View Full Microsoft AZ-400 Exam Dumps and Practice Test Dumps

 

Q161. Which Azure DevOps feature can administrators use to review changes and activities related to organizational resources and security?

1) Azure Boards
2) Azure DevOps Audit Logs
3) Azure Artifacts
4) Azure Test Plans

Correct Answer: 2)

Explanation:

Azure DevOps Audit Logs provide administrators with visibility into important organizational activities and changes. They can help track events related to users, permissions, security settings, repositories, pipelines, and other Azure DevOps resources. This information is particularly useful when investigating unexpected configuration changes, reviewing security-related activity, or supporting compliance requirements. Azure Boards focuses on work management, Azure Artifacts manages packages, and Azure Test Plans supports testing activities. Audit logging is therefore the most appropriate feature when an organization needs a historical record of administrative and security-related events.

Q162. An Azure DevOps administrator needs to grant permissions to manage repositories only within a specific project. Which approach is most appropriate?

1) Assign organization-level permissions to every developer
2) Grant permissions at the project level
3) Give users project collection administrator access
4) Create a separate Azure subscription

Correct Answer: 2)

Explanation:

Project-level permissions are appropriate when access should be limited to resources within a particular Azure DevOps project. This follows the principle of least privilege because users receive only the permissions necessary for their assigned project rather than broad organization-wide administrative access. Organization-level or project collection permissions may provide access to many unrelated projects and resources, increasing security risk. Creating a separate Azure subscription does not address Azure DevOps permission scope. Administrators should therefore configure project-specific permissions whenever the requirement is limited to repositories and other resources belonging to one project.

Q163. A pipeline references a protected service connection, but the pipeline fails because it has not been authorized to use the connection. What should an administrator configure?

1) Pipeline permissions for the service connection
2) A new Git repository
3) An additional build artifact
4) A branch naming convention

Correct Answer: 1)

Explanation:

Azure DevOps service connections can be protected so that only authorized pipelines can use them. If a pipeline attempts to access a protected service connection without authorization, the pipeline can fail before the deployment begins. The administrator should review the service connection’s security settings and authorize the required pipeline or grant appropriate pipeline permissions. Creating a repository or artifact does not resolve this authorization problem. Properly configuring pipeline permissions helps prevent unauthorized deployments and limits which automation processes can access cloud resources through the service connection.

Q164. A project uses several Git repositories, and a pipeline needs source code from two of them during the same job. Which YAML capability should be used?

1) Deployment slots
2) Variable groups
3) Multi-repository checkout
4) Azure Test Plans

Correct Answer: 3)

Explanation:

Multi-repository checkout allows an Azure Pipelines job to retrieve content from multiple repositories during the same pipeline execution. This is useful when an application depends on shared libraries, infrastructure definitions, configuration repositories, or other centrally maintained source code. The pipeline can define additional repositories and check them out alongside the primary repository. Variable groups manage shared variables and secrets, while deployment slots are used for application deployment strategies. Azure Test Plans supports test management. Therefore, multi-repository checkout is the appropriate capability when a pipeline needs source code from multiple repositories.

Q165. In an Azure Pipelines YAML file, what is the primary purpose of defining a repository resource?

1) To configure application monitoring
2) To define an external repository that the pipeline can reference
3) To create an Azure DevOps project
4) To store deployment secrets

Correct Answer: 2)

Explanation:

A repository resource allows a pipeline to explicitly define another repository that it can use as part of its execution. This can support scenarios involving multiple repositories, external templates, shared pipeline configuration, or source dependencies. Defining repository resources also makes the pipeline structure clearer because referenced repositories are declared in the YAML configuration. Monitoring is handled through services such as Azure Monitor and Application Insights, while secrets can be managed through secure variables, variable groups, or Azure Key Vault. Therefore, repository resources are designed to establish additional repository dependencies for pipeline operations.

Q166. Which statement best describes a compile-time expression in an Azure Pipelines YAML file?

1) It is evaluated only after a deployment finishes
2) It is evaluated during pipeline processing before runtime execution
3) It can only read application logs
4) It is evaluated by Azure Monitor

Correct Answer: 2)

Explanation:

Compile-time expressions in Azure Pipelines are evaluated while the YAML pipeline is being processed, before the pipeline runs its jobs and tasks. They are commonly used with template expressions and parameters to determine which sections of a pipeline should be included or configured. Runtime expressions, by comparison, are evaluated while the pipeline is executing and can depend on runtime variables and conditions. Understanding the distinction is important when designing reusable and dynamic YAML pipelines. Compile-time logic is particularly useful for controlling pipeline structure before execution begins rather than reacting to information generated during a running job.

Q167. A development team wants to reduce the size of its Docker production image by separating build dependencies from runtime dependencies. Which technique is most appropriate?

1) Docker multi-stage builds
2) Git tagging
3) Azure Boards queries
4) Branch policies

Correct Answer: 1)

Explanation:

Docker multi-stage builds allow developers to use separate stages for compiling or building an application and for creating the final runtime image. Build tools, source files, and temporary dependencies can remain in the earlier stage, while only the required application files and runtime components are copied into the final image. This can significantly reduce image size and attack surface. Git tags identify source versions, Azure Boards queries organize work items, and branch policies control repository changes. Therefore, multi-stage Docker builds are an effective DevOps practice for producing smaller and cleaner production container images.

Q168. Which practice is most appropriate for ensuring that a production deployment references a specific, traceable container image version?

1) Rebuilding the image during deployment
2) Using an immutable version tag or digest
3) Using only the tag latest
4) Changing the image name for every deployment

Correct Answer: 2)

Explanation:

Using an immutable container image tag or digest helps ensure that a deployment references a specific image version. This improves traceability and reproducibility because the same image can be promoted across environments without unexpectedly changing its contents. Relying exclusively on the latest tag can be risky because its underlying image may change over time. Rebuilding an image during deployment can also introduce differences between environments. Immutable references are therefore preferable for controlled release processes because teams can identify exactly which container image was tested, approved, and deployed to production.

Q169. Which Azure service can automatically build container images from source code and support automated container image workflows?

1) Azure Boards
2) Azure Test Plans
3) Azure Container Registry Tasks
4) Azure Repos

Correct Answer: 3)

Explanation:

Azure Container Registry Tasks provide automated workflows for building and managing container images directly with Azure Container Registry. They can be triggered by source code changes, base image updates, or other configured events, helping teams automate container image creation without requiring a dedicated build environment for every operation. Azure Repos provides source control, Azure Boards manages work items, and Azure Test Plans supports testing activities. ACR Tasks are therefore particularly useful when an organization wants to automate container image builds and related registry workflows as part of its DevOps process.

Q170. A deployment pipeline updates an application running in Kubernetes. Which command is useful for checking whether a Kubernetes deployment has successfully rolled out?

1) kubectl rollout status
2) git status
3) az boards status
4) docker history

Correct Answer: 1)

Explanation:

The kubectl rollout status command provides information about the progress of a Kubernetes deployment rollout. It can help determine whether the updated replicas have become available and whether the deployment has completed successfully. This is valuable in CI/CD pipelines because a pipeline can monitor rollout progress before proceeding to subsequent stages or reporting deployment success. git status displays the state of a Git working directory, while docker history shows image layers. The Kubernetes rollout command is therefore the appropriate choice for verifying the progress and completion of a deployment update.

Q171. A Kubernetes application should receive traffic only after its container has successfully initialized and is ready to serve requests. Which mechanism should be configured?

1) A Git hook
2) A readiness probe
3) A branch policy
4) A package feed

Correct Answer: 2)

Explanation:

A Kubernetes readiness probe determines whether a container is ready to receive traffic. If the readiness probe fails, Kubernetes can prevent the associated pod from receiving traffic through the service until the application becomes ready. This is especially useful for applications that require initialization time, database connections, configuration loading, or other startup processes. A readiness probe differs from a liveness probe, which is primarily used to determine whether a container should be restarted. Git hooks, branch policies, and package feeds do not control Kubernetes traffic routing. Therefore, a readiness probe is the correct mechanism for this requirement.

Q172. A Helm chart needs different configuration values for development, testing, and production environments. Which Helm feature is designed for this purpose?

1) Git commits
2) Kubernetes namespaces only
3) Helm values files
4) Azure Boards work items

Correct Answer: 3)

Explanation:

Helm values files allow teams to provide environment-specific configuration to a Helm chart without changing the chart’s underlying templates. For example, development, testing, and production can use different replica counts, resource limits, image tags, or application settings while sharing the same chart structure. This supports consistent and reusable deployment definitions. Kubernetes namespaces can separate resources but do not replace Helm’s configuration mechanism. Git commits track source changes, and Azure Boards manages work items. Values files therefore provide a practical way to customize Helm deployments for different environments while maintaining a common deployment template.

Q173. An Infrastructure as Code deployment reports that the actual Azure environment differs from the configuration stored in source control. What concept describes this situation?

1) Code coverage
2) Configuration drift
3) Continuous integration
4) Package caching

Correct Answer: 2)

Explanation:

Configuration drift occurs when the actual infrastructure environment gradually differs from the desired configuration defined in Infrastructure as Code. This can happen when administrators manually modify resources, when external processes make changes, or when infrastructure updates are not properly recorded in source control. Drift can create deployment inconsistencies and make environments harder to reproduce. Detecting and correcting drift helps maintain infrastructure reliability and consistency. Code coverage measures testing, continuous integration focuses on integrating code changes, and package caching improves dependency retrieval. Therefore, the described difference between actual and declared infrastructure is known as configuration drift.

Q174. A Bicep project contains several reusable infrastructure definitions that are shared across applications. Which Bicep feature is most appropriate for organizing this reusable infrastructure?

1) Bicep modules
2) Git stash
3) Pull request comments
4) Azure Boards dashboards

Correct Answer: 1)

Explanation:

Bicep modules allow infrastructure definitions to be separated into reusable components. Teams can create modules for common resources such as networking, storage, monitoring, or security configurations and then reference those modules from multiple Bicep files. This improves consistency, maintainability, and reuse across infrastructure deployments. Git stash temporarily stores local changes, pull request comments support code review discussions, and Azure Boards dashboards provide work tracking information. Modules are therefore the appropriate Bicep feature when an organization wants to build reusable infrastructure components and avoid duplicating the same resource definitions across multiple projects.

Q175. In Terraform, which component is primarily responsible for tracking the current state of managed infrastructure?

1) Terraform state
2) Dockerfile
3) Git branch policy
4) Azure Test Plan

Correct Answer: 1)

Explanation:

Terraform state records information about infrastructure resources that Terraform manages and helps Terraform determine the difference between the desired configuration and the current environment. During planning and application operations, Terraform uses this state information to identify resources that need to be created, updated, or removed. Proper state management is therefore critical for reliable Infrastructure as Code workflows. In team environments, remote state storage is commonly used to provide controlled access and collaboration. Dockerfiles define container images, branch policies govern Git workflows, and Azure Test Plans support testing, so they do not serve as Terraform’s infrastructure state mechanism.

Q176. An engineer needs to query application and infrastructure logs stored in Azure Monitor to identify failed requests during the previous hour. Which language is commonly used in Log Analytics for this task?

1) HTML
2) YAML
3) Kusto Query Language (KQL)
4) PowerShell DSC only

Correct Answer: 3)

Explanation:

Kusto Query Language, commonly called KQL, is used to query and analyze telemetry and log data in services such as Azure Monitor and Log Analytics. Engineers can use KQL to filter events by time, search for failures, group records, calculate statistics, and investigate application or infrastructure behavior. This makes it valuable for troubleshooting production issues and supporting observability practices. YAML is commonly used for pipeline configuration, HTML structures web content, and PowerShell DSC is used for configuration management. Therefore, KQL is the appropriate language when querying Azure Monitor or Log Analytics data to investigate failed requests.

Q177. A DevOps team wants an interactive Azure Monitor view containing charts, metrics, and log-query visualizations for tracking application health. Which feature is most appropriate?

1) Azure Monitor Workbooks
2) Git tags
3) Azure Repos branches
4) Azure Artifacts feeds

Correct Answer: 1)

Explanation:

Azure Monitor Workbooks provide interactive dashboards for combining metrics, logs, charts, text, and other visualizations into a single monitoring experience. They can help development and operations teams analyze application health, infrastructure performance, and operational trends. Workbooks can use Azure Monitor data and Log Analytics queries to provide customized views for different applications or environments. Git tags identify source versions, repositories manage source code, and artifact feeds manage packages. Therefore, Azure Monitor Workbooks are well suited for creating a centralized and interactive operational dashboard that supports observability and troubleshooting activities.

Q178. An Azure Monitor alert should notify the operations team and trigger an automated response when a critical condition occurs. Which feature defines these notification and automation targets?

1) Branch policies
2) Action groups
3) Variable templates
4) Git tags

Correct Answer: 2)

Explanation:

Azure Monitor action groups define the notifications and actions that should occur when an alert is triggered. An action group can include recipients such as email or SMS contacts and can also integrate with automation or other supported response mechanisms. This allows teams to standardize how critical alerts are communicated and handled. Branch policies govern source-control changes, variable templates support pipeline configuration reuse, and Git tags identify source versions. Therefore, action groups are the appropriate Azure Monitor feature when a team needs alerts to notify specific responders or initiate an automated operational response.

Q179. A team wants to regularly test whether an application endpoint is reachable and responding correctly from Azure. Which monitoring capability can provide this type of check?

1) Application Insights availability tests
2) Git merge
3) Azure Artifacts
4) Pipeline variables

Correct Answer: 1)

Explanation:

Application Insights availability tests can periodically check application endpoints to determine whether they are reachable and responding as expected. These tests provide useful monitoring information about availability and response behavior and can help teams detect outages before users report them. Availability monitoring is an important part of a proactive DevOps approach because it provides continuous feedback about application health. Git merge handles source-code integration, Azure Artifacts manages packages, and pipeline variables provide configuration values. Therefore, Application Insights availability tests are the appropriate capability for regularly validating endpoint availability.

Q180. A production service experiences a major outage, and the operations team needs a documented procedure for diagnosing and restoring the service. What should the team maintain?

1) A package feed
2) A Git tag
3) A deployment branch
4) An incident response runbook

Correct Answer: 4)

Explanation:

An incident response runbook provides documented procedures that help teams respond consistently to operational incidents. It can contain diagnostic steps, escalation contacts, recovery procedures, validation checks, and rollback or mitigation instructions. Runbooks are particularly useful during high-pressure incidents because responders can follow established procedures instead of relying entirely on memory or improvisation. After an incident, teams can update the runbook based on lessons learned and improve future response processes. Package feeds manage dependencies, Git tags identify source versions, and deployment branches organize code changes. Therefore, an incident response runbook is the best choice for structured outage response.