AZ-400 Design and implement a source control strategy — 30 Questions

Question 1

You are reviewing a webhook payload from Azure Repos. The payload indicates that a new branch named 'feature-123' was created. Which event type triggered this webhook?

Accepted Answer

A new branch creation.. In Azure Repos, the webhook event type for any push to the repository, including creating a new branch, is 'Code pushed' (also referred to as 'Push'). There is no separate 'New branch creation' event type. The payload contains a 'refUpdates' array where a 'created' flag distinguishes a new branch from an update to an existing branch. Therefore, the correct answer should be 'Code pushed', but that option is not listed.

Answer

A push to an existing branch.

Answer

A branch deletion.

Answer

A pull request update.

Question 2

Which TWO actions help reduce the size of a Git repository over time?

Accepted Answer

Use Git LFS for large binary files.. Git LFS (Large File Storage) replaces large binary files with text pointers in the repository, storing the actual binary content in an external server. This prevents the repository from bloating with large files that are stored in full in every commit, significantly reducing the repository size over time. Similarly, using 'git filter-branch' or 'git filter-repo' allows you to rewrite history to permanently remove obsolete files or sensitive data from previous commits, so those objects are no longer stored in the repository's history. Both actions directly reduce the total size of the repository by eliminating or externalizing file content, unlike shallow clones or commit squashing, which do not reduce the remote repository size, and 'git gc', which only compresses objects without removing reachable content.

Answer

Squash commits before pushing to the remote.

Answer

Perform shallow clones when cloning the repository.

Answer

Regularly run 'git gc' to compress objects.

Question 3

Which THREE are best practices for managing secrets in GitHub Actions workflows?

Accepted Answer

Enable secret scanning and push protection in the repository settings.. Environment secrets are scoped to environments, not workflows. They provide fine-grained control by allowing secrets to be used only by jobs that reference a specific environment. Option D is correct because enabling secret scanning and push protection helps prevent accidental exposure of secrets. Option E is correct because storing secrets as GitHub Actions secrets ensures they are encrypted and masked in logs. Option A is incorrect because passing secrets as environment variables can expose them in logs or to other actions. Option C is incorrect because storing the same secret in multiple repositories increases the risk of exposure.

Answer

Pass secrets as environment variables to actions.

Answer

Use environment secrets to restrict access to specific workflows.

Answer

Store the same secret in multiple repositories for consistency.

Question 4

Your team uses GitHub and wants to automate the creation of a new release branch (e.g., release/v1.2.3) whenever a tag starting with 'v' is pushed. Which GitHub Actions trigger should you use?

Accepted Answer

on: create: tags: ['v*']. GitHub Actions does not support `tags` or `branches` filters on the `create` event. To trigger on tag creation/push, use the `push` event with a `tags` filter. For example: `on: push: tags: ['v*']`. None of the provided options match this valid configuration.

Answer

on: release: types: [published]

Answer

on: push: branches: ['v*']

Answer

on: workflow_dispatch: inputs: tag

Question 5

Your team uses GitHub and wants to enforce a policy that all commits to the main branch must be signed with a GPG key that is associated with the author's GitHub account. Which method should you use to enforce this?

Accepted Answer

Add a branch protection rule that requires signed commits. Both branch protection rules and repository rulesets support the 'Require signed commits' setting. Branch protection rules are the classic method, while repository rulesets are the newer feature. The question as written is ambiguous because it asks for a single method without excluding either. To make it a single-answer question, it should specify criteria such as 'classic' or 'simplest'. Otherwise, both C and D are correct.

Answer

Create a GitHub Actions workflow that runs a signature check after push

Answer

Use a commit status check to verify signatures

Question 6

Your team uses GitHub and wants to prevent direct pushes to the main branch. Only pull requests with at least one approval should be allowed to merge. Which GitHub feature should you use?

Accepted Answer

Branch protection rules. Branch protection rules are the GitHub feature that can prevent direct pushes and require pull requests to have at least one approval before merging. CODEOWNERS only requests reviews, and GitHub Actions does not enforce branch protection policies.

Answer

Repository rulesets

Answer

CODEOWNERS file

Answer

GitHub Actions

Question 7

You are designing a source control strategy for a global team of 200 developers working on a single large .NET solution. The solution takes 45 minutes to build. You need to reduce build times and enable independent versioning of components. What should you do?

Accepted Answer

Split the solution into multiple repositories, each with its own CI/CD pipeline. Splitting the solution into multiple repositories (a multi-repo strategy) allows independent teams to version and build their components separately, reducing the monolithic 45-minute build to smaller, parallel CI/CD pipelines. This approach also enables independent versioning of components, which is impossible in a monorepo without complex tooling. Each repository can have its own pipeline that triggers only on changes to that component, drastically cutting build times.

Answer

Migrate from Git to Team Foundation Version Control (TFVC) for better performance

Answer

Stay in a monorepo and use one pipeline with path filters to build only changed components

Answer

Keep the monorepo and disable continuous integration builds to reduce load

Question 8

Your team uses Git with Azure Repos. You notice that the commit history on the main branch contains many merge commits and commit messages like 'fix merge conflict'. You want a linear history for better traceability. What should you change?

Accepted Answer

Use squash merge when completing pull requests. Squash merge collapses all feature branch commits into a single commit on the main branch, eliminating merge commits and preserving a linear history. This directly addresses the problem of cluttered commit messages like 'fix merge conflict' by discarding intermediate commits and their messages. Squash merge is configured in the Azure Repos branch policy for pull request completion.

Answer

Configure the repository to use rebase when pulling

Answer

Set the branch policy to require a clean fast-forward merge

Answer

Use rebase merge when completing pull requests

Question 9

Your team is migrating from TFVC to Git in Azure Repos. Which TWO actions should you take to ensure a smooth migration?

Accepted Answer

Use the git-tfs tool to clone the TFVC repository with full history into a local Git repository.. The git-tfs tool is specifically designed to bridge TFVC and Git, allowing you to clone a TFVC repository with full changeset history into a local Git repository. This preserves the commit history, which is critical for audit trails and code review continuity during the migration. Additionally, training the development team on Git branching strategies and commands is essential to ensure the team can work effectively with the new version control system and minimize disruption during the transition.

Answer

Use the Azure DevOps Migration Tool to directly map TFVC permissions to Git repository permissions.

Answer

Create a single Git repository with multiple branches that mirror the TFVC branch structure.

Answer

Enable Git LFS in the new repository to handle large binary files from TFVC.

Question 10

Your organization uses Azure Repos and wants to implement a Git branching strategy that supports continuous delivery with hotfix capabilities. Which THREE practices should be part of the strategy?

Accepted Answer

Release branches are used to stabilize a release before merging to main.. Release branches allow a team to stabilize a release candidate without disrupting ongoing development on the develop branch. Once the release is fully tested and stable, it is merged into main, ensuring that main always contains production-ready code. This aligns with the continuous delivery principle of maintaining a deployable main branch. Hotfix branches should be created from main to address urgent production issues, and the fix should be merged back into both main and develop to ensure the fix is not lost in subsequent development. This keeps main in a deployable state and avoids the risk of cherry-picking.

Answer

Feature branches have long lifetimes and are merged to main only after full feature completion.

Answer

Hotfixes are merged directly to develop and then cherry-picked to main.

Question 11

Your team is adopting GitFlow with a main and develop branch. You need to ensure that hotfix branches are merged into both main and develop, but feature branches only into develop. What branch policy configuration should you implement?

Accepted Answer

Use a build validation policy to check the branch name and reject merges that do not follow the pattern.. Azure Repos branch policies do not provide a native setting to restrict which source branches can merge into a target branch. To enforce the GitFlow workflow, you can add a build validation policy that runs a build (or a simple script) on the PR and fails if the source branch does not match the expected pattern for the target branch. For example, for `main` only `hotfix/*` is allowed, while for `develop` both `hotfix/*` and `feature/*` are allowed. This blocks any PR that violates the rules.

Answer

Set the main branch to require all merges to come from pull requests, and for develop, allow direct pushes.

Answer

Use branch policies on main and develop that allow only certain source branches to merge, using branch naming conventions.

Answer

Configure a global policy that requires all branches to have a minimum number of reviewers.

Question 12

Your organization uses GitHub Enterprise with a monorepo containing multiple microservices. Developers work on feature branches and create pull requests to merge into main. You need to implement a policy that ensures all pull requests have at least one review from a code owner, pass required status checks (CI build and unit tests), and are up-to-date with the latest main branch before merging. Additionally, you want to prevent direct pushes to main. Which combination of branch protection rules should you configure?

Accepted Answer

Require pull request reviews before merging, require status checks, require branches to be up-to-date, and restrict who can push to matching branches.. Option D is correct because it includes all required elements: requiring pull request reviews (which can be configured to require code owner reviews), requiring status checks, requiring branches to be up-to-date, and restricting who can push to matching branches to prevent direct pushes. Option A lacks the up-to-date requirement. Option B does include pull request reviews but lacks status checks and permits admin direct pushes. Option C lacks pull request reviews and does not restrict direct pushes, though it does include status checks.

Answer

Require pull request reviews before merging, require status checks, and restrict who can push to matching branches.

Answer

Require pull request reviews before merging, require branches to be up-to-date, and restrict push access to admins only.

Answer

Require status checks, require branches to be up-to-date, and include administrators.

Question 13

Your team uses a monorepo in Azure Repos with multiple feature branches. You notice that merge conflicts frequently occur because developers are working on the same files. You want to reduce conflicts and improve collaboration. Which branching strategy should you recommend?

Accepted Answer

Use trunk-based development with feature flags to merge small, frequent changes.. Trunk-based development with feature flags is the correct approach because it encourages developers to merge small, frequent changes into the main branch, reducing the surface area for conflicts. Feature flags allow incomplete features to be hidden in production, enabling continuous integration without requiring long-lived feature branches. This strategy directly addresses the problem of frequent merge conflicts by minimizing divergence between branches.

Answer

Use release branches for each deployment and cherry-pick commits from main.

Answer

Use a single main branch and require all changes to be committed directly.

Answer

Use GitFlow with separate develop and release branches.

Question 14

Your company is migrating from TFVC to Git in Azure Repos. The repository contains a large number of binary files (e.g., .dll, .exe) that are frequently updated. You need to minimize repository size and clone time. What should you include in your migration plan?

Accepted Answer

Use Git LFS to track binary files.. Git LFS (Large File Storage) replaces large binary files in the repository with lightweight text pointers, storing the actual binary content in external storage. This prevents the repository from bloating with frequently updated binaries, reducing clone time and repository size since only the pointers are cloned.

Answer

Perform a shallow clone of the last commit only.

Answer

Use sparse checkout to exclude binary files from the working tree.

Answer

Use TFVC to Git converter with default settings.

Question 15

You have a GitHub repository with a GitHub Actions workflow that builds a .NET application. The workflow should only run when changes are pushed to the main branch, but it currently runs on every push to any branch. How should you fix the workflow trigger?

Accepted Answer

Add 'on: push: branches: [main]' to the workflow.. The GitHub Actions workflow syntax to restrict a push trigger to a specific branch uses `on: push: branches: [main]`. This ensures the workflow only executes when commits are pushed to the main branch, not on pushes to any other branch.

Answer

Add 'on: push: branch: [main]' to the workflow.

Answer

Add 'on: push: paths: [main]' to the workflow.

Answer

Add 'on: pull_request: branches: [main]' to the workflow.

Question 16

You see the above git log output. The team has a policy requiring linear history on the main branch. Which command should be used next time to integrate the feature branch?

Accepted Answer

git rebase main feature/login then git merge --ff-only. The team requires a linear history on the main branch. By first rebasing the feature branch onto main (`git rebase main feature/login`), you reapply the feature commits on top of the latest main commit, creating a clean, linear sequence. Then `git merge --ff-only` performs a fast-forward merge, which simply moves the main branch pointer forward without creating a merge commit, preserving the linear history policy.

Answer

git merge --squash feature/login

Answer

git cherry-pick f4e5d6c a7b8c9d

Answer

git merge --no-ff feature/login

Question 17

Your team uses GitHub and wants to enforce that all commits to the main branch are signed with a GPG key. Which branch protection rule should you configure?

Accepted Answer

Require signed commits.. The 'Require signed commits' branch protection rule enforces that every commit pushed to the protected branch must be signed with a GPG key. This ensures cryptographic verification of the commit author's identity, directly addressing the requirement to enforce signed commits on the main branch.

Answer

Require pull request reviews before merging.

Answer

Require status checks to pass before merging.

Answer

Require linear history.

Question 18

Your Azure DevOps project contains a Git repository with multiple branches. You need to ensure that code reviews are mandatory for all pull requests targeting the 'release' branch. Additionally, the build pipeline must pass before merging. How should you configure branch policies?

Accepted Answer

Enable 'Require a minimum number of reviewers' and 'Build validation'.. The requirement specifies two distinct conditions: mandatory code reviews (enforced by 'Require a minimum number of reviewers') and a passing build pipeline before merge (enforced by 'Build validation'). In Azure Repos, branch policies allow you to combine multiple checks; enabling only one of these would leave the other requirement unmet. Therefore, both policies must be enabled to satisfy the full criteria.

Answer

Enable 'Build validation' only.

Answer

Enable 'Require a minimum number of reviewers' only.

Answer

Enable 'Require a minimum number of reviewers' and 'Comment resolution'.

Question 19

Your organization has multiple GitHub repositories that use shared workflows. You want to centrally manage these workflows and ensure they are always up to date. What is the recommended approach?

Accepted Answer

Create a central repository with reusable workflows and reference them using the 'uses' keyword in your workflows.. The recommended approach is to create a central repository with reusable workflows and reference them using the 'uses' keyword. This is a native GitHub Actions feature that allows you to define shared workflow files in one repository and call them from any other repository in your organization. This ensures all workflows stay up to date centrally. The other options are not recommended: B uses API scheduling which is unnecessary and harder to manage; C downloads workflows from blob storage as inline scripts which loses the benefits of shared workflow versioning; D uses Git submodules which are designed for code dependencies and do not integrate well with GitHub Actions workflow execution.

Answer

Use the GitHub API to push workflow files to each repository on a schedule.

Answer

Download the workflows from a central blob storage and include them as inline scripts.

Answer

Store the workflows in a separate repository and use Git submodules to include them.

Question 20

You are setting up a new GitHub repository for a project that requires strict access control. Only specific team members should be able to push to the main branch, but all team members should be able to create branches and open pull requests. What is the best way to achieve this?

Accepted Answer

Use a branch protection rule to restrict pushes to the main branch to specific users or teams.. Branch protection rules in GitHub allow you to enforce restrictions on specific branches, such as requiring pull request reviews or restricting who can push directly. By configuring a rule for the main branch that limits push access to only designated users or teams, you ensure that all team members can create branches and open PRs, but only authorized members can merge into main. This directly meets the requirement without over-provisioning permissions or blocking collaboration.

Answer

Add all team members as administrators of the repository.

Answer

Remove write permissions for non-core team members and give them read-only access.

Answer

Set the repository to private and invite only core team members.