AZ-400 Practice Questions
Prepare for AZ-400 with more than an answer.
- Exam fee
- $165 USD
- Level
- Expert
- Valid for
- 1 year
Domains covered on the exam 5
- Design and implement processes and communications12.5%
- Design and implement a source control strategy12.5%
- Design and implement build and release pipelines52.5%
- Develop a security and compliance plan12.5%
- Implement an instrumentation strategy7.5%
- 1
A project requires a wiki to document its architecture, coding standards, and release procedures. The documentation will include complex diagrams to illustrate process flows and system interactions. The team wants to store these diagrams as text within the markdown files so they can be version-controlled and easily updated. Which syntax should the team use within the Azure DevOps wiki to embed these diagrams as code?
Show answer details
Correct answer: D
Azure DevOps wikis and GitHub markdown both support Mermaid syntax for rendering diagrams from text. This allows teams to create and embed flowcharts, sequence diagrams, Gantt charts, and more directly within their documentation, meeting the requirement to have version-controllable, text-based diagrams.
- 2
You are creating a Bicep template to deploy an Azure Web App. You need to ensure that the application setting
ASPNETCORE_ENVIRONMENTis set based on an input parameter namedenvironmentType. IfenvironmentTypeis 'Production', the value should be 'Production'; otherwise, it should be 'Development'. Which Bicep expression should you use to define the value of this application setting?Show answer details
Correct answer: C
Bicep uses the ternary conditional operator
(condition) ? true-value : false-valuefor inline conditional logic. This expression correctly evaluates theenvironmentTypeparameter and returns the appropriate string value for the application setting. - 3
A team is migrating their classic UI-based release pipelines in Azure DevOps to multi-stage YAML pipelines. They heavily use release gates to query Azure Monitor alerts and ensure system health before promoting a release to the next stage. How can this same functionality be implemented in a YAML pipeline?
Show answer details
Correct answer: D
In YAML pipelines, the functionality of classic release gates is replaced by 'Checks' on 'Environments'. You can define an environment (e.g., 'Production') and configure checks on it, such as 'Invoke Azure Function' or 'Query Azure Monitor alerts'. A deployment job targeting this environment will only run after all configured checks have passed successfully.
- 4
A developer needs to revert a specific commit (
abc1234) from themainbranch that introduced a bug, but wants to keep the commit in the branch history for auditing purposes. The commit is not the most recent one. Which Git command should be used to achieve this?Show answer details
Correct answer: C
The
git revertcommand is used to create a new commit that undoes the changes made in a previous commit. This is the correct approach because it doesn't alter the existing project history, making it a safe operation for shared branches. The original buggy commit remains in the history, and a new commit is added that reverses its effects. - 5
A company is using GitHub and wants to automate the analysis of vulnerabilities in their open-source dependencies. They need a tool that automatically creates pull requests to upgrade packages to non-vulnerable versions. Which GitHub feature should they configure?
Show answer details
Correct answer: C
Dependabot is a GitHub feature specifically designed to find and fix vulnerabilities in dependencies. It can be configured to monitor dependency files and automatically create pull requests to update dependencies to secure versions, addressing the requirement perfectly.
- 6
An organization is using both GitHub for source control and Azure DevOps for work item tracking and CI/CD pipelines. They want to establish traceability between GitHub commits and Azure Boards work items. Which two actions are required to enable developers to link commits to work items? (Select TWO)
Show answer details
Correct answer: A, C
The Azure Boards app for GitHub is the primary mechanism that establishes the connection between the two platforms, allowing them to communicate and link artifacts.
Once the integration is established, developers use the
AB#syntax in their commit messages. This special mention is recognized by the integration and automatically links the commit to the specified Azure Boards work item. - 7
A team uses a multi-stage YAML pipeline to deploy an application to Staging and Production environments. The deployment to Production requires an explicit sign-off from the project manager. The following diagram shows the pipeline structure. How should this approval be configured?
flowchart LR Build --> Test Test --> Deploy_Staging Deploy_Staging --> Approval{Approval?} Approval -->|Yes| Deploy_Production Approval -->|No| Stop([End])Show answer details
Correct answer: C
In YAML pipelines, manual approvals are configured as 'Checks' on an 'Environment'. By creating a 'Production' environment and adding an 'Approvals' check, you can specify users or groups (like the project manager) who must approve any deployment job that targets that environment. This pauses the pipeline until the approval is granted.
- 8
A financial services company is implementing a new DevOps strategy. They are using Azure DevOps for work item tracking and Azure Repos for their private source code. For compliance reasons, every commit pushed to the
mainbranch must be linked to an approved work item in Azure Boards. The team lead wants to enforce this policy automatically and reject any pushes that do not comply. Which source control feature should be configured in Azure Repos?Show answer details
Correct answer: B
The most effective and automated way to enforce that commits are linked to work items before they are merged into a protected branch like
mainis by using a branch policy. This policy can be configured on themainbranch to require work item linking on pull requests, effectively preventing direct pushes and ensuring traceability for all changes. - 9
A DevOps team is tasked with monitoring a suite of microservices deployed to Azure Kubernetes Service (AKS). They need to collect detailed performance metrics, dependency maps, and trace transactions across services to quickly identify bottlenecks. The solution must integrate seamlessly with Azure Monitor and support custom telemetry. Which Azure service is specifically designed for this level of application performance monitoring?
Show answer details
Correct answer: C
Application Insights is the Application Performance Management (APM) feature of Azure Monitor. It is specifically designed to monitor live applications, automatically detect performance anomalies, and includes powerful analytics tools like Application Map for dependency visualization and distributed tracing to diagnose issues across microservices.
- 10
A security team wants to implement a robust secret management strategy for their Azure Pipelines. They have the following requirements:
- Secrets must be stored centrally and securely outside of Azure DevOps.
- Pipelines must be able to retrieve secrets at runtime without exposing them in logs.
- Access to secrets should be granted based on the pipeline's identity, not on user credentials.
Which combination of Azure services and features best meets these requirements? (Select TWO)
Show answer details
Correct answer: A, C
Azure Key Vault is the primary Azure service for centralized, secure storage of secrets, keys, and certificates. This directly addresses the requirement to store secrets outside of Azure DevOps.
Using a Service Connection configured with a Managed Identity allows the pipeline to authenticate to Azure resources like Key Vault using its own identity, managed by Azure AD. This fulfills the requirement of granting access based on the pipeline's identity without using static credentials like service principals with secrets.
