Microsoft Microsoft Certifications AZ-400 Questions & Answers

• Question 271:

  You use GitHub for source control and Azure Boards for project management. GitHub and Azure Boards are integrated.

  You plan to create a pull request in GitHub.

  You need to automatically link the request to an existing Azure Boards work item by using the text of AB#.

  To which two elements can you add the text? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. milestone

  B. label

  C. title

  D. comment

  E. description

  Correct Answer: CE

  Explanation:

  You can create links between GitHub commits and pull requests to work items tracked in Azure Boards. This enables a seamless way for you to use GitHub for software development while using Azure Boards to plan and track your work.

  Use AB# mention to link from GitHub to Azure Boards work items

  From a GitHub commit, pull request or issue, use the following syntax to create a link to your Azure Boards work item. Enter the AB#ID within the text of a commit message. Or, for a pull request or issue, enter the AB#ID within the title or

  description (not a comment).

  Reference:

  https://learn.microsoft.com/en-us/azure/devops/boards/github/link-to-from-github

• Question 272:

  You have a project in Azure DevOps named Project1 that contains a Kanban board named Board1.

  You create a Microsoft Teams channel and add the Azure Boards app to the channel.

  You need to ensure that users can create work items in Board1 from Microsoft Teams.

  Which command should you run?

  A. @azure boards subscriptions

  B. @azure boards create

  C. @azure boards sign in

  D. @azure boards link

  Correct Answer: D

  Explanation:

  Link your Azure Boards project to the Azure Boards app

  To use the app, you must first link your Azure Boards project to your Teams channel.

  1.

  Once the app has been installed in your team, connect and authenticate yourself to Azure Boards. Use Sign in with different email if your Microsoft Teams and Azure Boards are in different tenants.

  2.

  After signing in, use the following command inside a Teams channel to link to the Azure Boards project that you specify with the URL:

  @azure boards link [project url]

  For example:

  @azure boards link https://dev.azure.com/myorg/myproject

  Once the project is linked, you can create work items using @azure boards create command or use message actions.

  Incorrect:

  Not A: Set up subscriptions

  You can create subscriptions to monitor work items at any time using the @azure boards subscriptions command.

  Not B: Create a work item with a command

  With the Azure Boards app, you can create work items from your channel. The app supports custom work items as well.

  To create a work item, use @azure boards create.

  Reference: https://learn.microsoft.com/en-us/azure/devops/boards/integrations/boards-teams

• Question 273:

  You are designing a YAML template for use with Azure Pipelines. The template will include the outputfile parameter. Which two methods can you use to reference the parameter? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

  A. ${{parameters.outputfile}}

  B. $(parameters['outputfile'])

  C. $(parameters.outputfile)

  D. $(parameters[outputfile])

  E. ${{parameters['outputfile']}}

  Correct Answer: AE

  Explanation:

  The parameters section in a YAML defines what parameters are available. Parameters are only available at template parsing time. Parameters are expanded just before the pipeline runs so that values surrounded by ${{ }} are replaced with

  parameter values.

  Reference: https://docs.microsoft.com/en-us/azure/devops/pipelines/process/runtime-parameters

• Question 274:

  You have a GitHub Enterprise account.

  You need to enable push protection for secret scanning of the account repositories.

  What should you do first?

  A. Purchase a GitHub Advanced Security license.

  B. Purchase Premium Plus support.

  C. Enforce multi-factor authentication (MFA).

  D. Create an access policy for secrets.

  Correct Answer: A

  Explanation:

  Enabling secret scanning as a push protection

  For you to use secret scanning as a push protection, the organization or repository needs to have both GitHub Advanced Security and secret scanning enabled.

  Reference: https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/protecting-pushes-with-secret-scanning

• Question 275:

  You have an Azure Automation account that contains a runbook. The runbook is used to configure the application infrastructure of an Azure subscription.

  You have a project in Azure DevOps named Project1. Project1 contains a repository that stores code for the runbook.

  You need to ensure that every committed change to the code will update automatically and publish the runbook to Azure Automation.

  What should you configure?

  A. the Service hooks settings for Project1

  B. the Connections settings for the Automation account

  C. the Source control settings for the Automation account

  D. the Service connections settings for Project1

  Correct Answer: C

  Explanation:

  Source control integration in Azure Automation supports single-direction synchronization from your source control repository. Source control allows you to keep your runbooks in your Automation account up to date with scripts in your GitHub

  or Azure DevOps source control repository. This feature makes it easy to promote code that has been tested in your development environment to your production Automation account.

  Source control integration lets you easily collaborate with your team, track changes, and roll back to earlier versions of your runbooks. For example, source control allows you to synchronize different branches in source control with your

  development, test, and production Automation accounts.

  Note:

  Configure source control in Azure portal

  Use this procedure to configure source control using the Azure portal.

  In your Automation account, select Source Control and click Add.

  Etc.

  Reference:

  https://docs.microsoft.com/en-us/azure/automation/source-control-integration

• Question 276:

  You use Git for source control.

  You enable GitHub code scanning.

  You raise a pull request from a non-default branch. In the code scanning output, you receive the following error message: “Analysis not found.”

  You need to ensure that the code scanning completes successfully for the pull request.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Add the name of the default branch to the on: push specification in the code scanning workflow.

  B. Add the name of the non-default branch to the on:push specification in the code scanning workflow.

  C. Delete the pull request, and then raise the request again from the default branch.

  D. Update the code in the pull request.

  E. Add a new workflow for code scanning.

  Correct Answer: BD

  Reference: https://docs.github.com/en/github-ae@latest/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/setting-up-code-scanning-for-a-repository

• Question 277:

  You have a GitHub repository that contains multiple versions of an Azure Pipelines template.

  You plan to deploy multiple pipelines that will use a template stored in the repository.

  You need to ensure that you use a fixed version of the template.

  What should you use to reference which version of the template repository to use?

  A. the serial

  B. the SHA-based hashes

  C. the runner

  D. the branch

  Correct Answer: D

  Explanation:

  Repositories are resolved only once, when the pipeline starts up. After that, the same resource is used for the duration of the pipeline. Only the template files are used. Once the templates are fully expanded, the final pipeline runs as if it were

  defined entirely in the source repo. This means that you can't use scripts from the template repo in your pipeline.

  If you want to use a particular, fixed version of the template, be sure to pin to a ref. The refs are either branches (refs/heads/) or tags (refs/tags/). If you want to pin a specific commit, first create a tag pointing to that commit,

  then pin to that tag.

  NOTE: If no ref is specified, the pipeline will default to using refs/heads/main.

  Reference: https://github.com/MicrosoftDocs/azure-devops-docs/blob/main/docs/pipelines/process/templates.md

• Question 278:

  You plan to create a GitHub workflow that will use GitHub Actions. The actions will require a 256-KB secret.

  You need to recommend a solution to store and encrypt the secret. The secret value must be accessible only to the workflow. The solution must minimize administrative effort

  What should you recommend?

  A. Store the secret in the organization-level GitHub secrets.

  B. Store the secret in the repository-level GitHub secrets.

  C. Encrypt the secret value and store the value in the repository. Store the decryption key in the repository-level GitHub secrets.

  D. Encrypt the secret value and store the value in the repository. Store the decryption key in the organization-level GitHub secrets.

  Correct Answer: C

  Explanation:

  Storing large secrets

  To use secrets that are larger than 64 KB, you can use a workaround to store encrypted secrets in your repository and save the decryption passphrase as a secret on GitHub. For example, you can use gpg to encrypt a file containing your

  secret locally before checking the encrypted file in to your repository on GitHub.

  Note: Secrets are encrypted environment variables that you create in an organization, repository, or repository environment. The secrets that you create are available to use in GitHub Actions workflows.

  Incorrect:

  Not A: For secrets stored at the organization-level, you can use access policies to control which repositories can use organization secrets. Organization-level secrets let you share secrets between multiple repositories, which reduces the need

  for creating duplicate secrets. Updating an organization secret in one location also ensures that the change takes effect in all repository workflows that use that secret.

  Reference: https://docs.github.com/en/actions/security-guides/encrypted-secrets

• Question 279:

  You have an Azure subscription linked to an Azure Active Directory Premium Plan 1 tenant.

  A security review indicates that too many users have privileged access to resources.

  You need to deploy a privileged access management solution that meets the following requirements:

  Enforces time limits on the use of privileged access Requires approval to activate privileged access Minimizes costs

  What should you do first?

  A. Configure notifications when privileged roles are activated.

  B. Configure alerts for the activation of privileged roles.

  C. Enforce Azure Multi-Factor Authentication (MFA) for role activation.

  D. Upgrade the license of the Azure Active Directory (Azure AD) tenant.

  Correct Answer: D

  Explanation:

  Privileged Identity Management (PIM) is a service in Azure Active Directory (Azure AD) that enables you to manage, control, and monitor access to important resources in your organization. These resources include resources in Azure AD,

  Azure, and other Microsoft Online Services such as Microsoft 365 or Microsoft Intune.

  Using this feature requires an Azure AD Premium P2 license.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure

• Question 280:

  You have an Azure subscription that contains 50 virtual machines.

  You plan to manage the configuration of the virtual machines by using Azure Automation State Configuration.

  You need to create the Desired State Configuration (DSC) configuration files.

  How should you structure the code blocks?

  A. Node > Configuration > Resource

  B. Configuration > Resource > Node

  C. Resource > Configuration > Node

  D. Configuration > Node > Resource

  Correct Answer: D

  Explanation:

  Example, Create a DSC configuration:

  configuration TestConfig

  {

  Node IsWebServer

  {

  WindowsFeature IIS

  {

  Ensure = 'Present'

  Name = 'Web-Server'

  IncludeAllSubFeature = $true

  }

  }

  Node NotWebServer

  {

  WindowsFeature IIS

  {

  Ensure = 'Absent' Name = 'Web-Server' } } }

  This configuration calls one resource in each node block, the WindowsFeature resource. This resource ensures either the presence or absence of the Web-Server feature.

  Reference: https://docs.microsoft.com/en-us/azure/automation/automation-dsc-getting-started