Free AZ-400 DevOps Engineer Practice Exam (2026)

Your score by topic

Get a free AZ-400 study plan on WhatsApp See AZ-400 Azure DevOps Training with pass guarantee

Review answers Only my mistakes Retake

Question 1Build & Release Pipelines⚑ Flag

Blue Yonder Airlines builds with classic pipelines edited in the web portal. Auditors now require every pipeline change to be versioned with the code and reviewed in a pull request. What should you recommend?

AConvert the pipelines to YAML pipelines BExport the classic pipelines as JSON monthly CUse task groups for shared steps DEnable the audit log for the organization

Correct answer: A. Convert the pipelines to YAML pipelines
YAML pipelines live in the repository, so every change is versioned with the code and can go through pull request review. Task groups help reuse steps but are still edited in the portal, not reviewed in pull requests.

Question 2Source Control⚑ Flag

Relecloud ships a packaged desktop product on a fixed quarterly schedule. The team wants an integration branch separate from production code, dedicated branches to stabilize each release, and hotfix branches cut from production. Which branching strategy matches these needs?

AForking workflow BTrunk-based development CGitFlow DGitHub flow

Correct answer: C. GitFlow
GitFlow uses a develop branch for integration, release branches to stabilize each version, and hotfix branches from main. GitHub flow uses only main and short-lived feature branches, with no separate integration or release branches.

Question 3Security & Compliance⚑ Flag

Fourth Coffee runs a web app on Azure App Service that reads secrets from Azure Key Vault at runtime. Security bans storing any credentials in app settings or code. What should the app use to authenticate to Key Vault?

AA service principal client secret BA Key Vault access key CA shared access signature DA managed identity for the app

Correct answer: D. A managed identity for the app
A managed identity gives the app an Entra ID identity that Azure manages, so no credential is stored. A client secret would have to be stored in app settings or code, which the policy bans.

Question 4Build & Release Pipelines⚑ Flag

First Up Consultants deploys to a production environment with a YAML pipeline. A deployment must not start while there are active Azure Monitor alerts for the production resources. You want this enforced without adding steps to every pipeline. What should you configure?

AAn Approvals check on the environment BA post-deployment gate in the build stage CA Business hours check on the environment DA Query Azure Monitor alerts check

Correct answer: D. A Query Azure Monitor alerts check
The Query Azure Monitor alerts check evaluates alert rules before deployment to the environment and holds it while alerts are active. An Approvals check needs a person to decide and does not read alert state.

Question 5Instrumentation⚑ Flag

VanArsdel runs a .NET web app on Azure App Service. The team wants Application Insights request, dependency and exception telemetry without changing or redeploying the code. What should you do?

AInstall the Azure Monitor agent on the plan BTurn on autoinstrumentation in App Service CAdd the Application Insights SDK to the project DEnable App Service diagnostic logs to storage

Correct answer: B. Turn on autoinstrumentation in App Service
Autoinstrumentation turns on Application Insights from the App Service settings and collects requests, dependencies and exceptions with no code change. Adding the SDK means changing and redeploying the code.

Question 6Processes & Communications⚑ Flag

Proseware uses an Azure Boards Kanban board. The team agreed that no more than four items should be in the Active column at once. The board must make it obvious when the team goes over that number. What should you configure?

AA team capacity setting for the sprint BA WIP limit on the Active column CA swimlane for urgent items DA card style rule for old items

Correct answer: B. A WIP limit on the Active column
A WIP limit on a board column shows the item count against the limit and highlights the column when it is exceeded. Team capacity sets available hours per person for sprint planning and does not watch a board column.

Question 7Build & Release Pipelines⚑ Flag

Proseware has a self-hosted agent pool with mixed agents. Only some agents have the Java 17 SDK installed. Java jobs must run only on agents that have it. What should you use?

AA separate Azure DevOps organization BA matrix strategy on the job CA pipeline resource trigger DAgent capabilities with job demands

Correct answer: D. Agent capabilities with job demands
Agents advertise capabilities, and job demands make Azure Pipelines send the job only to agents whose capabilities match, such as Java 17. A matrix strategy creates more job copies but does not choose which agent runs them.

Question 8Source Control⚑ Flag

Lamna Healthcare uses Azure Repos. Any pull request that changes files under /src/auth must automatically add the Security Reviewers group as a required reviewer. Pull requests for other paths must not include that group. What should you configure?

AA CODEOWNERS file in the repository root BA build validation policy with a path filter CAn automatically included reviewers policy with a path filter DA minimum number of reviewers policy that requires two approvals

Correct answer: C. An automatically included reviewers policy with a path filter
The automatically included reviewers policy can add a group as required only when changed files match a path filter such as /src/auth/*. Azure Repos does not apply a GitHub CODEOWNERS file to pull requests.

Question 9Build & Release Pipelines⚑ Flag

Woodgrove Bank wants each build job to use exactly the same toolchain versions on Microsoft-hosted agents. The tools are packaged in an image in Azure Container Registry. You want the job steps to run inside that image. What should you configure?

AA Docker task that runs docker pull for the image BA container job that references the image CA self-hosted agent per tool version DA Cache task for the toolchain

Correct answer: B. A container job that references the image
A container job runs every step of the job inside the specified image, so the toolchain is identical on every run. A docker pull only downloads the image and the steps still run on the host agent.

Question 10Security & Compliance⚑ Flag

Alpine Ski House wants every GitHub Actions workflow to follow least privilege. The automatic GITHUB_TOKEN must only read repository contents unless a workflow explicitly needs more. What should you configure in the workflows?

AA deploy key with read-only access BBranch protection on the default branch CA permissions key with contents set to read DA fine-grained personal access token stored as a secret

Correct answer: C. A permissions key with contents set to read
The permissions key sets the scopes granted to GITHUB_TOKEN, and contents: read limits it to reading code. A personal access token is a long-lived credential tied to a user, which adds risk instead of reducing it.

Question 11Build & Release Pipelines⚑ Flag

Fourth Coffee has self-hosted GitHub Actions runners with access to production systems. Only three specific repositories in the organization may use these runners. What should you configure?

AA runner group limited to those repositories BCustom runner labels referenced in each workflow CGitHub-hosted larger runners DAn environment with required reviewers

Correct answer: A. A runner group limited to those repositories
An organization runner group can be limited to selected repositories, so other repositories cannot send jobs to those runners. Labels only help workflows pick runners and do not stop other repositories from using them.

Question 12Instrumentation⚑ Flag

Bellows College stores application logs in a Log Analytics workspace. The team wants an alert when a KQL query finds more than 20 login failures in 10 minutes. What type of alert rule should you create?

AA service health alert BA log search alert rule CA metric alert rule DAn activity log alert rule

Correct answer: B. A log search alert rule
A log search alert rule runs a KQL query on a schedule and fires when the result passes a threshold. A metric alert evaluates platform or custom metrics and cannot run a KQL query on log records.

Question 13Processes & Communications⚑ Flag

Woodgrove Bank publishes releases in GitHub. The release manager wants release notes built from merged pull request titles, grouped into categories such as Features and Bug Fixes by label. You want to avoid custom scripts. What should you use?

AAutomatically generated release notes BA wiki page updated after each sprint CA GitHub Discussions announcement DA milestone with a description field

Correct answer: A. Automatically generated release notes
GitHub can generate release notes from merged pull requests, and a .github/release.yml file groups them into categories by label. A milestone tracks progress on issues but does not build release notes.

Question 14Build & Release Pipelines⚑ Flag

Alpine Ski House has a GitHub Actions workflow with a build job and a separate deploy job. The deploy job must use the compiled files produced by the build job in the same workflow run. What should you use?

AA shared folder on the GitHub-hosted runner used by both jobs BRepository variables that hold the file path Cactions/upload-artifact and actions/download-artifact Dactions/cache keyed on the commit SHA

Correct answer: C. actions/upload-artifact and actions/download-artifact
Uploading an artifact in the build job and downloading it in the deploy job passes files between jobs, which run on separate runners. The cache action is meant to speed up dependency restores and is not guaranteed to keep build outputs.

Question 15Source Control⚑ Flag

A developer at Margie's Travel deleted a local branch that held three commits that were never pushed. The developer now needs those commits back. Which command helps find the lost commit hash?

Agit log --all Bgit stash list Cgit fetch --prune Dgit reflog

Correct answer: D. git reflog
git reflog records where HEAD and branch tips pointed recently, so it shows the hash of the deleted branch's last commit, which can then be restored. git log --all only shows commits still reachable from existing refs.

Question 16Build & Release Pipelines⚑ Flag

Coho Winery publishes NuGet packages to Azure Artifacts. Nightly builds of version 3.2.0 must be available for early testing, but consumers must not get them by default when they update packages. How should you version the nightly packages?

AIncrease the major version on each nightly build BUse the build number as the patch version CPublish them with the same version as the release DUse a prerelease label such as 3.2.0-nightly.15

Correct answer: D. Use a prerelease label such as 3.2.0-nightly.15
A SemVer prerelease label marks the package as prerelease, and NuGet clients skip prerelease versions unless they opt in. Raising the patch version makes nightlies look like stable releases that consumers would pick up.

Question 17Security & Compliance⚑ Flag

Coho Winery's legal team bans copyleft licenses in its products. Pull requests in GitHub that add a dependency with a license outside an approved list must fail before merge. What should you use?

ADependency review with allowed licenses BDependabot version updates with grouped pull requests CSecret scanning custom patterns DCode scanning with CodeQL

Correct answer: A. Dependency review with allowed licenses
The dependency review action checks dependencies added in a pull request and can fail when a license is not on the allowed list. Dependabot version updates keep dependencies current but do not enforce license rules.

Question 18Build & Release Pipelines⚑ Flag

Trey Research needs to version and share large machine learning model files and tooling binaries that are not NuGet, npm, Maven or Python packages. They must live in Azure Artifacts with access controlled by the feed. Which package type should you use?

AGit LFS in Azure Repos BUniversal Packages CPipeline artifacts DBuild artifacts on a file share

Correct answer: B. Universal Packages
Universal Packages store any set of files in an Azure Artifacts feed with versions and feed permissions. Pipeline artifacts are tied to a pipeline run and are not versioned packages in a feed.

Question 19Instrumentation⚑ Flag

Munson's Pickles engineers need the five operations with the highest average response time from Application Insights request data. Which query should they use?

Arequests | take 5 | order by duration desc Brequests | where duration > 5 | count Crequests | where success == false | summarize count() by name | top 5 by count_ Drequests | summarize avg(duration) by name | top 5 by avg_duration

Correct answer: D. requests | summarize avg(duration) by name | top 5 by avg_duration
Summarizing avg(duration) by name and then using top 5 by avg_duration returns the five slowest operations on average. Taking five rows first and then sorting looks at a random sample, not all requests.

Question 20Source Control⚑ Flag

VanArsdel requires one approval on pull requests to main in Azure Repos. Reviewers complained that authors push big changes after approval and then complete the pull request. Approvals must no longer count after new commits are pushed. What should you configure?

AAllow requestors to approve their own changes BCheck for linked work items CReset approval votes on new pushes DIncrease the minimum number of reviewers to three

Correct answer: C. Reset approval votes on new pushes
The minimum reviewers policy can reset approval votes when new changes are pushed, so the updated code needs a fresh approval. Raising the reviewer count adds more approvals but still lets old approvals count after new pushes.

Question 21Build & Release Pipelines⚑ Flag

Relecloud's Azure Artifacts feed has grown large because every CI build publishes a new package version. The team wants to keep only the 30 newest versions of each package, except versions that were downloaded recently. What should you configure?

ARetention policies on the feed BA feed view for old versions CAn upstream source with a limit DA scheduled pipeline that deletes packages

Correct answer: A. Retention policies on the feed
Feed retention policies keep a maximum number of versions per package and can spare versions downloaded recently. A feed view filters what consumers see but does not delete anything or reduce storage.

Question 22Processes & Communications⚑ Flag

Fourth Coffee tracks bugs as GitHub issues. When a pull request that fixes a bug merges into the default branch, the related issue must close automatically. What should developers add to the pull request description?

A@58 BAB#58 CCloses #58 DRelated to #58

Correct answer: C. Closes #58
A closing keyword such as Closes #58 links the pull request and closes the issue when the pull request merges into the default branch. A plain mention like Related to #58 links the issue but does not close it.

Question 23Build & Release Pipelines⚑ Flag

Lamna Healthcare wants to reduce the risk of each release. New versions must go first to internal staff, then to a pilot group of clinics, and finally to all customers, with checks between each step. Which deployment strategy is this?

ARing-based deployment BBlue-green deployment CRecreate deployment DRolling deployment

Correct answer: A. Ring-based deployment
Ring-based deployment exposes a release to growing groups of users, such as internal staff, then pilots, then everyone, with validation between rings. Blue-green switches all users at once between two environments.

Question 24Security & Compliance⚑ Flag

Trey Research has an Azure Resource Manager service connection for production. Any pipeline that uses it must extend the approved central security template. Pipelines that do not extend that template must be blocked from using the connection. What should you configure?

AA branch policy on the template repository BA Required template check on the service connection CPipeline permissions that allow only selected pipelines DAn Approvals check on the service connection

Correct answer: B. A Required template check on the service connection
A Required template check makes a pipeline that uses the resource fail unless it extends the specified template. Pipeline permissions decide which pipelines may use the connection but do not inspect how they are built.

Question 25Instrumentation⚑ Flag

Humongous Insurance has a planned maintenance window every Saturday night. Alerts from the affected resource group must not send notifications during that window, but the alert rules must stay enabled. What should you configure?

AAn alert processing rule with a schedule BA new action group with no receivers CA diagnostic setting on the resource group DA lower severity on each alert rule

Correct answer: A. An alert processing rule with a schedule
An alert processing rule can suppress action groups for a scope on a schedule while the rules keep firing and recording alerts. Lowering severity changes how alerts are labeled but still sends the notifications.

Question 26Build & Release Pipelines⚑ Flag

Margie's Travel swaps an App Service staging slot into production. The production database connection string must stay with the production slot and never move to the other slot during a swap. What should you do?

AAdd the connection string to a variable group BTurn on auto swap for the staging slot CMake it a deployment slot setting DStore the connection string in the app's code

Correct answer: C. Make it a deployment slot setting
A connection string marked as a deployment slot setting stays with its slot during a swap. Auto swap only triggers swaps automatically and does not control which settings move.

Question 27Source Control⚑ Flag

Bellows College hosts code in GitHub. The compliance team requires proof of who authored each commit that reaches main. Commits that are not cryptographically signed and verified must be blocked from main. What should you enable?

ARequire deployments to succeed BRequire signed commits on the branch CRequire linear history on the branch DRequire conversation resolution

Correct answer: B. Require signed commits on the branch
The require signed commits rule only accepts commits with a verified GPG, SSH or S/MIME signature. Requiring linear history blocks merge commits but says nothing about who authored a commit.

Question 28Build & Release Pipelines⚑ Flag

VanArsdel deploys Bicep files to a production resource group from a pipeline. Before the deployment stage runs, reviewers must see which resources will be created, changed or deleted. What should the pipeline run first?

Aaz bicep build Baz deployment group validate Caz resource list Daz deployment group what-if

Correct answer: D. az deployment group what-if
The what-if operation compares the template with the current state and lists resources that would be created, modified or deleted. Validate only checks that the template is valid and would be accepted, not what it would change.

Question 29Processes & Communications⚑ Flag

Alpine Ski House uses Azure Pipelines and Microsoft Teams. The operations channel must get a message each time a production release pipeline completes or fails. You want to set this up from the channel with no custom code. What should you use?

AThe Azure Pipelines app for Microsoft Teams BAn Incoming Webhook called from a PowerShell task CA dashboard shared in a Teams tab DAn email subscription sent to the channel

Correct answer: A. The Azure Pipelines app for Microsoft Teams
The Azure Pipelines app for Microsoft Teams lets you subscribe a channel to pipeline events such as run completion, without writing code. An Incoming Webhook called from a PowerShell task needs custom code in every pipeline.

Question 30Build & Release Pipelines⚑ Flag

Bellows College has several teams that write Bicep. The platform team wants to publish approved, versioned Bicep modules that teams reference by a short path, using a registry they control. What should you use?

ALinked ARM templates in a storage account BA private Bicep registry in Azure Container Registry CA shared folder of Bicep files on an Azure Files share DGit submodules in each team repository

Correct answer: B. A private Bicep registry in Azure Container Registry
A private Bicep registry in Azure Container Registry stores versioned modules that teams reference with a br: path. Git submodules copy files into each repository and give no central version catalog.

Question 31Source Control⚑ Flag

Munson's Pickles has a payment service and a shared library that change together often. Today they live in separate repositories, and a library change needs coordinated pull requests in two places. The team wants a single change that updates both atomically. What should you recommend?

AA monorepo for both projects BA NuGet package for the library CA fork of each repository DGit submodules for the library

Correct answer: A. A monorepo for both projects
A monorepo lets one commit and one pull request change the service and the library together. A NuGet package still needs a separate publish step and a version bump in the service, so the change is not atomic.

Question 32Security & Compliance⚑ Flag

Relecloud must sign its Android app in an Azure Pipelines build with a keystore file. The keystore must not be stored in the repository, and only authorized pipelines may use it. What should you use?

AA secret variable group that holds the file as base64 text BA build artifact uploaded by an administrator CGit LFS with a private repository DSecure files with the Download Secure File task

Correct answer: D. Secure files with the Download Secure File task
The Secure files library stores files like keystores encrypted in Azure DevOps, and the Download Secure File task gives them only to authorized pipelines. Git LFS still stores the file in a repository, which the requirement forbids.

Question 33Build & Release Pipelines⚑ Flag

Munson's Pickles deploys a resource group with Bicep. Resources removed from the Bicep file must be deleted from Azure on the next deployment, and operators must be blocked from deleting managed resources in the portal. What should you use?

AA deployment stack with deny settings BAn incremental mode deployment CA resource lock on each resource DA template spec with versions

Correct answer: A. A deployment stack with deny settings
A deployment stack tracks the resources it manages, can delete resources removed from the template, and applies deny settings to block manual deletes. Incremental mode leaves removed resources in place.

Question 34Instrumentation⚑ Flag

Graphic Design Institute wants Azure Key Vault resource logs, such as secret access events, in its Log Analytics workspace for querying. What should you configure on the key vault?

AA data collection rule for the Azure Monitor agent BAn activity log alert CA diagnostic setting to the workspace DAn Application Insights connection string

Correct answer: C. A diagnostic setting to the workspace
A diagnostic setting routes a resource's platform logs, such as Key Vault audit events, to a Log Analytics workspace. The activity log only records control plane operations, not data plane secret access.

Question 35Build & Release Pipelines⚑ Flag

Humongous Insurance uses Entity Framework Core migrations. The release pipeline must produce a SQL script that can run safely against databases at any migration level, applying only missing migrations. Which command should the pipeline run?

Adotnet ef migrations script --idempotent Bdotnet ef database drop --force Cdotnet ef migrations add Release Ddotnet ef dbcontext scaffold

Correct answer: A. dotnet ef migrations script --idempotent
An idempotent migration script checks which migrations were already applied and runs only the missing ones. Adding a migration creates new migration code and does not produce a deployable script.

Question 36Source Control⚑ Flag

Humongous Insurance runs an open-source SDK on GitHub. External contributors must be able to propose changes, but they must not get write access to the main repository. Which workflow should you use?

AContributors get the Triage role on the repository BContributors push to feature branches in the repository CContributors email patches to maintainers DContributors work in forks and open pull requests

Correct answer: D. Contributors work in forks and open pull requests
In a fork workflow, contributors push to their own copy and open pull requests back to the upstream repository, so they never need write access. Pushing feature branches to the main repository requires write access.

Question 37Build & Release Pipelines⚑ Flag

Graphic Design Institute wants a nightly YAML pipeline run at 02:00 UTC on main. The run must be skipped when nothing has changed since the last successful scheduled run. What should you configure?

AA schedules trigger with always: true BA schedules trigger with always: false CA CI trigger on main with batch set to true DA pipeline resource trigger on main

Correct answer: B. A schedules trigger with always: false
A schedules trigger with always: false runs only when the branch has changed since the last successful scheduled run. Setting always to true would run every night even with no changes.

Question 38Processes & Communications⚑ Flag

Coho Winery has six Scrum teams in one Azure DevOps project. Leadership needs a timeline view that shows features from all teams across upcoming sprints, with dependencies between them. What should you use?

AA sprint taskboard BA shared work item query CA Delivery Plan DA team dashboard

Correct answer: C. A Delivery Plan
A Delivery Plan shows work items from several teams on a calendar timeline by iteration and can show dependency lines. A sprint taskboard shows one team's tasks for a single sprint.

Question 39Security & Compliance⚑ Flag

Lamna Healthcare has several Azure DevOps projects. A pipeline in one project must not be able to read repositories in other projects with its job access token. You want to enforce this centrally. What should you enable?

ADisable anonymous access to badges BLimit job authorization scope to current project CProtect access to repositories in YAML pipelines DDisable creation of classic release pipelines

Correct answer: B. Limit job authorization scope to current project
Limiting the job authorization scope to the current project gives the job access token rights only within its own project. Protecting repository access in YAML requires the pipeline to declare repositories it uses but does not by itself remove cross-project rights.

Question 40Build & Release Pipelines⚑ Flag

Southridge Video keeps a web API and a mobile app in one repository. The API pipeline must run only when files under /src/api change. What should you add to the API pipeline's CI trigger?

AA branches include filter for api/* BA tags include filter for api CA batch setting of true DA paths include filter for /src/api

Correct answer: D. A paths include filter for /src/api
A paths include filter starts the CI trigger only when pushed changes touch files under /src/api. A branches filter controls which branches trigger runs, not which folders.

Question 41Instrumentation⚑ Flag

Southridge Video's operations team wants one interactive report that combines Application Insights metrics, KQL query results and text notes, with parameters to switch between environments. What should you use?

AThe Activity log BAzure Workbooks CAzure Advisor DLive Metrics

Correct answer: B. Azure Workbooks
Azure Workbooks combine metrics, log queries, text and parameters in one interactive report. Live Metrics shows real-time telemetry but cannot hold saved queries, notes or parameters.

Question 42Build & Release Pipelines⚑ Flag

Blue Yonder Airlines finds that some automated tests in Azure Pipelines pass on rerun without any code change. These tests make the team distrust failed runs. You want Azure DevOps to detect such tests and keep them from failing the pipeline. What should you enable?

ACode coverage on the test task BA retry count on every task CFlaky test detection in test management settings DTest Impact Analysis on the Visual Studio Test task

Correct answer: C. Flaky test detection in test management settings
Flaky test detection marks tests that flip results without code changes, and you can exclude flaky tests from the pass or fail outcome. Test Impact Analysis selects which tests to run based on code changes and does not track flakiness.

Question 43Source Control⚑ Flag

Graphic Design Institute keeps a release/2.4 branch for a shipped version. A security fix was merged to main as one commit. The same fix must be applied to release/2.4 without bringing in any other changes from main. What should you use?

Agit cherry-pick of the fix commit Bgit rebase release/2.4 onto main Cgit revert on main Dgit merge main into release/2.4

Correct answer: A. git cherry-pick of the fix commit
git cherry-pick applies the changes from a single commit onto another branch, so only the fix lands on release/2.4. Merging main would bring every other change on main into the release branch.

Question 44Build & Release Pipelines⚑ Flag

First Up Consultants runs integration tests in GitHub Actions that need a PostgreSQL database. The database must start fresh for each job and be torn down afterward, with no external infrastructure. What should you use?

AA PostgreSQL feed in Azure Artifacts BA self-hosted runner with PostgreSQL installed CA reusable workflow that installs PostgreSQL DA service container in the job

Correct answer: D. A service container in the job
A service container runs PostgreSQL next to the job and is removed when the job ends, so every run starts clean. A self-hosted runner with PostgreSQL installed keeps data between runs and needs maintenance.

Question 45Processes & Communications⚑ Flag

Trey Research wants a Power BI report on work item trends across several Azure Boards teams. Business analysts must build it themselves without writing OData queries. What should you recommend?

AAnalytics views with the Power BI connector BExporting work item query results to CSV each week CA Markdown widget on a dashboard DThe work item REST API in a script

Correct answer: A. Analytics views with the Power BI connector
Analytics views define filtered work item data that analysts load into Power BI with the built-in connector, with no OData queries needed. Weekly CSV exports are manual and the data goes stale between exports.

Question 46Security & Compliance⚑ Flag

Margie's Travel deploys Azure resources with pipelines. Compliance requires that no storage account can be created with public blob access enabled, even if a pipeline template has an error. What should you implement?

AA Required template check on the service connection BA Defender for Cloud recommendation CAn Azure Policy assignment with the deny effect DA branch policy on the IaC repository

Correct answer: C. An Azure Policy assignment with the deny effect
An Azure Policy assignment with deny blocks non-compliant resources at deployment time, whatever the source. A Defender for Cloud recommendation reports the problem after the resource exists but does not block it.

Question 47Build & Release Pipelines⚑ Flag

Proseware has one YAML deployment pipeline. When a user runs it manually, they must pick the target environment from a fixed list of dev, test or prod. Invalid values must not be possible. What should you use?

AA variable marked settable at queue time BA variable group per environment CA stage condition on a variable DA runtime parameter with a values list

Correct answer: D. A runtime parameter with a values list
A runtime parameter with a values list shows a dropdown when the run is queued and accepts only listed values. A variable settable at queue time accepts any free text, so invalid values are possible.

Question 48Instrumentation⚑ Flag

Blue Yonder Airlines is rolling out a new release of its API. During the next ten minutes, engineers want to watch incoming request rates, failures and server CPU with about one-second latency. What should they use?

AA log search alert rule BA standard availability test every five minutes CA scheduled Workbook export DLive Metrics in Application Insights

Correct answer: D. Live Metrics in Application Insights
Live Metrics streams request rates, failures and server performance with about one second of delay, which suits watching a deployment as it happens. A log search alert runs on a schedule and depends on ingested logs, so it is not a live view.

Question 49Source Control⚑ Flag

Southridge Video's GitHub repository gets dozens of pull requests a day. Pull requests often pass checks on their own but break main once merged together. The team wants each pull request tested against the latest main plus the queued changes before merging. What should you enable?

ADependabot version updates BA merge queue for the main branch CRequire branches to be up to date DAuto-merge on pull requests

Correct answer: B. A merge queue for the main branch
A merge queue builds temporary branches that combine main with queued pull requests and merges only those that pass. Requiring branches to be up to date forces authors to rebase repeatedly and does not scale with many pull requests.

Question 50Build & Release Pipelines⚑ Flag

Woodgrove Bank's GitHub workflow deploys to production on every push to main. Two pushes in quick succession started two deployments that overlapped. Only one deployment may run at a time, and a running deployment must not be canceled. What should you add?

AA matrix with max-parallel set to 2 BA paths filter on the push trigger CA concurrency group with cancel-in-progress set to false DA production environment with required reviewers and a wait timer

Correct answer: C. A concurrency group with cancel-in-progress set to false
A concurrency group lets only one run in that group execute at a time and queues the next one, and cancel-in-progress set to false protects the running deployment. Required reviewers add an approval but do not prevent two approved runs from overlapping.