Microsoft AZ-400 Practice Test 2
Question 10
After implementing the change, the team verifies: A new AKS container image may affect payments, but the team wants to limit customer exposure during rollout. Which result would BEST demonstrate that the issue is corrected?
- The test cohort receives the new flow while excluded users retain the original flow.
- A sample rollout maintains required ready endpoints with no response interruption.
- Replaying a completed migration does not corrupt or duplicate the schema.
- A faulty canary triggers rollback while most production traffic remains on healthy pods.
Explanation
Correct Answer
D:A faulty canary triggers rollback while most production traffic remains on healthy pods. This measures the actual expected outcome, rather than trusting only a configuration flag. Implemented action: Route a bounded canary share to new pods and expand only after acceptance checks. Canary deployments reduce blast radius by validating a small traffic share first.
Incorrect Answers
A:The test cohort receives the new flow while excluded users retain the original flow. This would address a different situation, such as: A retailer wants to expose a new checkout feature to 5% of customers but its current flag is on or off for everyone. In the present case, the most directly relevant verification is: A faulty canary triggers rollback while most production traffic remains on healthy pods. The crucial distinction is: Canary deployments reduce blast radius by validating a small traffic share first.
B:A sample rollout maintains required ready endpoints with no response interruption. This would address a different situation, such as: An AKS update removes every API pod simultaneously because maxUnavailable equals the full replica count. In the present case, the most directly relevant verification is: A faulty canary triggers rollback while most production traffic remains on healthy pods. The crucial distinction is: Canary deployments reduce blast radius by validating a small traffic share first.
C:Replaying a completed migration does not corrupt or duplicate the schema. This would address a different situation, such as: A release database task retries after a timeout and creates duplicate schema objects, causing subsequent deployments to fail. In the present case, the most directly relevant verification is: A faulty canary triggers rollback while most production traffic remains on healthy pods. The crucial distinction is: Canary deployments reduce blast radius by validating a small traffic share first.
Question 11
Before changing the pipeline or service, engineers find: A self-hosted agent fails after months because workspace and Docker layer caches exhaust disk space. Which evidence should the engineer inspect FIRST?
- Inspect stage timeline, dependsOn graph, runner slots and data dependencies.
- Inspect output variables, task logs, masking controls and newly added debug flags.
- Inspect free disk, workspace lifecycle, container images and failure records.
- Review alert subscriptions, team ownership, failure history and escalation paths.
Explanation
Correct Answer
C:Inspect free disk, workspace lifecycle, container images and failure records. This directly checks the uncertain behavior or control before changing production. Self-hosted agent maintenance requires bounded workspace cleanup and cache retention. The resulting targeted action is: Implement safe workspace cleanup and monitored cache eviction consistent with rollback needs.
Incorrect Answers
A:Inspect stage timeline, dependsOn graph, runner slots and data dependencies. This would address a different situation, such as: A large build spends most of its time serially running three independent test suites. In the present case, the most directly relevant evidence is: Inspect free disk, workspace lifecycle, container images and failure records. The crucial distinction is: Self-hosted agent maintenance requires bounded workspace cleanup and cache retention.
B:Inspect output variables, task logs, masking controls and newly added debug flags. This would address a different situation, such as: Verbose diagnostic logging starts printing deployment tokens after a new task version update. In the present case, the most directly relevant evidence is: Inspect free disk, workspace lifecycle, container images and failure records. The crucial distinction is: Self-hosted agent maintenance requires bounded workspace cleanup and cache retention.
D:Review alert subscriptions, team ownership, failure history and escalation paths. This would address a different situation, such as: A pipeline reports repeated deployment failures but no team receives notifications because the original owner left the company. In the present case, the most directly relevant evidence is: Inspect free disk, workspace lifecycle, container images and failure records. The crucial distinction is: Self-hosted agent maintenance requires bounded workspace cleanup and cache retention.
Question 12
Before changing the pipeline or service, engineers find: A desktop client update is rolled out to every employee globally at the same moment, causing a widespread outage. Which evidence should the engineer inspect FIRST?
- Inspect ACR digest, release manifest, build provenance and tag permissions.
- Inspect endpoint groups, telemetry, rollout schedule and early-ring feedback.
- Inspect targeting rules, conversion events, experiment durations and uncontrolled changes.
- Inspect Helm release history, rendered manifests, readiness probes and errors.
Explanation
Correct Answer
B:Inspect endpoint groups, telemetry, rollout schedule and early-ring feedback. This directly checks the uncertain behavior or control before changing production. Ring deployment sequences exposure through controlled representative cohorts. The resulting targeted action is: Implement staged deployment rings with explicit gates and pause criteria.
Incorrect Answers
A:Inspect ACR digest, release manifest, build provenance and tag permissions. This would address a different situation, such as: A release manifest references an ACR latest tag that was replaced after QA approval. In the present case, the most directly relevant evidence is: Inspect endpoint groups, telemetry, rollout schedule and early-ring feedback. The crucial distinction is: Ring deployment sequences exposure through controlled representative cohorts.
C:Inspect targeting rules, conversion events, experiment durations and uncontrolled changes. This would address a different situation, such as: Two user interface variants are shown, but the team changes both pricing logic and checkout latency simultaneously and cannot attribute outcomes. In the present case, the most directly relevant evidence is: Inspect endpoint groups, telemetry, rollout schedule and early-ring feedback. The crucial distinction is: Ring deployment sequences exposure through controlled representative cohorts.
D:Inspect Helm release history, rendered manifests, readiness probes and errors. This would address a different situation, such as: An AKS Helm upgrade fails after rendering a misconfigured resource, leaving pods partially updated. In the present case, the most directly relevant evidence is: Inspect endpoint groups, telemetry, rollout schedule and early-ring feedback. The crucial distinction is: Ring deployment sequences exposure through controlled representative cohorts.
Question 13
Before changing the pipeline or service, engineers find: A compatible optional SDK feature is added, but release automation increments the major version for every change. Which evidence should the engineer inspect FIRST?
- Review feed upstream configuration, package authorization and cached dependency versions.
- Inspect dependency resolution reports, advisory scope, wheel metadata and test outcomes.
- Inspect build timestamps, package versions, artifact digests and update metadata.
- Review API surface change, dependency constraints, version bump rules and changelog.
Explanation
Correct Answer
D:Review API surface change, dependency constraints, version bump rules and changelog. This directly checks the uncertain behavior or control before changing production. Semantic versioning should reflect compatibility impact rather than commit count. The resulting targeted action is: Classify the nonbreaking feature under an appropriate minor release with validation.
Incorrect Answers
A:Review feed upstream configuration, package authorization and cached dependency versions. This would address a different situation, such as: A package feed cannot install vetted public dependencies during a disconnected corporate build unless developers manually copy files. In the present case, the most directly relevant evidence is: Review API surface change, dependency constraints, version bump rules and changelog. The crucial distinction is: Semantic versioning should reflect compatibility impact rather than commit count.
B:Inspect dependency resolution reports, advisory scope, wheel metadata and test outcomes. This would address a different situation, such as: A pipeline publishes Python wheels from a feed after an advisory identifies a vulnerable indirect dependency. In the present case, the most directly relevant evidence is: Review API surface change, dependency constraints, version bump rules and changelog. The crucial distinction is: Semantic versioning should reflect compatibility impact rather than commit count.
C:Inspect build timestamps, package versions, artifact digests and update metadata. This would address a different situation, such as: An organization uses calendar-versioned nightly internal tools but deployments cannot distinguish two builds made on the same day. In the present case, the most directly relevant evidence is: Review API surface change, dependency constraints, version bump rules and changelog. The crucial distinction is: Semantic versioning should reflect compatibility impact rather than commit count.
Question 14
The DevOps team must resolve this situation: A platform dependency blocks three application teams, but each Azure Boards team tracks a separate unrelated task. Which engineering action is MOST appropriate?
- Adopt protected mainline GitHub Flow with small reviewed changes and linked work items.
- Update related GitHub Issues from protected workflow events with release status and error context.
- Configure meaningful status checks, reviewer ownership and notification routing.
- Link dependent work items across teams and use delivery plans to visualize blockers.
Explanation
Correct Answer
D:Link dependent work items across teams and use delivery plans to visualize blockers. This action addresses the specific failure or requirement and preserves delivery controls. Validation criterion: The shared platform dependency appears before downstream releases in an integrated plan. Shared delivery dependencies must be visible across team backlogs with responsible ownership.
Incorrect Answers
A:Adopt protected mainline GitHub Flow with small reviewed changes and linked work items. This would address a different situation, such as: An engineering organization uses long-lived feature branches, and its hotfixes regularly miss previously merged changes. In the present case, the most directly relevant engineering action is: Link dependent work items across teams and use delivery plans to visualize blockers. The crucial distinction is: Shared delivery dependencies must be visible across team backlogs with responsible ownership.
B:Update related GitHub Issues from protected workflow events with release status and error context. This would address a different situation, such as: A deployment job fails but the failure is not associated with the GitHub issue that requested the release. In the present case, the most directly relevant engineering action is: Link dependent work items across teams and use delivery plans to visualize blockers. The crucial distinction is: Shared delivery dependencies must be visible across team backlogs with responsible ownership.
C:Configure meaningful status checks, reviewer ownership and notification routing. This would address a different situation, such as: A team cannot tell when a pull request is waiting for security approval versus failed tests. In the present case, the most directly relevant engineering action is: Link dependent work items across teams and use delivery plans to visualize blockers. The crucial distinction is: Shared delivery dependencies must be visible across team backlogs with responsible ownership.
Question 15
An engineering design review identifies: Azure Boards shows completed user stories, but there is no way to identify the commits and deployments delivering each story. Which shortcut should the team MOST specifically avoid for this case?
- Ask support staff to maintain a private unversioned list of customer complaints.
- Duplicate the same task without linkage in each team's backlog and mark all as independent.
- Delete every review requirement so developers can push hotfixes directly to main.
- Treat the work item's Closed state as proof that its code is in production.
Explanation
Correct Answer
D:Treat the work item's Closed state as proof that its code is in production. This shortcut directly undermines the stated control or workflow. A safer action is: Configure work-item linking and automatic build/deployment associations in Azure Boards. Explanation: Traceability requires explicit relationships among work items, source revisions, builds and deployments.
Incorrect Answers
A:Ask support staff to maintain a private unversioned list of customer complaints. This would address a different situation, such as: Customer-reported bugs arrive in chat messages and are never consistently recorded for the development team. In the present case, the most directly relevant unsafe shortcut is: Treat the work item's Closed state as proof that its code is in production. The crucial distinction is: Traceability requires explicit relationships among work items, source revisions, builds and deployments.
B:Duplicate the same task without linkage in each team's backlog and mark all as independent. This would address a different situation, such as: A platform dependency blocks three application teams, but each Azure Boards team tracks a separate unrelated task. In the present case, the most directly relevant unsafe shortcut is: Treat the work item's Closed state as proof that its code is in production. The crucial distinction is: Traceability requires explicit relationships among work items, source revisions, builds and deployments.
C:Delete every review requirement so developers can push hotfixes directly to main. This would address a different situation, such as: An engineering organization uses long-lived feature branches, and its hotfixes regularly miss previously merged changes. In the present case, the most directly relevant unsafe shortcut is: Treat the work item's Closed state as proof that its code is in production. The crucial distinction is: Traceability requires explicit relationships among work items, source revisions, builds and deployments.
Question 16
Before changing the pipeline or service, engineers find: An AKS update removes every API pod simultaneously because maxUnavailable equals the full replica count. Which evidence should the engineer inspect FIRST?
- Review artifact retention, release manifest, service health signals and restoration test.
- Inspect Azure App Configuration flags, filters, defaults and access rights.
- Inspect targeting rules, conversion events, experiment durations and uncontrolled changes.
- Inspect Deployment strategy, replica count, readiness probes and disruption events.
Explanation
Correct Answer
D:Inspect Deployment strategy, replica count, readiness probes and disruption events. This directly checks the uncertain behavior or control before changing production. Rolling update policies should preserve minimum ready capacity during replacement. The resulting targeted action is: Set appropriate maxUnavailable/maxSurge and validate readiness during rollout.
Incorrect Answers
A:Review artifact retention, release manifest, service health signals and restoration test. This would address a different situation, such as: A release detects elevated errors but cannot roll back because the prior verified package was deleted. In the present case, the most directly relevant evidence is: Inspect Deployment strategy, replica count, readiness probes and disruption events. The crucial distinction is: Rolling update policies should preserve minimum ready capacity during replacement.
B:Inspect Azure App Configuration flags, filters, defaults and access rights. This would address a different situation, such as: A half-finished payment feature accidentally activates immediately when its code merges into main. In the present case, the most directly relevant evidence is: Inspect Deployment strategy, replica count, readiness probes and disruption events. The crucial distinction is: Rolling update policies should preserve minimum ready capacity during replacement.
C:Inspect targeting rules, conversion events, experiment durations and uncontrolled changes. This would address a different situation, such as: Two user interface variants are shown, but the team changes both pricing logic and checkout latency simultaneously and cannot attribute outcomes. In the present case, the most directly relevant evidence is: Inspect Deployment strategy, replica count, readiness probes and disruption events. The crucial distinction is: Rolling update policies should preserve minimum ready capacity during replacement.
Question 17
The DevOps team must resolve this situation: An archived security-sensitive repository remains writable by former project members and receives unreviewed commits. Which engineering action is MOST appropriate?
- Configure supported sparse checkout or Scalar/partial clone for constrained workflows.
- Archive the repository or lock write access with audited exception handling.
- Recover the intended commit using the recorded reflog SHA and a safe new branch.
- Normalize names and case-correct imports with cross-platform validation in PR checks.
Explanation
Correct Answer
B:Archive the repository or lock write access with audited exception handling. This action addresses the specific failure or requirement and preserves delivery controls. Validation criterion: A former contributor cannot push to the archived security repository. Repository lifecycle controls should remove stale rights and enforce appropriate archival state.
Incorrect Answers
A:Configure supported sparse checkout or Scalar/partial clone for constrained workflows. This would address a different situation, such as: A developer needs one service from a huge monorepo, but each checkout transfers every unrelated project and binary. In the present case, the most directly relevant engineering action is: Archive the repository or lock write access with audited exception handling. The crucial distinction is: Repository lifecycle controls should remove stale rights and enforce appropriate archival state.
C:Recover the intended commit using the recorded reflog SHA and a safe new branch. This would address a different situation, such as: A developer accidentally removes an important local commit during an interactive rebase, but it is still reachable from Git reflog. In the present case, the most directly relevant engineering action is: Archive the repository or lock write access with audited exception handling. The crucial distinction is: Repository lifecycle controls should remove stale rights and enforce appropriate archival state.
D:Normalize names and case-correct imports with cross-platform validation in PR checks. This would address a different situation, such as: A service builds on a Windows workstation but fails on Linux CI because a source import differs only in filename case. In the present case, the most directly relevant engineering action is: Archive the repository or lock write access with audited exception handling. The crucial distinction is: Repository lifecycle controls should remove stale rights and enforce appropriate archival state.
Question 18
An Azure DevOps engineering team evaluates this condition: A deployment stage starts before the packaging stage publishes an artifact because stages are configured independently. Which DevOps principle BEST explains the underlying weakness?
- Self-hosted runners require trust boundaries and workload-specific isolation.
- Azure service connections can use workload identity federation instead of expiring shared secrets.
- YAML stage dependencies should express the actual required job order.
- Custom YAML conditions must retain required success prerequisites.
Explanation
Correct Answer
C:YAML stage dependencies should express the actual required job order. This principle identifies the risk or delivery weakness in the case. Relevant evidence: Inspect dependsOn, output artifacts, stage conditions and run timelines. An appropriate controlled response is: Define explicit stage dependencies and artifact handoffs in the YAML pipeline.
Incorrect Answers
A:Self-hosted runners require trust boundaries and workload-specific isolation. This would address a different situation, such as: A GitHub self-hosted runner accepts workflows from untrusted forks and shares its workspace with production credentials. In the present case, the most directly relevant principle is: YAML stage dependencies should express the actual required job order. The crucial distinction is: YAML stage dependencies should express the actual required job order.
B:Azure service connections can use workload identity federation instead of expiring shared secrets. This would address a different situation, such as: An Azure DevOps pipeline's Azure Resource Manager service connection fails each quarter when its client secret expires. In the present case, the most directly relevant principle is: YAML stage dependencies should express the actual required job order. The crucial distinction is: YAML stage dependencies should express the actual required job order.
D:Custom YAML conditions must retain required success prerequisites. This would address a different situation, such as: A post-deployment verification job runs even when staging tests fail because its condition overrides the default dependency check. In the present case, the most directly relevant principle is: YAML stage dependencies should express the actual required job order. The crucial distinction is: YAML stage dependencies should express the actual required job order.
Question 19
A Microsoft DevOps team is addressing: Hundreds of nightly builds run when source code is unchanged, consuming expensive hosted parallel minutes. Which TWO complementary actions should be taken? Select TWO answers.
- Assign accountable pipeline owners and route critical failures to current responders.
- Inspect pipeline resources, branch filters, artifact provenance and run IDs.
- Inspect run triggers, change events, consumption and mandated scheduled security scans.
- Review service connection mode, secret expiration, Azure RBAC and trust configuration.
- Introduce relevant path/branch conditions and appropriately scheduled validation.
Explanation
Correct Answers
C:Inspect run triggers, change events, consumption and mandated scheduled security scans. This supplies the diagnosis/evidence needed for the scenario. Its complementary step is: Introduce relevant path/branch conditions and appropriately scheduled validation. Together they address: Pipeline cost optimization should remove redundant executions without weakening required checks.
E:Introduce relevant path/branch conditions and appropriately scheduled validation. This supplies the controlled implementation needed for the scenario. Its complementary step is: Inspect run triggers, change events, consumption and mandated scheduled security scans. Together they address: Pipeline cost optimization should remove redundant executions without weakening required checks.
Incorrect Answers
A:Assign accountable pipeline owners and route critical failures to current responders. This concerns a different DevOps situation: A pipeline reports repeated deployment failures but no team receives notifications because the original owner left the company. This case instead requires both a targeted investigation (Inspect run triggers, change events, consumption and mandated scheduled security scans.) and a controlled change (Introduce relevant path/branch conditions and appropriately scheduled validation.).
B:Inspect pipeline resources, branch filters, artifact provenance and run IDs. This concerns a different DevOps situation: A production stage sometimes downloads an artifact from a different branch due to an ambiguous pipeline resource definition. This case instead requires both a targeted investigation (Inspect run triggers, change events, consumption and mandated scheduled security scans.) and a controlled change (Introduce relevant path/branch conditions and appropriately scheduled validation.).
D:Review service connection mode, secret expiration, Azure RBAC and trust configuration. This concerns a different DevOps situation: A legacy release service principal secret is set to expire tomorrow and pipeline maintenance has no automated credential lifecycle. This case instead requires both a targeted investigation (Inspect run triggers, change events, consumption and mandated scheduled security scans.) and a controlled change (Introduce relevant path/branch conditions and appropriately scheduled validation.).
Question 20
An Azure DevOps engineering team evaluates this condition: Several production defects were fixed, but QA cannot determine which automated test gaps allowed them to escape. Which DevOps principle BEST explains the underlying weakness?
- Shared delivery dependencies must be visible across team backlogs with responsible ownership.
- Traceability requires explicit relationships among work items, source revisions, builds and deployments.
- Short-lived branches and reviewed pull requests reduce integration drift and make changes traceable.
- Defect traceability should connect incidents to code, test coverage and prevention work.
Explanation
Correct Answer
D:Defect traceability should connect incidents to code, test coverage and prevention work. This principle identifies the risk or delivery weakness in the case. Relevant evidence: Inspect production incident links, bug work items, affected commits and test case mappings. An appropriate controlled response is: Relate production bugs to failing or missing tests and preventive backlog work.
Incorrect Answers
A:Shared delivery dependencies must be visible across team backlogs with responsible ownership. This would address a different situation, such as: A platform dependency blocks three application teams, but each Azure Boards team tracks a separate unrelated task. In the present case, the most directly relevant principle is: Defect traceability should connect incidents to code, test coverage and prevention work. The crucial distinction is: Defect traceability should connect incidents to code, test coverage and prevention work.
B:Traceability requires explicit relationships among work items, source revisions, builds and deployments. This would address a different situation, such as: Azure Boards shows completed user stories, but there is no way to identify the commits and deployments delivering each story. In the present case, the most directly relevant principle is: Defect traceability should connect incidents to code, test coverage and prevention work. The crucial distinction is: Defect traceability should connect incidents to code, test coverage and prevention work.
C:Short-lived branches and reviewed pull requests reduce integration drift and make changes traceable. This would address a different situation, such as: An engineering organization uses long-lived feature branches, and its hotfixes regularly miss previously merged changes. In the present case, the most directly relevant principle is: Defect traceability should connect incidents to code, test coverage and prevention work. The crucial distinction is: Defect traceability should connect incidents to code, test coverage and prevention work.