Microsoft Designing and Implementing Microsoft DevOps Solutions - AZ-400 Exam Questions
QUESTION NO: 1
You use GitHub for source control and Azure Boards for project management. GitHub and Azure Boards are integrated.
You plan to create a pull request in GitHub.
You need to automatically link the request to an existing Azure Boards work item by using the text of AB# < WORKITEMNUMBER > .
To which two elements can you add the text? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
You use GitHub for source control and Azure Boards for project management. GitHub and Azure Boards are integrated.
You plan to create a pull request in GitHub.
You need to automatically link the request to an existing Azure Boards work item by using the text of AB# < WORKITEMNUMBER > .
To which two elements can you add the text? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
Correct Answer: B,D
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
QUESTION NO: 2
Task 6
For Project 1. you need to create a service connection that can be used to deploy resources to the RGHod489Q1628 resource group.
The service connection must use the ManagedJd1 identity and workload identity federation.
Task 6
For Project 1. you need to create a service connection that can be used to deploy resources to the RGHod489Q1628 resource group.
The service connection must use the ManagedJd1 identity and workload identity federation.
Correct Answer:
See explanation below
Explanation:
Task 6: Create a Service Connection for Resource Group Deployment using Managed Identity and Workload Identity Federation Step 1: Understand the Requirements
* You want to deploy resources in the RGHod489Q1628 resource group.
* The service connection must:
* Use the ManagedJd1 managed identity.
* Use workload identity federation (OIDC-based authentication for enhanced security).
Step 2: Verify Prerequisites
* You need to ensure:
* The ManagedJd1 managed identity exists in your Azure subscription.
* Your Azure DevOps project (Project1) is linked to an Azure Active Directory tenant (for OIDC support).
* You have the Owner or User Access Administrator role on the RGHod489Q1628 resource group.
Step 3: Assign Role to Managed Identity
* Go to the Azure Portal .
* In the search bar, type Managed Identities and select Managed Identities .
* Locate and click on the ManagedJd1 identity.
* In the left menu, click Azure role assignments .
* Click + Add role assignment .
* Set the following:
* Scope: Resource Group
* Subscription: Your subscription
* Resource Group: RGHod489Q1628
* Role: Contributor (or appropriate role)
* Click Save .
This step ensures ManagedJd1 has permissions to deploy resources to RGHod489Q1628.
Step 4: Create a Federated Credential for Workload Identity Federation
* In the Azure Portal, navigate to the ManagedJd1 managed identity.
* In the left menu, click Workload identity federation (preview).
* Click + Add a federated credential .
* Configure as follows:
* Federated credential name: devops-oidc
* Issuer: https://vstoken.actions.githubusercontent.com (or use the default https://pipelines.actions.
githubusercontent.com for Azure DevOps)
* Subject identifier: Use the following format for Azure DevOps:
css
Copy
system:azuredevops:{organizationName}:{projectName}
For example:
css
Copy
system:azuredevops:{YourOrganizationName}:{Project1}
* Audience: api://AzureADTokenExchange
* Click Add .
This federated credential establishes trust between your Azure DevOps project and the managed identity.
Step 5: Create a Service Connection in Azure DevOps
* Go to your Azure DevOps project (Project1) in the browser.
* In the left menu, click Project settings .
* Under Pipelines , click Service connections .
* Click New service connection .
* Choose Azure Resource Manager .
* Choose the authentication method:
* Select Workload identity federation .
* Configure the service connection:
* Scope level: Resource Group.
* Resource Group: RGHod489Q1628.
* Subscription: Your subscription.
* Authentication method: Managed Identity with workload identity federation.
* Managed Identity: Enter the client ID or select ManagedJd1.
* Service connection name: e.g., Project1-RGHod489Q1628-Conn.
* Grant access permission to all pipelines (recommended).
* Click Save .
Step 6: Validate the Service Connection
* After creation, click on the new service connection to Verify it.
* Ensure the connection test is successful .
* You can now use this service connection in your pipelines for deploying resources to RGHod489Q1628.
Explanation:
Task 6: Create a Service Connection for Resource Group Deployment using Managed Identity and Workload Identity Federation Step 1: Understand the Requirements
* You want to deploy resources in the RGHod489Q1628 resource group.
* The service connection must:
* Use the ManagedJd1 managed identity.
* Use workload identity federation (OIDC-based authentication for enhanced security).
Step 2: Verify Prerequisites
* You need to ensure:
* The ManagedJd1 managed identity exists in your Azure subscription.
* Your Azure DevOps project (Project1) is linked to an Azure Active Directory tenant (for OIDC support).
* You have the Owner or User Access Administrator role on the RGHod489Q1628 resource group.
Step 3: Assign Role to Managed Identity
* Go to the Azure Portal .
* In the search bar, type Managed Identities and select Managed Identities .
* Locate and click on the ManagedJd1 identity.
* In the left menu, click Azure role assignments .
* Click + Add role assignment .
* Set the following:
* Scope: Resource Group
* Subscription: Your subscription
* Resource Group: RGHod489Q1628
* Role: Contributor (or appropriate role)
* Click Save .
This step ensures ManagedJd1 has permissions to deploy resources to RGHod489Q1628.
Step 4: Create a Federated Credential for Workload Identity Federation
* In the Azure Portal, navigate to the ManagedJd1 managed identity.
* In the left menu, click Workload identity federation (preview).
* Click + Add a federated credential .
* Configure as follows:
* Federated credential name: devops-oidc
* Issuer: https://vstoken.actions.githubusercontent.com (or use the default https://pipelines.actions.
githubusercontent.com for Azure DevOps)
* Subject identifier: Use the following format for Azure DevOps:
css
Copy
system:azuredevops:{organizationName}:{projectName}
For example:
css
Copy
system:azuredevops:{YourOrganizationName}:{Project1}
* Audience: api://AzureADTokenExchange
* Click Add .
This federated credential establishes trust between your Azure DevOps project and the managed identity.
Step 5: Create a Service Connection in Azure DevOps
* Go to your Azure DevOps project (Project1) in the browser.
* In the left menu, click Project settings .
* Under Pipelines , click Service connections .
* Click New service connection .
* Choose Azure Resource Manager .
* Choose the authentication method:
* Select Workload identity federation .
* Configure the service connection:
* Scope level: Resource Group.
* Resource Group: RGHod489Q1628.
* Subscription: Your subscription.
* Authentication method: Managed Identity with workload identity federation.
* Managed Identity: Enter the client ID or select ManagedJd1.
* Service connection name: e.g., Project1-RGHod489Q1628-Conn.
* Grant access permission to all pipelines (recommended).
* Click Save .
Step 6: Validate the Service Connection
* After creation, click on the new service connection to Verify it.
* Ensure the connection test is successful .
* You can now use this service connection in your pipelines for deploying resources to RGHod489Q1628.
QUESTION NO: 3
Your company has a project in Azure DevOps for a new web application.
The company identifies security as one of the highest priorities.
You need to recommend a solution to minimize the likelihood that infrastructure credentials will be leaked.
What should you recommend?
Your company has a project in Azure DevOps for a new web application.
The company identifies security as one of the highest priorities.
You need to recommend a solution to minimize the likelihood that infrastructure credentials will be leaked.
What should you recommend?
Correct Answer: D
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
QUESTION NO: 4
You have a GitHub repository that contains workflows. The workflows contain steps that execute predefined actions. Each action has one or more versions.
You need to request the specific version of an action to execute.
Which three attributes can you use to identify the version? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
You have a GitHub repository that contains workflows. The workflows contain steps that execute predefined actions. Each action has one or more versions.
You need to request the specific version of an action to execute.
Which three attributes can you use to identify the version? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
Correct Answer: A,D,E
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
QUESTION NO: 5
You plan to build an app named App1 by using GitHub.
You need to recommend a build and deployment solution for App1. The solution must meet the following requirements:
* Ensure that the code for App1 is submitted for testing only when a build has completed successfully.
* Ensure that a build is approved by the change management team before the build is released.
What should you include in the recommendation for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
You plan to build an app named App1 by using GitHub.
You need to recommend a build and deployment solution for App1. The solution must meet the following requirements:
* Ensure that the code for App1 is submitted for testing only when a build has completed successfully.
* Ensure that a build is approved by the change management team before the build is released.
What should you include in the recommendation for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
QUESTION NO: 6
After you answer a question in this section, you will NOT be able to return to it As a result, these questions will not appear in the review screen.
You use Azure Pipelines to build and test a React js application
You have a pipeline that has a single job.
You discover that installing JavaScript packages from npm lakes approximately five minutes each time you run the pipeline.
You need to recommend a solution to reduce the pipeline execution time.
Solution: You recommend enabling pipeline caching.
Does this meet the goal?
After you answer a question in this section, you will NOT be able to return to it As a result, these questions will not appear in the review screen.
You use Azure Pipelines to build and test a React js application
You have a pipeline that has a single job.
You discover that installing JavaScript packages from npm lakes approximately five minutes each time you run the pipeline.
You need to recommend a solution to reduce the pipeline execution time.
Solution: You recommend enabling pipeline caching.
Does this meet the goal?
Correct Answer: A
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
QUESTION NO: 7
You provision an Azure Kubernetes Service (AKS) cluster that has RBAC enabled. You have a Helm chart for a client application.
You need to configure Helm and Tiller on the cluster and install the chart.
Which three commands should you recommend be run in sequence? To answer, move the appropriate commands from the list of commands to the answer area and arrange them in the correct order.
You provision an Azure Kubernetes Service (AKS) cluster that has RBAC enabled. You have a Helm chart for a client application.
You need to configure Helm and Tiller on the cluster and install the chart.
Which three commands should you recommend be run in sequence? To answer, move the appropriate commands from the list of commands to the answer area and arrange them in the correct order.
Correct Answer:
Explanation:
Step 1: Kubectl create
You can add a service account to Tiller using the --service-account < NAME > flag while you're configuring Helm (step 2 below). As a prerequisite, you'll have to create a role binding which specifies a role and a service account name that have been set up in advance.
Example: Service account with cluster-admin role
$ kubectl create -f rbac-config.yaml
serviceaccount " tiller " created
clusterrolebinding " tiller " created
$ helm init --service-account tiller
Step 2: helm init
To deploy a basic Tiller into an AKS cluster, use the helm init command.
Step 3: helm install
To install charts with Helm, use the helm install command and specify the name of the chart to install.
References:
https://docs.micro soft.com/en-us /azure/aks/kubernetes- helm
https://docs.helm.sh/using_hel m/#tiller- names paces-and-rbac
QUESTION NO: 8
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that m.ght meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you win NOT be able to return to it. As a result, these questions win not appear in the review screen.
You integrate a cloud- hosted Jenkins server and a new Azure DevOps deployment You need Azure DevOps to send a notification to Jenkins when a developer commits changes to a branch in Azure Repos.
Solution: You create a service hook subscription that uses the code pushed event.
Does this meet the goal?
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that m.ght meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you win NOT be able to return to it. As a result, these questions win not appear in the review screen.
You integrate a cloud- hosted Jenkins server and a new Azure DevOps deployment You need Azure DevOps to send a notification to Jenkins when a developer commits changes to a branch in Azure Repos.
Solution: You create a service hook subscription that uses the code pushed event.
Does this meet the goal?
Correct Answer: A
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
QUESTION NO: 9
Your company has a project in Azure DevOps for a new application. The application will be deployed to several Azure virtual machines that run Windows Server 2016.
You need to recommend a deployment strategy for the virtual machines. The strategy must meet the following requirements:
* Ensure that the virtual machines maintain a consistent configuration.
* Minimize administrative effort to configure the virtual machines
What should you include in the recommendation?
Your company has a project in Azure DevOps for a new application. The application will be deployed to several Azure virtual machines that run Windows Server 2016.
You need to recommend a deployment strategy for the virtual machines. The strategy must meet the following requirements:
* Ensure that the virtual machines maintain a consistent configuration.
* Minimize administrative effort to configure the virtual machines
What should you include in the recommendation?
Correct Answer: C
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
QUESTION NO: 10
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an approval process that contains a condition. The condition requires that releases be approved by a team leader before they are deployed.
You have a policy stating that approvals must occur within eight hours.
You discover that deployment fail if the approvals take longer than two hours.
You need to ensure that the deployments only fail if the approvals take longer than eight hours.
Solution: From Pre-deployment conditions, you modify the Time between re-evaluation of gates option.
Does this meet the goal?
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an approval process that contains a condition. The condition requires that releases be approved by a team leader before they are deployed.
You have a policy stating that approvals must occur within eight hours.
You discover that deployment fail if the approvals take longer than two hours.
You need to ensure that the deployments only fail if the approvals take longer than eight hours.
Solution: From Pre-deployment conditions, you modify the Time between re-evaluation of gates option.
Does this meet the goal?
Correct Answer: B
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
