Microsoft AZ-400 Exam Dumps, Practice Test Questions

100% Latest & Updated Microsoft AZ-400 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!

Microsoft AZ-400 Premium Bundle
$79.97
$59.98

AZ-400 Premium Bundle

  • Premium File: 398 Questions & Answers. Last update: Nov 7, 2026
  • Training Course: 27 Video Lectures
  • Study Guide: 784 Pages
  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates

AZ-400 Premium Bundle

Microsoft AZ-400 Premium Bundle
  • Premium File: 398 Questions & Answers. Last update: Nov 7, 2026
  • Training Course: 27 Video Lectures
  • Study Guide: 784 Pages
  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates
$79.97
$59.98

Microsoft AZ-400 Practice Test 43

Question 420

A GitHub-native repository needs reusable CI, while management chooses a separate tool without considering audit and identity integration. Choose TWO measures that implement and verify an effective Azure DevOps response to this specific situation. (Choose TWO.)

  1. Bypass review and testing for choosing azure pipelines versus github actions for release workflow whenever the release deadline is urgent, applying the change to production immediately.
  2. Declare choosing azure pipelines versus github actions for release workflow successful solely from a green pipeline status and skip checking its actual control outcome.
  3. Dismiss the known risk for choosing azure pipelines versus github actions for release workflow and keep no evidence or accountable owner after deployment.
  4. Select a supported pipeline engine according to repository location, governance, deployment needs, skills, and maintainability.
  5. Implement a proof-of-concept that covers source trigger, secured runner access, test artifacts, and deployment approvals.

Explanation

Correct Answers

D:

Select a supported pipeline engine according to repository location, governance, deployment needs, skills, and maintainability. Tool selection must fit ownership and security integration, not just whether the product can execute scripts. A mismatched platform can increase brittle integrations or weaken accountability for deployments.

E:

Implement a proof-of-concept that covers source trigger, secured runner access, test artifacts, and deployment approvals. Tool selection must fit ownership and security integration, not just whether the product can execute scripts.

Incorrect Answers

A:

Bypass review and testing for choosing azure pipelines versus github actions for release workflow whenever the release deadline is urgent, applying the change to production immediately. It conflicts with the stated operating condition: Tool selection must fit ownership and security integration, not just whether the product can execute scripts.

B:

Declare choosing azure pipelines versus github actions for release workflow successful solely from a green pipeline status and skip checking its actual control outcome. It conflicts with the stated operating condition: Tool selection must fit ownership and security integration, not just whether the product can execute scripts.

C:

Dismiss the known risk for choosing azure pipelines versus github actions for release workflow and keep no evidence or accountable owner after deployment. It conflicts with the stated operating condition: Tool selection must fit ownership and security integration, not just whether the product can execute scripts.

Question 421

A GitHub Actions job needs to deploy to an isolated Azure private endpoint but its hosted runner cannot resolve the address. Which implementation BEST addresses the operational issue?

  1. Design agent network routes and identity permissions for required private endpoints and minimize exposed inbound access.
  2. Authorize cross-project pipeline access narrowly and consume immutable artifact versions associated with approved upstream runs.
  3. Choose isolated self-hosted runners with controlled network access, ephemeral execution where possible, and least-privilege identities.
  4. Create reusable version-controlled YAML templates with explicit parameters, permitted references, and consumer validation.

Explanation

Correct Answer

C:

Choose isolated self-hosted runners with controlled network access, ephemeral execution where possible, and least-privilege identities. Self-hosted runners extend the enterprise trust boundary into job execution and must isolate untrusted code. Compromised pipeline jobs can reach private infrastructure or steal credentials from other workflows.

Incorrect Answers

A:

Design agent network routes and identity permissions for required private endpoints and minimize exposed inbound access.

B:

Authorize cross-project pipeline access narrowly and consume immutable artifact versions associated with approved upstream runs.

D:

Create reusable version-controlled YAML templates with explicit parameters, permitted references, and consumer validation.

Question 422

A GitHub Actions job needs to deploy to an isolated Azure private endpoint but its hosted runner cannot resolve the address. How should the team validate the intended result?

  1. Run authorized and untrusted example jobs to verify network reachability and credential separation.
  2. Commit representative included and excluded changes and correlate each trigger to the expected pipeline run.
  3. Run network, DNS, and token permission checks from an isolated agent against each required service.
  4. Inspect the federated subject and audience and run an authorized and unauthorized test deployment.

Explanation

Correct Answer

A:

Run authorized and untrusted example jobs to verify network reachability and credential separation. Self-hosted runners extend the enterprise trust boundary into job execution and must isolate untrusted code.

Incorrect Answers

B:

Commit representative included and excluded changes and correlate each trigger to the expected pipeline run.

C:

Run network, DNS, and token permission checks from an isolated agent against each required service.

D:

Inspect the federated subject and audience and run an authorized and unauthorized test deployment. That applies to federated workload identity for azure deployment workflows, not self-hosted runner security for private network access.

Question 423

A GitHub Actions job needs to deploy to an isolated Azure private endpoint but its hosted runner cannot resolve the address. Which design distinction is MOST relevant in these conditions?

  1. Self-hosted runners extend the enterprise trust boundary into job execution and must isolate untrusted code.
  2. Pipeline variables cross trust boundaries and must be scoped to the specific workflow and environment.
  3. Parallelism improves delivery only when work is independent and prerequisite order is enforced for risky operations.
  4. Federated credentials use short-lived token exchange and must bind trust to the intended repository, branch, or service connection.

Explanation

Correct Answer

A:

Self-hosted runners extend the enterprise trust boundary into job execution and must isolate untrusted code. Compromised pipeline jobs can reach private infrastructure or steal credentials from other workflows.

Incorrect Answers

B:

Pipeline variables cross trust boundaries and must be scoped to the specific workflow and environment.

C:

Parallelism improves delivery only when work is independent and prerequisite order is enforced for risky operations. That applies to multi-stage pipeline dependencies and parallel test jobs, not controlling principle for self-hosted runner security for private network access.

D:

Federated credentials use short-lived token exchange and must bind trust to the intended repository, branch, or service connection.

Question 424

A GitHub Actions job needs to deploy to an isolated Azure private endpoint but its hosted runner cannot resolve the address. Which ongoing guardrail would BEST prevent this problem from recurring?

  1. Audit environment names and protection rule changes and prevent unrestricted alternate deployment credentials.
  2. Review the build matrix when application support targets or runner images change.
  3. Patch runner images, rotate credentials, and avoid persistent cross-job secrets or unrestricted fork execution.
  4. Rotate webhook credentials and monitor subscriptions and failures after repository or project changes.

Explanation

Correct Answer

C:

Patch runner images, rotate credentials, and avoid persistent cross-job secrets or unrestricted fork execution. Compromised pipeline jobs can reach private infrastructure or steal credentials from other workflows.

Incorrect Answers

A:

Audit environment names and protection rule changes and prevent unrestricted alternate deployment credentials.

B:

Review the build matrix when application support targets or runner images change. This helps sustain a control for hybrid windows and linux pipeline matrix selection; it does not directly stop recurrence of self-hosted runner security for private network access described in this case.

D:

Rotate webhook credentials and monitor subscriptions and failures after repository or project changes. This helps sustain a control for authenticated webhook source event integration; it does not directly stop recurrence of self-hosted runner security for private network access described in this case.

Question 425

A GitHub Actions job needs to deploy to an isolated Azure private endpoint but its hosted runner cannot resolve the address. Which risk is directly created by the described failure?

  1. Unvalidated platform assumptions can break one supported environment while all other pipeline checks are green.
  2. Ad hoc connectivity workarounds can leak credentials or cause recurrent pipeline outages.
  3. Compromised pipeline jobs can reach private infrastructure or steal credentials from other workflows.
  4. Incorrect job ordering can deploy incomplete infrastructure or bypass required test outcomes.

Explanation

Correct Answer

C:

Compromised pipeline jobs can reach private infrastructure or steal credentials from other workflows. This is the directly relevant business or security consequence of self-hosted runner security for private network access. Root cause: Self-hosted runners extend the enterprise trust boundary into job execution and must isolate untrusted code.

Incorrect Answers

A:

Unvalidated platform assumptions can break one supported environment while all other pipeline checks are green. That risk is relevant to hybrid windows and linux pipeline matrix selection, but the specific unresolved condition here concerns self-hosted runner security for private network access and has a different direct consequence.

B:

Ad hoc connectivity workarounds can leak credentials or cause recurrent pipeline outages. That risk is relevant to azure devops self-hosted agent connectivity to private endpoints, but the specific unresolved condition here concerns self-hosted runner security for private network access and has a different direct consequence.

D:

Incorrect job ordering can deploy incomplete infrastructure or bypass required test outcomes. That risk is relevant to multi-stage pipeline dependencies and parallel test jobs, but the specific unresolved condition here concerns self-hosted runner security for private network access and has a different direct consequence.

Question 426

A self-hosted runner accepts untrusted fork PR jobs and stores cloud credentials accessible to later builds. Which solution should be prioritized to resolve the stated failure?

  1. Create reusable version-controlled YAML templates with explicit parameters, permitted references, and consumer validation.
  2. Authorize cross-project pipeline access narrowly and consume immutable artifact versions associated with approved upstream runs.
  3. Design agent network routes and identity permissions for required private endpoints and minimize exposed inbound access.
  4. Choose isolated self-hosted runners with controlled network access, ephemeral execution where possible, and least-privilege identities.

Explanation

Correct Answer

D:

Choose isolated self-hosted runners with controlled network access, ephemeral execution where possible, and least-privilege identities. Self-hosted runners extend the enterprise trust boundary into job execution and must isolate untrusted code. Compromised pipeline jobs can reach private infrastructure or steal credentials from other workflows.

Incorrect Answers

A:

Create reusable version-controlled YAML templates with explicit parameters, permitted references, and consumer validation.

B:

Authorize cross-project pipeline access narrowly and consume immutable artifact versions associated with approved upstream runs.

C:

Design agent network routes and identity permissions for required private endpoints and minimize exposed inbound access.

Question 427

A self-hosted runner accepts untrusted fork PR jobs and stores cloud credentials accessible to later builds. Which evidence would BEST demonstrate that the fix operates as intended?

  1. Inspect the federated subject and audience and run an authorized and unauthorized test deployment.
  2. Commit representative included and excluded changes and correlate each trigger to the expected pipeline run.
  3. Run authorized and untrusted example jobs to verify network reachability and credential separation.
  4. Run network, DNS, and token permission checks from an isolated agent against each required service.

Explanation

Correct Answer

C:

Run authorized and untrusted example jobs to verify network reachability and credential separation. Self-hosted runners extend the enterprise trust boundary into job execution and must isolate untrusted code.

Incorrect Answers

A:

Inspect the federated subject and audience and run an authorized and unauthorized test deployment. That applies to federated workload identity for azure deployment workflows, not self-hosted runner security for private network access.

B:

Commit representative included and excluded changes and correlate each trigger to the expected pipeline run.

D:

Run network, DNS, and token permission checks from an isolated agent against each required service.

Question 428

A self-hosted runner accepts untrusted fork PR jobs and stores cloud credentials accessible to later builds. Which design distinction is MOST relevant in these conditions?

  1. Federated credentials use short-lived token exchange and must bind trust to the intended repository, branch, or service connection.
  2. Tool selection must fit ownership and security integration, not just whether the product can execute scripts.
  3. Self-hosted runners extend the enterprise trust boundary into job execution and must isolate untrusted code.
  4. Pipeline variables cross trust boundaries and must be scoped to the specific workflow and environment.

Explanation

Correct Answer

C:

Self-hosted runners extend the enterprise trust boundary into job execution and must isolate untrusted code. Compromised pipeline jobs can reach private infrastructure or steal credentials from other workflows.

Incorrect Answers

A:

Federated credentials use short-lived token exchange and must bind trust to the intended repository, branch, or service connection.

B:

Tool selection must fit ownership and security integration, not just whether the product can execute scripts. That applies to choosing azure pipelines versus github actions for release workflow, not controlling principle for self-hosted runner security for private network access.

D:

Pipeline variables cross trust boundaries and must be scoped to the specific workflow and environment.

Question 429

A self-hosted runner accepts untrusted fork PR jobs and stores cloud credentials accessible to later builds. Which ongoing guardrail would BEST prevent this problem from recurring?

  1. Patch runner images, rotate credentials, and avoid persistent cross-job secrets or unrestricted fork execution.
  2. Audit environment names and protection rule changes and prevent unrestricted alternate deployment credentials.
  3. Review the build matrix when application support targets or runner images change.
  4. Rotate webhook credentials and monitor subscriptions and failures after repository or project changes.

Explanation

Correct Answer

A:

Patch runner images, rotate credentials, and avoid persistent cross-job secrets or unrestricted fork execution. Compromised pipeline jobs can reach private infrastructure or steal credentials from other workflows.

Incorrect Answers

B:

Audit environment names and protection rule changes and prevent unrestricted alternate deployment credentials.

C:

Review the build matrix when application support targets or runner images change. This helps sustain a control for hybrid windows and linux pipeline matrix selection; it does not directly stop recurrence of self-hosted runner security for private network access described in this case.

D:

Rotate webhook credentials and monitor subscriptions and failures after repository or project changes. This helps sustain a control for authenticated webhook source event integration; it does not directly stop recurrence of self-hosted runner security for private network access described in this case.

Question 430

A self-hosted runner accepts untrusted fork PR jobs and stores cloud credentials accessible to later builds. Which risk is directly created by the described failure?

  1. Unvalidated platform assumptions can break one supported environment while all other pipeline checks are green.
  2. Incorrect job ordering can deploy incomplete infrastructure or bypass required test outcomes.
  3. Ad hoc connectivity workarounds can leak credentials or cause recurrent pipeline outages.
  4. Compromised pipeline jobs can reach private infrastructure or steal credentials from other workflows.

Explanation

Correct Answer

D:

Compromised pipeline jobs can reach private infrastructure or steal credentials from other workflows. This is the directly relevant business or security consequence of self-hosted runner security for private network access. Root cause: Self-hosted runners extend the enterprise trust boundary into job execution and must isolate untrusted code.

Incorrect Answers

A:

Unvalidated platform assumptions can break one supported environment while all other pipeline checks are green. That risk is relevant to hybrid windows and linux pipeline matrix selection, but the specific unresolved condition here concerns self-hosted runner security for private network access and has a different direct consequence.

B:

Incorrect job ordering can deploy incomplete infrastructure or bypass required test outcomes. That risk is relevant to multi-stage pipeline dependencies and parallel test jobs, but the specific unresolved condition here concerns self-hosted runner security for private network access and has a different direct consequence.

C:

Ad hoc connectivity workarounds can leak credentials or cause recurrent pipeline outages. That risk is relevant to azure devops self-hosted agent connectivity to private endpoints, but the specific unresolved condition here concerns self-hosted runner security for private network access and has a different direct consequence.

Designing and Implementing Microsoft DevOps Solutions (AZ-400) Practice Tests

UP

SPECIAL OFFER: GET 10% OFF

This is ONE TIME OFFER

ExamSnap Discount Offer
Enter Your Email Address to Receive Your 10% Off Discount Code

A confirmation link will be sent to this email address to verify your login. *We value your privacy. We will not rent or sell your email address.

Download Free Demo of VCE Exam Simulator

Experience Avanset VCE Exam Simulator for yourself.

Simply submit your e-mail address below to get started with our interactive software demo of your free trial.

Free Demo Limits: In the demo version you will be able to access only first 5 questions from exam.