View Full Microsoft AZ-400 Exam Dumps and Practice Test Dumps

 

Q281. Which Azure Policy feature allows multiple related policy definitions to be managed and assigned as a single unit?

1) Management group
2) Policy initiative
3) Resource lock
4) Deployment stack

Correct Answer: 2)

Explanation:

An Azure Policy initiative is a collection of related policy definitions grouped together so they can be assigned and managed as one logical unit. This is useful when an organization needs to enforce several compliance requirements across resources, such as allowed locations, required tags, and approved resource types. Instead of assigning each policy individually, an initiative can contain multiple policies and apply them together. This simplifies governance and makes compliance management easier. Management groups organize subscriptions, while resource locks help prevent accidental modifications or deletions. Therefore, when multiple policy definitions need to be handled together, a policy initiative is the appropriate choice.

Q282. A development team wants to determine whether Azure resources currently comply with assigned policies. Which Azure Policy capability should they use?

1) Policy compliance evaluation
2) Azure Repos branching
3) Pipeline caching
4) Application Insights sampling

Correct Answer: 1)

Explanation:

Azure Policy compliance evaluation determines whether resources meet the requirements defined by assigned policies. Azure Policy continuously evaluates applicable resources and reports whether they are compliant or noncompliant. This allows development and operations teams to identify configuration problems, governance violations, and resources that require remediation. For example, a policy might require resources to use specific regions or contain required tags. Compliance results can then be reviewed to determine which resources violate those requirements. Azure Repos, pipeline caching, and Application Insights serve different purposes and do not provide Azure Policy compliance evaluation. Therefore, policy compliance evaluation is the correct capability for checking resource governance status.

Q283. What is a major advantage of using Bicep modules in Infrastructure as Code?

1) They permanently encrypt deployment templates
2) They replace Azure subscriptions
3) They provide reusable infrastructure components
4) They eliminate the need for source control

Correct Answer: 3)

Explanation:

Bicep modules allow infrastructure definitions to be divided into reusable components. Instead of placing an entire environment into one large Bicep file, teams can create modules for common resources such as virtual networks, storage accounts, or application infrastructure. These modules can then be referenced by multiple deployments, improving consistency and reducing duplication. Modules can also make infrastructure code easier to maintain because changes to a common component can be managed centrally. They do not replace subscriptions, eliminate source control, or automatically provide permanent encryption. Therefore, the primary advantage of Bicep modules is that they provide reusable infrastructure components that support maintainable and consistent deployments.

Q284. Why is Terraform state locking important when multiple team members manage the same infrastructure?

1) It prevents simultaneous conflicting state operations
2) It automatically creates application containers
3) It replaces Terraform configuration files
4) It converts Terraform code into Bicep

Correct Answer: 1)

Explanation:

Terraform state locking helps prevent multiple Terraform operations from modifying the same state simultaneously. Without locking, two users or automated pipelines could run Terraform commands at nearly the same time and attempt to update shared infrastructure state, potentially causing inconsistencies or conflicts. A supported remote backend can provide state locking so that one operation obtains the lock while another waits or fails until the lock is released. This protects the integrity of the Terraform state and reduces the risk of concurrent changes. State locking does not create containers, replace configuration files, or convert Terraform into Bicep. Its primary purpose is safe coordination of shared state operations.

Q285. What is the primary purpose of running terraform plan before applying infrastructure changes?

1) Permanently deploy resources without confirmation
2) Show the proposed infrastructure changes
3) Delete the Terraform state file
4) Build Docker container images

Correct Answer: 2)

Explanation:

The terraform plan command previews the changes Terraform intends to make based on the current configuration and state. It allows engineers to review which resources may be created, modified, or destroyed before making actual changes. This is particularly valuable in CI/CD pipelines because the proposed infrastructure changes can be reviewed and validated before deployment. It can help detect unexpected changes caused by configuration modifications, state differences, or resource drift. The command does not itself apply the changes, delete the state file, or build Docker images. Therefore, its primary purpose is to generate a planned change set that can be reviewed before execution.

Q286. Which Terraform command is normally used to execute the infrastructure changes described by the configuration?

1) terraform inspect
2) terraform validate
3) terraform graph
4) terraform apply

Correct Answer: 4)

Explanation:

The terraform apply command executes the infrastructure changes defined by a Terraform configuration. Before applying changes, Terraform evaluates the configuration and compares it with the current state and infrastructure. It then proposes the changes and, after approval when required, performs the operations. In an automated pipeline, the approved plan can be used as part of a controlled deployment process. terraform validate checks configuration syntax and internal consistency but does not deploy resources. Other commands serve different purposes, such as generating dependency graphs or inspecting configuration. Therefore, when the objective is to actually provision or modify infrastructure according to Terraform configuration, terraform apply is the appropriate command.

Q287. A team wants every Infrastructure as Code change to be reviewed and validated before it is merged. Which approach is most appropriate?

1) Store infrastructure code only on developer machines
2) Manually modify production resources first
3) Use pull requests with automated IaC validation
4) Disable branch protection for infrastructure repositories

Correct Answer: 3)

Explanation:

Using pull requests with automated Infrastructure as Code validation provides a controlled way to review infrastructure changes before they reach the main branch. Developers can submit changes through a pull request, while automated checks can run formatting validation, syntax checks, security scans, policy checks, and Terraform plans or Bicep validation. Reviewers can inspect the proposed changes and discuss concerns before approval. This approach improves quality, traceability, and governance while reducing the risk of unreviewed infrastructure modifications. Keeping code only on local machines or manually changing production resources reduces control and visibility. Therefore, combining pull requests with automated IaC validation is the strongest approach.

Q288. What is the main purpose of policy as code in a DevOps workflow?

1) Store governance rules in version-controlled definitions
2) Replace all application source code
3) Automatically increase virtual machine size
4) Remove the need for deployment pipelines

Correct Answer: 1)

Explanation:

Policy as code represents governance, security, or compliance requirements as machine-readable definitions that can be version controlled, reviewed, tested, and automated. This allows organizations to apply consistent rules across environments and integrate governance into CI/CD workflows. For example, a policy can require specific resource configurations or prevent deployments that violate organizational standards. Storing policies alongside infrastructure code also provides traceability and makes changes easier to review. Policy as code does not replace application source code, automatically resize every virtual machine, or eliminate deployment pipelines. Instead, it brings governance into the same automated development practices used for application and infrastructure delivery.

Q289. Why should open-source license scanning be included in a software delivery pipeline?

1) To increase CPU capacity automatically
2) To identify licensing risks in dependencies
3) To replace functional testing
4) To improve database indexing

Correct Answer: 2)

Explanation:

Open-source license scanning helps organizations identify licensing information and potential legal or compliance risks associated with third-party dependencies. Modern applications commonly rely on many open-source packages, and each package may have different licensing requirements. A license scanning tool can inspect dependencies and flag packages whose licenses may conflict with organizational policies or distribution requirements. Integrating this check into the CI/CD pipeline allows issues to be identified early rather than after software has already been released. License scanning does not replace functional testing or improve database performance. Its main purpose is to provide visibility into open-source licensing obligations and help organizations manage associated compliance risks.

Q290. What is a primary benefit of generating a Software Bill of Materials (SBOM) during CI?

1) It increases the number of application features
2) It automatically fixes every vulnerability
3) It replaces source control
4) It provides an inventory of software components

Correct Answer: 4)

Explanation:

Generating an SBOM during CI provides a structured inventory of the components included in a software artifact. This can include direct and transitive dependencies, libraries, versions, and other component information. Having this inventory improves software supply-chain visibility and helps organizations respond more efficiently when a vulnerability affects a specific dependency. An SBOM does not automatically fix vulnerabilities, replace source control, or add application functionality. Instead, it provides useful information that security and operations teams can use for vulnerability management, compliance, auditing, and incident response. Generating the SBOM during CI also helps associate component information with a specific build or release artifact.

Q291. What is the main purpose of scanning container images for vulnerabilities before deployment?

1) Identify known security weaknesses in image components
2) Increase container CPU limits
3) Convert containers into virtual machines
4) Remove the need for application testing

Correct Answer: 1)

Explanation:

Container image vulnerability scanning analyzes operating system packages, libraries, and other components within an image to identify known security vulnerabilities. Performing this check before deployment allows teams to detect risky dependencies and base-image packages before the image reaches production. The pipeline can then block, warn about, or require remediation for images that exceed defined security thresholds. Vulnerability scanning does not increase CPU limits, convert containers into virtual machines, or eliminate other forms of application testing. It is one layer of a broader DevSecOps process designed to identify security issues earlier in the software delivery lifecycle and reduce the risk of deploying vulnerable container workloads.

Q292. Why are immutable container image digests useful for reliable deployments?

1) They automatically rewrite application source code
2) They identify an exact image version
3) They increase Kubernetes node capacity
4) They remove the need for image registries

Correct Answer: 2)

Explanation:

A container image digest identifies a specific image content and provides a precise reference to that immutable artifact. Using a digest instead of relying only on a mutable tag helps ensure that different environments deploy exactly the same image content. This improves reproducibility and strengthens artifact traceability because a deployment can be associated with a specific image rather than whatever content a tag happens to reference later. Digests do not increase node capacity, modify source code, or eliminate the need for registries. In controlled CI/CD workflows, referencing immutable image digests can therefore reduce deployment inconsistencies and make rollback and auditing more reliable.

Q293. What is a common use of Azure Container Registry Tasks?

1) Manage employee work items
2) Create database schemas manually
3) Automate container image builds
4) Replace Kubernetes clusters

Correct Answer: 3)

Explanation:

Azure Container Registry Tasks provide automated workflows for building and managing container images in Azure Container Registry. They can be triggered by source-code changes, base-image updates, or other events, allowing organizations to automate container image creation without requiring a dedicated build environment for every operation. This can help keep images current and integrate container builds into DevOps workflows. ACR Tasks do not replace Kubernetes clusters or serve as a work-item management system. Their focus is container image build and automation functionality associated with Azure Container Registry. Therefore, automating container image builds is a common and appropriate use of ACR Tasks.

Q294. Which Kubernetes command is commonly used to monitor the progress of a Deployment rollout?

1) kubectl rollout status
2) kubectl create namespace
3) kubectl get events
4) kubectl config view

Correct Answer: 1)

Explanation:

The kubectl rollout status command is commonly used to monitor the progress of a Kubernetes Deployment rollout. It reports whether the deployment is progressing toward its desired state and helps operators determine when updated replicas have become available. This is useful in CI/CD pipelines because the pipeline can wait for deployment completion and detect rollout problems before considering a release successful. Other commands have different purposes. For example, kubectl create namespace creates namespaces, kubectl get events displays cluster events, and kubectl config view displays client configuration. Therefore, kubectl rollout status is the most direct command for monitoring Deployment rollout progress.

Q295. A Kubernetes application update introduces unexpected behavior. Which Helm capability can help restore a previous release version?

1) Helm package
2) Helm rollback
3) Helm repo add
4) Helm dependency update

Correct Answer: 2)

Explanation:

Helm rollback allows a Kubernetes application release to be returned to a previous known revision. Helm maintains release history, which makes it possible to identify earlier versions and roll back when a deployment introduces unexpected behavior. This capability can be useful in CI/CD environments where rapid recovery is important. A rollback does not necessarily eliminate the need to investigate the underlying problem, but it can restore a previously working release while remediation occurs. Other Helm commands have different purposes: packaging creates charts, adding a repository configures a chart source, and dependency updates manage chart dependencies. Therefore, Helm rollback is the appropriate capability for restoring a previous release.

Q296. Which Kubernetes deployment approach gradually replaces old application instances with new ones?

1) Immediate deletion
2) Manual copying
3) Rolling update
4) Local development

Correct Answer: 3)

Explanation:

A Kubernetes rolling update gradually replaces existing application instances with new instances. Instead of stopping all existing replicas at once, Kubernetes progressively updates the workload while maintaining the desired availability according to the deployment configuration. This approach can reduce downtime and allows teams to monitor the new version as it is introduced. If problems occur, deployment mechanisms can also support controlled recovery. A rolling update is therefore well suited to continuous delivery scenarios where applications need to be updated without taking the entire service offline. The other options do not describe a standard Kubernetes deployment strategy for progressively replacing application instances.

Q297. What is a key advantage of externalizing application configuration from application code?

1) Configuration can be changed independently of application binaries
2) Source code no longer requires testing
3) Databases are automatically optimized
4) Container images become larger

Correct Answer: 1)

Explanation:

Externalizing application configuration allows settings such as connection information, feature settings, or environment-specific values to be managed separately from the application binary or source code. This makes it easier to use the same application artifact across development, testing, and production while supplying appropriate configuration for each environment. It also reduces the need to rebuild an application simply because a configuration value changes. Sensitive configuration should additionally be protected using appropriate secret-management services. External configuration does not eliminate application testing, automatically optimize databases, or inherently make container images larger. Its major benefit is separation of application code from environment-specific configuration.

Q298. A team wants to enable a new application capability for selected users without deploying separate application versions. What approach is appropriate?

1) Hard-code separate production binaries
2) Use feature management controls
3) Disable deployment automation
4) Duplicate the entire application environment

Correct Answer: 2)

Explanation:

Feature management controls allow teams to activate or deactivate application functionality independently of the application’s deployment process. A feature can be enabled for selected users, groups, regions, or other conditions while remaining disabled for everyone else. This supports gradual releases, controlled experimentation, and safer feature rollouts. If an issue occurs, the feature can often be disabled without redeploying the entire application. This approach separates feature availability from application deployment and can reduce release risk. Creating separate production binaries or duplicating complete environments is generally more complex. Therefore, feature management controls provide an effective way to selectively expose new functionality.

Q299. What is the purpose of an availability test in Application Insights?

1) Modify application source code
2) Monitor whether an application endpoint is reachable and responding
3) Increase database storage automatically
4) Create Git branches

Correct Answer: 2)

Explanation:

Application Insights availability tests help determine whether an application endpoint is reachable and responding as expected from configured test locations. These tests can periodically send requests to an application and record availability results, response times, and failures. This provides an external perspective that can help detect outages or accessibility problems even when application users have not yet reported them. Availability testing complements application telemetry such as requests, dependencies, and exceptions. It does not modify source code, create Git branches, or automatically increase database storage. Therefore, monitoring whether an application endpoint remains reachable and responsive is the primary purpose of an Application Insights availability test.

Q300. Which Azure Monitor capability can help combine and visualize KQL-based data from multiple monitoring sources?

1) Azure DevOps Boards
2) Azure Repos
3) Azure Monitor Workbooks
4) Azure Artifacts

Correct Answer: 3)

Explanation:

Azure Monitor Workbooks provide interactive reports and visualizations that can combine monitoring information from different Azure sources. Workbooks can use queries, including KQL-based queries against Log Analytics data, to create charts, tables, metrics, and other visual elements. This makes them useful for operational dashboards, troubleshooting, trend analysis, and correlating information across applications and infrastructure. Azure DevOps Boards manages work items, Azure Repos provides source control, and Azure Artifacts manages packages, so they do not provide the same monitoring visualization capability. Therefore, Azure Monitor Workbooks are the appropriate choice when teams need to correlate and present monitoring data in an interactive format.