Microsoft Microsoft Certifications AZ-400 Questions & Answers

• Question 101:

  HOTSPOT

  You have a management group that contains four Azure subscriptions. Each subscription contains four resource groups.

  You develop a new web app named App1.

  You plan to deploy an instance of App1 to each resource group.

  You need to create a Bicep template that will be used to deploy App1. The solution must meet the following requirements:

  1.

  The name of each App1 instance must be consistent for each subscription and resource group.

  2.

  The name of each App Service plan used to host App1 must be consistent.

  How should you complete the template? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: (subscription().id)')

  The name of each App Service plan used to host App1 must be consistent.

  Note: An app service always runs in an App Service plan. In addition, Azure Functions also has the option of running in an App Service plan. An App Service plan defines a set of compute resources for a web app to run.

  When you create an App Service plan in a certain region (for example, West Europe), a set of compute resources is created for that plan in that region. Whatever apps you put into this App Service plan run on these compute resources as

  defined by your App Service plan. Each App Service plan defines:

  Operating System (Windows, Linux)

  Region (West US, East US, and so on)

  Number of VM instances

  Size of VM instances (Small, Medium, Large)

  Pricing tier (Free, Shared, Basic, Standard, Premium, PremiumV2, PremiumV3, Isolated, IsolatedV2)

  Box 2: (resourceGroup().id)')

  The name of each App1 instance must be consistent for each subscription and resource group.

  The template used in this quickstart is shown below. It deploys an App Service plan and an App Service app on Linux and a sample Node.js "Hello World" app from the Azure Samples repo.

  param webAppName string = uniqueString(resourceGroup().id) // Generate unique String for web app name

  param sku string = 'F1' // The SKU of App Service Plan

  param linuxFxVersion string = 'node|14-lts' // The runtime stack of web app

  param location string = resourceGroup().location // Location for all resources

  param repositoryUrl string = 'https://github.com/Azure-Samples/nodejs-docs-hello-world'

  param branch string = 'main'

  var appServicePlanName = toLower('AppServicePlan-${webAppName}')

  var webSiteName = toLower('wapp-${webAppName}')

  resource appServicePlan 'Microsoft.Web/serverfarms@2020-06-01' = {

  name: appServicePlanName

  location: location

  properties: {

  reserved: true

  }

  sku: {

  name: sku

  }

  kind: 'linux'

  }

  resource appService 'Microsoft.Web/sites@2020-06-01' = { name: webSiteName location: location properties: {

  serverFarmId: appServicePlan.id

  siteConfig: {

  linuxFxVersion: linuxFxVersion

  }

  } } Reference: https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans https://learn.microsoft.com/en-us/azure/app-service/provision-resource-bicep

• Question 102:

  HOTSPOT

  You have an Azure subscription that contains Azure DevOps build pipelines.

  You need to implement pipeline caching by using the cache task.

  How should you complete the YAML definition? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: key:

  Box 2: path:

  Example:

  Here's an example showing how to cache dependencies installed by Yarn:

  YAML

  Copy

  variables: YARN_CACHE_FOLDER: $(Pipeline.Workspace)/.yarn steps:

  -task: Cache@2

  inputs:

  key: '"yarn" | "$(Agent.OS)" | yarn.lock'

  restoreKeys: |

  "yarn" | "$(Agent.OS)"

  "yarn"

  path: $(YARN_CACHE_FOLDER)

  displayName: Cache Yarn packages

  -script: yarn --frozen-lockfile In this example, the cache key contains three parts: a static string ("yarn"), the OS the job is running on since this cache is unique per operating system, and the hash of the yarn.lock file that uniquely identifies the set of dependencies in the cache.

  Reference: https://learn.microsoft.com/en-us/azure/devops/pipelines/release/caching

• Question 103:

  HOTSPOT

  You have an Azure subscription.

  You need to create a storage account by using a Bicep file.

  How should you complete the file? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: kind Bicep resource definition Property values include:

  *

  kind

  Required.

  Indicates the type of storage account.

  'BlobStorage'

  'BlockBlobStorage'

  'FileStorage'

  'Storage'

  'StorageV2' (required)

  Box 2: properties: StorageAccountPropertiesCreateParametersOrStorageAcc include:

  *

  supportsHttpsTrafficOnly

  Allows https traffic only to storage service if sets to true. The default value is true since API version 2019-04-01.

  Reference: https://learn.microsoft.com/en-us/azure/templates/microsoft.storage/storageaccounts

• Question 104:

  HOTSPOT

  You have a GitHub repository.

  You plan to use the repository to create a container.

  You need to configure GitHub Actions to deploy the container to GitHub Container Registry.

  How should you complete the script? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: echo $GITHUB_TOKEN | docker login ghcr.io -u USERNAME --password-stdin

  Login

  Working with the Container registry

  You can store and manage Docker and OCI images in the Container registry, which uses the package namespace https://ghcr.io.

  Authenticating to the Container registry

  You need an access token to publish, install, and delete private, internal, and public packages.

  Using the CLI for your container type, sign in to the Container registry service at ghcr.io.

  $ echo $CR_PAT | docker login ghcr.io -u USERNAME --password-stdin

  > Login Succeeded

  Box 2: docker build. *etc*

  Build

  Building container images

  This example builds the hello_docker image:

  docker build -t hello_docker .

  Box 3: docker push ghcr.io *etc*

  Push

  Pushing container images

  This example pushes the latest version of IMAGE_NAME.

  docker push ghcr.io/NAMESPACE/IMAGE_NAME:latest

  Replace NAMESPACE with the name of the personal account or organization to which you want the image to be scoped.

  Reference:

  https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry

• Question 105:

  HOTSPOT

  You are using Agile process methodologies in Azure DevOps.

  You need to deploy a dashboard that will provide progress reports for the following work items:

  1.

  How long it took to close a work item after it was created.

  2.

  How long it took to close a work item after the work was started.

  Which type of widget should you use for each work item? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Lead time

  How long it took to close a work item after it was created.

  Lead time measures the total time elapsed from the creation of work items to their completion.

  Box 2: Cycle time

  How long it took to close a work item after the work was started.

  Cycle time measures the time it takes for your team to complete work items once they begin actively working on them.

  Incorrect:

  *

  Burndown chart Use the burndown chart to track completion of a predefined scope of work over a predefined period of time. For example, a sprint burndown tracks the sprint backlog completion by end of the sprint. A release burndown tracks the release backlog completion by the end of the release. You can define a bug burndown chart to track completion of a set of bugs by a certain date.

  *

  Configuring the Burnup widget is exactly like configuring the Burndown widget, except that it plots work completed, rather than work remaining.

  Reference: https://learn.microsoft.com/en-us/azure/devops/report/dashboards/cycle-time-and-lead-time https://learn.microsoft.com/en-us/azure/devops/report/dashboards/configure-burndown-burnup-widgets?view=azure-devops

• Question 106:

  HOTSPOT

  You have an Azure subscription that contains an Azure key vault named Vault1, an Azure pipeline named Pipeline1, and an Azure SQL database named DB1.

  Pipeline1 is used to deploy an app that will authenticate to DB1 by using a password.

  You need to store the password in Vault1. The solution must ensure that the password can be accessed by Pipeline1.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Secret

  You can store credentials for data stores and computes in an Azure Key Vault. Azure Data Factory retrieves the credentials when executing an activity that uses the data store/compute.

  To reference a credential stored in Azure Key Vault, you need to:

  Retrieve data factory managed identity by copying the value of "Managed Identity Object ID" generated along with your factory. If you use ADF authoring UI, the managed identity object ID will be shown on the Azure Key Vault linked service

  creation window; you can also retrieve it from Azure portal.

  Grant the managed identity access to your Azure Key Vault. In your key vault -> Access policies -> Add Access Policy, search this managed identity to grant Get and List permissions in the Secret permissions dropdown. It allows this

  designated factory to access secret in key vault.

  Create a linked service pointing to your Azure Key Vault.

  Create data store linked service, inside which reference the corresponding secret stored in key vault.

  Box 2: Access policies

  Reference:

  https://learn.microsoft.com/en-us/azure/data-factory/store-credentials-in-key-vault

• Question 107:

  HOTSPOT

  You have an Azure virtual machine named web1.

  You need to query the amount of free memory that was available on web1 during the past seven days. The solution must meet the following requirements:

  1.

  Display the data as a time chart.

  2.

  Calculate the average value per hour.

  How should you complete the KQL query? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: TimeGenerated>ago(7d)

  Example:

  // Find all processes that started in the last 3 days. ID 4688: A new process has been created.

  let RunProcesses = SecurityEvent

  | where TimeGenerated > ago(3d)

  | where EventID == “4688”;

  Box 2: bin(TimeGenerated, 1h)

  Example:

  // Find the 5 processes that were run the most

  let Top5Processes =

  RunProcesses

  | summarize count() by Process | top 5 by count_; // Create a time chart of these 5 processes – hour by hour RunProcesses | where Process in (Top5Processes) | summarize count() by bin (TimeGenerated, 1h), Process | render timechart Reference:

  https://marckean.com/2019/03/25/log-analytics-advanced-queries/

• Question 108:

  HOTSPOT

  You have a project in Azure DevOps that includes two users named User1 and User2.

  You plan to use Azure Monitor to manage logs.

  You need to ensure that the users can perform the actions shown in following the table.

  

  The solution must follow the principle of least privilege.

  Which role should you assign to each user? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Built-in monitoring roles

  Built-in roles in Azure Monitor help limit access to resources in a subscription while still enabling staff who monitor infrastructure to obtain and configure the data they need. Azure Monitor provides two out-of-the-box roles: Monitoring Reader

  and Monitoring Contributor.

  Box 1: Monitoring Contributor

  People assigned the Monitoring Contributor role can view all monitoring data in a subscription. They can also create or modify monitoring settings, but they can't modify any other resources.

  This role is a superset of the Monitoring Reader role. It's appropriate for members of an organization's monitoring team or managed service providers who, in addition to the permissions mentioned earlier, need to:

  *-> View monitoring dashboards in the portal and create their own private monitoring dashboards.

  Create and edit diagnostic settings for a resource.

  Set alert rule activity and settings using Azure alerts.

  List shared keys for a Log Analytics workspace.

  Create, delete, and execute saved searches in a Log Analytics workspace.

  Create and delete the workspace storage configuration for Log Analytics.

  Create web tests and components for Application Insights. See Resources, roles, and access control in Application Insights.

  Box 2: Monitoring Reader

  People assigned the Monitoring Reader role can view all monitoring data in a subscription but can't modify any resource or edit any settings related to monitoring resources. This role is appropriate for users in an organization, such as support

  or operations engineers, who need to:

  View monitoring dashboards in the Azure portal.

  View alert rules defined in Azure alerts.

  Query Azure Monitor Metrics by using the Azure Monitor REST API, PowerShell cmdlets, or cross-platform CLI.

  Query the Activity log by using the portal, Azure Monitor REST API, PowerShell cmdlets, or cross-platform CLI.

  View the diagnostic settings for a resource.

  View the log profile for a subscription.

  *-> View autoscale settings.

  *-> View alert activity and settings.

  Search Log Analytics workspace data, including usage data for the workspace.

  Retrieve the table schemas in a Log Analytics workspace.

  Retrieve and execute log queries in a Log Analytics workspace.

  Access Application Insights data.

  Reference: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

• Question 109:

  HOTSPOT

  You have a virtual machine that runs Windows Server 2019 and is managed by using Desired State Configuration (DSC).

  You have the following DSC configuration.

  

  You have the following Local Configuration Manager (LCM) configuration.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 110:

  HOTSPOT

  You have an Azure subscription that contains two resource groups named ContosoRG and ContosoDev, an Azure data factory named Contoso Data Factory, and a release pipeline in Azure Pipelines named Pipeline1.

  You plan to deploy Contoso Data Factory to ContosoRG by using Pipeline1.

  You add the Azure Resource Manager (ARM) template deployment task shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer: