100% Latest & Updated Microsoft AZ-400 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 780
An external GitHub Actions runner needs Azure access but assumes it can use a managed identity tied to an Azure host it does not run on. Choose TWO measures that implement and verify an effective Azure DevOps response to this specific situation. (Choose TWO.)
- Bypass review and testing for managed identity versus entra service principal for azure deployment whenever the release deadline is urgent, applying the change to production immediately.
- Declare managed identity versus entra service principal for azure deployment successful solely from a green pipeline status and skip checking its actual control outcome.
- Exercise token acquisition in each environment and validate intended roles, resource scope, and secretless authentication.
- Choose managed identity for supported Azure-hosted workloads and scoped federated service principals for appropriate external workflows.
- Dismiss the known risk for managed identity versus entra service principal for azure deployment and keep no evidence or accountable owner after deployment.
Explanation
Correct Answers
C:Exercise token acquisition in each environment and validate intended roles, resource scope, and secretless authentication. Identity method selection depends on where the workload runs and whether its platform can issue managed identity tokens.
D:Choose managed identity for supported Azure-hosted workloads and scoped federated service principals for appropriate external workflows. Identity method selection depends on where the workload runs and whether its platform can issue managed identity tokens. An unsuitable identity method can produce failed deployments or long-lived credential leakage.
Incorrect Answers
A:Bypass review and testing for managed identity versus entra service principal for azure deployment whenever the release deadline is urgent, applying the change to production immediately. It conflicts with the stated operating condition: Identity method selection depends on where the workload runs and whether its platform can issue managed identity tokens.
B:Declare managed identity versus entra service principal for azure deployment successful solely from a green pipeline status and skip checking its actual control outcome. It conflicts with the stated operating condition: Identity method selection depends on where the workload runs and whether its platform can issue managed identity tokens.
E:Dismiss the known risk for managed identity versus entra service principal for azure deployment and keep no evidence or accountable owner after deployment. It conflicts with the stated operating condition: Identity method selection depends on where the workload runs and whether its platform can issue managed identity tokens.
Question 781
An organization-wide bot uses a developer's long-lived personal access token and stops working when that developer leaves. Which implementation BEST addresses the operational issue?
- Use a GitHub App with narrowly scoped permissions and installation boundaries when suitable, avoiding unnecessary standing user tokens.
- Configure narrowly scoped Azure DevOps service connections with explicit pipeline authorization and controlled identity roles.
- Choose managed identity for supported Azure-hosted workloads and scoped federated service principals for appropriate external workflows.
- Apply appropriate stakeholder or Basic access levels and group-based permissions consistent with each user's task.
Explanation
Correct Answer
A:Use a GitHub App with narrowly scoped permissions and installation boundaries when suitable, avoiding unnecessary standing user tokens. GitHub Apps support app-scoped installation identity instead of inheriting all of a person's broad permissions. Personal credential dependence can interrupt automation or overexpose source repositories.
Incorrect Answers
B:Configure narrowly scoped Azure DevOps service connections with explicit pipeline authorization and controlled identity roles. That applies to azure devops service connection authorization and scope, not github apps versus personal access tokens for automation.
C:Choose managed identity for supported Azure-hosted workloads and scoped federated service principals for appropriate external workflows.
D:Apply appropriate stakeholder or Basic access levels and group-based permissions consistent with each user's task. That applies to azure devops stakeholder access and team security groups, not github apps versus personal access tokens for automation.
Question 782
An organization-wide bot uses a developer's long-lived personal access token and stops working when that developer leaves. How should the team validate the intended result?
- Log in as a test business stakeholder and verify work item access without unintended repository or pipeline privileges.
- Exercise token acquisition in each environment and validate intended roles, resource scope, and secretless authentication.
- Inspect effective permissions under a sample collaborator identity and test denial of organization settings access.
- Install the App on a test repository and confirm allowed API calls succeed while unrelated repository requests are denied.
Explanation
Correct Answer
D:Install the App on a test repository and confirm allowed API calls succeed while unrelated repository requests are denied. GitHub Apps support app-scoped installation identity instead of inheriting all of a person's broad permissions.
Incorrect Answers
A:Log in as a test business stakeholder and verify work item access without unintended repository or pipeline privileges. That applies to azure devops stakeholder access and team security groups, not github apps versus personal access tokens for automation.
B:Exercise token acquisition in each environment and validate intended roles, resource scope, and secretless authentication.
C:Inspect effective permissions under a sample collaborator identity and test denial of organization settings access.
Question 783
An organization-wide bot uses a developer's long-lived personal access token and stops working when that developer leaves. Which design distinction is MOST relevant in these conditions?
- The least-privilege GitHub permission model separates repository contributions from broad organizational governance.
- GitHub Apps support app-scoped installation identity instead of inheriting all of a person's broad permissions.
- Azure DevOps licensing and security permissions are separate controls that should reflect the user's responsibility.
- Identity method selection depends on where the workload runs and whether its platform can issue managed identity tokens.
Explanation
Correct Answer
B:GitHub Apps support app-scoped installation identity instead of inheriting all of a person's broad permissions. Personal credential dependence can interrupt automation or overexpose source repositories.
Incorrect Answers
A:The least-privilege GitHub permission model separates repository contributions from broad organizational governance.
C:Azure DevOps licensing and security permissions are separate controls that should reflect the user's responsibility. That applies to azure devops stakeholder access and team security groups, not controlling principle for github apps versus personal access tokens for automation.
D:Identity method selection depends on where the workload runs and whether its platform can issue managed identity tokens.
Question 784
An organization-wide bot uses a developer's long-lived personal access token and stops working when that developer leaves. Which ongoing guardrail would BEST prevent this problem from recurring?
- Periodically recertify external collaborators and restrict who can add owners or change SSO requirements.
- Recheck installation scopes, app secret rotation, and audit logs when ownership or integration functions change.
- Audit service connection usage and restrict credential changes when projects and teams are reorganized.
- Review project group memberships and access levels after team reorganizations or role changes.
Explanation
Correct Answer
B:Recheck installation scopes, app secret rotation, and audit logs when ownership or integration functions change. Personal credential dependence can interrupt automation or overexpose source repositories.
Incorrect Answers
A:Periodically recertify external collaborators and restrict who can add owners or change SSO requirements.
C:Audit service connection usage and restrict credential changes when projects and teams are reorganized. This helps sustain a control for azure devops service connection authorization and scope; it does not directly stop recurrence of github apps versus personal access tokens for automation described in this case.
D:Review project group memberships and access levels after team reorganizations or role changes. This helps sustain a control for azure devops stakeholder access and team security groups; it does not directly stop recurrence of github apps versus personal access tokens for automation described in this case.
Question 785
An organization-wide bot uses a developer's long-lived personal access token and stops working when that developer leaves. Which risk is directly created by the described failure?
- Personal credential dependence can interrupt automation or overexpose source repositories.
- An unsuitable identity method can produce failed deployments or long-lived credential leakage.
- Excessive roles create unnecessary risk while misapplied access levels block legitimate collaboration.
- Excess collaborator authority can enable source tampering, secret access, or unauthorized governance changes.
Explanation
Correct Answer
A:Personal credential dependence can interrupt automation or overexpose source repositories. This is the directly relevant business or security consequence of github apps versus personal access tokens for automation. Root cause: GitHub Apps support app-scoped installation identity instead of inheriting all of a person's broad permissions.
Incorrect Answers
B:An unsuitable identity method can produce failed deployments or long-lived credential leakage. That risk is relevant to managed identity versus entra service principal for azure deployment, but the specific unresolved condition here concerns github apps versus personal access tokens for automation and has a different direct consequence.
C:Excessive roles create unnecessary risk while misapplied access levels block legitimate collaboration. That risk is relevant to azure devops stakeholder access and team security groups, but the specific unresolved condition here concerns github apps versus personal access tokens for automation and has a different direct consequence.
D:Excess collaborator authority can enable source tampering, secret access, or unauthorized governance changes. That risk is relevant to github organization roles and external collaborator access, but the specific unresolved condition here concerns github apps versus personal access tokens for automation and has a different direct consequence.
Question 786
A third-party release integration asks for full organization repository access even though it needs only one repository's issues. Which solution should be prioritized to resolve the stated failure?
- Choose managed identity for supported Azure-hosted workloads and scoped federated service principals for appropriate external workflows.
- Configure narrowly scoped Azure DevOps service connections with explicit pipeline authorization and controlled identity roles.
- Use a GitHub App with narrowly scoped permissions and installation boundaries when suitable, avoiding unnecessary standing user tokens.
- Apply appropriate stakeholder or Basic access levels and group-based permissions consistent with each user's task.
Explanation
Correct Answer
C:Use a GitHub App with narrowly scoped permissions and installation boundaries when suitable, avoiding unnecessary standing user tokens. GitHub Apps support app-scoped installation identity instead of inheriting all of a person's broad permissions. Personal credential dependence can interrupt automation or overexpose source repositories.
Incorrect Answers
A:Choose managed identity for supported Azure-hosted workloads and scoped federated service principals for appropriate external workflows.
B:Configure narrowly scoped Azure DevOps service connections with explicit pipeline authorization and controlled identity roles. That applies to azure devops service connection authorization and scope, not github apps versus personal access tokens for automation.
D:Apply appropriate stakeholder or Basic access levels and group-based permissions consistent with each user's task. That applies to azure devops stakeholder access and team security groups, not github apps versus personal access tokens for automation.
Question 787
A third-party release integration asks for full organization repository access even though it needs only one repository's issues. Which evidence would BEST demonstrate that the fix operates as intended?
- Install the App on a test repository and confirm allowed API calls succeed while unrelated repository requests are denied.
- Inspect effective permissions under a sample collaborator identity and test denial of organization settings access.
- Exercise token acquisition in each environment and validate intended roles, resource scope, and secretless authentication.
- Log in as a test business stakeholder and verify work item access without unintended repository or pipeline privileges.
Explanation
Correct Answer
A:Install the App on a test repository and confirm allowed API calls succeed while unrelated repository requests are denied. GitHub Apps support app-scoped installation identity instead of inheriting all of a person's broad permissions.
Incorrect Answers
B:Inspect effective permissions under a sample collaborator identity and test denial of organization settings access.
C:Exercise token acquisition in each environment and validate intended roles, resource scope, and secretless authentication.
D:Log in as a test business stakeholder and verify work item access without unintended repository or pipeline privileges. That applies to azure devops stakeholder access and team security groups, not github apps versus personal access tokens for automation.
Question 788
A third-party release integration asks for full organization repository access even though it needs only one repository's issues. Which design distinction is MOST relevant in these conditions?
- The least-privilege GitHub permission model separates repository contributions from broad organizational governance.
- GitHub Apps support app-scoped installation identity instead of inheriting all of a person's broad permissions.
- Identity method selection depends on where the workload runs and whether its platform can issue managed identity tokens.
- Azure DevOps licensing and security permissions are separate controls that should reflect the user's responsibility.
Explanation
Correct Answer
B:GitHub Apps support app-scoped installation identity instead of inheriting all of a person's broad permissions. Personal credential dependence can interrupt automation or overexpose source repositories.
Incorrect Answers
A:The least-privilege GitHub permission model separates repository contributions from broad organizational governance.
C:Identity method selection depends on where the workload runs and whether its platform can issue managed identity tokens.
D:Azure DevOps licensing and security permissions are separate controls that should reflect the user's responsibility. That applies to azure devops stakeholder access and team security groups, not controlling principle for github apps versus personal access tokens for automation.
Question 789
A third-party release integration asks for full organization repository access even though it needs only one repository's issues. Which ongoing guardrail would BEST prevent this problem from recurring?
- Recheck installation scopes, app secret rotation, and audit logs when ownership or integration functions change.
- Audit service connection usage and restrict credential changes when projects and teams are reorganized.
- Periodically recertify external collaborators and restrict who can add owners or change SSO requirements.
- Review project group memberships and access levels after team reorganizations or role changes.
Explanation
Correct Answer
A:Recheck installation scopes, app secret rotation, and audit logs when ownership or integration functions change. Personal credential dependence can interrupt automation or overexpose source repositories.
Incorrect Answers
B:Audit service connection usage and restrict credential changes when projects and teams are reorganized. This helps sustain a control for azure devops service connection authorization and scope; it does not directly stop recurrence of github apps versus personal access tokens for automation described in this case.
C:Periodically recertify external collaborators and restrict who can add owners or change SSO requirements.
D:Review project group memberships and access levels after team reorganizations or role changes. This helps sustain a control for azure devops stakeholder access and team security groups; it does not directly stop recurrence of github apps versus personal access tokens for automation described in this case.
Question 790
A third-party release integration asks for full organization repository access even though it needs only one repository's issues. Which risk is directly created by the described failure?
- An unsuitable identity method can produce failed deployments or long-lived credential leakage.
- Excess collaborator authority can enable source tampering, secret access, or unauthorized governance changes.
- Personal credential dependence can interrupt automation or overexpose source repositories.
- Excessive roles create unnecessary risk while misapplied access levels block legitimate collaboration.
Explanation
Correct Answer
C:Personal credential dependence can interrupt automation or overexpose source repositories. This is the directly relevant business or security consequence of github apps versus personal access tokens for automation. Root cause: GitHub Apps support app-scoped installation identity instead of inheriting all of a person's broad permissions.
Incorrect Answers
A:An unsuitable identity method can produce failed deployments or long-lived credential leakage. That risk is relevant to managed identity versus entra service principal for azure deployment, but the specific unresolved condition here concerns github apps versus personal access tokens for automation and has a different direct consequence.
B:Excess collaborator authority can enable source tampering, secret access, or unauthorized governance changes. That risk is relevant to github organization roles and external collaborator access, but the specific unresolved condition here concerns github apps versus personal access tokens for automation and has a different direct consequence.
D:Excessive roles create unnecessary risk while misapplied access levels block legitimate collaboration. That risk is relevant to azure devops stakeholder access and team security groups, but the specific unresolved condition here concerns github apps versus personal access tokens for automation and has a different direct consequence.
Designing and Implementing Microsoft DevOps Solutions (AZ-400) Practice Tests
