100% Latest & Updated Microsoft AZ-400 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 770
A project migrates to YAML but forgets an agent capability restriction and runs deployment scripts in the wrong environment. What is the MOST important consequence if this issue remains unresolved?
- Unreliable delivery automation can normalize known defects and slow emergency releases.
- Insufficient retention destroys necessary evidence while unbounded retention raises cost and exposure.
- A superficially successful migration may bypass approvals or deploy a different artifact than before.
- Inefficient concurrency wastes CI cost or creates overlapping production changes.
Explanation
Correct Answer
C:A superficially successful migration may bypass approvals or deploy a different artifact than before. This is the directly relevant business or security consequence of migrating classic releases to azure pipelines yaml without lost gates. Root cause: Migration changes orchestration representation and can silently remove operational safety controls.
Incorrect Answers
A:Unreliable delivery automation can normalize known defects and slow emergency releases. That risk is relevant to monitoring pipeline flaky tests and recurrent failures, but the specific unresolved condition here concerns migrating classic releases to azure pipelines yaml without lost gates and has a different direct consequence.
B:Insufficient retention destroys necessary evidence while unbounded retention raises cost and exposure. That risk is relevant to retention rules for pipeline runs and audit artifacts, but the specific unresolved condition here concerns migrating classic releases to azure pipelines yaml without lost gates and has a different direct consequence.
D:Inefficient concurrency wastes CI cost or creates overlapping production changes. That risk is relevant to concurrency and parallel jobs cost-performance tradeoffs, but the specific unresolved condition here concerns migrating classic releases to azure pipelines yaml without lost gates and has a different direct consequence.
Question 771
An Azure VM-based deployment worker stores a client secret to access Key Vault despite running on a service that supports managed identity. What action is MOST appropriate given these constraints?
- Choose managed identity for supported Azure-hosted workloads and scoped federated service principals for appropriate external workflows.
- Grant repository-level read or triage roles as appropriate and keep organization administration separate from contributions.
- Apply appropriate stakeholder or Basic access levels and group-based permissions consistent with each user's task.
- Configure narrowly scoped Azure DevOps service connections with explicit pipeline authorization and controlled identity roles.
Explanation
Correct Answer
A:Choose managed identity for supported Azure-hosted workloads and scoped federated service principals for appropriate external workflows. Identity method selection depends on where the workload runs and whether its platform can issue managed identity tokens. An unsuitable identity method can produce failed deployments or long-lived credential leakage.
Incorrect Answers
B:Grant repository-level read or triage roles as appropriate and keep organization administration separate from contributions.
C:Apply appropriate stakeholder or Basic access levels and group-based permissions consistent with each user's task.
D:Configure narrowly scoped Azure DevOps service connections with explicit pipeline authorization and controlled identity roles.
Question 772
An Azure VM-based deployment worker stores a client secret to access Key Vault despite running on a service that supports managed identity. Which test MOST directly confirms the solution?
- Install the App on a test repository and confirm allowed API calls succeed while unrelated repository requests are denied.
- Log in as a test business stakeholder and verify work item access without unintended repository or pipeline privileges.
- Exercise token acquisition in each environment and validate intended roles, resource scope, and secretless authentication.
- Attempt deployment through approved and unapproved pipelines and inspect effective Azure RBAC and service connection authorization.
Explanation
Correct Answer
C:Exercise token acquisition in each environment and validate intended roles, resource scope, and secretless authentication. Identity method selection depends on where the workload runs and whether its platform can issue managed identity tokens.
Incorrect Answers
A:Install the App on a test repository and confirm allowed API calls succeed while unrelated repository requests are denied.
B:Log in as a test business stakeholder and verify work item access without unintended repository or pipeline privileges.
D:Attempt deployment through approved and unapproved pipelines and inspect effective Azure RBAC and service connection authorization.
Question 773
An Azure VM-based deployment worker stores a client secret to access Key Vault despite running on a service that supports managed identity. Which DevOps implementation principle BEST explains the issue?
- Azure DevOps licensing and security permissions are separate controls that should reflect the user's responsibility.
- Identity method selection depends on where the workload runs and whether its platform can issue managed identity tokens.
- Service connections delegate cloud authority, and access should be limited by both pipeline resource authorization and Azure identity role.
- GitHub Apps support app-scoped installation identity instead of inheriting all of a person's broad permissions.
Explanation
Correct Answer
B:Identity method selection depends on where the workload runs and whether its platform can issue managed identity tokens. An unsuitable identity method can produce failed deployments or long-lived credential leakage.
Incorrect Answers
A:Azure DevOps licensing and security permissions are separate controls that should reflect the user's responsibility.
C:Service connections delegate cloud authority, and access should be limited by both pipeline resource authorization and Azure identity role.
D:GitHub Apps support app-scoped installation identity instead of inheriting all of a person's broad permissions.
Question 774
An Azure VM-based deployment worker stores a client secret to access Key Vault despite running on a service that supports managed identity. What preventive practice should be maintained after the fix?
- Audit service connection usage and restrict credential changes when projects and teams are reorganized.
- Recheck installation scopes, app secret rotation, and audit logs when ownership or integration functions change.
- Review role assignments, token audiences, and unused client credentials as pipeline hosting changes.
- Review project group memberships and access levels after team reorganizations or role changes.
Explanation
Correct Answer
C:Review role assignments, token audiences, and unused client credentials as pipeline hosting changes. An unsuitable identity method can produce failed deployments or long-lived credential leakage.
Incorrect Answers
A:Audit service connection usage and restrict credential changes when projects and teams are reorganized.
B:Recheck installation scopes, app secret rotation, and audit logs when ownership or integration functions change.
D:Review project group memberships and access levels after team reorganizations or role changes.
Question 775
An Azure VM-based deployment worker stores a client secret to access Key Vault despite running on a service that supports managed identity. What outcome most clearly explains the business impact?
- Excess collaborator authority can enable source tampering, secret access, or unauthorized governance changes.
- Excessive roles create unnecessary risk while misapplied access levels block legitimate collaboration.
- Personal credential dependence can interrupt automation or overexpose source repositories.
- An unsuitable identity method can produce failed deployments or long-lived credential leakage.
Explanation
Correct Answer
D:An unsuitable identity method can produce failed deployments or long-lived credential leakage. This is the directly relevant business or security consequence of managed identity versus entra service principal for azure deployment. Root cause: Identity method selection depends on where the workload runs and whether its platform can issue managed identity tokens.
Incorrect Answers
A:Excess collaborator authority can enable source tampering, secret access, or unauthorized governance changes. That risk is relevant to github organization roles and external collaborator access, but the specific unresolved condition here concerns managed identity versus entra service principal for azure deployment and has a different direct consequence.
B:Excessive roles create unnecessary risk while misapplied access levels block legitimate collaboration. That risk is relevant to azure devops stakeholder access and team security groups, but the specific unresolved condition here concerns managed identity versus entra service principal for azure deployment and has a different direct consequence.
C:Personal credential dependence can interrupt automation or overexpose source repositories. That risk is relevant to github apps versus personal access tokens for automation, but the specific unresolved condition here concerns managed identity versus entra service principal for azure deployment and has a different direct consequence.
Question 776
An external GitHub Actions runner needs Azure access but assumes it can use a managed identity tied to an Azure host it does not run on. What change should the DevOps engineer implement FIRST for the stated Azure DevOps requirement?
- Configure narrowly scoped Azure DevOps service connections with explicit pipeline authorization and controlled identity roles.
- Grant repository-level read or triage roles as appropriate and keep organization administration separate from contributions.
- Choose managed identity for supported Azure-hosted workloads and scoped federated service principals for appropriate external workflows.
- Apply appropriate stakeholder or Basic access levels and group-based permissions consistent with each user's task.
Explanation
Correct Answer
C:Choose managed identity for supported Azure-hosted workloads and scoped federated service principals for appropriate external workflows. Identity method selection depends on where the workload runs and whether its platform can issue managed identity tokens. An unsuitable identity method can produce failed deployments or long-lived credential leakage.
Incorrect Answers
A:Configure narrowly scoped Azure DevOps service connections with explicit pipeline authorization and controlled identity roles.
B:Grant repository-level read or triage roles as appropriate and keep organization administration separate from contributions.
D:Apply appropriate stakeholder or Basic access levels and group-based permissions consistent with each user's task.
Question 777
An external GitHub Actions runner needs Azure access but assumes it can use a managed identity tied to an Azure host it does not run on. What check would most directly verify this Microsoft DevOps control?
- Install the App on a test repository and confirm allowed API calls succeed while unrelated repository requests are denied.
- Attempt deployment through approved and unapproved pipelines and inspect effective Azure RBAC and service connection authorization.
- Log in as a test business stakeholder and verify work item access without unintended repository or pipeline privileges.
- Exercise token acquisition in each environment and validate intended roles, resource scope, and secretless authentication.
Explanation
Correct Answer
D:Exercise token acquisition in each environment and validate intended roles, resource scope, and secretless authentication. Identity method selection depends on where the workload runs and whether its platform can issue managed identity tokens.
Incorrect Answers
A:Install the App on a test repository and confirm allowed API calls succeed while unrelated repository requests are denied.
B:Attempt deployment through approved and unapproved pipelines and inspect effective Azure RBAC and service connection authorization.
C:Log in as a test business stakeholder and verify work item access without unintended repository or pipeline privileges.
Question 778
An external GitHub Actions runner needs Azure access but assumes it can use a managed identity tied to an Azure host it does not run on. Which DevOps implementation principle BEST explains the issue?
- Service connections delegate cloud authority, and access should be limited by both pipeline resource authorization and Azure identity role.
- Azure DevOps licensing and security permissions are separate controls that should reflect the user's responsibility.
- GitHub Apps support app-scoped installation identity instead of inheriting all of a person's broad permissions.
- Identity method selection depends on where the workload runs and whether its platform can issue managed identity tokens.
Explanation
Correct Answer
D:Identity method selection depends on where the workload runs and whether its platform can issue managed identity tokens. An unsuitable identity method can produce failed deployments or long-lived credential leakage.
Incorrect Answers
A:Service connections delegate cloud authority, and access should be limited by both pipeline resource authorization and Azure identity role.
B:Azure DevOps licensing and security permissions are separate controls that should reflect the user's responsibility.
C:GitHub Apps support app-scoped installation identity instead of inheriting all of a person's broad permissions.
Question 779
An external GitHub Actions runner needs Azure access but assumes it can use a managed identity tied to an Azure host it does not run on. What preventive practice should be maintained after the fix?
- Audit service connection usage and restrict credential changes when projects and teams are reorganized.
- Review role assignments, token audiences, and unused client credentials as pipeline hosting changes.
- Recheck installation scopes, app secret rotation, and audit logs when ownership or integration functions change.
- Review project group memberships and access levels after team reorganizations or role changes.
Explanation
Correct Answer
B:Review role assignments, token audiences, and unused client credentials as pipeline hosting changes. An unsuitable identity method can produce failed deployments or long-lived credential leakage.
Incorrect Answers
A:Audit service connection usage and restrict credential changes when projects and teams are reorganized.
C:Recheck installation scopes, app secret rotation, and audit logs when ownership or integration functions change.
D:Review project group memberships and access levels after team reorganizations or role changes.
Question 780
An external GitHub Actions runner needs Azure access but assumes it can use a managed identity tied to an Azure host it does not run on. Choose TWO measures that implement and verify an effective Azure DevOps response to this specific situation. (Choose TWO.)
- Bypass review and testing for managed identity versus entra service principal for azure deployment whenever the release deadline is urgent, applying the change to production immediately.
- Declare managed identity versus entra service principal for azure deployment successful solely from a green pipeline status and skip checking its actual control outcome.
- Exercise token acquisition in each environment and validate intended roles, resource scope, and secretless authentication.
- Choose managed identity for supported Azure-hosted workloads and scoped federated service principals for appropriate external workflows.
- Dismiss the known risk for managed identity versus entra service principal for azure deployment and keep no evidence or accountable owner after deployment.
Explanation
Correct Answers
C:Exercise token acquisition in each environment and validate intended roles, resource scope, and secretless authentication. Identity method selection depends on where the workload runs and whether its platform can issue managed identity tokens.
D:Choose managed identity for supported Azure-hosted workloads and scoped federated service principals for appropriate external workflows. Identity method selection depends on where the workload runs and whether its platform can issue managed identity tokens. An unsuitable identity method can produce failed deployments or long-lived credential leakage.
Incorrect Answers
A:Bypass review and testing for managed identity versus entra service principal for azure deployment whenever the release deadline is urgent, applying the change to production immediately. It conflicts with the stated operating condition: Identity method selection depends on where the workload runs and whether its platform can issue managed identity tokens.
B:Declare managed identity versus entra service principal for azure deployment successful solely from a green pipeline status and skip checking its actual control outcome. It conflicts with the stated operating condition: Identity method selection depends on where the workload runs and whether its platform can issue managed identity tokens.
E:Dismiss the known risk for managed identity versus entra service principal for azure deployment and keep no evidence or accountable owner after deployment. It conflicts with the stated operating condition: Identity method selection depends on where the workload runs and whether its platform can issue managed identity tokens.
Designing and Implementing Microsoft DevOps Solutions (AZ-400) Practice Tests
