Microsoft AZ-400 Practice Test 50
Question 490
After implementing the change, the team verifies: Teams use dozens of release branches with ambiguous names, and automation often deploys the wrong branch. Which result would BEST demonstrate that the issue is corrected?
- A release process selects the exact approved commit instead of a similarly named branch.
- The corrected test fails before and passes after the fix on both maintained lines.
- A collaborator can still resolve the original commit history after the next integration.
- A sample outside contribution requires approved checks before entering protected mainline.
Explanation
Correct Answer
A:A release process selects the exact approved commit instead of a similarly named branch. This measures the actual expected outcome, rather than trusting only a configuration flag. Implemented action: Define clear branch purposes and deploy from approved immutable tagged or hashed revisions. Branch conventions and immutable release references should uniquely identify deployable versions.
Incorrect Answers
B:The corrected test fails before and passes after the fix on both maintained lines. This would address a different situation, such as: A critical production fix is committed to an old release branch and never reaches the mainline, so the bug returns next month. In the present case, the most directly relevant verification is: A release process selects the exact approved commit instead of a similarly named branch. The crucial distinction is: Branch conventions and immutable release references should uniquely identify deployable versions.
C:A collaborator can still resolve the original commit history after the next integration. This would address a different situation, such as: A maintainer rebases a shared release branch and force pushes, invalidating teammates' commit references. In the present case, the most directly relevant verification is: A release process selects the exact approved commit instead of a similarly named branch. The crucial distinction is: Branch conventions and immutable release references should uniquely identify deployable versions.
D:A sample outside contribution requires approved checks before entering protected mainline. This would address a different situation, such as: External contributors can directly edit protected organization branches rather than submitting reviewed fork-based changes. In the present case, the most directly relevant verification is: A release process selects the exact approved commit instead of a similarly named branch. The crucial distinction is: Branch conventions and immutable release references should uniquely identify deployable versions.
Question 491
After implementing the change, the team verifies: A platform team thinks an Azure Policy Audit effect blocks deployment of unencrypted storage, but noncompliant accounts continue being created. Which result would BEST demonstrate that the issue is corrected?
- Repeated plans use the same provider version and give consistent changes.
- Two new applications deploy consistent approved network controls from the shared module.
- A test service deployment inherits baseline health and identity configuration.
- A new prohibited test storage deployment is rejected while approved configurations succeed.
Explanation
Correct Answer
D:A new prohibited test storage deployment is rejected while approved configurations succeed. This measures the actual expected outcome, rather than trusting only a configuration flag. Implemented action: Use a reviewed Deny policy where prevention is required and remediate existing noncompliance separately. Policy effects differ between reporting and preventive enforcement.
Incorrect Answers
A:Repeated plans use the same provider version and give consistent changes. This would address a different situation, such as: The same Terraform source yields changed resource behavior because local users and CI select different provider versions. In the present case, the most directly relevant verification is: A new prohibited test storage deployment is rejected while approved configurations succeed. The crucial distinction is: Policy effects differ between reporting and preventive enforcement.
B:Two new applications deploy consistent approved network controls from the shared module. This would address a different situation, such as: Six teams manually create nearly identical VNets with inconsistent NSG defaults and missing diagnostics. In the present case, the most directly relevant verification is: A new prohibited test storage deployment is rejected while approved configurations succeed. The crucial distinction is: Policy effects differ between reporting and preventive enforcement.
C:A test service deployment inherits baseline health and identity configuration. This would address a different situation, such as: Each team's pipeline provisions Azure Container Apps independently, with inconsistent health probes and identity. In the present case, the most directly relevant verification is: A new prohibited test storage deployment is rejected while approved configurations succeed. The crucial distinction is: Policy effects differ between reporting and preventive enforcement.
Question 492
The DevOps team must resolve this situation: A Terraform pipeline applies a production plan without showing that a changed resource will be destroyed. Which engineering action is MOST appropriate?
- Publish a reviewed Terraform plan and apply the exact approved plan under controls.
- Route a bounded canary share to new pods and expand only after acceptance checks.
- Isolate the tested change and instrument comparable outcome metrics across randomized cohorts.
- Set appropriate maxUnavailable/maxSurge and validate readiness during rollout.
Explanation
Correct Answer
A:Publish a reviewed Terraform plan and apply the exact approved plan under controls. This action addresses the specific failure or requirement and preserves delivery controls. Validation criterion: An unintended destroy action blocks execution until authorized disposition. Infrastructure deployment should preview and approve material changes before applying.
Incorrect Answers
B:Route a bounded canary share to new pods and expand only after acceptance checks. This would address a different situation, such as: A new AKS container image may affect payments, but the team wants to limit customer exposure during rollout. In the present case, the most directly relevant engineering action is: Publish a reviewed Terraform plan and apply the exact approved plan under controls. The crucial distinction is: Infrastructure deployment should preview and approve material changes before applying.
C:Isolate the tested change and instrument comparable outcome metrics across randomized cohorts. This would address a different situation, such as: Two user interface variants are shown, but the team changes both pricing logic and checkout latency simultaneously and cannot attribute outcomes. In the present case, the most directly relevant engineering action is: Publish a reviewed Terraform plan and apply the exact approved plan under controls. The crucial distinction is: Infrastructure deployment should preview and approve material changes before applying.
D:Set appropriate maxUnavailable/maxSurge and validate readiness during rollout. This would address a different situation, such as: An AKS update removes every API pod simultaneously because maxUnavailable equals the full replica count. In the present case, the most directly relevant engineering action is: Publish a reviewed Terraform plan and apply the exact approved plan under controls. The crucial distinction is: Infrastructure deployment should preview and approve material changes before applying.
Question 493
An engineering design review identifies: A service builds on a Windows workstation but fails on Linux CI because a source import differs only in filename case. Which shortcut should the team MOST specifically avoid for this case?
- Always check out the newest submodule main branch during production build.
- Delete unrelated projects from the shared monorepo before every local build.
- Add the same binaries to .gitignore only after committing them, without removing their history.
- Disable the Linux build and claim the repository's code is portable.
Explanation
Correct Answer
D:Disable the Linux build and claim the repository's code is portable. This shortcut directly undermines the stated control or workflow. A safer action is: Normalize names and case-correct imports with cross-platform validation in PR checks. Explanation: Source control workflows must verify path case and platform consistency.
Incorrect Answers
A:Always check out the newest submodule main branch during production build. This would address a different situation, such as: A build references a Git submodule by moving branch and occasionally acquires incompatible dependency changes. In the present case, the most directly relevant unsafe shortcut is: Disable the Linux build and claim the repository's code is portable. The crucial distinction is: Source control workflows must verify path case and platform consistency.
B:Delete unrelated projects from the shared monorepo before every local build. This would address a different situation, such as: A developer needs one service from a huge monorepo, but each checkout transfers every unrelated project and binary. In the present case, the most directly relevant unsafe shortcut is: Disable the Linux build and claim the repository's code is portable. The crucial distinction is: Source control workflows must verify path case and platform consistency.
C:Add the same binaries to.gitignore only after committing them, without removing their history. This would address a different situation, such as: Designers repeatedly commit multi-gigabyte video assets as normal Git blobs and cloning takes hours. In the present case, the most directly relevant unsafe shortcut is: Disable the Linux build and claim the repository's code is portable. The crucial distinction is: Source control workflows must verify path case and platform consistency.
Question 494
An Azure DevOps engineering team evaluates this condition: A legacy classic Azure Release pipeline hides deployment steps in the UI and new teams cannot peer-review changes. Which DevOps principle BEST explains the underlying weakness?
- Pipeline resource references should bind to intended verified source and build run.
- Pipeline migration must account for external dependencies and supported retention.
- Pipeline telemetry should distinguish agent scarcity from actual code execution cost.
- Moving deployment logic to versioned YAML can improve consistency and review.
Explanation
Correct Answer
D:Moving deployment logic to versioned YAML can improve consistency and review. This principle identifies the risk or delivery weakness in the case. Relevant evidence: Inventory classic tasks, approvals, variables, environments and artifact inputs. An appropriate controlled response is: Migrate release steps to reviewed YAML with protected environment checks and verified parity.
Incorrect Answers
A:Pipeline resource references should bind to intended verified source and build run. This would address a different situation, such as: A production stage sometimes downloads an artifact from a different branch due to an ambiguous pipeline resource definition. In the present case, the most directly relevant principle is: Moving deployment logic to versioned YAML can improve consistency and review. The crucial distinction is: Moving deployment logic to versioned YAML can improve consistency and review.
B:Pipeline migration must account for external dependencies and supported retention. This would address a different situation, such as: A package registry is scheduled for migration, but retired feeds still contain dependencies used by maintained builds. In the present case, the most directly relevant principle is: Moving deployment logic to versioned YAML can improve consistency and review. The crucial distinction is: Moving deployment logic to versioned YAML can improve consistency and review.
C:Pipeline telemetry should distinguish agent scarcity from actual code execution cost. This would address a different situation, such as: A pipeline runs quickly on an agent but waits 70 minutes in queue due to a limited self-hosted pool. In the present case, the most directly relevant principle is: Moving deployment logic to versioned YAML can improve consistency and review. The crucial distinction is: Moving deployment logic to versioned YAML can improve consistency and review.
Question 495
Before changing the pipeline or service, engineers find: A GitHub project has rising CI failures, but maintainers monitor only total completed workflow counts. Which evidence should the engineer inspect FIRST?
- Inspect Application Insights request/dependency telemetry, correlation IDs and trace configuration.
- Inspect GitHub Actions run history, job timing, failure causes and usage trends.
- Inspect VM agent health, DCR association, scope, endpoint and ingestion diagnostics.
- Review Azure Monitor Storage transaction metrics, response codes and client diagnostics.
Explanation
Correct Answer
B:Inspect GitHub Actions run history, job timing, failure causes and usage trends. This directly checks the uncertain behavior or control before changing production. Workflow insight metrics should distinguish failed jobs, timing and relevant branches. The resulting targeted action is: Configure insight charts and notifications for failed and slow required workflows.
Incorrect Answers
A:Inspect Application Insights request/dependency telemetry, correlation IDs and trace configuration. This would address a different situation, such as: A shopping application logs HTTP failures but does not show which downstream payment call caused the response delay. In the present case, the most directly relevant evidence is: Inspect GitHub Actions run history, job timing, failure causes and usage trends. The crucial distinction is: Workflow insight metrics should distinguish failed jobs, timing and relevant branches.
C:Inspect VM agent health, DCR association, scope, endpoint and ingestion diagnostics. This would address a different situation, such as: A VM sends no logs to Log Analytics because its Azure Monitor Agent data collection rule targets another resource group. In the present case, the most directly relevant evidence is: Inspect GitHub Actions run history, job timing, failure causes and usage trends. The crucial distinction is: Workflow insight metrics should distinguish failed jobs, timing and relevant branches.
D:Review Azure Monitor Storage transaction metrics, response codes and client diagnostics. This would address a different situation, such as: Blob transaction failures increase, but dashboards track only storage account capacity in bytes. In the present case, the most directly relevant evidence is: Inspect GitHub Actions run history, job timing, failure causes and usage trends. The crucial distinction is: Workflow insight metrics should distinguish failed jobs, timing and relevant branches.
Question 496
After implementing the change, the team verifies: A new release increases HTTP 500s, but the team cannot match failures to deployment timestamps. Which result would BEST demonstrate that the issue is corrected?
- A disconnected test agent generates an actionable monitoring-gap alert.
- The controlled rare failure produces a discoverable correlated trace.
- A representative test improves disk latency and request completion without pointless CPU scaling.
- An injected failing release creates a visible change-linked error cluster.
Explanation
Correct Answer
D:An injected failing release creates a visible change-linked error cluster. This measures the actual expected outcome, rather than trusting only a configuration flag. Implemented action: Add release annotations and traceable version properties to Application Insights. Operational telemetry should correlate errors with release markers and change events.
Incorrect Answers
A:A disconnected test agent generates an actionable monitoring-gap alert. This would address a different situation, such as: A VM's monitoring dashboard reports no errors because its telemetry agent stopped sending data three days ago. In the present case, the most directly relevant verification is: An injected failing release creates a visible change-linked error cluster. The crucial distinction is: Operational telemetry should correlate errors with release markers and change events.
B:The controlled rare failure produces a discoverable correlated trace. This would address a different situation, such as: A low-volume payment failure disappears from diagnostic traces because sampling drops all relevant requests. In the present case, the most directly relevant verification is: An injected failing release creates a visible change-linked error cluster. The crucial distinction is: Operational telemetry should correlate errors with release markers and change events.
C:A representative test improves disk latency and request completion without pointless CPU scaling. This would address a different situation, such as: An application slows while CPU is low but disk I/O is saturated; operators conclude more vCPUs are needed. In the present case, the most directly relevant verification is: An injected failing release creates a visible change-linked error cluster. The crucial distinction is: Operational telemetry should correlate errors with release markers and change events.
Question 497
The DevOps team must resolve this situation: A VM's monitoring dashboard reports no errors because its telemetry agent stopped sending data three days ago. Which engineering action is MOST appropriate?
- Use a Kusto summarize query grouped by deployment version and appropriate time bins.
- Measure and alert on relevant latency percentiles with suitable dimensions.
- Create a missing-heartbeat query or alert with appropriate response ownership.
- Join relevant telemetry tables by operation identifiers to isolate failed dependency calls.
Explanation
Correct Answer
C:Create a missing-heartbeat query or alert with appropriate response ownership. This action addresses the specific failure or requirement and preserves delivery controls. Validation criterion: A disconnected test agent generates an actionable monitoring-gap alert. Missing data must not be interpreted as proof of a healthy resource.
Incorrect Answers
A:Use a Kusto summarize query grouped by deployment version and appropriate time bins. This would address a different situation, such as: A Log Analytics workspace stores application exceptions, but engineers cannot identify which deployment revision triggered a spike. In the present case, the most directly relevant engineering action is: Create a missing-heartbeat query or alert with appropriate response ownership. The crucial distinction is: Missing data must not be interpreted as proof of a healthy resource.
B:Measure and alert on relevant latency percentiles with suitable dimensions. This would address a different situation, such as: An API dashboard shows acceptable average response time even though the slowest 5% of requests exceed the customer SLA. In the present case, the most directly relevant engineering action is: Create a missing-heartbeat query or alert with appropriate response ownership. The crucial distinction is: Missing data must not be interpreted as proof of a healthy resource.
D:Join relevant telemetry tables by operation identifiers to isolate failed dependency calls. This would address a different situation, such as: Application requests and dependency spans share an operation ID but engineers compare two unrelated totals instead of correlating affected calls. In the present case, the most directly relevant engineering action is: Create a missing-heartbeat query or alert with appropriate response ownership. The crucial distinction is: Missing data must not be interpreted as proof of a healthy resource.
Question 498
The DevOps team must resolve this situation: A self-hosted agent fails after months because workspace and Docker layer caches exhaust disk space. Which engineering action is MOST appropriate?
- Migrate to workload identity federation or controlled rotation with alerting.
- Implement safe workspace cleanup and monitored cache eviction consistent with rollback needs.
- Protect recent deployed digests and remove only eligible unreferenced artifacts.
- Track flaky test metrics and assign root-cause fixes rather than unconditional retries.
Explanation
Correct Answer
B:Implement safe workspace cleanup and monitored cache eviction consistent with rollback needs. This action addresses the specific failure or requirement and preserves delivery controls. Validation criterion: The agent handles repeated builds without losing required artifacts or filling disks. Self-hosted agent maintenance requires bounded workspace cleanup and cache retention.
Incorrect Answers
A:Migrate to workload identity federation or controlled rotation with alerting. This would address a different situation, such as: A legacy release service principal secret is set to expire tomorrow and pipeline maintenance has no automated credential lifecycle. In the present case, the most directly relevant engineering action is: Implement safe workspace cleanup and monitored cache eviction consistent with rollback needs. The crucial distinction is: Self-hosted agent maintenance requires bounded workspace cleanup and cache retention.
C:Protect recent deployed digests and remove only eligible unreferenced artifacts. This would address a different situation, such as: A cost-reduction retention rule deletes the last known-good container image before the rollback period ends. In the present case, the most directly relevant engineering action is: Implement safe workspace cleanup and monitored cache eviction consistent with rollback needs. The crucial distinction is: Self-hosted agent maintenance requires bounded workspace cleanup and cache retention.
D:Track flaky test metrics and assign root-cause fixes rather than unconditional retries. This would address a different situation, such as: Pipeline duration grows because a flaky test is retried eight times but the dashboard still shows every build as green. In the present case, the most directly relevant engineering action is: Implement safe workspace cleanup and monitored cache eviction consistent with rollback needs. The crucial distinction is: Self-hosted agent maintenance requires bounded workspace cleanup and cache retention.
Question 499
Before changing the pipeline or service, engineers find: Release rollback fails because the pipeline cleaned the package version deployed last week. Which evidence should the engineer inspect FIRST?
- Inspect release history, retention settings, artifact references and support policy.
- Review API surface change, dependency constraints, version bump rules and changelog.
- Review feed upstream configuration, package authorization and cached dependency versions.
- Inspect feed/project scope, pipeline identity, role assignment and error logs.
Explanation
Correct Answer
A:Inspect release history, retention settings, artifact references and support policy. This directly checks the uncertain behavior or control before changing production. Retention must preserve artifacts and dependencies required for defined rollback windows. The resulting targeted action is: Protect deployed and rollback-candidate artifacts with defined retention exceptions.
Incorrect Answers
B:Review API surface change, dependency constraints, version bump rules and changelog. This would address a different situation, such as: A compatible optional SDK feature is added, but release automation increments the major version for every change. In the present case, the most directly relevant evidence is: Inspect release history, retention settings, artifact references and support policy. The crucial distinction is: Retention must preserve artifacts and dependencies required for defined rollback windows.
C:Review feed upstream configuration, package authorization and cached dependency versions. This would address a different situation, such as: A package feed cannot install vetted public dependencies during a disconnected corporate build unless developers manually copy files. In the present case, the most directly relevant evidence is: Inspect release history, retention settings, artifact references and support policy. The crucial distinction is: Retention must preserve artifacts and dependencies required for defined rollback windows.
D:Inspect feed/project scope, pipeline identity, role assignment and error logs. This would address a different situation, such as: A central deployment pipeline cannot restore a package from another Azure DevOps project although the feed works locally. In the present case, the most directly relevant evidence is: Inspect release history, retention settings, artifact references and support policy. The crucial distinction is: Retention must preserve artifacts and dependencies required for defined rollback windows.
Question 500
After implementing the change, the team verifies: An archived security-sensitive repository remains writable by former project members and receives unreviewed commits. Which result would BEST demonstrate that the issue is corrected?
- A former contributor cannot push to the archived security repository.
- The target service builds correctly with only its required repository content.
- Both consumers can choose approved versions and receive a security fix predictably.
- The vendor can run authorized tests but cannot change protected repository settings.
Explanation
Correct Answer
A:A former contributor cannot push to the archived security repository. This measures the actual expected outcome, rather than trusting only a configuration flag. Implemented action: Archive the repository or lock write access with audited exception handling. Repository lifecycle controls should remove stale rights and enforce appropriate archival state.
Incorrect Answers
B:The target service builds correctly with only its required repository content. This would address a different situation, such as: A developer needs one service from a huge monorepo, but each checkout transfers every unrelated project and binary. In the present case, the most directly relevant verification is: A former contributor cannot push to the archived security repository. The crucial distinction is: Repository lifecycle controls should remove stale rights and enforce appropriate archival state.
C:Both consumers can choose approved versions and receive a security fix predictably. This would address a different situation, such as: Two separate repositories copy and edit a common authentication library independently, producing inconsistent fixes. In the present case, the most directly relevant verification is: A former contributor cannot push to the archived security repository. The crucial distinction is: Repository lifecycle controls should remove stale rights and enforce appropriate archival state.
D:The vendor can run authorized tests but cannot change protected repository settings. This would address a different situation, such as: A QA vendor needs read-only test access but has been granted repository administration rights. In the present case, the most directly relevant verification is: A former contributor cannot push to the archived security repository. The crucial distinction is: Repository lifecycle controls should remove stale rights and enforce appropriate archival state.