Microsoft AZ-400 Practice Exam

• A. AB#123 Correct answer
• B. ADO-123
• C. #boards/123
• D. WI#123

Option A is correct because the AB# prefix followed by the work item number is the syntax the Azure Boards GitHub integration recognizes in commit messages, pull requests and issues. ADO-123, #boards/123 and WI#123 are not recognized link syntaxes, so no link is created.

• A. The Velocity chart for the last six iterations
• B. The Sprint Burndown widget on the team dashboard
• C. The cumulative flow diagram for the board Correct answer
• D. The Lead Time widget filtered to closed items

Option C is correct because a cumulative flow diagram plots item counts per column over time, so a widening band for the Review column shows work piling up. Velocity and sprint burndown track completed or remaining work per sprint, not column accumulation, and the Lead Time widget measures elapsed time for closed items only.

• A. Trunk-based development Correct answer
• B. Forking workflow
• C. Environment branching
• D. GitFlow

Option A is correct because trunk-based development has everyone integrate short-lived branches into a single main branch at least daily, keeping integration continuous. Forking workflow (B) is about contributing from personal forks, environment branching (C) maintains long-lived branches per environment, and GitFlow (D) relies on long-lived develop and release branches.

• A. Branch policies on main with build validation Correct answer
• B. A pre-deployment gate on the production environment
• C. A required reviewers policy on main
• D. Deny for Contribute on main for the Contributors group

Option A is correct because a branch policy on main with build validation forces changes to arrive through a pull request and blocks completion until the build passes. A deployment gate (B) controls releases, not merges; required reviewers (C) enforces approval but not a passing build; and denying Contribute (D) blocks direct pushes but does not require a build.

• A. Create one Azure Artifacts feed and publish all three package types to it Correct answer
• B. Run Sonatype Nexus Repository on an Azure VM with one hosted repository per format
• C. Publish all three package types to GitHub Packages from the pipelines
• D. Push each package to Azure Container Registry as an OCI artifact

Option A is correct because a single Azure Artifacts feed hosts NuGet, npm and Python packages together, and it authenticates through Microsoft Entra and the pipelines' build identities with no extra infrastructure to administer. Option B adds a VM and a product to patch and run, option C moves the packages out of the tenant's own identity model, and option D (ACR) is for container images and OCI artifacts, not language package feeds.

• A. Python packages
• B. Universal Packages Correct answer
• C. Maven artifacts
• D. NuGet .nupkg packages

Option B is correct because Universal Packages store arbitrary files or directories as a versioned package and can hold large content such as model files, retrieved by version. Python, Maven and NuGet packages each require content to be built as a library of that ecosystem, which these model files are not.

• A. Attach a Query Azure Monitor Alerts check to the prod-aks environment for the resource group Correct answer
• B. Run an Azure CLI step that queries Azure Monitor and fails the stage on a fired Sev0 or Sev1 alert
• C. Insert a Manual validation step so the on-call engineer reviews open alerts before resuming
• D. Configure an Invoke Azure Function check on the environment to query the Alerts Management API

Option A is correct because the Query Azure Monitor Alerts check is built into environments, evaluates fired alerts for the resource group, and re-evaluates on an interval until it passes or times out, with no custom code. Options B and D require custom scripts or functions, and option C is a one-time manual step that does not repeat automatically.

• A. Required template check pointing to the shared deployment template
• B. Exclusive lock check on the prod environment
• C. Invoke REST API check that reads the change request state Correct answer
• D. Approvals check assigned to the security leads group Correct answer
• E. Branch control check limited to refs/heads/main

Options C and D are correct because environment checks are enforced by the environment itself, so pipeline authors cannot remove them by editing YAML: an Invoke REST API check can read the change state from the change-management system, and an Approvals check can require sign-off from the security leads group. A Required template check, an Exclusive lock and a Branch control check do not evaluate change approval or require the security leads' sign-off.

• A. Azure DevTest Labs with one formula per stack and a cost threshold on each lab
• B. A manually triggered GitHub Actions workflow that deploys the Bicep files with a shared service principal
• C. Template specs with Contributor granted to developers on a sandbox resource group
• D. Azure Deployment Environments with the repository added as a catalog and a project environment type Correct answer

Option D is correct because Azure Deployment Environments lets the platform team publish the Bicep templates from the GitHub repository as a catalog, set per-project environment types with spending limits, and deploy on behalf of developers who need no subscription rights. DevTest Labs does not use a Bicep catalog this way, a shared service principal gives no per-project limit, and Contributor on a resource group grants the rights the team wants to avoid.

• A. skip-checks: true Correct answer
• B. [skip build]
• C. [skip ci] Correct answer
• D. [ci off]
• E. [no ci]

Options A and C are correct because Azure Pipelines skips CI for a push when the commit message contains [skip ci] (or [ci skip]) or skip-checks: true. The strings [skip build], [ci off] and [no ci] are not recognised by Azure Pipelines, so the run would still start.

• A. Run a swap with preview, then complete the swap once validation passes Correct answer
• B. Deploy to staging, then redeploy the previous package to the production slot if validation fails
• C. Enable auto swap on the staging slot
• D. Add a second App Service plan and shift traffic with Traffic Manager weighted routing

Option A is correct because a swap with preview applies the production slot's settings to the staging slot, so the new build can be validated under production configuration before traffic moves; completing the swap keeps the previous build in the staging slot as a quick return path. Option B only rolls back by redeploying, which is slow, C auto swap gives no validation window with production settings, and D adds needless infrastructure.

• A. It is read through a separate feature endpoint
• B. It is a key-value under the .appconfig.featureflag/ prefix Correct answer
• C. It is a Key Vault secret referenced from the store's key-values
• D. It is a resource tag on the store
• E. It is read over the same connection as other settings Correct answer

Options B and E are correct because a feature flag is stored as an ordinary key-value whose key starts with the .appconfig.featureflag/ prefix, and it is read through the same endpoint and connection as every other setting. There is no separate feature endpoint (A), flags are not Key Vault secrets (C), and they are not resource tags on the store (D).

• A. PowerShell DSC with the Local Configuration Manager
• B. Ansible with playbooks run over SSH Correct answer
• C. Chef Infra with chef-client on each node
• D. Puppet with the Puppet agent on each node

Option B is correct because Ansible is agentless: it pushes YAML playbooks over SSH, so nothing is installed on the Azure or colocation Linux servers. Options C and D require an agent (chef-client, Puppet agent) on every node, and option A (PowerShell DSC with the Local Configuration Manager) is built around Windows and its LCM, which is an on-node component.

• A. Replace the sshd_config shell command with the lineinfile module Correct answer
• B. Add changed_when: false to every task in the play
• C. Run ansible-playbook with --check on each execution to suppress changes
• D. Raise forks so that hosts are configured in parallel
• E. Install the package with the package module and state: present Correct answer
• F. Restart sshd from a handler that only fires when the file task changes Correct answer

Options A, E and F are correct because idempotence comes from state-aware modules: lineinfile only changes the file when the line is missing, the package module with state: present only acts when the package is absent, and a handler restarts sshd only when the file task reports a change. Option B hides changes instead of removing them, option C runs in check mode so nothing is configured, and option D (forks) only affects parallelism.

• A. Mark the VSTest task with continueOnError: true
• B. Set retryCountOnTaskFailure on the VSTest task to 2 retries
• C. Turn on flaky test detection in Test management settings Correct answer
• D. Set failTaskOnFailedTests to false on the PublishTestResults task

Option C is correct because flaky test detection in Test management settings analyses pass/fail history across reruns, flags tests that flip results as flaky and tracks them without any change to the test code. Options A and D only hide or ignore failures, and option B retries the task without identifying which tests are unstable.

• A. Days to keep pull request runs Correct answer
• B. Number of recent runs to retain per pipeline Correct answer
• C. Days to keep runs Correct answer
• D. Maximum parallel jobs for the project
• E. Maximum versions per package
• F. Days to keep recently downloaded packages

Options A, B and C are correct because Project settings > Pipelines > Settings controls run retention through Days to keep runs, Days to keep pull request runs and the number of recent runs to retain per pipeline. Maximum parallel jobs (D) is a capacity setting, and the package settings in E and F belong to Azure Artifacts feeds, not to pipeline run records.

• A. Convert the service connection to workload identity federation on the existing app registration Correct answer
• B. Replace the client secret with a certificate uploaded to the app registration and to the service connection
• C. Recreate the service connection to use a user-assigned managed identity on Microsoft-hosted agents
• D. Raise the secret lifetime to the 24-month maximum and add an Azure Monitor alert before expiry

Option A is correct because workload identity federation removes the stored secret entirely and can be applied to the existing app registration, so its role assignments are untouched. A certificate (B) is still a stored credential that expires, a managed identity on Microsoft-hosted agents (C) is not supported, and a longer secret lifetime (D) keeps the secret and only delays the failure.

• A. Turn on Dependabot security updates for the repository Correct answer
• B. Commit a dependabot.yml file that opens version-update pull requests for npm on a weekly schedule
• C. Add the dependency review action to the pull request workflow
• D. Turn on Dependabot alerts for the repository Correct answer
• E. Schedule a weekly CodeQL analysis of the default branch

Options A and D are correct because Dependabot alerts notify maintainers when a dependency is affected by an advisory, and Dependabot security updates open a pull request that bumps the package only when an advisory affects it. Version updates from dependabot.yml (B) open pull requests regardless of advisories, the dependency review action (C) checks pull requests and does not notify, and CodeQL (E) analyzes your own code.

• A. Diagnostic settings Correct answer
• B. Application Insights connection string
• C. Activity log alert rule
• D. Azure Monitor Agent

Option A is correct because diagnostic settings are the per-resource Azure Monitor configuration that routes platform logs and metrics to a Log Analytics workspace, a storage account or an event hub. The Application Insights connection string only identifies where application telemetry is sent, an activity log alert rule just raises alerts, and Azure Monitor Agent collects guest OS data rather than routing platform logs.

• A. Resource health alert Correct answer
• B. Service health alert Correct answer
• C. Log search alert on the requests table
• D. Smart detection failure anomalies alert
• E. Metric alert with a dynamic threshold

Options A and B are correct because Resource health alerts report the health of a specific Azure resource and Service health alerts report Azure service incidents and planned maintenance, so both concern the platform itself. A log search alert on requests, a smart detection failure anomalies alert and a dynamic threshold metric alert all watch the behavior of the application that the team runs.