AZ-400 practice questions 211–220

1. Question 211 · 540 in bank

   HOTSPOT - You have a GitHub repository named Repo1 and an app named App1. Repo1 stores the source code for App1. You need to perform the following tests: • Test1: Run a ZAP spider against App1 for one minute and wait for passive scanning to complete. The test must NOT perform active attacks. • Test2: Run a ZAP spider against App1, and when complete, execute an AJAX spider scan. Which GitHub action should you use for each test? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Test1: Use the ZAP Baseline Scan for passive scanning. Test2: Use the ZAP Full Scan, which will inherently include the ability to perform AJAX spidering if configured correctly.

   Source: Adapted from community discussion — MrAZ105

   

   Next question

2. Question 212 · 540 in bank

   You use Azure Pipelines pipeline to build and deploy an app named App1. You need to ensure that before App1 is deployed, all the code for the app passes a security validation by using a custom tool. What should you do?

   • AAdd a status check to the policies of the branch used by your company's development department.
   • BAdd a status check to the policies of the main branch.
   • CAdd a service hook to the project.
   • DLimit the job authorization scope to the current project for all the release pipelines.

   Show answer

   Answer: A

   Explanation

   you need to catch vulnerabilities "before" deployment because once it's in PROD with vulnerabilities, you would need to do a rollback. So, performing the tests in TEST environment is more appropriate and cause less headaches of having to rollback.

   Source: Adapted from community discussion — Dankho

   Next question

3. Question 213 · 540 in bank

   SIMULATION - You need to ensure that an Azure web app named az400-123456789-main can retrieve secrets from an Azure key vault named az400-123456789-kv1 by using a system managed identity. The solution must use the principle of least privilege. To complete this task, sign in to the Microsoft Azure portal.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. In Azure portal navigate to the az400-123456789-main app. 2. Scroll down to the Settings group in the left navigation. 3. Select Managed identity. 4. Within the System assigned tab, switch Status to On. Click Save. Reference: https://docs.microsoft.com/en-us/azure/app-service/overview-managed-identity

   Source: Adapted from community discussion — Rams_84zO6n

   References

   • Microsoft Learn

   

   Next question

4. Question 214 · 540 in bank

   You create a Microsoft ASP.NET Core application. You plan to use Azure Key Vault to provide secrets to the application as configuration data. You need to create a Key Vault access policy to assign secret permissions to the application. The solution must use the principle of least privilege. Which secret permissions should you use?

   • AList only
   • BGet only
   • CGet and List

   Show answer

   Answer: B

   Explanation

   If you need to read/provide to the webapp a list of secrets at once - yes, it will need List as well. But do we need to provide such list, or just a specific secret on request? Tested with .netcore webapp (3.1), deployed to an App Service, retrieving values from 2 keyvault secrets. Values are defined as Application Settings in the App Svc, with a reference to the keyvault: @Microsoft.KeyVault(SecretUri= {uri to the secret here}) . And it worked with only GET permission!

   Source: Adapted from community discussion — ttm_19

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 215 · 540 in bank

   You are designing the development process for your company. You need to recommend a solution for continuous inspection of the company's code base to locate common code patterns that are known to be problematic. What should you include in the recommendation?

   • AMicrosoft Visual Studio test plans
   • BGradle wrapper scripts
   • CSonarCloud analysis
   • Dthe JavaScript task runner

   Show answer

   Answer: C

   References

   • Microsoft Learn

   Next question

6. Question 216 · 540 in bank

   DRAG DROP - You are creating a NuGet package. You plan to distribute the package to your development team privately. You need to share the package and test that the package can be consumed. Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Step 1: Configure a self-hosted agent. The build will run on a Microsoft hosted agent. Step 2: Create a new Azure Artifacts feed Microsoft offers an official extension for publishing and managing your private NuGet feeds. Step 3: Publish the package. Publish, pack and push the built project to your NuGet feed. Step 4: Connect to an Azure Artifacts feed. With the package now available, you can point Visual Studio to the feed, and download the newly published package Reference: https://medium.com/@dan.cokely/creating-nuget-packages-in-azure-devops-with-azure-pipelines-and-yaml-d6fa30f0f15e

   Source: Adapted from community discussion — tom999

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 217 · 540 in bank

   During a code review, you discover many quality issues. Many modules contain unused variables and empty catch blocks. You need to recommend a solution to improve the quality of the code. What should you recommend?

   • AIn a Grunt build task, select Enabled from Control Options.
   • BIn a Maven build task, select Run PMD.
   • CIn a Xcode build task, select Use xcpretty from Advanced.
   • DIn a Gradle build task, select Run Checkstyle.

   Show answer

   Answer: B

   Explanation

   B is the answer. https://pmd.github.io/ PMD is a source code analyzer. It finds common programming flaws like unused variables, empty catch blocks, unnecessary object creation, and so forth.

   Source: Adapted from community discussion — zellck

   Next question

8. Question 218 · 540 in bank

   Select 3

   Your development team is building a new web solution by using the Microsoft Visual Studio integrated development environment (IDE). You need to make a custom package available to all the developers. The package must be managed centrally, and the latest version must be available for consumption in Visual Studio automatically. Which three actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • APublish the package to a feed.
   • BCreate a new feed in Azure Artifacts.
   • CUpload a package to a Git repository.
   • DAdd the package URL to the Environment settings in Visual Studio.
   • EAdd the package URL to the NuGet Package Manager settings in Visual Studio.
   • FCreate a Git repository in Azure Repos.

   Show answer

   Answer: ABE

   Explanation

   Pretty sure it's correct C: we want an automatic processs. Here we have to download the package manually D: The menu targetted is Options/Environment. But there are many sub menus down F: we already have a repository.

   Source: Adapted from community discussion — Fred64

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 219 · 540 in bank

   Select 2

   You use GitHub for source control. A file that contains sensitive data is committed accidentally to the Git repository of a project. You need to delete the file and its history form the repository. Which two tools can you use? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

   • Athe git filter-branch command
   • BBFG Repo-Cleaner
   • Cthe git rebase command
   • DGitHub Desktop

   Show answer

   Answer: AB

   Explanation

   BFG Repo cleaner is an alternative to git filter-branch. It can be used to remove sensitive data or large files that were committed wrongly like binaries compiled from the source. It is written in Scala. Project website: BFG Repo Cleaner

   Source: Adapted from community discussion — knvenkat123

   Next question

10. Question 220 · 540 in bank

    Select 2

    Your company uses GitHub for source control. The company has a team that performs code reviews. You need to automate the assignment of the code reviews. The solution must meet the following requirements: ✑ Prioritize the assignment of code reviews to team members who have the fewest outstanding assignments. ✑ Ensure that each team member performs an equal number of code reviews in any 30-day period. ✑ Prevent the assignment of code reviews to the team leader. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

    • AClear Never assign certain team members.
    • BSelect If assigning team members, don't notify the entire team.
    • CSelect Never assign certain team members.
    • DSet Routing algorithm to Round robin.
    • ESet Routing algorithm to Load balance.

    Show answer

    Answer: CE

    Explanation

    https://docs.github.com/en/organizations/organizing-members-into-teams/managing-code-review-settings-for-your-team "Optionally, to always skip certain members of the team, select Never assign certain team members. Then, select one or more team members you'd like to always skip" ---> C (prevent assignment to Leader) "The load balance algorithm chooses reviewers based on each member's total number of recent review requests and considers the number of outstanding reviews for each member. The load balance algorithm tries to ensure that each team member reviews an equal number of pull requests in any 30 day period." ---> E (Ensure that each team member performs an equal number of code reviews in any 30-day period)

    Source: Adapted from community discussion — syu31svc

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-400 practice, question 211. 540 questions available.