AZ-400 practice questions 181–190

1. Question 181 · 540 in bank

   SIMULATION - You need to prepare a network security group (NSG) named az400-123456789-nsg1 to host an Azure DevOps pipeline agent. The solution must allow only the required outbound port for Azure DevOps and deny all other inbound and outbound access to the Internet. To complete this task, sign in to the Microsoft Azure portal.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. Open Microsoft Azure Portal and Log into your Azure account. 2. Select network security group (NSG) named az400-123456789-nsg1 3. Select Settings, Outbound security rules, and click Add 4. Click Advanced 5. Change the following settings: ✑ Destination Port range: 8080 ✑ Protocol. TCP ✑ Action: Allow Note: By default, Azure DevOps Server uses TCP Port 8080. Reference: https://robertsmit.wordpress.com/2017/09/11/step-by-step-azure-network-security-groups-nsg-security-center-azure-nsg-network/ https://docs.microsoft.com/en-us/azure/devops/server/architecture/required-ports?view=azure-devops

   Source: Adapted from community discussion — Root_Access

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 182 · 540 in bank

   DRAG DROP - You have a project in Azure DevOps named Project1 that contains two Azure DevOps pipelines named Pipeline1 and Pipeline2. You need to ensure that Pipeline1 can deploy code successfully to an Azure web app named webapp1. The solution must ensure that Pipeline2 does not have permission to webapp1. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/devops/pipelines/library/connect-to-azure?view=azure-devops

   Source: Adapted from community discussion — AhmedAbouhamed

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 183 · 540 in bank

   DRAG DROP - You need to increase the security of your team's development process. Which type of security tool should you recommend for each stage of the development process? To answer, drag the appropriate security tools to the correct stages. Each security tool may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Threat modeling - Threat modeling's motto should be, ג€The earlier the better, but not too late and never ignore.ג€ Box 2: Static code analysis - Validation in the CI/CD begins before the developer commits his or her code. Static code analysis tools in the IDE provide the first line of defense to help ensure that security vulnerabilities are not introduced into the CI/CD process. Box 3: Penetration testing - Once your code quality is verified, and the application is deployed to a lower environment like development or QA, the process should verify that there are not any security vulnerabilities in the running application. This can be accomplished by executing automated penetration test against the running application to scan it for vulnerabilities. Reference: https://docs.microsoft.com/en-us/azure/devops/articles/security-validation-cicd-pipeline?view=vsts

   Source: Adapted from community discussion — PlumpyTumbler

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 184 · 540 in bank

   You have an Azure DevOps organization named Contoso. You need to recommend an authentication mechanism that meets the following requirements: ✑ Supports authentication from Git ✑ Minimizes the need to provide credentials during authentication What should you recommend?

   • Apersonal access tokens (PATs) in Azure DevOps
   • BAlternate credentials in Azure DevOps
   • Cuser accounts in Azure Active Directory (Azure AD)
   • Dmanaged identities in Azure Active Directory (Azure AD)

   Show answer

   Answer: A

   Explanation

   Answer C provides the best chance the user will not have to provide authentication, because the windows login user can be used to perform SSO on git with azure devops. Nowhere in the question does it state that it's an automated process that should access git. I think the answer should be C.

   Source: Adapted from community discussion — mobrockers

   References

   • Microsoft Learn

   Next question

5. Question 185 · 540 in bank

   You plan to use a NuGet package in a project in Azure DevOps. The NuGet package is in a feed that requires authentication. You need to ensure that the project can restore the NuGet package automatically. What should the project use to automate the authentication?

   • Aan Azure Automation account
   • Ban Azure Artifacts Credential Provider
   • Can Azure Active Directory (Azure AD) account that has multi-factor authentication (MFA) enabled
   • Dan Azure Active Directory (Azure AD) service principal

   Show answer

   Answer: B

   Explanation

   B is the answer. https://github.com/microsoft/artifacts-credprovider#azure-artifacts-credential-provider The Azure Artifacts Credential Provider automates the acquisition of credentials needed to restore NuGet packages as part of your .NET development workflow. It integrates with MSBuild, dotnet, and NuGet(.exe) and works on Windows, Mac, and Linux. Any time you want to use packages from an Azure Artifacts feed, the Credential Provider will automatically acquire and securely store a token on behalf of the NuGet client you're using.

   Source: Adapted from community discussion — zellck

   Next question

6. Question 186 · 540 in bank

   You use Azure Pipelines to manage project builds and deployments. You plan to use Azure Pipelines for Microsoft Teams to notify the legal team when a new build is ready for release. You need to configure the Organization Settings in Azure DevOps to support Azure Pipelines for Microsoft Teams. What should you turn on?

   • AThird-party application access via OAuth
   • BAzure Active Directory Conditional Access Policy Validation
   • CAlternate authentication credentials
   • DSSH authentication

   Show answer

   Answer: A

   Explanation

   A. Third party application access via OAuth' must be enabled to receive notifications for the organization in Azure DevOps (Organization Settings -> Security -> Policies) https://docs.microsoft.com/en-us/azure/devops/pipelines/integrations/microsoft-teams?view=azure-devops

   Source: Adapted from community discussion — Hooters

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 187 · 540 in bank

   You have an existing project in Azure DevOps. You plan to integrate GitHub as the repository for the project. You need to ensure that Azure Pipelines runs under the Azure Pipelines identity. Which authentication mechanism should you use?

   • Apersonal access token (PAT)
   • BGitHub App
   • CAzure Active Directory (Azure AD)
   • DOAuth

   Show answer

   Answer: B

   Explanation

   B correct answer. Initially I' m confused little but to ensure that Pipelines run using The Azure Pipelines identity clearly show the given answer is right https://docs.microsoft.com/en-us/azure/devops/pipelines/repos/github?view=azure-devops&tabs=yaml

   Source: Adapted from community discussion — eray95

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 188 · 540 in bank

   DRAG DROP - You have an Azure subscription that uses Azure Monitor and contains a Log Analytics workspace. You have an encryption key. You need to configure Azure Monitor to use the key to encrypt log data. Which five actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Customer-Managed key provisioning steps: Step 1: Create an Azure Key vault and store the key. Creating Azure Key Vault and storing key. Create or use an existing Azure Key Vault in the region that the cluster is planed, and generate or import a key to be used for logs encryption. Step 2: Create an Azure Monitor Logs dedicate cluster that has a system-assigned managed identity Clusters uses managed identity for data encryption with your Key Vault. Configure identity type property to SystemAssigned when creating your cluster to allow access to your Key Vault for "wrap" and "unwrap" operations. Step 3: Grant the system-assigned managed Identity Key permissions for the key vault. Grant Key Vault permissions. Create Access Policy in Key Vault to grants permissions to your cluster. These permissions are used by the underlay cluster storage. Open your Key Vault in Azure portal and click Access Policies then + Add Access Policy to create a policy with these settings: Key permissionsג€"select Get, Wrap Key and Unwrap Key. Etc. 1. Creating cluster 2. Granting permissions to your Key Vault 3. Updating cluster with key identifier details 4. Linking workspaces Step 4: Configure the key vault properties for the cluster. Update cluster with key identifier details. Step 5: Link the Log Analytics workspace to the cluster Link workspace to cluster. This step should be performed only after the cluster provisioning. If you link workspaces and ingest data prior to the provisioning, ingested data will be dropped and won't be recoverable. Reference: https://docs.microsoft.com/en-us/azure/azure-monitor/logs/customer-managed-keys

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 189 · 540 in bank

   DRAG DROP - You have an Azure Key Vault that contains an encryption key named key1. You plan to create a Log Analytics workspace that will store logging data. You need to encrypt the workspace by using key1. Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Customer-Managed key provisioning steps (assuming there already is an Azure Key Vault): Step 1: Enable soft delete for the key vault. The Azure Key Vault must be configured as recoverable, to protect your key and the access to your data in Azure Monitor. You can verify this configuration under properties in your Key Vault, both Soft delete and Purge protection should be enabled. Step 2: Create a Log Analytics cluster. Clusters uses managed identity for data encryption with your Key Vault. Configure identity type property to SystemAssigned when creating your cluster to allow access to your Key Vault for "wrap" and "unwrap" operations. Step 3: Grant permissions to the key vault. Grant Key Vault permissions. Create Access Policy in Key Vault to grants permissions to your cluster. These permissions are used by the underlay cluster storage. Open your Key Vault in Azure portal and click Access Policies then + Add Access Policy to create a policy with these settings: Key permissionsג€"select Get, Wrap Key and Unwrap Key. Etc. 1. Creating cluster 2. Granting permissions to your Key Vault 3. Updating cluster with key identifier details 4. Linking workspaces Step 4: Link workspace - Link workspace to cluster. This step should be performed only after the cluster provisioning. If you link workspaces and ingest data prior to the provisioning, ingested data will be dropped and won't be recoverable. Reference: https://docs.microsoft.com/en-us/azure/azure-monitor/logs/customer-managed-keys

   Source: Adapted from community discussion — 509325_5153

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 190 · 540 in bank

    You use release pipelines in Azure Pipelines to deploy an app. Secrets required be the pipeline are stored as pipeline variables. Logging of commands is enabled for the Azure Pipelines agent. You need to prevent the values of the secrets from being logged. What should you do?

    • AStore the secrets in the environment variables instead of the pipeline variables.
    • BPass the secrets on the command line instead of in the pipeline variables.
    • CApply a prefix of secret to the name of the variables.
    • DEcho the values of the secrets to the command line.

    Show answer

    Answer: A

    Explanation

    A is correct. But provided link and explanation are not totally correct. The question is about Classis Release (not YAML), so the correct explanation is from here: https://docs.microsoft.com/en-us/azure/devops/pipelines/process/variables?view=azure-devops&tabs=classic%2Cbatch We make an effort to mask secrets from appearing in Azure Pipelines output, but you still need to take precautions. Never echo secrets as output. Some operating systems log command line arguments. Never pass secrets on the command line. Instead, we suggest that you map your secrets into environment variables.

    Source: Adapted from community discussion — markp

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-400 practice, question 181. 540 questions available.