Microsoft AZ-400 Practice Test 3
Question 20
An Azure DevOps engineering team evaluates this condition: Several production defects were fixed, but QA cannot determine which automated test gaps allowed them to escape. Which DevOps principle BEST explains the underlying weakness?
- Shared delivery dependencies must be visible across team backlogs with responsible ownership.
- Traceability requires explicit relationships among work items, source revisions, builds and deployments.
- Short-lived branches and reviewed pull requests reduce integration drift and make changes traceable.
- Defect traceability should connect incidents to code, test coverage and prevention work.
Explanation
Correct Answer
D:Defect traceability should connect incidents to code, test coverage and prevention work. This principle identifies the risk or delivery weakness in the case. Relevant evidence: Inspect production incident links, bug work items, affected commits and test case mappings. An appropriate controlled response is: Relate production bugs to failing or missing tests and preventive backlog work.
Incorrect Answers
A:Shared delivery dependencies must be visible across team backlogs with responsible ownership. This would address a different situation, such as: A platform dependency blocks three application teams, but each Azure Boards team tracks a separate unrelated task. In the present case, the most directly relevant principle is: Defect traceability should connect incidents to code, test coverage and prevention work. The crucial distinction is: Defect traceability should connect incidents to code, test coverage and prevention work.
B:Traceability requires explicit relationships among work items, source revisions, builds and deployments. This would address a different situation, such as: Azure Boards shows completed user stories, but there is no way to identify the commits and deployments delivering each story. In the present case, the most directly relevant principle is: Defect traceability should connect incidents to code, test coverage and prevention work. The crucial distinction is: Defect traceability should connect incidents to code, test coverage and prevention work.
C:Short-lived branches and reviewed pull requests reduce integration drift and make changes traceable. This would address a different situation, such as: An engineering organization uses long-lived feature branches, and its hotfixes regularly miss previously merged changes. In the present case, the most directly relevant principle is: Defect traceability should connect incidents to code, test coverage and prevention work. The crucial distinction is: Defect traceability should connect incidents to code, test coverage and prevention work.
Question 21
An Azure DevOps engineering team evaluates this condition: A critical production fix is committed to an old release branch and never reaches the mainline, so the bug returns next month. Which DevOps principle BEST explains the underlying weakness?
- Maintenance branching should match support windows and preserve immutable release history.
- Branch conventions and immutable release references should uniquely identify deployable versions.
- Hotfix processes must propagate tested corrections to every maintained affected line.
- Branch policies should enforce an independent review and required checks for protected code.
Explanation
Correct Answer
C:Hotfix processes must propagate tested corrections to every maintained affected line. This principle identifies the risk or delivery weakness in the case. Relevant evidence: Compare release branch commits, mainline history and subsequent deployment tags. An appropriate controlled response is: Require reviewed back-merges or cherry-picks of hotfixes into active branches.
Incorrect Answers
A:Maintenance branching should match support windows and preserve immutable release history. This would address a different situation, such as: Old supported product versions receive urgent fixes but the team deletes prior release references after every mainline update. In the present case, the most directly relevant principle is: Hotfix processes must propagate tested corrections to every maintained affected line. The crucial distinction is: Hotfix processes must propagate tested corrections to every maintained affected line.
B:Branch conventions and immutable release references should uniquely identify deployable versions. This would address a different situation, such as: Teams use dozens of release branches with ambiguous names, and automation often deploys the wrong branch. In the present case, the most directly relevant principle is: Hotfix processes must propagate tested corrections to every maintained affected line. The crucial distinction is: Hotfix processes must propagate tested corrections to every maintained affected line.
D:Branch policies should enforce an independent review and required checks for protected code. This would address a different situation, such as: A repository's default branch allows authors to approve their own high-risk changes without independent review. In the present case, the most directly relevant principle is: Hotfix processes must propagate tested corrections to every maintained affected line. The crucial distinction is: Hotfix processes must propagate tested corrections to every maintained affected line.
Question 22
An Azure DevOps engineering team evaluates this condition: A pipeline reports repeated deployment failures but no team receives notifications because the original owner left the company. Which DevOps principle BEST explains the underlying weakness?
- Cache keys must include dependency inputs so old artifacts cannot silently corrupt builds.
- Pipeline cost optimization should remove redundant executions without weakening required checks.
- Capacity changes should be justified by measured critical-path improvements and cost.
- Pipeline operational health needs assigned responders and maintained notification routing.
Explanation
Correct Answer
D:Pipeline operational health needs assigned responders and maintained notification routing. This principle identifies the risk or delivery weakness in the case. Relevant evidence: Review alert subscriptions, team ownership, failure history and escalation paths. An appropriate controlled response is: Assign accountable pipeline owners and route critical failures to current responders.
Incorrect Answers
A:Cache keys must include dependency inputs so old artifacts cannot silently corrupt builds. This would address a different situation, such as: A pipeline caches packages under one global key even after lockfile changes, causing inconsistent builds. In the present case, the most directly relevant principle is: Pipeline operational health needs assigned responders and maintained notification routing. The crucial distinction is: Pipeline operational health needs assigned responders and maintained notification routing.
B:Pipeline cost optimization should remove redundant executions without weakening required checks. This would address a different situation, such as: Hundreds of nightly builds run when source code is unchanged, consuming expensive hosted parallel minutes. In the present case, the most directly relevant principle is: Pipeline operational health needs assigned responders and maintained notification routing. The crucial distinction is: Pipeline operational health needs assigned responders and maintained notification routing.
C:Capacity changes should be justified by measured critical-path improvements and cost. This would address a different situation, such as: A pipeline team wants 50 more hosted agent slots even though bottlenecks are serial manual approvals and limited integration environments. In the present case, the most directly relevant principle is: Pipeline operational health needs assigned responders and maintained notification routing. The crucial distinction is: Pipeline operational health needs assigned responders and maintained notification routing.
Question 23
After implementing the change, the team verifies: An engineering organization uses long-lived feature branches, and its hotfixes regularly miss previously merged changes. Which result would BEST demonstrate that the issue is corrected?
- The shared platform dependency appears before downstream releases in an integrated plan.
- A hotfix reaches the protected mainline through review with all intended prior changes intact.
- A sample release note lists the actual included fixes without unrelated pending changes.
- A sampled escaped defect traces to an added regression test and successful validation.
Explanation
Correct Answer
B:A hotfix reaches the protected mainline through review with all intended prior changes intact. This measures the actual expected outcome, rather than trusting only a configuration flag. Implemented action: Adopt protected mainline GitHub Flow with small reviewed changes and linked work items. Short-lived branches and reviewed pull requests reduce integration drift and make changes traceable.
Incorrect Answers
A:The shared platform dependency appears before downstream releases in an integrated plan. This would address a different situation, such as: A platform dependency blocks three application teams, but each Azure Boards team tracks a separate unrelated task. In the present case, the most directly relevant verification is: A hotfix reaches the protected mainline through review with all intended prior changes intact. The crucial distinction is: Short-lived branches and reviewed pull requests reduce integration drift and make changes traceable.
C:A sample release note lists the actual included fixes without unrelated pending changes. This would address a different situation, such as: Release notes are composed from memory and routinely omit merged security improvements. In the present case, the most directly relevant verification is: A hotfix reaches the protected mainline through review with all intended prior changes intact. The crucial distinction is: Short-lived branches and reviewed pull requests reduce integration drift and make changes traceable.
D:A sampled escaped defect traces to an added regression test and successful validation. This would address a different situation, such as: Several production defects were fixed, but QA cannot determine which automated test gaps allowed them to escape. In the present case, the most directly relevant verification is: A hotfix reaches the protected mainline through review with all intended prior changes intact. The crucial distinction is: Short-lived branches and reviewed pull requests reduce integration drift and make changes traceable.
Question 24
An Azure DevOps engineering team evaluates this condition: A protected mainline accepts pull requests before a required unit test suite finishes, causing broken packages. Which DevOps principle BEST explains the underlying weakness?
- Consumer contract tests should detect interface-breaking changes before coordinated release.
- Code-scanning feedback should be available on proposed changes before merge.
- Integration tests must exercise representative dependent services and configuration.
- Unit test gates should complete successfully against the proposed change before merge.
Explanation
Correct Answer
D:Unit test gates should complete successfully against the proposed change before merge. This principle identifies the risk or delivery weakness in the case. Relevant evidence: Review PR check policies, test job dependencies and build result timing. An appropriate controlled response is: Require verified unit test checks as part of protected pull request policy.
Incorrect Answers
A:Consumer contract tests should detect interface-breaking changes before coordinated release. This would address a different situation, such as: A microservice changes a JSON field name while a downstream consumer still relies on the old name. In the present case, the most directly relevant principle is: Unit test gates should complete successfully against the proposed change before merge. The crucial distinction is: Unit test gates should complete successfully against the proposed change before merge.
B:Code-scanning feedback should be available on proposed changes before merge. This would address a different situation, such as: A GitHub repository scans vulnerabilities once a month but merges vulnerable code daily. In the present case, the most directly relevant principle is: Unit test gates should complete successfully against the proposed change before merge. The crucial distinction is: Unit test gates should complete successfully against the proposed change before merge.
C:Integration tests must exercise representative dependent services and configuration. This would address a different situation, such as: Service unit tests pass but integration fails because Azure SQL connectivity differs between staging and production. In the present case, the most directly relevant principle is: Unit test gates should complete successfully against the proposed change before merge. The crucial distinction is: Unit test gates should complete successfully against the proposed change before merge.
Question 25
A Microsoft DevOps team is addressing: Six teams manually create nearly identical VNets with inconsistent NSG defaults and missing diagnostics. Which TWO complementary actions should be taken? Select TWO answers.
- Compare YAML and Bicep modules, probes, managed identity choices and review history.
- Inspect existing VNet templates, module interfaces, policy results and configuration drift.
- Publish a versioned Bicep networking module with secure defaults and reviewed parameters.
- Use a safe scoped deployment strategy with reviewed change previews and deletion protections.
- Inspect environment provisioning logs, resource tags, TTL and cleanup policies.
Explanation
Correct Answers
B:Inspect existing VNet templates, module interfaces, policy results and configuration drift. This supplies the diagnosis/evidence needed for the scenario. Its complementary step is: Publish a versioned Bicep networking module with secure defaults and reviewed parameters. Together they address: IaC modules should centralize approved reusable infrastructure patterns.
C:Publish a versioned Bicep networking module with secure defaults and reviewed parameters. This supplies the controlled implementation needed for the scenario. Its complementary step is: Inspect existing VNet templates, module interfaces, policy results and configuration drift. Together they address: IaC modules should centralize approved reusable infrastructure patterns.
Incorrect Answers
A:Compare YAML and Bicep modules, probes, managed identity choices and review history. This concerns a different DevOps situation: Each team's pipeline provisions Azure Container Apps independently, with inconsistent health probes and identity. This case instead requires both a targeted investigation (Inspect existing VNet templates, module interfaces, policy results and configuration drift.) and a controlled change (Publish a versioned Bicep networking module with secure defaults and reviewed parameters.).
D:Use a safe scoped deployment strategy with reviewed change previews and deletion protections. This concerns a different DevOps situation: A deployment pipeline uses complete mode unintentionally and deletes resources omitted from an updated ARM template. This case instead requires both a targeted investigation (Inspect existing VNet templates, module interfaces, policy results and configuration drift.) and a controlled change (Publish a versioned Bicep networking module with secure defaults and reviewed parameters.).
E:Inspect environment provisioning logs, resource tags, TTL and cleanup policies. This concerns a different DevOps situation: Engineers create temporary load-test environments manually but never remove costly public IP addresses. This case instead requires both a targeted investigation (Inspect existing VNet templates, module interfaces, policy results and configuration drift.) and a controlled change (Publish a versioned Bicep networking module with secure defaults and reviewed parameters.).
Question 26
An Azure DevOps engineering team evaluates this condition: A central deployment pipeline cannot restore a package from another Azure DevOps project although the feed works locally. Which DevOps principle BEST explains the underlying weakness?
- Cross-project feeds require authorized build-service identities and scope settings.
- Private package access requires scoped workflow identity and authorized repository permissions.
- Release images should be identified by immutable digests or protected version tags.
- Reproducible builds require controlled package versions and lockfile inputs.
Explanation
Correct Answer
A:Cross-project feeds require authorized build-service identities and scope settings. This principle identifies the risk or delivery weakness in the case. Relevant evidence: Inspect feed/project scope, pipeline identity, role assignment and error logs. An appropriate controlled response is: Grant the consuming build service read access at the appropriate feed scope.
Incorrect Answers
B:Private package access requires scoped workflow identity and authorized repository permissions. This would address a different situation, such as: A GitHub Actions workflow receives 403 when installing a private package owned by another organization repository. In the present case, the most directly relevant principle is: Cross-project feeds require authorized build-service identities and scope settings. The crucial distinction is: Cross-project feeds require authorized build-service identities and scope settings.
C:Release images should be identified by immutable digests or protected version tags. This would address a different situation, such as: A team overwrites the same image tag in Azure Container Registry for every build and loses reproducible deployment history. In the present case, the most directly relevant principle is: Cross-project feeds require authorized build-service identities and scope settings. The crucial distinction is: Cross-project feeds require authorized build-service identities and scope settings.
D:Reproducible builds require controlled package versions and lockfile inputs. This would address a different situation, such as: The same Git commit restores different NuGet package versions one week apart and intermittently fails tests. In the present case, the most directly relevant principle is: Cross-project feeds require authorized build-service identities and scope settings. The crucial distinction is: Cross-project feeds require authorized build-service identities and scope settings.
Question 27
The DevOps team must resolve this situation: A deployment job fails but the failure is not associated with the GitHub issue that requested the release. Which engineering action is MOST appropriate?
- Use a structured GitHub Issues intake process with ownership, labels and linked fixes.
- Relate production bugs to failing or missing tests and preventive backlog work.
- Update related GitHub Issues from protected workflow events with release status and error context.
- Adopt protected mainline GitHub Flow with small reviewed changes and linked work items.
Explanation
Correct Answer
C:Update related GitHub Issues from protected workflow events with release status and error context. This action addresses the specific failure or requirement and preserves delivery controls. Validation criterion: A failed sample release leaves the linked issue open and alerts its responsible team. Closed-loop delivery needs automated status updates connected to the requesting work.
Incorrect Answers
A:Use a structured GitHub Issues intake process with ownership, labels and linked fixes. This would address a different situation, such as: Customer-reported bugs arrive in chat messages and are never consistently recorded for the development team. In the present case, the most directly relevant engineering action is: Update related GitHub Issues from protected workflow events with release status and error context. The crucial distinction is: Closed-loop delivery needs automated status updates connected to the requesting work.
B:Relate production bugs to failing or missing tests and preventive backlog work. This would address a different situation, such as: Several production defects were fixed, but QA cannot determine which automated test gaps allowed them to escape. In the present case, the most directly relevant engineering action is: Update related GitHub Issues from protected workflow events with release status and error context. The crucial distinction is: Closed-loop delivery needs automated status updates connected to the requesting work.
D:Adopt protected mainline GitHub Flow with small reviewed changes and linked work items. This would address a different situation, such as: An engineering organization uses long-lived feature branches, and its hotfixes regularly miss previously merged changes. In the present case, the most directly relevant engineering action is: Update related GitHub Issues from protected workflow events with release status and error context. The crucial distinction is: Closed-loop delivery needs automated status updates connected to the requesting work.
Question 28
The DevOps team must resolve this situation: A reusable GitHub Actions workflow grants write permissions to every job although most only compile and test. Which engineering action is MOST appropriate?
- Configure trusted GitHub OIDC federation and least-privilege Azure roles for the deployment.
- Include explicit succeeded dependencies in the custom promotion condition.
- Define explicit stage dependencies and artifact handoffs in the YAML pipeline.
- Restrict default GITHUB_TOKEN permissions and grant write scopes only to required jobs.
Explanation
Correct Answer
D:Restrict default GITHUB_TOKEN permissions and grant write scopes only to required jobs. This action addresses the specific failure or requirement and preserves delivery controls. Validation criterion: A test-only job cannot mutate repository releases while publish job remains authorized. Job-level token permissions should match each workflow task's minimum needs.
Incorrect Answers
A:Configure trusted GitHub OIDC federation and least-privilege Azure roles for the deployment. This would address a different situation, such as: A GitHub Actions release stores a long-lived Azure service principal password in repository secrets for every deployment. In the present case, the most directly relevant engineering action is: Restrict default GITHUB_TOKEN permissions and grant write scopes only to required jobs. The crucial distinction is: Job-level token permissions should match each workflow task's minimum needs.
B:Include explicit succeeded dependencies in the custom promotion condition. This would address a different situation, such as: A post-deployment verification job runs even when staging tests fail because its condition overrides the default dependency check. In the present case, the most directly relevant engineering action is: Restrict default GITHUB_TOKEN permissions and grant write scopes only to required jobs. The crucial distinction is: Job-level token permissions should match each workflow task's minimum needs.
C:Define explicit stage dependencies and artifact handoffs in the YAML pipeline. This would address a different situation, such as: A deployment stage starts before the packaging stage publishes an artifact because stages are configured independently. In the present case, the most directly relevant engineering action is: Restrict default GITHUB_TOKEN permissions and grant write scopes only to required jobs. The crucial distinction is: Job-level token permissions should match each workflow task's minimum needs.
Question 29
After implementing the change, the team verifies: Azure Boards reports near-zero cycle time because teams move stories to Active only when coding is almost finished. Which result would BEST demonstrate that the issue is corrected?
- Sample completed stories show realistic cycle times that match actual engineering work.
- A test job delayed by runner scarcity shows queue time rather than slow compilation.
- A deliberately overdue critical issue remains visible until independently resolved.
- The report states response coverage and captures previously omitted contributor feedback.
Explanation
Correct Answer
A:Sample completed stories show realistic cycle times that match actual engineering work. This measures the actual expected outcome, rather than trusting only a configuration flag. Implemented action: Define and enforce meaningful Active and Done transitions in the team's process. Flow metrics depend on consistent state-transition definitions and truthful process data.
Incorrect Answers
B:A test job delayed by runner scarcity shows queue time rather than slow compilation. This would address a different situation, such as: A pipeline takes 50 minutes, but dashboard owners cannot distinguish runner queue delays from actual build execution. In the present case, the most directly relevant verification is: Sample completed stories show realistic cycle times that match actual engineering work. The crucial distinction is: Flow metrics depend on consistent state-transition definitions and truthful process data.
C:A deliberately overdue critical issue remains visible until independently resolved. This would address a different situation, such as: A security scorecard shows the total number of alerts but cannot identify overdue critical fixes. In the present case, the most directly relevant verification is: Sample completed stories show realistic cycle times that match actual engineering work. The crucial distinction is: Flow metrics depend on consistent state-transition definitions and truthful process data.
D:The report states response coverage and captures previously omitted contributor feedback. This would address a different situation, such as: A team reports excellent developer experience based only on responses from its three most active maintainers. In the present case, the most directly relevant verification is: Sample completed stories show realistic cycle times that match actual engineering work. The crucial distinction is: Flow metrics depend on consistent state-transition definitions and truthful process data.
Question 30
An Azure DevOps engineering team evaluates this condition: Two user interface variants are shown, but the team changes both pricing logic and checkout latency simultaneously and cannot attribute outcomes. Which DevOps principle BEST explains the underlying weakness?
- Rolling update policies should preserve minimum ready capacity during replacement.
- Rolling replacement should account for connection draining and readiness transitions.
- Slot deployment must isolate environment-specific connection and trigger settings.
- A/B evaluations require stable cohorts and measurable objective-specific differences.
Explanation
Correct Answer
D:A/B evaluations require stable cohorts and measurable objective-specific differences. This principle identifies the risk or delivery weakness in the case. Relevant evidence: Inspect targeting rules, conversion events, experiment durations and uncontrolled changes. An appropriate controlled response is: Isolate the tested change and instrument comparable outcome metrics across randomized cohorts.
Incorrect Answers
A:Rolling update policies should preserve minimum ready capacity during replacement. This would address a different situation, such as: An AKS update removes every API pod simultaneously because maxUnavailable equals the full replica count. In the present case, the most directly relevant principle is: A/B evaluations require stable cohorts and measurable objective-specific differences. The crucial distinction is: A/B evaluations require stable cohorts and measurable objective-specific differences.
B:Rolling replacement should account for connection draining and readiness transitions. This would address a different situation, such as: A deployment removes an application instance while it has open customer sessions, causing dropped purchases. In the present case, the most directly relevant principle is: A/B evaluations require stable cohorts and measurable objective-specific differences. The crucial distinction is: A/B evaluations require stable cohorts and measurable objective-specific differences.
C:Slot deployment must isolate environment-specific connection and trigger settings. This would address a different situation, such as: An Azure Functions staging slot unexpectedly processes production queue messages before its swap because a trigger configuration was not isolated. In the present case, the most directly relevant principle is: A/B evaluations require stable cohorts and measurable objective-specific differences. The crucial distinction is: A/B evaluations require stable cohorts and measurable objective-specific differences.