100% Latest & Updated Microsoft AZ-400 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 420
A GitHub-native repository needs reusable CI, while management chooses a separate tool without considering audit and identity integration. Choose TWO measures that implement and verify an effective Azure DevOps response to this specific situation. (Choose TWO.)
- Bypass review and testing for choosing azure pipelines versus github actions for release workflow whenever the release deadline is urgent, applying the change to production immediately.
- Declare choosing azure pipelines versus github actions for release workflow successful solely from a green pipeline status and skip checking its actual control outcome.
- Dismiss the known risk for choosing azure pipelines versus github actions for release workflow and keep no evidence or accountable owner after deployment.
- Select a supported pipeline engine according to repository location, governance, deployment needs, skills, and maintainability.
- Implement a proof-of-concept that covers source trigger, secured runner access, test artifacts, and deployment approvals.
Explanation
Correct Answers
D:Select a supported pipeline engine according to repository location, governance, deployment needs, skills, and maintainability. Tool selection must fit ownership and security integration, not just whether the product can execute scripts. A mismatched platform can increase brittle integrations or weaken accountability for deployments.
E:Implement a proof-of-concept that covers source trigger, secured runner access, test artifacts, and deployment approvals. Tool selection must fit ownership and security integration, not just whether the product can execute scripts.
Incorrect Answers
A:Bypass review and testing for choosing azure pipelines versus github actions for release workflow whenever the release deadline is urgent, applying the change to production immediately. It conflicts with the stated operating condition: Tool selection must fit ownership and security integration, not just whether the product can execute scripts.
B:Declare choosing azure pipelines versus github actions for release workflow successful solely from a green pipeline status and skip checking its actual control outcome. It conflicts with the stated operating condition: Tool selection must fit ownership and security integration, not just whether the product can execute scripts.
C:Dismiss the known risk for choosing azure pipelines versus github actions for release workflow and keep no evidence or accountable owner after deployment. It conflicts with the stated operating condition: Tool selection must fit ownership and security integration, not just whether the product can execute scripts.
Question 421
A GitHub Actions job needs to deploy to an isolated Azure private endpoint but its hosted runner cannot resolve the address. Which implementation BEST addresses the operational issue?
- Design agent network routes and identity permissions for required private endpoints and minimize exposed inbound access.
- Authorize cross-project pipeline access narrowly and consume immutable artifact versions associated with approved upstream runs.
- Choose isolated self-hosted runners with controlled network access, ephemeral execution where possible, and least-privilege identities.
- Create reusable version-controlled YAML templates with explicit parameters, permitted references, and consumer validation.
Explanation
Correct Answer
C:Choose isolated self-hosted runners with controlled network access, ephemeral execution where possible, and least-privilege identities. Self-hosted runners extend the enterprise trust boundary into job execution and must isolate untrusted code. Compromised pipeline jobs can reach private infrastructure or steal credentials from other workflows.
Incorrect Answers
A:Design agent network routes and identity permissions for required private endpoints and minimize exposed inbound access.
B:Authorize cross-project pipeline access narrowly and consume immutable artifact versions associated with approved upstream runs.
D:Create reusable version-controlled YAML templates with explicit parameters, permitted references, and consumer validation.
Question 422
A GitHub Actions job needs to deploy to an isolated Azure private endpoint but its hosted runner cannot resolve the address. How should the team validate the intended result?
- Run authorized and untrusted example jobs to verify network reachability and credential separation.
- Commit representative included and excluded changes and correlate each trigger to the expected pipeline run.
- Run network, DNS, and token permission checks from an isolated agent against each required service.
- Inspect the federated subject and audience and run an authorized and unauthorized test deployment.
Explanation
Correct Answer
A:Run authorized and untrusted example jobs to verify network reachability and credential separation. Self-hosted runners extend the enterprise trust boundary into job execution and must isolate untrusted code.
Incorrect Answers
B:Commit representative included and excluded changes and correlate each trigger to the expected pipeline run.
C:Run network, DNS, and token permission checks from an isolated agent against each required service.
D:Inspect the federated subject and audience and run an authorized and unauthorized test deployment. That applies to federated workload identity for azure deployment workflows, not self-hosted runner security for private network access.
Question 423
A GitHub Actions job needs to deploy to an isolated Azure private endpoint but its hosted runner cannot resolve the address. Which design distinction is MOST relevant in these conditions?
- Self-hosted runners extend the enterprise trust boundary into job execution and must isolate untrusted code.
- Pipeline variables cross trust boundaries and must be scoped to the specific workflow and environment.
- Parallelism improves delivery only when work is independent and prerequisite order is enforced for risky operations.
- Federated credentials use short-lived token exchange and must bind trust to the intended repository, branch, or service connection.
Explanation
Correct Answer
A:Self-hosted runners extend the enterprise trust boundary into job execution and must isolate untrusted code. Compromised pipeline jobs can reach private infrastructure or steal credentials from other workflows.
Incorrect Answers
B:Pipeline variables cross trust boundaries and must be scoped to the specific workflow and environment.
C:Parallelism improves delivery only when work is independent and prerequisite order is enforced for risky operations. That applies to multi-stage pipeline dependencies and parallel test jobs, not controlling principle for self-hosted runner security for private network access.
D:Federated credentials use short-lived token exchange and must bind trust to the intended repository, branch, or service connection.
Question 424
A GitHub Actions job needs to deploy to an isolated Azure private endpoint but its hosted runner cannot resolve the address. Which ongoing guardrail would BEST prevent this problem from recurring?
- Audit environment names and protection rule changes and prevent unrestricted alternate deployment credentials.
- Review the build matrix when application support targets or runner images change.
- Patch runner images, rotate credentials, and avoid persistent cross-job secrets or unrestricted fork execution.
- Rotate webhook credentials and monitor subscriptions and failures after repository or project changes.
Explanation
Correct Answer
C:Patch runner images, rotate credentials, and avoid persistent cross-job secrets or unrestricted fork execution. Compromised pipeline jobs can reach private infrastructure or steal credentials from other workflows.
Incorrect Answers
A:Audit environment names and protection rule changes and prevent unrestricted alternate deployment credentials.
B:Review the build matrix when application support targets or runner images change. This helps sustain a control for hybrid windows and linux pipeline matrix selection; it does not directly stop recurrence of self-hosted runner security for private network access described in this case.
D:Rotate webhook credentials and monitor subscriptions and failures after repository or project changes. This helps sustain a control for authenticated webhook source event integration; it does not directly stop recurrence of self-hosted runner security for private network access described in this case.
Question 425
A GitHub Actions job needs to deploy to an isolated Azure private endpoint but its hosted runner cannot resolve the address. Which risk is directly created by the described failure?
- Unvalidated platform assumptions can break one supported environment while all other pipeline checks are green.
- Ad hoc connectivity workarounds can leak credentials or cause recurrent pipeline outages.
- Compromised pipeline jobs can reach private infrastructure or steal credentials from other workflows.
- Incorrect job ordering can deploy incomplete infrastructure or bypass required test outcomes.
Explanation
Correct Answer
C:Compromised pipeline jobs can reach private infrastructure or steal credentials from other workflows. This is the directly relevant business or security consequence of self-hosted runner security for private network access. Root cause: Self-hosted runners extend the enterprise trust boundary into job execution and must isolate untrusted code.
Incorrect Answers
A:Unvalidated platform assumptions can break one supported environment while all other pipeline checks are green. That risk is relevant to hybrid windows and linux pipeline matrix selection, but the specific unresolved condition here concerns self-hosted runner security for private network access and has a different direct consequence.
B:Ad hoc connectivity workarounds can leak credentials or cause recurrent pipeline outages. That risk is relevant to azure devops self-hosted agent connectivity to private endpoints, but the specific unresolved condition here concerns self-hosted runner security for private network access and has a different direct consequence.
D:Incorrect job ordering can deploy incomplete infrastructure or bypass required test outcomes. That risk is relevant to multi-stage pipeline dependencies and parallel test jobs, but the specific unresolved condition here concerns self-hosted runner security for private network access and has a different direct consequence.
Question 426
A self-hosted runner accepts untrusted fork PR jobs and stores cloud credentials accessible to later builds. Which solution should be prioritized to resolve the stated failure?
- Create reusable version-controlled YAML templates with explicit parameters, permitted references, and consumer validation.
- Authorize cross-project pipeline access narrowly and consume immutable artifact versions associated with approved upstream runs.
- Design agent network routes and identity permissions for required private endpoints and minimize exposed inbound access.
- Choose isolated self-hosted runners with controlled network access, ephemeral execution where possible, and least-privilege identities.
Explanation
Correct Answer
D:Choose isolated self-hosted runners with controlled network access, ephemeral execution where possible, and least-privilege identities. Self-hosted runners extend the enterprise trust boundary into job execution and must isolate untrusted code. Compromised pipeline jobs can reach private infrastructure or steal credentials from other workflows.
Incorrect Answers
A:Create reusable version-controlled YAML templates with explicit parameters, permitted references, and consumer validation.
B:Authorize cross-project pipeline access narrowly and consume immutable artifact versions associated with approved upstream runs.
C:Design agent network routes and identity permissions for required private endpoints and minimize exposed inbound access.
Question 427
A self-hosted runner accepts untrusted fork PR jobs and stores cloud credentials accessible to later builds. Which evidence would BEST demonstrate that the fix operates as intended?
- Inspect the federated subject and audience and run an authorized and unauthorized test deployment.
- Commit representative included and excluded changes and correlate each trigger to the expected pipeline run.
- Run authorized and untrusted example jobs to verify network reachability and credential separation.
- Run network, DNS, and token permission checks from an isolated agent against each required service.
Explanation
Correct Answer
C:Run authorized and untrusted example jobs to verify network reachability and credential separation. Self-hosted runners extend the enterprise trust boundary into job execution and must isolate untrusted code.
Incorrect Answers
A:Inspect the federated subject and audience and run an authorized and unauthorized test deployment. That applies to federated workload identity for azure deployment workflows, not self-hosted runner security for private network access.
B:Commit representative included and excluded changes and correlate each trigger to the expected pipeline run.
D:Run network, DNS, and token permission checks from an isolated agent against each required service.
Question 428
A self-hosted runner accepts untrusted fork PR jobs and stores cloud credentials accessible to later builds. Which design distinction is MOST relevant in these conditions?
- Federated credentials use short-lived token exchange and must bind trust to the intended repository, branch, or service connection.
- Tool selection must fit ownership and security integration, not just whether the product can execute scripts.
- Self-hosted runners extend the enterprise trust boundary into job execution and must isolate untrusted code.
- Pipeline variables cross trust boundaries and must be scoped to the specific workflow and environment.
Explanation
Correct Answer
C:Self-hosted runners extend the enterprise trust boundary into job execution and must isolate untrusted code. Compromised pipeline jobs can reach private infrastructure or steal credentials from other workflows.
Incorrect Answers
A:Federated credentials use short-lived token exchange and must bind trust to the intended repository, branch, or service connection.
B:Tool selection must fit ownership and security integration, not just whether the product can execute scripts. That applies to choosing azure pipelines versus github actions for release workflow, not controlling principle for self-hosted runner security for private network access.
D:Pipeline variables cross trust boundaries and must be scoped to the specific workflow and environment.
Question 429
A self-hosted runner accepts untrusted fork PR jobs and stores cloud credentials accessible to later builds. Which ongoing guardrail would BEST prevent this problem from recurring?
- Patch runner images, rotate credentials, and avoid persistent cross-job secrets or unrestricted fork execution.
- Audit environment names and protection rule changes and prevent unrestricted alternate deployment credentials.
- Review the build matrix when application support targets or runner images change.
- Rotate webhook credentials and monitor subscriptions and failures after repository or project changes.
Explanation
Correct Answer
A:Patch runner images, rotate credentials, and avoid persistent cross-job secrets or unrestricted fork execution. Compromised pipeline jobs can reach private infrastructure or steal credentials from other workflows.
Incorrect Answers
B:Audit environment names and protection rule changes and prevent unrestricted alternate deployment credentials.
C:Review the build matrix when application support targets or runner images change. This helps sustain a control for hybrid windows and linux pipeline matrix selection; it does not directly stop recurrence of self-hosted runner security for private network access described in this case.
D:Rotate webhook credentials and monitor subscriptions and failures after repository or project changes. This helps sustain a control for authenticated webhook source event integration; it does not directly stop recurrence of self-hosted runner security for private network access described in this case.
Question 430
A self-hosted runner accepts untrusted fork PR jobs and stores cloud credentials accessible to later builds. Which risk is directly created by the described failure?
- Unvalidated platform assumptions can break one supported environment while all other pipeline checks are green.
- Incorrect job ordering can deploy incomplete infrastructure or bypass required test outcomes.
- Ad hoc connectivity workarounds can leak credentials or cause recurrent pipeline outages.
- Compromised pipeline jobs can reach private infrastructure or steal credentials from other workflows.
Explanation
Correct Answer
D:Compromised pipeline jobs can reach private infrastructure or steal credentials from other workflows. This is the directly relevant business or security consequence of self-hosted runner security for private network access. Root cause: Self-hosted runners extend the enterprise trust boundary into job execution and must isolate untrusted code.
Incorrect Answers
A:Unvalidated platform assumptions can break one supported environment while all other pipeline checks are green. That risk is relevant to hybrid windows and linux pipeline matrix selection, but the specific unresolved condition here concerns self-hosted runner security for private network access and has a different direct consequence.
B:Incorrect job ordering can deploy incomplete infrastructure or bypass required test outcomes. That risk is relevant to multi-stage pipeline dependencies and parallel test jobs, but the specific unresolved condition here concerns self-hosted runner security for private network access and has a different direct consequence.
C:Ad hoc connectivity workarounds can leak credentials or cause recurrent pipeline outages. That risk is relevant to azure devops self-hosted agent connectivity to private endpoints, but the specific unresolved condition here concerns self-hosted runner security for private network access and has a different direct consequence.
Designing and Implementing Microsoft DevOps Solutions (AZ-400) Practice Tests