AZ-400 practice questions 151–160

1. Question 151 · 540 in bank

   Select 3

   You are deploying a server application that will run on a Server Core installation of Windows Server 2019. You create an Azure key vault and a secret. You need to use the key vault to secure API secrets for third-party integrations. Which three actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AConfigure RBAC for the key vault.
   • BModify the application to access the key vault.
   • CConfigure a Key Vault access policy.
   • DDeploy an Azure Desired State Configuration (DSC) extension.
   • EDeploy a virtual machine that uses a system-assigned managed identity.

   Show answer

   Answer: ABE

   Explanation

   RBAC is the recommended authorization now, I understand Marang73 comments was almost 3 years ago, but for others going to see this, use RBAC if possible

   Source: Adapted from community discussion — Tyler2023

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 152 · 540 in bank

   HOTSPOT - Your company is creating a suite of three mobile applications. You need to control access to the application builds. The solution must be managed at the organization level. What should you use? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Microsoft Visual Studio App Center distribution Groups Distribution Groups are used to control access to releases. A Distribution Group represents a set of users that can be managed jointly and can have common access to releases. Example of Distribution Groups can be teams of users, like the QA Team or External Beta Testers or can represent stages or rings of releases, such as Staging. Box 2: Shared - Shared distribution groups are private or public distribution groups that are shared across multiple apps in a single organization. Shared distribution groups eliminate the need to replicate distribution groups across multiple apps. Note: With the Deploy with App Center Task in Visual Studio Team Services, you can deploy your apps from Azure DevOps (formerly known as VSTS) to App Center. By deploying to App Center, you will be able to distribute your builds to your users. Reference: https://docs.microsoft.com/en-us/appcenter/distribution/groups

   Source: Adapted from community discussion — binq

   

   Next question

3. Question 153 · 540 in bank

   You have several Azure Active Directory (Azure AD) accounts. You need to ensure that users use multi-factor authentication (MFA) to access Azure apps from untrusted networks. What should you configure in Azure AD?

   • Aaccess reviews
   • Bmanaged identities
   • Centitlement management
   • Dconditional access

   Show answer

   Answer: D

   References

   • Microsoft Learn

   Next question

4. Question 154 · 540 in bank

   You have an Azure DevOps organization named Contoso that contains a project named Project1. You provision an Azure key vault named Keyvault1. You need to reference Keyvault1 secrets in a build pipeline of Project1. What should you do first?

   • AAdd a secure file to Project1.
   • BCreate an XAML build service.
   • CCreate a variable group in Project1.
   • DConfigure the security policy of Contoso.

   Show answer

   Answer: C

   Explanation

   Yeah but D is saying to configure the security policy of CONTOSO - Contoso is the Azure DevOps org. If you were setting the key vault access policy, it wouldn't involve changing anything with the azure devops org. If D specifically mentioned kv access policies, that would be better, but in this case it seems like the best answer is C.

   Source: Adapted from community discussion — yicim24216

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 155 · 540 in bank

   You have the following Azure policy.

   

   You assign the policy to the Tenant root group. What is the effect of the policy?

   • Aprevents all HTTP traffic to existing Azure Storage accounts
   • Bensures that all traffic to new Azure Storage accounts is encrypted
   • Cprevents HTTPS traffic to new Azure Storage accounts when the accounts are accessed over the Internet
   • Densures that all data for new Azure Storage accounts is encrypted at rest

   Show answer

   Answer: B

   Explanation

   Correct answer is good, the policy is not going to apply to the existing resources, unless you run a remediation task to force the policy to all the existing resources

   Source: Adapted from community discussion — rafapaz09

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 156 · 540 in bank

   You have an Azure DevOps organization named Contoso, an Azure DevOps project named Project1, an Azure subscription named Sub1, and an Azure key vault named vault1. You need to ensure that you can reference the values of the secrets stored in vault1 in all the pipelines of Project1. The solution must prevent the values from being stored in the pipelines. What should you do?

   • ACreate a variable group in Project1.
   • BAdd a secure file to Project1.
   • CModify the security settings of the pipelines.
   • DConfigure the security policy of Contoso.

   Show answer

   Answer: A

   Explanation

   Anwer is correct, because in a variable group you can link a key vault. Then you can make the group available to everyone. This way you can ensure that every pipeline can use the variables. Better useability then using tasks in every pipeline.

   Source: Adapted from community discussion — thijsvb

   References

   • Microsoft Learn

   Next question

7. Question 157 · 540 in bank

   DRAG DROP - You use GitHub Enterprise Server as a source code repository. You create an Azure DevOps organization named Contoso. In the Contoso organization, you create a project named Project1. You need to link GitHub commits, pull requests, and issues to the work items of Project1. The solution must use OAuth-based authentication. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Step 1: From Developer settings in GitHub Enterprise Server, register a new OAuth app. If you plan to use OAuth to connect Azure DevOps Services or Azure DevOps Server with your GitHub Enterprise Server, you first need to register the application as an OAuth App Step 2: Organization settings in Azure DevOps, add an OAuth configuration Register your OAuth configuration in Azure DevOps Services. Note: 1. Sign into the web portal for Azure DevOps Services. 2. Add the GitHub Enterprise Oauth configuration to your organization. 3. Open Organization settings>Oauth configurations, and choose Add Oauth configuration. 4. Fill in the form that appears, and then choose Create. Step 3: From Project Settings in Azure DevOps, add a GitHub connection. Connect Azure DevOps Services to GitHub Enterprise Server Choose the Azure DevOps logo to open Projects, and then choose the Azure Boards project you want to configure to connect to your GitHub Enterprise repositories. Choose (1) Project Settings, choose (2) GitHub connections and then (3) Click here to connect to your GitHub Enterprise organization. Reference: https://docs.microsoft.com/en-us/azure/devops/boards/github/connect-to-github

   Source: Adapted from community discussion — Govcomm

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 158 · 540 in bank

   DRAG DROP - You are configuring an Azure DevOps deployment pipeline. The deployed application will authenticate to a web service by using a secret stored in an Azure key vault. You need to use the secret in the deployment pipeline. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Step 1: Create a service principal in Azure Active Directory (Azure AD). You will need a service principal to deploy an app to an Azure resource from Azure Pipelines. Step 2: Configure an access policy in the key vault. You need to secure access to your key vaults by allowing only authorized applications and users. To access the data from the vault, you will need to provide read (Get) permissions to the service principal that you will be using for authentication in the pipeline. Select Access policy and then select + Add Access Policy to setup a new policy. Step 3: Add an Azure Resource Manager service connection to the pipeline You need to authorize the pipeline to deploy to Azure: 1. Select Pipelines | Pipelines, 2. Go to Releases under Pipelines and then select and Edit your pipeline. 3. Under Tasks, notice the release definition for Dev stage has a Azure Key Vault task. This task downloads Secrets from an Azure Key Vault. You will need to point to the subscription and the Azure Key Vault resource. 4. Click Manage, this will redirect to the Service connections page. 5.Click on New Service connection -> Azure Resource Manager -> Service Principal (manual). Fill the information from previously created service principal. Reference: https://azuredevopslabs.com/labs/vstsextend/azurekeyvault/

   Source: Adapted from community discussion — jeet1985

   References

   • Microsoft Learn

   

   Next question

9. Question 159 · 540 in bank

   DRAG DROP - You have a private project in Azure DevOps and two users named User1 and User2. You need to add User1 and User2 to groups to meet the following requirements: ✑ User1 must be able to create a code wiki. ✑ User2 must be able to edit wiki pages. ✑ The solution must use the principle of least privilege. To which group should you add each user? To answer, drag the appropriate groups to the correct users. Each group may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   User1: Project Administrators - You must have the permission Create Repository to publish code as wiki. By default, this permission is set for members of the Project Administrators group. User2: Contributors - Anyone who is a member of the Contributors security group can add or edit wiki pages. Anyone with access to the team project, including stakeholders, can view the wiki. Reference: https://docs.microsoft.com/en-us/azure/devops/project/wiki/wiki-create-repo

   Source: Adapted from community discussion — Yatoom

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 160 · 540 in bank

    Select 2

    You use WhiteSource Bolt to scan a Node.js application. The WhiteSource Bolt scan identifies numerous libraries that have invalid licenses. The libraries are used only during development and are not part of a production deployment. You need to ensure that WhiteSource Bolt only scans production dependencies. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

    • ARun npm install and specify the --production flag.
    • BModify the WhiteSource Bolt policy and set the action for the licenses used by the development tools to Reassign.
    • CModify the devDependencies section of the project's Package.json file.
    • DConfigure WhiteSource Bolt to scan the node_modules directory only.

    Show answer

    Answer: AD

    Explanation

    Correct answers are A & D. 1. When you use --production flag in npm install devDependencies are not installed (so C is wrong). 2. npm install command installs the dependencies to the local node_modules folder. https://docs.npmjs.com/cli/v8/commands/npm-install 3. WhiteSource scan the entire project folder by default. You have to configure it to scan only the node_modules since the production dependencies are there. https://whitesource.atlassian.net/wiki/spaces/WD/pages/33751265/Previous+Version+of+WhiteSource+Bolt+for+Azure+Pipeline#Build-Configuration-for-Azure-DevOps-Server "If there is a policy match on a Reassign action, the request will be automatically reassigned to a designated user or group in the system which is not the default approver." https://whitesource.atlassian.net/wiki/spaces/WD/pages/34013519/Managing+Automated+Policies#Applying-Actions-to-a-Library But is this action required in the question? Of course no. So even B is wrong

    Source: Adapted from community discussion — rdemontis

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-400 practice, question 151. 540 questions available.