Practice Mode

AZ-400

0/0 Loading...
of 0

AZ-400 — 20 free practice questions

Preview the exam for free. Unlock all 562 questions →

Question 1

You are configuring project metrics for dashboards in Azure DevOps. You need to configure a chart widget that measures the elapsed time to complete work items once they become active. Which of the following is the widget you should use?
  • A. Cumulative Flow Diagram
  • B. Burnup
  • C. Cycle time Correct
  • D. Burndown

Explanation

The Cycle Time widget measures the elapsed time from when a work item first enters an In Progress (active) state until it reaches a Completed state, which is exactly what is asked. Lead time would start the clock at work item creation instead. Cumulative Flow Diagram shows the count of items in each state over time, and Burnup and Burndown track completed or remaining work against a scope, not elapsed time per item.

Question 2

You need to consider the underlined segment to establish whether it is accurate. The Burnup widget measures the elapsed time from creation of work items to their completion. (Underlined segment: "Burnup".) Select "No adjustment required" if the underlined segment is accurate. If the underlined segment is inaccurate, select the accurate option.
  • A. No adjustment required.
  • B. Lead time Correct
  • C. Test results trend
  • D. Burndown

Explanation

Lead time is the elapsed time from when a work item is created until it reaches a Completed state, so the Lead Time widget is the correct one. Burnup charts show completed work against total scope, and Burndown shows remaining work over time; neither measures per-item elapsed time. Test results trend reports pass/fail rates of test runs, not work item timing.

Question 3

You are using Azure DevOps to manage build pipelines and deploy pipelines. The development team is quite large and is regularly added to. You have been informed that the management of users and licenses must be automated when it can be. Which of the following is a task that can't be automated?
  • A. Group membership changes
  • B. License assignment
  • C. Assigning entitlements
  • D. License procurement Correct

Explanation

Group rules in Azure DevOps automate access level (license) assignment, project and group membership, and extension entitlements based on Microsoft Entra or Azure DevOps group membership, so new team members get the right access automatically. Procuring licenses, that is, purchasing them and setting up billing, is a commercial step that group rules cannot perform. Group membership changes, license assignment and entitlement assignment can all be driven by group rules.

Question 4

You have been tasked with strengthening the security of your team's development process. You need to suggest a security tool type for the Continuous Integration (CI) phase of the development process. Which of the following is the option you would suggest?
  • A. Penetration testing
  • B. Static code analysis Correct
  • C. Threat modeling
  • D. Dynamic code analysis

Explanation

Static code analysis inspects source code without running it, so it fits naturally into the Continuous Integration phase and runs on every build or pull request. Dynamic code analysis and penetration testing need a running, deployed application and belong to later test or release stages. Threat modeling is a design-time activity performed before code is written, not a CI tool.

Question 5

Your company is currently making use of Team Foundation Server 2013 (TFS 2013), but intend to migrate to Azure DevOps. You have been tasked with supplying a migration approach that allows for the preservation of Team Foundation Version Control changesets dates, as well as the changes dates of work items revisions. The approach should also allow for the migration of all TFS artifacts, while keeping migration effort to a minimum. You have suggested upgrading TFS to the most recent RTW release. Which of the following should also be suggested?
  • A. Installing the TFS Java SDK
  • B. Using the TFS Database Import Service to perform the upgrade. Correct
  • C. Upgrading PowerShell Core to the latest version.
  • D. Using the TFS Integration Platform to perform the upgrade.

Explanation

The only Microsoft approach that preserves TFVC changeset dates and work item revision dates and moves all artifacts with minimal effort is the full-fidelity database import (the TFS Database Import Service, now the Azure DevOps Data Migration Tool), after first upgrading the server to one of the two most recent releases. API-based tools such as the TFS Integration Platform replay changes, so they do not keep original changeset dates and lose fidelity. The Java SDK and PowerShell Core are irrelevant to the migration.

Question 6

You have an on-premises Bitbucket Server with a firewall configured to block inbound Internet traffic. The server is used for Git-based source control. You intend to manage the build and release processes using Azure DevOps. This plan requires you to integrate Azure DevOps and Bitbucket. Which two components will allow for this integration? Drag the correct options from the list to the answer area.

Explanation

Because the firewall blocks inbound traffic, Azure Pipelines and Microsoft-hosted agents cannot reach the Bitbucket Server, so you install a self-hosted agent inside the network; it only needs outbound connections to Azure Pipelines and can fetch the code locally. The repository is referenced through an External Git (Other Git) service connection with the option to access it from Azure Pipelines turned off, which supports manual and scheduled runs. Microsoft-hosted agents run in Azure and would be blocked by the firewall, and service hooks push events from Azure DevOps outward rather than giving access to the repository.

Question 7

You are currently developing a project for a client that will be managing work items via Azure DevOps. You want to make sure that the work item process you use for the client allows for requirements, change requests, risks, and reviews to be tracked. Which of the following is the option you would choose?
  • A. Basic
  • B. Agile
  • C. Scrum
  • D. CMMI Correct

Explanation

The CMMI process includes the Requirement, Change Request, Risk, Review and Issue work item types and supports formal change management. Agile uses User Story and Issue, Scrum uses Product Backlog Item and Impediment, and Basic uses only Epic, Issue and Task; none of them ship Change Request, Risk or Review work item types.

Question 8

You run the Register-AzureRmAutomationDscNode command in your company's environment. You need to make sure that your company's test servers remain correctly configured, regardless of configuration drift. Solution: You set the -ConfigurationMode parameter to ApplyOnly. Does the solution meet the goal?
  • A. Yes
  • B. No Correct

Explanation

With ApplyOnly, DSC applies the configuration once and then does not check for drift from the configured state, so drifted test servers would not be corrected. Only ApplyAndAutoCorrect reapplies the configuration when drift is detected.

Question 9

You run the Register-AzureRmAutomationDscNode command in your company's environment. You need to make sure that your company's test servers remain correctly configured, regardless of configuration drift. Solution: You set the -ConfigurationMode parameter to ApplyAndMonitor. Does the solution meet the goal?
  • A. Yes
  • B. No Correct

Explanation

ApplyAndMonitor, the default, applies the configuration and then only reports drift in the logs; it does not correct it. To keep servers correctly configured regardless of drift you need ApplyAndAutoCorrect, which reports and then reapplies the current configuration.

Question 10

You run the Register-AzureRmAutomationDscNode command in your company's environment. You need to make sure that your company's test servers remain correctly configured, regardless of configuration drift. Solution: You set the -ConfigurationMode parameter to ApplyAndAutocorrect. Does the solution meet the goal?
  • A. Yes Correct
  • B. No

Explanation

With ApplyAndAutoCorrect, the Local Configuration Manager checks the node on every configuration cycle and, when it drifts from the desired state, logs the discrepancy and reapplies the current configuration. That keeps the test servers correctly configured despite drift, unlike ApplyOnly or ApplyAndMonitor.

Question 11

You need to consider the underlined segment to establish whether it is accurate. To compile an Internet Information Services (IIS) web application that runs docker, you should use a Default build agent pool. (Underlined segment: "Default".) Select "No adjustment required" if the underlined segment is accurate. If the underlined segment is inaccurate, select the accurate option.
  • A. No adjustment required.
  • B. Hosted Windows Container Correct
  • C. Hosted
  • D. Hosted macOS

Explanation

An IIS application packaged in Docker needs a Windows agent that can build Windows containers, which is what the Microsoft-hosted Hosted Windows Container pool was provided for. The Default pool holds your own self-hosted agents with no guaranteed Docker or Windows container support, the generic Hosted pool was not intended for container builds, and Hosted macOS cannot build Windows containers. In current Azure Pipelines the equivalent is a Microsoft-hosted Windows image such as windows-latest, which includes Docker.

Question 12

Your company has an Azure DevOps environment that can only be accessed by Azure Active Directory users. You are instructed to make sure that the Azure DevOps environment can only be accessed from devices connected to the company's on-premises network. Which of the following actions should you take?
  • A. Assign the devices to a security group.
  • B. Create a GPO.
  • C. Configure Security in Project Settings from Azure DevOps.
  • D. Configure conditional access in Azure Active Directory. Correct

Explanation

Azure DevOps sign-in for Microsoft Entra users is governed by Microsoft Entra Conditional Access, and a Conditional Access policy with an IP (named location) condition can restrict access to the corporate network range. Security settings in Project Settings control permissions, not network location. A GPO or a device security group alone does not stop access to a cloud service from outside the network.

Question 13

You are making use of Azure DevOps to configure Azure Pipelines for project, named PROJ-01. You are preparing to use a version control system that allows for source code to be stored on a managed Windows server located on the company network. Which of the following is the version control system you should use?
  • A. Github Enterprise Correct
  • B. Bitbucket cloud
  • C. Github Professional
  • D. Git in Azure Repos

Explanation

GitHub Enterprise can be deployed as GitHub Enterprise Server, a self-hosted instance you run and manage in your own network, and Azure Pipelines can build from it. Git in Azure Repos, Bitbucket Cloud and GitHub Professional plans are cloud-hosted services, so the source code would not be stored on a server on the company network.

Question 14

You need to consider the underlined segment to establish whether it is accurate. When moving to Azure DevOps, JIRA must be replaced with the build pipelines Azure DevOps service. (Underlined segment: "build pipelines".) Select "No adjustment required" if the underlined segment is accurate. If the underlined segment is inaccurate, select the accurate option.
  • A. No adjustment required.
  • B. repos
  • C. release pipelines
  • D. boards Correct

Explanation

JIRA is a work-tracking tool for issues, backlogs and sprints, and its Azure DevOps equivalent is Azure Boards. Build and release pipelines automate CI/CD, and Repos hosts source code, so neither replaces JIRA's planning and tracking role.

Question 15

You scan a Node.js application using WhiteSource Bolt. The scan finds numerous libraries with invalid licenses, but are only used during development. You have to make sure that only production dependencies are scanned by WhiteSource Bolt. Which of the following is a command you should run?
  • A. npm edit
  • B. npm publish
  • C. npm install Correct
  • D. npm update

Explanation

Running npm install with the production flag (npm install --production, or --omit=dev in newer npm) installs only the dependencies listed under dependencies and skips devDependencies, so the scan sees only production libraries. npm edit opens a package for editing, npm publish pushes a package to a registry, and npm update upgrades installed packages; none of them excludes development dependencies.

Question 16

You are currently defining a release strategy for an app, named APP-01. The strategy should allow you to keep the time it takes to deploy new releases of the app to a minimum. The strategy should also allow you to roll back in the shortest time required. Which of the following is the release strategy you should use?
  • A. Red/Black deployment Correct
  • B. Rolling deployment
  • C. "Big Bang" deployment
  • D. Canary deployment

Explanation

Red/black (also called blue/green) deployment keeps two identical production environments: the new release is deployed to the idle one and traffic is switched over in one step, so release time is short, and rollback is just switching traffic back to the environment that still runs the previous version. A rolling deployment replaces instances in batches, so both the rollout and a rollback take longer. A big bang deployment replaces everything at once with no standby environment to fall back to, and a canary deployment deliberately rolls out gradually to a subset of users, which lengthens the release.

Question 17

Your company hosts a web application in Azure, and makes use of Azure Pipelines for managing the build and release of the application. When stakeholders report that system performance has been adversely affected by the most recent releases, you configure alerts in Azure Monitor. You are informed that new releases must satisfy specified performance baseline conditions in the staging environment before they can be deployed to production. You need to make sure that releases not satisfying the performance baseline are prevented from being deployed. Which of the following actions should you take?
  • A. You should make use of a branch control check.
  • B. You should make use of an alert trigger.
  • C. You should make use of a gate. Correct
  • D. You should make use of an approval check.

Explanation

A deployment gate collects health signals automatically before a release is promoted; the built-in Query Azure Monitor alerts gate checks the configured alert rules and blocks promotion to production while alerts are active, which enforces the performance baseline from staging. An approval check relies on a person rather than measured performance. A branch control check only verifies which branch the run came from, and an alert trigger does not stop a deployment.

Question 18

You need to consider the underlined segment to establish whether it is accurate. To deploy an application to a number of Azure virtual machines, you should create a **universal** group. Select `No adjustment required` if the underlined segment is accurate. If the underlined segment is inaccurate, select the accurate option.
  • A. No adjustment required.
  • B. security
  • C. deployment Correct
  • D. resource

Explanation

In Azure Pipelines classic release pipelines, a deployment group is a logical set of target machines, each running a deployment agent, that a release deploys the application to. Universal and security groups are identity groups for permissions, not deployment targets, and a resource group only organizes Azure resources; it does not deploy an application to the VMs.

Question 19

You are preparing to deploy an Azure resource group via Terraform. To achieve your goal, you have to install the necessary frameworks. Which of the following are the frameworks you should use? Each correct answer presents part of the solution. (Choose two.)
  • A. Yeoman Correct
  • B. Vault
  • C. Terratest Correct
  • D. Tiller

Explanation

Microsoft's Terraform on Azure guidance uses Yeoman (with the generator-az-terra-module generator) to scaffold a base Terraform module, and Terratest, a Go library, to deploy the configuration, validate the deployed resources and tear them down. Vault is HashiCorp's secrets manager, and Tiller is the server-side component of Helm 2 for Kubernetes; neither is needed to build and test a Terraform deployment of a resource group.

Question 20

You intend to make use of Azure Artifacts to share packages that you wrote, tested, validated, and deployed. You want to use a solitary feed to release several builds of each package. You have to make sure that the release of packages that are in development is restricted. Which of the following actions should you take?
  • A. You should make use of static code analysis.
  • B. You should make use of views. Correct
  • C. You should make use of dynamic code analysis.
  • D. You should make use of upstream sources.

Explanation

Feed views let one feed expose only a subset of package versions, for example promoting validated versions to the @Release view while versions still in development stay only in @Local, so consumers of the release view never get them. Upstream sources pull packages in from other feeds or public registries and do not restrict what you release. Static and dynamic code analysis assess code quality and security but do not control package visibility.

Verifying access...