Free AZ-401 practice test: 30 questions with answers

The trigger key defines which branch pushes start the pipeline automatically. schedules runs on a timer, resources declare external dependencies such as repositories or pipelines, and pool selects the agent pool.

The template keyword references a reusable YAML file that can be included at stage, job or step level. include, import and reuse are not keywords used for template references in Azure Pipelines YAML.

A variable group linked to Key Vault pulls the secret values at run time, so the YAML stays free of secrets. Hardcoded values, committed environment files and display names all expose the secret.

Workload identity federation exchanges short-lived tokens between the pipeline and Entra ID, so no long-lived secret is needed. The other options store long-lived secrets or personal credentials, which are harder to rotate and audit.

Approvals and checks on an environment hold the deployment until the named approvers respond. A branch name, a schedule delay and commit signing do not require a person to approve the deployment.

Blue-green keeps the old environment ready for rollback, and canary releases limit exposure by sending a fraction of traffic first. Rolling updates can avoid downtime, recreate deployments stop the old version first, and feature flags are switched without redeploying.

A CODEOWNERS file maps paths to owners, and GitHub and Azure Repos can request their review on matching pull requests. .gitignore excludes files from tracking, dependabot.yml configures dependency updates, and the workflow env file sets variables.

Git LFS stores large files outside the normal object store and keeps lightweight pointers in the history. Submodules link separate repositories, stash saves uncommitted work, and bisect finds the commit that introduced a bug.

A squash merge combines all commits from the feature branch into a single commit on the target branch. Fast-forward only keeps the individual commits, octopus merges combine many branches at once, and manual cherry-picking is error-prone.

Secret scanning with push protection checks pushes for known secret patterns and blocks them before they reach the repository. Dependabot updates libraries, CodeQL finds code vulnerabilities, and review comments do not stop a push.

Required status checks block the merge until the named builds or tests report success. Signed commits verify authorship, force-push settings govern history rewriting, and linear history controls merge shape but not test results.

Branch policies with minimum reviewers and required status checks are enforced by the platform before a merge completes. A wiki page and reminder emails only advise, and a shared administrator password is an insecure access practice.

The AB# mention in commit messages and pull request titles creates a link between the code change and the work item. Repository names and manual tags do not create those links, and email hooks only notify people.

Small frequent merges to a shared trunk surface integration problems early and shorten the time from change to production. Long-lived branches, freezes and big-bang integration all increase batch size and delay feedback.

Blameless postmortems focus on system causes and shared follow-up actions, which improves future reliability. Change boards for every commit slow delivery, penetration tests are periodic security checks, and single sign-off does not address learning.

Notifications and subscriptions let users and teams follow work items and receive alerts on changes. Service connections link pipelines to external services, deployment groups target machines, and artifact feeds store packages.

Shared dashboards and shared incident ownership give both teams the same view of production health and responsibility. Blocking log access, ticket-only handoffs and hiding pipeline runs create silos that slow recovery.

Lead time for changes measures how long a committed change takes to reach production. Mean time to recovery measures how quickly service is restored after a failure, change failure rate measures the share of deployments that cause problems, and deployment frequency counts how often deployments happen.

Federated credentials avoid stored secrets, and scoping the connection limits what a compromised pipeline can reach. Root-level Owner and shared tokens give far more access than a pipeline needs.

Defender for Cloud's DevOps security capability scans connected repositories and pipelines for code, IaC and secret issues. The other services cover cost, load testing and disaster recovery rather than DevOps security posture.

An SBOM enumerates the components and versions in an artifact, which supports audits and vulnerability tracking. Firewall ports, certificate schedules and key logs do not describe software components.

The Deny effect blocks a non-compliant request before the resource is created. Audit only reports non-compliance, AuditIfNotExists reports missing related resources, and DeployIfNotExists remediates by deploying resources rather than blocking.

MFA through Conditional Access and phishing-resistant methods for privileged accounts make stolen passwords much less useful. Shared accounts remove accountability, and disabling audit logs removes the evidence needed to detect misuse.

Dependabot security updates open pull requests that upgrade vulnerable dependencies to fixed versions. Secret scanning finds credentials, code scanning finds code issues, and Codespaces prebuilds speed up development environments.

Distributed tracing correlates telemetry across services with a shared operation ID, so the end-to-end transaction shows where time was spent. Cost reports, code analysis and backup reports do not trace requests across services.

Log Analytics uses Kusto Query Language, known as KQL, to query tables of logs and telemetry. The other languages are used by different products and are not the native query language here.

The auto-instrumentation agent collects exceptions, requests and dependency calls without code changes. An availability test checks endpoints from outside, CSV metrics are not an instrumentation method, and deleting a workspace removes the data store.

A log search alert rule runs a KQL query at an interval and triggers when results meet a condition. Activity log alerts watch control-plane events, metric alerts evaluate numeric metrics, and Service Health advisories report platform events.

A percentile aggregation over request duration gives the value below which 95 percent of requests complete. Averages hide tail latency, and CPU, request counts and disk space do not describe response time.

Application Insights collects traces (logs), metrics, requests, exceptions and dependencies as telemetry. Printed reports, video and code diffs are not telemetry types it collects.