should you use?

Accepted Answer

Enable 'Require signed commits' and set 'Include administrators' to true.. Enabling 'Require signed commits' in a GitHub branch protection rule, combined with setting 'Include administrators' to true, enforces that every commit pushed to the protected branch must be signed with a GPG key verified against the user's GitHub account, and this restriction applies even to repository administrators. This configuration blocks unsigned commits entirely, meeting the requirement to enforce signing for all users including admins.

Answer

Add a pre-receive hook that rejects unsigned commits.

Answer

Enable 'Require signed commits' and set 'Include administrators' to false.

Answer

Enable 'Require signed commits' and configure web commit signing.

Question 8

Your team uses Azure DevOps and wants to automate the creation of work items when a build pipeline fails. The work item should be assigned to the last person who committed a change in the failed build. Which approach should you use?

Accepted Answer

Add the 'Create work item on failure' task to the build pipeline.. The 'Create work item on failure' task in Azure DevOps build pipelines automatically creates a bug work item and assigns it to the last committer of the failed build. Option A is incorrect because release pipelines are meant for deployment, not build-time tasks. Option C is incorrect because while Service Hooks can trigger on build failure, they require additional custom logic to assign the work item to the last committer, making it less straightforward. Option D is incorrect because using a PowerShell script to call the REST API is more complex and error-prone compared to the built-in task.

Answer

Create a release pipeline that triggers on build failure and creates a work item.

Answer

Configure a Service Hook to create a work item on build failure.

Answer

Use a PowerShell script in the pipeline to call Azure DevOps REST API.

Question 9

Your organization uses GitHub and wants to implement a policy that requires all pull requests to be approved by at least two members of the 'security-team' team before merging. The 'security-team' team is a child team of 'engineering'. Which branch protection rule setting should you use?

Accepted Answer

Use the 'Require pull request reviews before merging' rule and set 'Required reviewers' to the security team.. 'Require pull request reviews before merging' with 'Required reviewers' set to the security team. This configuration enables branch protection to enforce reviews from that specific team. To require approval from at least two members, you must also set the 'Required number of reviewers' to 2 within the same branch protection rule. Option A is unrelated to reviewer requirements. Option C only sets a minimum number of reviewers without specifying which team, so it could allow any approver. Option D requires a CODEOWNERS file and only applies to file patterns owned by the team, not all pull requests. Therefore, B is the foundational setting needed to achieve the policy.

Answer

Enable 'Dismiss stale pull request approvals when new commits are pushed'.

Answer

Require a minimum number of reviewers and set it to 2.

Answer

Require code owner review and add the security team as code owners.

Question 10

Your team uses Azure DevOps and wants to enforce that all work items must be linked to a pull request before merging. Additionally, the pull request must be approved by at least two reviewers. Which two branch policies should you enable?

Accepted Answer

Require a minimum number of reviewers. The 'Require a minimum number of reviewers' policy enforces that a pull request must be approved by at least two reviewers before it can be completed. Option C is correct because the 'Check for linked work items' policy ensures that every pull request is associated with a work item, which satisfies the requirement that all work items must be linked to a pull request before merging.

Answer

Automatically update work items

Answer

Build validation

Answer

Comment resolution

Question 11

Your organization uses GitHub and wants to ensure that all commits to the main branch are associated with a GitHub issue. Which three settings should you configure?

Accepted Answer

Require status checks to pass before merging. Requiring status checks to pass before merging can include a custom status check that validates that a pull request is linked to a GitHub issue, directly enforcing association. Option D is correct because requiring pull request reviews before merging forces all changes to go through a pull request, which must be linked to a GitHub issue to satisfy the review process, ensuring traceability. Option A is incorrect because requiring conversation resolution only ensures comments are resolved, not that commits are associated with an issue. Options C and E are irrelevant to issue association.

Answer

Require conversation resolution before merging

Answer

Allow force pushes

Answer

Allow deletions

Question 12

Your organization uses GitHub and wants to automatically assign pull request reviewers based on the files changed. Which three steps should you take?

Accepted Answer

Configure 'Code owner review requirement' in branch protection.. Configuring 'Code owner review requirement' in branch protection enforces that pull requests affecting files with defined code owners must be approved by those owners before merging. This ensures that changes to specific file patterns automatically require review from the designated teams or individuals, aligning with the goal of automatic assignment based on files changed.

Answer

Enable 'Protected branches' for the main branch.

Answer

Configure team synchronization for the organization.

Question 13

Refer to the exhibit. You are reviewing an Azure DevOps YAML pipeline. The pipeline is configured with a webhook trigger from GitHub for pull request opened events. However, the pipeline does not trigger when a PR is opened. What is the most likely cause?

Accepted Answer

The webhook subscription is not configured in GitHub.. The most likely cause is that the webhook subscription is not configured in GitHub. Azure DevOps YAML pipelines with webhook triggers require an explicit webhook to be set up in the GitHub repository to send events (like pull request opened) to Azure DevOps. Without this subscription, Azure DevOps never receives the event, so the pipeline cannot trigger.

Answer

The webhook name does not match the service connection.

Answer

The pipeline lacks an agent pool specification.

Answer

The webhook filter is incorrect; 'opened' should be 'created'.

Question 14

Refer to the exhibit. You are reviewing the branch policy configuration for the main branch in Azure DevOps. The policy requires a successful status check for 'continuous-integration/azure-devops' but not for 'security-scanner'. The minimum approver count is 0 and direct push is disallowed. What is the effect of this policy?

Accepted Answer

Pull requests must pass the 'continuous-integration/azure-devops' check, but no reviewer approval is needed.. The policy requires a successful status check for 'continuous-integration/azure-devops' but not for 'security-scanner'. With a minimum approver count of 0 and direct push disallowed, pull requests must pass the required CI check, but no reviewer approval is needed. This means the PR can be completed automatically once the CI check passes, without any human reviewer.

Answer

Developers can push directly to main without a pull request.

Answer

Pull requests require at least two reviewers.

Answer

Both status checks are required to pass.

Question 15

Your organization uses Azure DevOps and has a strict compliance requirement: all changes to the main branch must be reviewed by at least two members of the 'ComplianceTeam' group. Additionally, a static code analysis tool must run and its results must be published to the pull request. The ComplianceTeam is a custom group defined in Azure DevOps, not a Microsoft Entra ID group. The team wants to enforce this using branch policies. You need to configure the minimum number of reviewers and also ensure that the code analysis results are visible to reviewers. What should you do?

Accepted Answer

Add a branch policy 'Require a minimum number of reviewers' set to 2, and specify the ComplianceTeam as required reviewers. Additionally, add a build policy that runs the code analysis and publishes results as a build summary.. The 'Require a minimum number of reviewers' branch policy enforces that at least two members from the ComplianceTeam must approve the pull request. Adding a build policy that runs static code analysis and publishes results as a build summary ensures the analysis output is visible directly in the PR, meeting the compliance requirement for both reviewer count and code analysis visibility.

Answer

Add a branch policy 'Require code owner review' and define the ComplianceTeam as code owners in a CODEOWNERS file.

Answer

Add a branch policy 'Comment resolution' and configure the ComplianceTeam to resolve comments.

Answer

Add a branch policy 'Automatically included reviewers' and set the ComplianceTeam to be automatically added to all PRs.