AZ-400: DevOps Engineer Expert Practice Exam

A development team needs to build and deploy a .NET application to Azure App Service every time code is merged to the main branch, with automated tests in the flow. Which pipeline configuration should be implemented?

1. A manual build triggered by the team lead after reviewing each merge
2. A YAML multi-stage pipeline with a CI trigger on main, plus build, test, and deploy stages
3. A classic release pipeline that deploys the latest commit without test stages
4. Scheduled nightly builds only

A team’s Azure Pipelines must deploy to Azure without storing long-lived credentials in the pipeline. Security wants no secret in the service connection that could leak or expire silently. Which authentication approach should be used?

1. Store an Azure service principal client secret in a pipeline variable marked secret
2. Use a personal access token (PAT) with a one-year expiry stored in a variable group
3. Configure a workload identity federation (OIDC) service connection so the pipeline exchanges a short-lived token with Microsoft Entra ID — no stored secret
4. Embed the credentials in the YAML file and restrict who can read the repository

A team deploys weekly but had three rollback incidents last month from undetected issues. They need to reduce deployment risk. Which deployment strategy should the team adopt?

1. Deploy to a staging environment and promote manually after a one-week observation period
2. Implement canary deployments with progressive traffic exposure and automated health rollback
3. Use blue-green deployment switching between environments without runtime health monitoring
4. Deploy directly to all production servers simultaneously during a scheduled off-hours window

A mobile team builds iOS, Android, and backend services from a single repo. Each component has different build requirements and toolchains. Which pipeline architecture should be used?

1. Three completely separate repositories each with an independent build pipeline
2. Template-based YAML pipelines using shared stages with platform-specific template extensions
3. A single monolithic YAML pipeline running all platform steps sequentially in one job
4. A classic UI-based release pipeline configured individually for each platform

An organization wants no code to reach production without security scanning, and high-severity vulnerabilities must block the deployment. Which pipeline enhancement should be added?

1. Manual security review by the AppSec team after each production deployment
2. Security scans scheduled monthly in a separate assessment process
3. Security requirement notes added to each pull-request description template
4. SAST and dependency scanning integrated as pipeline gates with severity-based fail rules

A DevOps team manages 20 microservices. When one service changes, only the affected service should rebuild and deploy, not all 20. Which pipeline feature enables this selective triggering?

1. Configure all 20 pipelines to trigger on every commit regardless of path
2. Disable CI for all pipelines and rely on manual triggers exclusively
3. Use path-based CI triggers in YAML that filter on each service-specific directory subtree
4. Maintain a single unified pipeline that rebuilds everything on each change

A team of 15 developers works on a shared codebase. They need parallel feature development, code reviews, and a stable main branch. Which branching strategy should they adopt?

1. GitHub Flow with short-lived feature branches requiring pull-request reviews before merging
2. Individual developer branches that accumulate changes and merge in bulk once per month
3. A single long-lived develop branch where all developers push without PR reviews
4. All 15 developers committing directly to main with no code-review requirement

A regulated company needs every code change traceable to a work item and approved by at least two reviewers before merging. Which branch policy should be configured?

1. Email-based approval chains requiring manager sign-off before each commit
2. Post-merge audits reviewing commit history at the end of each sprint
3. Branch policies requiring linked work items and a minimum of two reviewer approvals on main
4. No branch policies — trust developers to follow the documented review process

A project team needs to visualize sprint work, track burndown, and identify blockers across their Azure DevOps project. Which Azure DevOps feature provides this visibility?

1. Azure Pipelines run history showing build success rates and deployment frequencies
2. Azure Boards with sprint planning, burndown charts, and work-item tracking
3. Azure Artifacts feed statistics showing package download counts and versions
4. Azure Repos commit-history graph showing code change frequency and contributors

A company stores pipeline secrets like database connection strings and API keys. Secrets must be accessible to pipelines but hidden from developers in logs. Which approach should be used?

1. Variable groups linked to Azure Key Vault, with automatic secret masking in pipeline logs
2. Secret values stored in a committed text file in the repository root
3. Secret values stored directly as plain-text variables in the pipeline YAML
4. Secrets passed as visible command-line arguments to build and deploy scripts