AZ-400 sample questions

Question 1

A security team wants to implement a robust secret management strategy for their Azure Pipelines. They have the following requirements:
1. Secrets must be stored centrally and securely outside of Azure DevOps.
2. Pipelines must be able to retrieve secrets at runtime without exposing them in logs.
3. Access to secrets should be granted based on the pipeline's identity, not on user credentials.

Which combination of Azure services and features best meets these requirements? (Select TWO)

Accepted Answer

Azure Key Vault

Accepted Answer

Service Connections with Managed Identity

Answer

Azure DevOps Variable Groups

Answer

Azure Pipelines Secure Files

Answer

Personal Access Tokens (PATs)

Question 2

A project manager at a large enterprise is concerned about the team's release cadence and efficiency. They want to track key DORA (DevOps Research and Assessment) metrics, specifically Lead Time for Changes and Deployment Frequency. The team uses Azure Boards for work items and Azure Pipelines for CI/CD. Where can the project manager most effectively visualize these metrics in a continuously updated dashboard?

Accepted Answer

Using the Analytics views and Dashboard widgets in Azure DevOps.

Answer

By exporting pipeline logs to an external BI tool.

Answer

In the Azure Pipelines summary view for each individual run.

Answer

By manually creating reports from Azure Boards query results.

Question 3

A development team is building a containerized application and using a YAML pipeline in Azure Pipelines to build and push the image to Azure Container Registry (ACR). During a security review, it was mandated that no container image with 'High' or 'Critical' vulnerabilities should be pushed to the production ACR instance. What is the most integrated and automated way to enforce this within the Azure ecosystem?

Accepted Answer

Enable Microsoft Defender for Containers and configure an Azure Policy on the ACR to deny pushes of vulnerable images.

Answer

Add a pipeline task that runs a third-party scanning tool like Trivy and parses the output to decide whether to fail the build.

Answer

Implement a manual approval gate in the release pipeline where a security officer checks a scan report before promotion.

Answer

Configure a webhook in ACR to trigger an Azure Function that deletes the image if a post-push scan finds critical vulnerabilities.

Question 4

A team is adopting trunk-based development using GitHub. To maintain code quality and prevent broken builds, they want to enforce that all pull requests targeting the `main` branch must pass a series of checks before they can be merged. These checks include a successful build, a minimum code coverage percentage, and a security scan. What GitHub feature should be configured on the `main` branch to enforce these requirements?

Accepted Answer

Branch protection rules

Answer

CODEOWNERS file

Answer

GitHub Actions workflow triggers

Answer

Repository issue templates

Question 5

A DevOps engineer needs to write a Kusto Query Language (KQL) query in Log Analytics to investigate performance issues. The goal is to find the average request duration for all failed requests (resultCode starts with '5') in the `requests` table over the last 24 hours, summarized into 1-hour intervals. Which KQL query correctly accomplishes this?

Accepted Answer

requests | where timestamp > ago(24h) and resultCode startswith '5' | summarize avg(duration) by bin(timestamp, 1h)

Answer

requests | where timestamp > ago(1d) | where resultCode has '5' | summarize avg(duration) by bin(timestamp, 1h)

Answer

requests | where resultCode contains '500' | summarize count() by bin(timestamp, 1h)

Answer

requests | top 100 by timestamp desc | where resultCode startswith '5' | project duration

Question 6

A manufacturing company is modernizing its application deployment. The primary goal is to minimize downtime and risk when deploying new versions of their critical inventory management web app, which is hosted on Azure App Service. They want to route a small percentage of live traffic to the new version for a period of time to monitor its performance and stability before rolling it out to all users. Which deployment strategy should they implement?

Accepted Answer

Canary release using App Service deployment slots and traffic routing.

Answer

Blue-green deployment using two separate App Service Plans.

Answer

Rolling deployment across multiple instances within the App Service Plan.

Answer

A/B testing using Azure Application Gateway.

Question 7

True or False: When using GitHub Advanced Security, secret scanning is limited to detecting secrets only in the default branch of a repository.

Accepted Answer

False

Answer

True

Question 8

A DevOps team manages multiple projects, each with its own Azure Pipeline. To ensure consistency and reduce redundant code, they want to create a reusable component that defines a sequence of steps for running integration tests. This component should be easily versioned and shared across different pipelines. Which Azure Pipelines feature is best suited for this purpose?

Accepted Answer

YAML Templates

Answer

Task Groups

Answer

Variable Groups

Answer

Service Connections

Question 9

**Case Study:**

A healthcare technology company, HealthData Inc., is migrating its monolithic patient portal application to a microservices architecture on Azure Kubernetes Service (AKS). The company operates under strict regulatory compliance (HIPAA) and must maintain a high degree of security and traceability.

**Current Situation:**
The development team uses GitHub for source code management. The current CI/CD process is manual, slow, and error-prone. There is no automated security scanning, and secrets like database connection strings are stored in configuration files within the repositories. The operations team has limited Kubernetes experience, and developers need a way to test their services in isolated, production-like environments before merging code.

**Requirements:**
1. **CI/CD Automation:** Implement a fully automated build, test, and deployment pipeline using GitHub Actions.
2. **Security:** All container images must be scanned for vulnerabilities. Secrets must be removed from source code and managed securely. A full audit trail of all code changes and deployments is required.
3. **Developer Environments:** Provide developers with on-demand, self-service environments for testing pull requests.
4. **Deployment Strategy:** Deployments to the production AKS cluster must use a progressive exposure model to minimize risk.

Which proposed solution best addresses all of HealthData Inc.'s requirements?

Accepted Answer

Use GitHub Actions for CI/CD, leveraging GitHub Advanced Security for secret and vulnerability scanning. Store secrets in Azure Key Vault, accessed via workload identity. Use Azure Deployment Environments for on-demand developer testing. Implement a canary release strategy for production AKS deployments.

Answer

Use GitHub Actions for CI. Store secrets in GitHub encrypted secrets. Manually provision test namespaces in the shared dev AKS cluster. Use a rolling deployment strategy for production.

Answer

Use Azure Pipelines for CI/CD connected to GitHub. Store secrets in Azure App Configuration. Use Azure DevTest Labs to create VMs for developer testing. Use a blue-green deployment strategy for production.

Answer

Use Jenkins for CI/CD. Store secrets in HashiCorp Vault. Use Docker Compose on developer laptops for testing. Use a recreate deployment strategy for simplicity in production.

Question 10

A team is designing a package management strategy using Azure Artifacts. They produce several internal NuGet packages that are consumed by different applications. They need to create a feed that provides access to their own packages as well as packages from the official nuget.org repository. New applications should only use packages that have been vetted and approved by a quality assurance team. How should they configure their feeds to meet these requirements?

Accepted Answer

Create one feed, enable nuget.org as an upstream source, and use feed views. Promote approved packages to an '@Approved' view that developers consume from.

Answer

Create one feed, add nuget.org as an upstream source, and have developers connect directly to this feed.

Answer

Create two separate feeds, one for internal packages and one for caching nuget.org packages. Developers must configure both feeds in their NuGet client.

Answer

Have a CI pipeline that downloads packages from nuget.org, scans them, and then publishes them to an internal-only Azure Artifacts feed.

Free AZ-400 sample questions

True or False: When using GitHub Advanced Security, secret scanning is limited to detecting secrets only in the default branch of a repository.

10 more free samples are waiting