Free Microsoft AZ-400 Practice Questions

Correct answer: C. Cycle time

Cycle time specifically measures the elapsed time from when a work item becomes active (enters development) to when it is completed. This is distinct from lead time, which measures from creation to completion. Burnup and Burndown charts track cumulative work progress over time, while Cumulative Flow Diagram shows the distribution of work across different states.

Why the other options are wrong

• A. Cumulative Flow Diagram shows work distribution across states, not elapsed time to completion.
• B. Burnup chart measures total work completed over time, not the time elapsed for individual items.
• D. Burndown chart shows remaining work over time, not the elapsed time from active to complete.

Correct answer: B. Lead time

The Burnup widget measures work completed over time, not elapsed time from creation to completion. The metric that measures elapsed time from creation of work items to their completion is lead time. Lead time encompasses the entire lifecycle from when a work item is created until it is finished, whereas cycle time only measures from when it becomes active.

Why the other options are wrong

• A. The statement is inaccurate; Burnup does not measure creation-to-completion time.
• C. Test results trend is a different metric related to test quality, not work item timing.
• D. Burndown measures remaining work over time, not creation-to-completion elapsed time.

Correct answer: D. License procurement

License procurement is a business decision that involves purchasing licenses from Microsoft and cannot be automated through Azure DevOps or related tools. Group membership changes, license assignment, and entitlements assignment can all be automated using scripts, extensions, or API calls, but the actual procurement of new licenses requires human decision-making and vendor interaction.

Why the other options are wrong

• A. Group membership changes can be automated using Azure DevOps REST APIs or PowerShell.
• B. License assignment to users can be automated through scripts or automation tools.
• C. Assigning entitlements can be automated using Azure DevOps APIs and automation scripts.

Correct answer: B. Static code analysis

Static code analysis is the appropriate security tool for the Continuous Integration phase because it analyzes source code without executing it, identifying vulnerabilities during the build process before code is deployed. Penetration testing and dynamic code analysis occur after deployment, while threat modeling is a design-phase activity. Static analysis fits naturally into CI pipelines to catch security issues early.

Why the other options are wrong

• A. Penetration testing is a post-deployment security activity, not part of the CI phase.
• C. Threat modeling is a design and planning phase activity, not a CI tool.
• D. Dynamic code analysis requires running the application and is typically performed in later stages, not in CI.

Correct answer: B. Using the TFS Database Import Service to perform the upgrade.

The TFS Database Import Service is the recommended tool for migrating from TFS 2013 to Azure DevOps while preserving changeset dates and work item revision dates. This service is specifically designed to perform full-fidelity migrations of TFS data, including all artifacts and historical timestamps, with minimal migration effort required compared to other approaches.

Why the other options are wrong

• A. The TFS Java SDK is not a valid or relevant tool for TFS migration to Azure DevOps.
• C. Upgrading PowerShell Core is not necessary or directly related to preserving TFS data during migration.
• D. The TFS Integration Platform is older and less efficient than the TFS Database Import Service for this migration scenario.

Correct answer: D. CMMI

CMMI (Capability Maturity Model Integration) is the work item process that includes requirements, change requests, risks, and reviews. This process is designed for organizations needing formal governance and change management. Basic lacks this scope, Agile focuses on user stories and features, and Scrum emphasizes sprints and backlog items without the formal change and risk management structures.

Why the other options are wrong

• A. Basic process is minimal and does not include change requests, risks, or reviews.
• B. Agile process focuses on user stories and does not have formal risk or review work item types.
• C. Scrum process is sprint-focused and lacks the formal change request and risk tracking of CMMI.

Correct answer: B. No

Setting the -ConfigurationMode to ApplyOnly does not meet the requirement. ApplyOnly applies the configuration once but does not monitor or correct configuration drift afterward. To ensure servers remain correctly configured regardless of drift, you need ApplyAndMonitor or ApplyAndAutoCorrect, which continuously check and maintain the desired configuration state.

Why the other options are wrong

• A. ApplyOnly does not provide ongoing monitoring or correction of configuration drift.

Correct answer: B. No

Setting the -ConfigurationMode to ApplyAndMonitor does not fully meet the requirement. While ApplyAndMonitor continuously monitors for configuration drift and reports discrepancies, it does not automatically correct drift. To ensure servers remain correctly configured regardless of drift, ApplyAndAutoCorrect is needed, which both monitors and automatically corrects any configuration deviations.

Why the other options are wrong

• A. ApplyAndMonitor only detects drift but does not automatically correct it, leaving servers potentially misconfigured.

Correct answer: A. Yes

The ApplyAndAutocorrect parameter in Register-AzureRmAutomationDscNode configures the DSC node to automatically apply configurations and correct any drift detected from the desired state. This ensures that test servers remain correctly configured regardless of configuration drift by continuously monitoring and reapplying the desired configuration when deviations are detected.

Why the other options are wrong

• B. ApplyAndAutocorrect is the correct parameter that addresses configuration drift by automatically correcting it.

Correct answer: B. Hosted Windows Container

To compile an IIS web application that runs Docker, you should use the Hosted Windows Container build agent pool. This pool provides Windows Server containers with Docker support, enabling you to build and containerize IIS web applications. The Default pool does not include Docker support, the Hosted pool uses Linux, and macOS is not suitable for IIS.

Why the other options are wrong

• A. The Default pool lacks Docker capabilities required for this scenario.
• C. The standard Hosted pool uses Linux containers, not Windows containers needed for IIS.
• D. macOS is not appropriate for building IIS web applications.

Correct answer: D. boards

When migrating from JIRA to Azure DevOps, JIRA's functionality maps to Azure DevOps Boards, not build pipelines. Azure Boards provides work item tracking, sprint planning, and agile board management equivalent to JIRA's capabilities. Build pipelines in Azure DevOps serve a different purpose related to CI/CD, not work item management.

Why the other options are wrong

• A. The underlined segment is inaccurate; JIRA does not map to build pipelines.
• B. Azure Repos handles version control, not work item tracking like JIRA.
• C. Release pipelines are for deployment automation, not for replacing JIRA's work management features.

Correct answer: B. Recreate the secret at the repository level.

Secrets stored at the environment level in GitHub are scoped only to that specific environment and cannot be accessed by all workflows. To ensure a secret can be used by all workflows, it must be recreated at the repository level. Repository-level secrets are accessible to any workflow in that repository, regardless of environment, making this the necessary first action.

Why the other options are wrong

• A. Organization-level secrets are broader than needed and would require additional setup; repository level is the appropriate scope for workflows within a single repository.
• C. Required reviewers is a deployment protection feature and does not affect secret accessibility across workflows.

Correct answer: A. Add a deployment gate.

Deployment gates are used in Azure DevOps release pipelines to enforce policy compliance checks before deployments proceed. A deployment gate can evaluate whether releases comply with Azure Policy rules assigned to a subscription, preventing non-compliant releases from being deployed to environments.

Why the other options are wrong

• B. Deployment queue settings control the order and concurrency of deployments, not compliance validation.
• C. Deployment triggers define when releases are created, not whether they comply with policies.
• D. Pipeline variables store values for use in the pipeline but do not enforce policy compliance.

Correct answer: B. No

Configuring Notifications settings in Azure DevOps allows you to receive alerts about build and release pipeline events, but scaling events for VMSS occur at the Azure infrastructure level, not within the DevOps pipeline. Azure DevOps notifications are limited to project-related activities and cannot be triggered by Azure resource scaling events.

Correct answer: D. Configure conditional access in Azure Active Directory.

Conditional Access in Azure Active Directory allows you to enforce access policies based on device location and network conditions. By configuring conditional access policies in Azure AD, you can restrict Azure DevOps access to only devices connected to the company's on-premises network, providing the necessary security controls for location-based access restrictions.

Why the other options are wrong

• A. Security group assignment controls user membership but not network location restrictions.
• B. GPOs manage Windows domain policies and cannot control Azure DevOps cloud access.
• C. Project Settings in Azure DevOps manage project-level permissions but lack network-based access controls.

Correct answer: B. Register GitHub in Azure AD.

To configure GitHub to use Azure Active Directory for authentication, you must first register GitHub as an application in Azure AD. This registration establishes the trust relationship and service principal needed for SAML or OAuth authentication between GitHub and Azure AD. Registration must occur before any authentication policies or conditional access rules can be applied.

Why the other options are wrong

• A. Conditional access policies are configured after GitHub is registered in Azure AD, not before.
• C. Azure AD B2C is used for customer/external user authentication scenarios, not for configuring GitHub enterprise authentication with standard Azure AD.
• D. Modifying GitHub security settings is a step that follows Azure AD registration, not a prerequisite.

Correct answer: D. Push a GitHub Actions workflow to all the repositories.

CodeQL scanning in GitHub Enterprise is enabled by pushing a GitHub Actions workflow file to the repositories. The workflow file (typically a YAML file in the .github/workflows directory) contains the CodeQL analysis job configuration. This approach allows CodeQL analysis to run automatically on code changes. Dependabot features (A, B) handle vulnerability scanning but not CodeQL analysis. While a required workflow (C) could mandate CodeQL runs, the direct method is to push the workflow file itself.

Why the other options are wrong

• A. Dependabot security updates address known vulnerabilities but do not enable CodeQL scanning.
• B. Dependabot alerts notify about vulnerabilities but are not the mechanism for CodeQL analysis.
• C. Requiring a workflow enforces its use but does not actually deploy the CodeQL workflow to repositories.

Correct answer: C. a user-assigned managed identity

A user-assigned managed identity is the optimal solution for this scenario. By creating a single user-assigned managed identity and assigning it to all three web servers, you minimize permission grants (one identity receives one set of permissions) while following least privilege principles. Each server uses the same managed identity to authenticate to Key Vault with only the necessary secret retrieval permissions. This approach is superior to system-assigned identities, which would require three separate permission grants, one for each server.

Why the other options are wrong

• A. RBAC permissions alone don't solve the authentication problem; you still need an identity to grant them to.
• B. System-assigned managed identities create separate identities per server, requiring multiple permission grants rather than minimizing them.
• D. Service principals require manual credential management and do not minimize permission grants as effectively as a shared user-assigned managed identity.

Correct answer: A. Yes

Implementing Continuous Assurance meets the goal of preventing project configuration from changing over time. Continuous Assurance involves continuous monitoring, scanning, and validation of configurations to ensure they remain compliant and unchanged from baseline state. This approach detects unauthorized configuration changes and can enforce policies that prevent modifications, thereby protecting the project configuration integrity over time.

Correct answer: A. No adjustment required.

Black Duck is a leading tool for managing open source components and ensuring compliance with licensing requirements. It identifies all open source libraries in a codebase and verifies that their licenses align with company policies. This statement is accurate and requires no adjustment.

Why the other options are wrong

• B. Maven is a build automation tool for Java projects, not a license compliance verification solution.
• C. Bamboo is a continuous integration server, not a tool for open source license compliance verification.
• D. CMAKE is a build system generator, not a tool designed for open source license compliance management.

Correct answer: B. Add a status check to the policies of the main branch.

To ensure that all code passes security validation before deployment, you should add a status check to the policies of the main branch. Status checks enforce that custom security validation tools must complete successfully before code can be merged to the main branch, preventing any code from reaching deployment without passing the security validation. This ensures App1 only deploys code that has been validated.

Why the other options are wrong

• A. Applying status checks only to a development branch does not prevent unvalidated code from reaching main and being deployed.
• C. Service hooks trigger actions on events but do not enforce validation requirements before deployment.
• D. Limiting job authorization scope affects permissions for pipeline execution but does not enforce pre-deployment security validation.

Correct answer: A. Github Enterprise

GitHub Enterprise is the appropriate choice for storing source code on a managed Windows server within the company network. GitHub Enterprise provides an on-premises installation option that allows source code management on internal infrastructure while integrating with Azure DevOps. The other options either lack on-premises capability or are cloud-only solutions unsuitable for on-premises Windows server deployment.

Why the other options are wrong

• B. Bitbucket Cloud is a cloud-hosted solution, not suitable for on-premises network storage.
• C. GitHub Professional is a cloud-based tier and does not support on-premises deployment.
• D. While Git in Azure Repos works with Azure DevOps, it is the Azure-hosted option, not an on-premises Windows server solution.

Correct answer: A, D. the secret key of WS1; the ID of WS1

The Microsoft Enterprise Cloud Monitoring extension is the Log Analytics agent for VMs. Its public setting requires the workspace ID, and its protected setting requires the workspace key. These two values tell the agent which workspace to report to and authenticate it.

Why the other options are wrong

• B. The subscription ID is not part of the extension's settings.
• C. The Log Analytics agent authenticates with the workspace key, not with the VM's managed identity.
• E. The VM's resource ID is not needed because the extension is installed on the VM itself.

Correct answer: C. Maven

Maven is a widely-used build automation tool for Java projects that integrates seamlessly with SonarQube for code quality analysis. Maven handles project building, dependency management, and can execute SonarQube analysis as part of the build pipeline. Grunt and Gulp are JavaScript task runners unsuitable for Java projects, and Octopus is a deployment tool, not a build tool.

Why the other options are wrong

• A. Grunt is a JavaScript task runner and is not appropriate for Java projects.
• B. Octopus is a deployment automation tool, not a build tool for Java projects.
• D. Gulp is a JavaScript task runner and is not appropriate for Java projects.

Correct answer: B. availability tests in Azure Application Insights

Availability tests in Azure Application Insights are specifically designed to monitor web endpoints and verify they return expected status codes (such as 200). When an availability test fails, it can trigger alerts that send email notifications. This is the direct feature for monitoring HTTP status codes and generating alerts based on them.

Why the other options are wrong

• A. Service Map visualizes dependencies between components but does not monitor status codes or generate status-based alerts.
• C. Profiler analyzes application performance and resource usage, not HTTP response status codes.
• D. Application Map shows component relationships and health but is not the primary feature for monitoring specific status codes and triggering alerts.

Correct answer: A. the Dependency agent

Service Map requires the Dependency agent to be installed alongside the Log Analytics agent on monitored virtual machines. The Dependency agent collects data about processes and connections between machines, which is essential for Service Map to visualize dependencies and communication patterns. While the Log Analytics agent collects basic monitoring data, only the Dependency agent provides the detailed connection and process information that Service Map requires.

Why the other options are wrong

• B. Telegraf is a metrics collection agent not required for Service Map.
• C. Windows Azure Diagnostics Extension is for collecting diagnostics data, not for Service Map dependencies.
• D. Azure Monitor Agent is a newer telemetry agent but does not provide the Dependency agent functionality needed for Service Map.

Correct answer: C, D. provides automatic authentication; minimizes the impact on your storage quota

Proxying a private upstream MyGet feed provides automatic authentication by handling credentials transparently through the proxy layer, eliminating manual authentication management. It also protects your storage quota by caching packages at the proxy level rather than consuming storage in your primary feed for every package access.

Why the other options are wrong

• A. Proxying does not minimize upstream source availability issues; it depends on upstream availability.
• B. Proxying may actually increase latency by adding an intermediate layer rather than accessing the upstream directly.

Correct answer: A. Create a variable group in Project1.

A variable group in Azure DevOps linked to Azure Key Vault allows all pipelines in a project to reference vault secrets without storing values in pipeline definitions. When you link a variable group to vault1, the pipeline retrieves secret values at runtime from Key Vault rather than storing them in pipeline code or configuration. This prevents secrets from being exposed in pipeline definitions while making them available across all Project1 pipelines. Secure files store files rather than secrets, pipeline security settings do not enable Key Vault integration, and Contoso organization security policy is not the mechanism for per-project Key Vault access.

Why the other options are wrong

• B. Secure files are for storing binary or text files in pipelines, not for referencing Key Vault secrets.
• C. Pipeline security settings control who can view or edit pipelines but do not enable Key Vault secret integration.
• D. Contoso organization-level security policy does not configure Key Vault access for individual projects; this is configured at the project level through variable groups.

Correct answer: A. Yes

Azure Monitor autoscale settings include a notification section. You can configure it to send email to administrators, co-administrators or specific addresses, or to call webhooks, whenever a scale-in or scale-out action occurs. Configuring the autoscale settings therefore generates the required email alert.

Why the other options are wrong

• B. The autoscale settings include built-in email notifications on scale actions, so the solution does meet the goal.

Correct answer: A. Store the secrets in the environment variables instead of the pipeline variables.

Storing secrets in environment variables instead of pipeline variables prevents them from being logged by Azure Pipelines when command logging is enabled. Environment variables are handled specially by the agent and are not echoed to logs, protecting sensitive values from exposure in build logs.

Why the other options are wrong

• B. Passing secrets on the command line would actually increase the risk of exposure through command logging.
• C. Adding a prefix to variable names does not prevent logging of the values themselves.
• D. Echoing secret values to the command line would explicitly expose them in the logs.

Correct answer: B. No

Continuous deployment automates the release of code to production environments but does not inherently identify or prevent licensing violations and prohibited libraries. It is a deployment mechanism, not a detection or scanning mechanism. The identification of compliance issues must occur before the CD pipeline, typically through CI and automated scanning tools.

Correct answer: A. Yes

Implementing continuous integration directly addresses the requirement to identify licensing violations and prohibited libraries as they occur during development. CI pipelines can include automated scanning tools like WhiteSource Bolt, OWASP Dependency-Check, or similar solutions that run on every commit or pull request, catching compliance issues early in the development process before code reaches production.

Correct answer: B. No

Service hooks in Azure DevOps enable integration with external services based on Azure DevOps events such as code commits and build completions, but they cannot directly trigger from Azure resource events like VMSS scaling. Scaling events occur in the Azure platform layer, not in the Azure DevOps service layer, making service hooks unsuitable for this requirement.

Correct answer: D. Drag and drop the pages in the navigation pane.

In Azure DevOps published wikis, you can directly change the order of pages by dragging and dropping them in the navigation pane of the portal. This is the standard user-interface method for reordering wiki pages without requiring file system changes.

Why the other options are wrong

• A. The .order file method is used for unpublished code wikis stored in repositories, not for published wikis accessed through the portal UI.
• B. The wiki.md file defines wiki content and structure in code wikis, not page ordering in published wikis.
• C. Renaming pages does not change their order in the navigation hierarchy.

Correct answer: C. In Azure AD, configure conditional access.

Azure AD Conditional Access is the mechanism that enforces location-based access policies. It can be configured to require that devices connecting to Azure DevOps must be on the on-premises network, effectively restricting access based on network location while still allowing Azure AD-authenticated users.

Why the other options are wrong

• A. Assigning Stakeholder access level controls feature access within Azure DevOps, not device or network location restrictions.
• B. Azure DevOps Project Settings security controls permission levels within the platform, not external network access requirements.
• D. Risky sign-ins detection is a monitoring feature that alerts on suspicious authentication patterns, not a preventive control for location-based access.

Correct answer: A. From Microsoft Teams, run @azure pipelines subscribe https://dev.azure.com/Contoso/Project1.

After subscribing to a project in Microsoft Teams, you must run the @azure pipelines subscribe command with the project URL from Microsoft Teams to configure subscription settings and filter which events (such as only failed builds) you receive. The subscriptions command (C) lists current subscriptions but does not configure filters. Publishing artifacts (B) and enabling CI (D) are pipeline configuration tasks, not notification filtering.

Why the other options are wrong

• B. Adding a Publish Build Artifacts task is a pipeline configuration, not a method to filter Teams notifications.
• C. The subscriptions command lists active subscriptions but does not allow you to configure event filters.
• D. Enabling continuous integration configures the build trigger, not Teams notification filters.

Correct answer: B, C, E. Modify the application to access the key vault; Configure a Key Vault access policy; Deploy a virtual machine that uses a system-assigned managed identity.

To securely use Key Vault secrets in a server application, you must first deploy a virtual machine with a system-assigned managed identity to authenticate to Key Vault without storing credentials. Second, configure a Key Vault access policy that grants the managed identity permissions to read secrets. Third, modify the application to use the managed identity credentials and Key Vault API to retrieve secrets at runtime. RBAC can supplement access policies but is not required, and DSC extension is not relevant to Key Vault integration.

Why the other options are wrong

• A. RBAC can be used but is not the primary method for Key Vault access control; access policies are the standard approach for Key Vault authorization.
• D. Azure DSC extension is used for configuration management of the server itself, not for Key Vault integration or secret retrieval.

Correct answer: C. CodeQL actions

CodeQL actions provide comprehensive static analysis for scanning all code in a repository for vulnerabilities. CodeQL can be run as GitHub Actions workflows to analyze code before and after commits, providing detailed vulnerability detection across the entire codebase.

Why the other options are wrong

• A. Dependabot alerts focus on dependency vulnerabilities, not comprehensive code scanning.
• B. Branch protection rules enforce policies but do not perform vulnerability scanning themselves.
• D. The GitHub Advisory Database is a reference resource, not a scanning tool.

Correct answer: D. conditional access

Conditional Access in Azure AD allows you to define policies that require multi-factor authentication based on specific conditions, such as sign-in risk or location. This enables enforcing MFA specifically when users access Azure apps from untrusted networks. Access reviews manage user permissions, managed identities handle service authentication, and entitlement management controls resource access, but none provide the condition-based MFA enforcement needed here.

Why the other options are wrong

• A. Access reviews are used to audit and manage user access permissions, not to enforce MFA requirements.
• B. Managed identities provide service-to-service authentication without user credentials, not user MFA enforcement.
• C. Entitlement management controls which users can access specific resources, not MFA authentication requirements.

Correct answer: B. Get only

An ASP.NET Core application needs only to retrieve secrets from Key Vault at runtime, requiring only the Get permission. The List permission would allow enumerating all secrets in the vault, which violates the principle of least privilege. The application should only be able to access the specific secrets it needs, not discover or list other secrets in the vault.

Why the other options are wrong

• A. List permission alone does not allow the application to retrieve actual secret values, making the application unable to function.
• C. Including List permission grants more access than necessary; the application only needs Get permission to retrieve secrets it already knows about.

Correct answer: A, E. Azure Logic Apps; Azure Application Insights

Azure Application Insights collects and analyzes exception data from the application, while Azure Logic Apps can be configured to automatically retrieve this data on a schedule and send formatted summaries to Microsoft Teams via a connector. Together, these services provide the complete solution for automated daily exception reporting.

Why the other options are wrong

• B. Azure Pipelines is for CI/CD automation, not for monitoring exceptions.
• C. Visual Studio App Center is for mobile app distribution and crash reporting, not for web application exception monitoring.
• D. Azure DevOps Project is a project management and configuration service, not for automated monitoring alerts.

Correct answer: D. Creates a service hook subscription.

Service hook subscriptions are the mechanism for connecting Azure Pipelines to external services like Slack. You must first create a service hook subscription that configures which events (build notifications) should be sent to your Slack workspace and channel. Project and global notifications are for internal Azure DevOps notifications only, while service connections are for source control and artifact repository authentication.

Why the other options are wrong

• A. Project-level notifications are for internal Azure DevOps alerts, not external Slack integration.
• B. Service connections authenticate with external services but do not configure event forwarding to Slack.
• C. Global notifications send alerts within Azure DevOps, not to external Slack channels.

Correct answer: C. WhiteSource Bolt

WhiteSource Bolt is an Azure DevOps extension specifically designed to identify open source components and their licenses, ensuring compliance with company licensing standards. It scans dependencies and provides license compliance reports integrated directly into the build pipeline.

Why the other options are wrong

• A. Ansible is a configuration management and automation tool, not a license compliance scanner.
• B. Maven is a build automation tool for Java projects, not a license compliance verification service.
• D. Helm is a Kubernetes package manager, not a licensing compliance tool.

Correct answer: B. No

Azure Log Analytics is not a query language itself; it is a service and platform. While Azure Log Analytics uses Kusto Query Language (KQL) for querying data, the solution requires specifying the actual query language used. The correct answer to this scenario requires using Kusto Query Language (KQL), not simply stating Azure Log Analytics.

Why the other options are wrong

• A. Azure Log Analytics is a service platform, not the query language needed for ad-hoc queries.

Correct answer: A. Events

The Events pane in Application Insights is used to analyze custom events and track how often specific actions occur, including page accesses. This pane allows you to query and visualize the frequency of page views and custom events. While Users tracks individual users and Sessions groups user activities, neither directly answers how often a page is accessed. Impact analyzes the effect of properties on performance.

Why the other options are wrong

• B. Sessions groups activities by user session but doesn't directly measure page access frequency.
• C. Impact analyzes how properties affect performance metrics, not page access frequency.
• D. Users pane tracks unique users rather than page access frequency.

Correct answer: A. the Smart Detection feature in Azure Application Insights

The Smart Detection feature in Azure Application Insights automatically detects abnormal patterns in failure rates and other metrics without requiring manual threshold configuration. Since App1 has variable usage patterns that change weekly, Smart Detection adapts to these fluctuations and identifies true anomalies while minimizing false positives. This approach requires minimal administrative effort as it does not require manual baseline definitions or complex alert rules.

Why the other options are wrong

• B. The Failures feature shows failure information but does not automatically detect abnormal rises in failure rates.
• C. Azure Service Health alerts report on Azure platform issues, not application-specific failure rate anomalies.
• D. While Log Analytics queries can detect failures, they require manual configuration of baselines and thresholds, which is more administrative effort than Smart Detection.

Correct answer: A. Yes

Reducing code coupling and dependency cycles directly addresses technical debt by making code more maintainable and easier to modify. When code is loosely coupled with minimal circular dependencies, developers can add features faster because changes have limited ripple effects throughout the system. This strategy improves code organization and reduces the complexity developers encounter when implementing new features.

Why the other options are wrong

• B. This strategy is effective for reducing technical debt and does help achieve the stated goal of speeding up feature development.

Correct answer: B. a user-assigned managed identity

A user-assigned managed identity is the correct choice when multiple resources need to share a single identity. User-assigned managed identities allow you to create an identity once and assign it to multiple Azure resources, meeting the requirement of using a single identity across four virtual machines. The credentials are managed automatically by Azure, and you can grant privileges to this single identity through RBAC, satisfying all stated requirements. A system-assigned managed identity creates a separate identity for each resource, defeating the goal of a single shared identity.

Why the other options are wrong

• A. System-assigned managed identities create separate identities for each VM rather than a single shared identity.
• C. Service principals require manual credential management, which contradicts the automatic credential management requirement.
• D. User accounts do not provide automatic credential management in Azure resource contexts.

Correct answer: A. Send to Log Analytics

Send to Log Analytics enables querying and alerting on diagnostic metrics through Log Analytics workspace. This provides the most straightforward way to set up alerts on connection metrics without custom development. Log Analytics has built-in alerting capabilities that can trigger when the simultaneous connections threshold of 10,000 is reached. The other options require additional development work: streaming to an event hub requires custom processing logic to detect the threshold, and archiving to storage requires post-processing and manual analysis.

Why the other options are wrong

• B. Event hub streaming requires additional development effort to process the stream and generate alerts.
• C. Archiving to storage requires manual inspection or custom code to analyze the data and trigger alerts.

Correct answer: D. From the Security settings of the branch, modify the access control for the user.

Branch-level security settings in Azure DevOps allow you to grant specific users override permissions for branch policies without giving them broad administrative rights. This allows a specific user to bypass the build policy requirement for the master branch while maintaining the policy for other users, adhering to least privilege. Adding the user to Build Administrators or Project Administrators groups would grant unnecessary broad permissions across the entire project or organization.

Why the other options are wrong

• A. Build Administrators group has permissions beyond branch policy overrides and violates least privilege.
• B. Project Administrators group grants excessive permissions across the entire project, far beyond the specific need to override one branch policy.
• C. Repository-level security controls access to the entire repository; branch-level controls are more granular and appropriate for this scenario.

Correct answer: D. a single long-running branch with multiple short-lived feature branches

A single long-running main branch with multiple short-lived feature branches (trunk-based development with feature branches) meets all requirements. Multiple independent feature branches allow parallel work on different tasks. The main branch remains releasable since features are merged only when complete and tested. Features can be abandoned by simply not merging the branch. Short-lived branches encourage experimentation without affecting main stability. A single long-running branch (A) prevents parallel work. Multiple long-running branches (B) complicate integration. A fork per team member (C) creates isolation that conflicts with collaborative goals.

Why the other options are wrong

• A. A single branch without forking prevents parallel independent work on different tasks.
• B. Multiple long-running branches increase complexity and make integration difficult.
• C. Individual forks isolate work excessively and complicate team collaboration and integration.

Correct answer: D. the Application Health extension

The Application Health extension is specifically designed for Azure virtual machine scale sets to monitor application health and determine instance eligibility for upgrade operations. It can evaluate custom health criteria at the application level without requiring administrative configuration of complex probes, and it directly integrates with scale set upgrade policies. A Load Balancer health probe cannot assess application-specific health for upgrade eligibility, Monitor autoscale manages scaling rather than health checking, and Custom Script Extension requires manual scripting.

Why the other options are wrong

• A. A Load Balancer health probe monitors connectivity but cannot evaluate application-specific health requirements like HTTPS mutual authentication.
• B. Azure Monitor autoscale manages instance scaling based on metrics, not health checking for upgrade eligibility.
• C. Custom Script Extension requires manual scripting and administration, increasing effort rather than minimizing it.

Correct answer: B. Integrate Azure DevOps and SonarQube.

Integrating Azure DevOps with SonarQube provides continuous code quality analysis specific to Java projects, enabling teams to identify, track, and manage technical debt effectively. This integration allows quality metrics to be monitored throughout the development lifecycle. Post-deployment approvals occur too late to prevent technical debt, and Azure DevTest Labs is for test environment provisioning, not technical debt management.

Why the other options are wrong

• A. Post-deployment approvals cannot prevent technical debt from being introduced into production.
• C. Azure DevTest Labs manages test environments but does not contribute to technical debt analysis or management.

Correct answer: B. PromQL

PromQL (Prometheus Query Language) is the standard query language used with Azure Monitor managed service for Prometheus. When analyzing metrics collected from AKS using Prometheus, PromQL is the appropriate language to query and analyze the performance data.

Why the other options are wrong

• A. PL/SQL is used for SQL databases, not Prometheus metrics.
• C. SparkQL is not a standard query language for Prometheus or Azure Monitor.
• D. KQL (Kusto Query Language) is used for Log Analytics and other Azure Monitor workspaces, not Prometheus metrics.

Correct answer: B. Microsoft Visual Studio App Center integration

Microsoft Visual Studio App Center provides all three required capabilities: crash report collection for analysis, beta release distribution to testers, and user feedback collection on app functionality. It integrates with Azure DevOps for work item management and is specifically designed for mobile app lifecycle management on Android and iOS.

Why the other options are wrong

• A. The Microsoft Test & Feedback extension is for manual testing feedback within Azure DevOps, not for crash reporting or beta distribution.
• C. Azure Application Insights widgets are for monitoring web applications, not for mobile-specific crash reporting and beta distribution.
• D. Jenkins integration is a CI/CD tool and does not provide crash reporting or user feedback collection capabilities.

Correct answer: A. bfg

BFG (BFG Repo-Cleaner) is a specialized tool designed to remove large files from Git repository history. It efficiently rewrites the entire repository to purge the accidentally committed large file from all commits, reducing the repository size.

Why the other options are wrong

• B. Git LFS is used for managing large files going forward, not for removing them from history.
• C. GVFS (Git Virtual File System) optimizes repository access but does not remove files from history.
• D. The init command initializes repositories and is unrelated to removing files.

Correct answer: B. No

Pre-deployment gates occur after code has already been developed and tested, functioning as a barrier to production deployment. While they can prevent problematic code from reaching production, they do not identify licensing violations and prohibited libraries as they occur during the development process itself. These issues would already be embedded in the codebase by the time pre-deployment gates are evaluated.

Correct answer: D. Azure Security Center

Azure Security Center provides security recommendations and assessments for various Azure resources. The Compute and Apps section within Azure Security Center displays security recommendations specifically for compute resources like App Service web apps and Azure Functions. This is the correct service to navigate to for viewing these security insights.

Why the other options are wrong

• A. Azure Log Analytics is used for log aggregation and querying, not for displaying security recommendations.
• B. Azure Event Hubs is a data streaming platform, not a service for security recommendations.
• C. Azure Advisor provides general optimization recommendations but Azure Security Center is the dedicated service for security-specific guidance.

Correct answer: D. the secret scanning partner

GitHub's secret scanning feature automatically notifies the configured secret scanning partner (such as the service that issued the secret) first when a pattern matching a known secret is detected in a commit. This allows the partner to take immediate action like revoking credentials before other parties are notified.

Why the other options are wrong

• A. Organization administrators are not the first notification recipients in GitHub's secret scanning workflow.
• B. The committer is not automatically notified first by the secret scanning system.
• C. The repository owner is notified, but not before the secret scanning partner.

Correct answer: D. Visual Studio Codespaces

Visual Studio Codespaces is a cloud-hosted development environment that integrates with GitHub, provides debugging tools, and works in browsers without local installation. It supports remote workers, hot-desking, and functions on any device with a browser including tablets and Chromebooks. VS Code, Xamarin Studio, and MonoDevelop are desktop applications lacking the cloud-based browser accessibility and cross-platform device support required.

Why the other options are wrong

• A. VS Code is a desktop application without cloud-based remote access for browsers and non-traditional devices.
• B. Xamarin Studio is specialized for mobile development and lacks cloud-based browser access.
• C. MonoDevelop is a desktop IDE without cloud deployment and browser accessibility.

Correct answer: B, D. the Azure Log Analytics agent; the Dependency agent

The Azure Log Analytics agent collects detailed data from the guest operating system including process information and performance metrics, while the Dependency agent maps process dependencies and inter-process communications running on virtual machines. Together, these agents provide comprehensive guest-level monitoring and detailed process insights. Telegraf is used for infrastructure monitoring but not guest OS processes. The Network Watcher Agent for Windows focuses on network diagnostics, not process-level monitoring.

Why the other options are wrong

• A. Telegraf is a metric collection agent primarily for infrastructure monitoring, not detailed guest OS process data.
• C. The Azure Network Watcher Agent for Windows is designed for network diagnostics and connectivity monitoring, not process-level guest OS monitoring.

Correct answer: C. You should make use of a gate.

A gate in Azure Pipelines is a quality control mechanism that evaluates specified conditions before allowing a release to proceed to the next stage. By configuring gates with Azure Monitor alerts, you can automatically prevent releases that fail to meet performance baseline conditions from being deployed to production. Gates act as automated guardrails that enforce quality standards based on predefined criteria.

Why the other options are wrong

• A. Branch control checks manage code integration and branching strategies, not release quality validation.
• B. Alert triggers notify stakeholders about issues but do not automatically block releases from proceeding.
• D. Approval checks require manual intervention, whereas automated gates can immediately block releases based on performance metrics.

Correct answer: D. SonarQube

SonarQube is a code quality and security analysis platform that identifies package dependencies with known security vulnerabilities and recommends updates. It integrates into CI/CD pipelines to scan for and report security issues in dependencies.

Why the other options are wrong

• A. Octopus Deploy is a release management tool, not a security vulnerability scanner for dependencies.
• B. Jenkins is a CI/CD automation server but does not natively scan for dependency vulnerabilities.
• C. Gradle is a build automation tool, not a security vulnerability identification service.

Correct answer: B. No

Transact-SQL is designed for SQL Server and Azure SQL Database data manipulation, not for querying monitoring telemetry from Application Insights or Azure Log Analytics. For ad-hoc queries against monitoring and diagnostics data in these services, you must use Kusto Query Language (KQL), not T-SQL.

Why the other options are wrong

• A. T-SQL cannot be used to query Application Insights or Log Analytics monitoring data.

Correct answer: C, D. Create an Azure Service Health alert; Create and configure an action group.

To send SMS alerts for scheduled maintenance, you need both a Service Health alert (which detects planned maintenance notifications from Azure) and an action group (which defines how and where to send the notification, including SMS). The Service Health alert triggers based on Azure infrastructure events, and the action group specifies the SMS recipient and delivery mechanism.

Why the other options are wrong

• A. Azure Security Center focuses on security posture and threat detection, not service maintenance notifications.
• B. Monitor alert rules are for metric-based alerts on resources, not for Azure-wide service health and maintenance events.

Correct answer: A. Azure Application Insights

Azure Application Insights is the appropriate tool for tracking application performance metrics including page load times, response times, and other performance data from web applications. It provides comprehensive telemetry and analytics for multi-tier applications hosted on Azure App Service.

Why the other options are wrong

• B. The activity log shows subscription-level management operations, not application performance metrics.
• C. Diagnostic logs contain system logs and error information, not performance metrics like page load times.
• D. Azure Advisor provides recommendations for cost optimization and security, not application performance metrics.

Correct answer: C, E. the Azure virtual machines that run the latest version of Ubuntu; The Windows Server 2019 container images hosted in the Azure Container Registry.

Azure Security Center provides vulnerability assessments for Azure virtual machines (including Ubuntu) and container images stored in Azure Container Registry. The Log Analytics workspace, Key Vault, and Azure AD are not resources that receive vulnerability assessments from Azure Security Center. Security scanning focuses on compute resources and container images where vulnerabilities in dependencies and system components can be detected.

Why the other options are wrong

• A. Azure Log Analytics workspace does not receive vulnerability assessments from Security Center.
• B. Azure Key Vault does not receive vulnerability assessments from Security Center.
• D. Azure Active Directory does not receive vulnerability assessments from Security Center.

Correct answer: A. Kanban boards

Kanban boards visualize work flow in an agile methodology, displaying tasks across columns representing workflow stages (e.g., To Do, In Progress, Done). This provides visibility into work status and supports continuous delivery principles. Sprint planning (B) is a meeting activity, not a visualization component. Delivery plans (C) show high-level timelines across teams. Portfolio backlogs (D) manage program-level items. Only Kanban boards directly visualize workflow and work progress in agile methodology.

Why the other options are wrong

• B. Sprint planning is a meeting activity, not a visualization component.
• C. Delivery plans show timeline overviews but do not visualize individual work flow.
• D. Portfolio backlogs focus on strategic planning rather than work flow visualization.

Correct answer: C, E. Select Never assign certain team members; Set Routing algorithm to Load balance.

To prevent assignment to the team leader, you must select 'Never assign certain team members' (option C). To ensure equal distribution of code reviews across a 30-day period while prioritizing those with fewer outstanding assignments, you set the routing algorithm to 'Load balance' (option E), which automatically distributes work based on current workload. The Load balance algorithm meets both requirements by balancing assignments over time and respecting team member constraints.

Why the other options are wrong

• A. Clearing 'Never assign certain team members' would remove restrictions rather than add them to exclude the team leader.
• B. Notification preferences do not affect assignment distribution or load balancing logic.
• D. Round robin assigns in fixed sequential order and does not prioritize based on current outstanding assignments or workload.

Correct answer: D. Azure Log Analytics

Azure Log Analytics is the central repository for storing and querying telemetry data from multiple sources including Web Apps and SQL Database. It supports ad-hoc KQL queries to establish baselines, integrates with Azure Monitor for alerting when metrics exceed thresholds, and provides a unified location for application and database metrics. Event Hubs is for streaming data ingestion, Intelligent Insights provides specific database performance analysis, and Application Insights focuses on application-level monitoring without the comprehensive querying and alerting capabilities needed here.

Why the other options are wrong

• A. Event Hubs is designed for high-volume event streaming ingestion, not for storing and querying historical telemetry data.
• B. Intelligent Insights provides automated database performance analysis but does not support ad-hoc queries or centralized storage for both application and database metrics.
• C. Application Insights is primarily for application telemetry and lacks the centralized querying and comprehensive baseline comparison capabilities required.

Correct answer: B. No

A service hook subscription using the build completed event triggers when a build finishes in Azure DevOps, not when a developer commits changes to a branch. To send a notification to Jenkins when code is committed, you need a service hook subscription using the code pushed event or commit event, which fires when changes are pushed to Azure Repos. The build completed event occurs after build execution, making it unsuitable for this requirement.

Why the other options are wrong

• A. Build completed events occur after build execution, not when developers commit code to branches.

Correct answer: D. From Import a Git repository, click Import.

The 'Import a Git repository' option in Azure DevOps is the direct procedure for cloning a repository from GitHub to Azure DevOps. This feature allows you to specify the GitHub repository URL and import its entire history and content into a new Azure DevOps repository in a single operation.

Why the other options are wrong

• A. Pull requests are for code review workflows, not for initial repository cloning.
• B. Webhooks are for triggering events but do not perform repository cloning.
• C. Service connections enable integration but are not the mechanism for cloning repositories.
• E. Personal access tokens are authentication credentials but do not directly clone repositories.

Correct answer: B. Smart Detection uses the first 24 hours to establish the normal behavior of the web app.

Smart Detection requires an initial learning period of 24 hours to establish baseline behavior and normal performance patterns for the application. During this baseline period, Smart Detection cannot send notifications because it hasn't yet learned what normal behavior looks like. After 24 hours, Smart Detection can identify anomalies and abnormal failures that deviate from the established baseline.

Why the other options are wrong

• A. Snapshot Debugger is used for detailed debugging of exceptions but is not required for Smart Detection notifications.
• C. The shared service plan tier does not prevent Smart Detection from functioning; Smart Detection works across different pricing tiers.
• D. Restarting the web app is not necessary to enable Smart Detection once it is configured.

Correct answer: D. WhiteSource Bolt

WhiteSource Bolt is an automated solution integrated into Azure DevOps build pipelines that detects open source libraries as they are added to the codebase and verifies compliance with licensing standards. It provides continuous monitoring and policy enforcement.

Why the other options are wrong

• A. OWASP ZAP is a security testing tool for web application vulnerabilities, not license compliance.
• B. Jenkins is a CI/CD server that requires additional plugins and configuration for license scanning.
• C. Code Style is used for enforcing code formatting standards, not detecting open source license issues.

Correct answer: C. a readiness probe

A readiness probe is the correct choice for verifying that DB1 can handle incoming requests before allowing traffic from App1. Readiness probes check whether a container is ready to accept traffic after startup initialization. In this scenario, since DB1 loads a large amount of data during startup, a readiness probe ensures the data loading is complete and the container is ready to handle requests before users can submit requests through App1.

Why the other options are wrong

• A. A liveness probe detects if a container has crashed and needs restart; it does not verify readiness to accept requests.
• B. A performance log tracks metrics but does not actively verify that a container is ready to handle incoming requests.
• D. An Azure Load Balancer health probe is for load balancer configuration, not for verifying individual container readiness in Container Instances.

Correct answer: A. Yes

Creating an action group in Azure Monitor is the correct solution. You would configure an autoscale alert rule in Azure Monitor to detect when VMSS scales in or out, then attach an action group to that alert that sends email notifications. This directly addresses the requirement by monitoring the Azure resource and triggering email alerts based on scaling events.

Correct answer: B, D. Clear Flaky tests included in test pass percentage; Manually mark the test as flaky.

To prevent a flaky test from failing the build, you should manually mark the test as flaky and clear flaky tests from the test pass percentage calculation. Marking the test as flaky signals that the test is unreliable, and excluding it from the pass percentage ensures that occasional failures do not fail the entire pipeline. Disabling flaky test detection would hide the problem, TIA and test slicing are optimization techniques unrelated to preventing failure.

Why the other options are wrong

• A. Turning off flaky test detection prevents the system from identifying unreliable tests, leaving the pipeline vulnerable to failures.
• C. Test Impact Analysis optimizes which tests run but does not prevent flaky tests from failing the build.
• E. Test slicing distributes tests across agents for parallelization but does not address flaky test failures.

Correct answer: A, B, E. Publish the package to a feed; Create a new feed in Azure Artifacts; Add the package URL to the NuGet Package Manager settings in Visual Studio.

Creating a new feed in Azure Artifacts provides a central repository for managing custom packages. Publishing the package to that feed makes it available for consumption. Adding the package URL to the NuGet Package Manager settings in Visual Studio enables automatic discovery and installation of the latest version. Git repositories are for source code management, not package distribution, and Environment settings are not where package sources are configured in Visual Studio.

Why the other options are wrong

• C. Git repositories are for source code version control, not for managing and distributing NuGet packages centrally.
• D. Environment settings in Visual Studio are not used to configure package sources; NuGet Package Manager settings are the correct location.
• F. Creating a Git repository is unnecessary for package management; Azure Artifacts is the proper solution for centralized package distribution.

Correct answer: D. Github Codespaces

GitHub Codespaces is a cloud-based development environment that integrates directly with GitHub, provides integrated debugging tools, works entirely in browsers, and supports remote workers and hot-desking without requiring local machine setup. It functions on any device with a browser, including tablets and Chromebooks. VS Code, Xamarin Studio, and MonoDevelop are desktop applications that lack the cloud-based accessibility and browser support required.

Why the other options are wrong

• A. VS Code is a desktop application that does not provide cloud-based remote access for browsers and tablets.
• B. Xamarin Studio is a mobile development tool, not suitable for general development and lacks cloud-based browser access.
• C. MonoDevelop is a desktop IDE that does not support browser-based access or hot-desking environments.

Correct answer: A. You should create a build task and use the WhiteSource Bolt service.

WhiteSource Bolt should be configured as a build task within the Azure DevOps build pipeline to scan for security weaknesses in open source libraries. Running it during the build phase allows early detection of vulnerabilities before deployment. This integrates seamlessly into the CI/CD workflow and provides immediate feedback on security issues.

Why the other options are wrong

• B. Security scanning for open source libraries should occur during the build phase, not deployment, for early detection.
• C. Chef is a configuration management tool, not a security scanning solution for open source dependencies.
• D. Chef is a configuration management tool and should not be used as a deployment task for security scanning.

Correct answer: D. Microsoft Teams

Microsoft Teams meets all the stated requirements: it provides isolated channels for different project teams with chat history, runs on Windows 10, macOS, iOS, and Android, allows adding external contractors and suppliers, and integrates directly with Azure DevOps through connectors and bots. Teams is the modern unified communication platform designed for enterprise collaboration.

Why the other options are wrong

• A. Microsoft Project is a project management tool, not a communication platform.
• B. Bamboo is a CI/CD tool by Atlassian and does not provide communication capabilities.
• C. Microsoft Lync (now Skype for Business) is outdated and lacks the channel-based organization and Azure DevOps integration of Teams.

Correct answer: B. Create an app registration in Azure AD

Creating an app registration in Azure AD is the first required step to authenticate users with Azure AD. The app registration establishes the application's identity in Azure AD, enables token endpoint access, and creates the necessary credentials for authentication flows. Without registering the app, you cannot configure SAML endpoints, obtain tokens, or assign the enterprise application to users.

Why the other options are wrong

• A. Assigning an enterprise application to users requires the app to already be registered and configured.
• C. Configuring SAML endpoints requires the app to be registered first.
• D. OAuth tokens can only be obtained after the application is registered and configured.
• E. A membership database is not necessary when using Azure AD for authentication.

Correct answer: B, E. Install the Git LFS extension and associate the extension to ZIP files; Store files in Azure Storage and enable blob versions.

Git LFS (Large File Storage) is the standard Git extension for versioning large binary files while maintaining association with commits. Storing files in Azure Storage with blob versioning provides additional version tracking and backup of the large test VM files, ensuring they remain associated with corresponding code commits.

Why the other options are wrong

• A. Git-fat is an older alternative to LFS and is not the recommended solution.
• C. Git-stash is for temporary work storage, not for versioning large files.
• D. GZip compression alone does not solve the versioning requirement for 3-GB files in Git.

Correct answer: C. Add an Azure Key Vault task to the pipeline.

The Azure Key Vault task in Azure DevOps pipelines is specifically designed to securely retrieve secrets from Azure Key Vault during pipeline execution without exposing them in logs or configuration files. This task prevents credentials from being leaked by handling secret retrieval securely as part of the pipeline workflow. Running PowerShell inline or using Set-AzureKeyVaultSecret exposes the pipeline to credential handling risks, and adding Key Vault references to ARM templates stores references in template files rather than retrieving secrets securely during execution.

Why the other options are wrong

• A. Running inline Azure PowerShell in the pipeline requires embedding credentials or secret retrieval logic directly in the pipeline definition, increasing leak risk.
• B. Using Set-AzureKeyVaultSecret stores secrets rather than retrieving them, and PowerShell tasks can expose credentials in logs or pipeline definitions.
• D. Adding Azure Key Vault references to ARM templates still stores configuration references in files that could be exposed; it does not secure the actual credential retrieval during pipeline execution.

Correct answer: A. Azure Key Vault

Azure Key Vault is the secure service designed specifically to store and manage sensitive credentials, secrets, and connection strings. It prevents the deployment user from viewing the actual credentials while allowing the application to retrieve them securely at runtime. Web.config and Appsettings.json files store secrets in plain text in the application, Azure Storage tables are not designed for credential management, and ARM parameter files are source-controlled and expose secrets.

Why the other options are wrong

• B. Web.config files store credentials in plain text within the application codebase, making them viewable to anyone with file access.
• C. Appsettings.json files store configuration including secrets in plain text, exposing them to anyone accessing the file.
• D. Azure Storage tables are not designed for credential management and do not provide the security isolation of Key Vault.
• E. ARM parameter files are typically stored in version control and source repositories, exposing their contents to anyone with repository access.

Correct answer: A. Yes

Reducing code complexity directly addresses technical debt and enables faster feature development. Complex code is harder to understand, maintain, and modify, which slows the addition of new features. By refactoring to reduce complexity through simplification, breaking down large functions, and improving code structure, the development team can work more efficiently and accumulate less technical debt.

Correct answer: B. No

Contextual Query Language (CQL) is not a valid query language for Azure SQL Database Intelligent Insights or Azure Application Insights. For ad-hoc queries against monitoring data, you must use Kusto Query Language (KQL), which is the standard query language for Azure Log Analytics and Application Insights. CQL does not exist in the Azure monitoring ecosystem.

Why the other options are wrong

• A. CQL is not a recognized query language in Azure for monitoring purposes.

Correct answer: A. Features and Tasks

Features and Tasks represent the work levels where individual teams execute autonomously. Features are large units of work that teams own and complete, while Tasks break down the implementation details. This level of granularity allows each team to work independently on their assigned features and tasks while contributing to the common goal. Initiatives and Epics (B) are higher-level strategic planning elements typically managed at the company or program level, not by individual teams. Epics and Features (C) skips the team-level execution detail, and Stories and Tasks (D) is too granular for team ownership.

Why the other options are wrong

• B. Initiatives and Epics represent strategic company-level goals, not autonomous team-level work.
• C. Epics and Features omits the task-level detail needed for team autonomy.
• D. Stories and Tasks does not align with the team ownership model as effectively as Features and Tasks.

Correct answer: C. Black Duck

Black Duck is a software composition analysis platform that scans projects for open source libraries and validates their licenses against company compliance standards. It provides detailed reporting on all dependencies and their licensing requirements.

Why the other options are wrong

• A. NuGet is a .NET package manager, not a license compliance verification service.
• B. Maven is a Java build tool, not a licensing compliance scanner.
• D. Helm is a Kubernetes package manager, not an open source license compliance tool.

Correct answer: B. ensures that all traffic to new Azure Storage accounts is encrypted

The policy uses an 'allof' condition requiring two criteria: (1) the resource type must be 'Microsoft.Storage/storageAccounts' AND (2) the field 'supportsHttpsTrafficOnly' must NOT equal 'true'. When both conditions are met, the effect is 'deny', which blocks the creation or update of storage accounts that do not enforce HTTPS-only traffic. This means the policy ensures that all new Azure Storage accounts configured through this policy must have HTTPS traffic enforcement enabled, thereby ensuring all traffic to these accounts is encrypted in transit.

Why the other options are wrong

• A. The policy targets new storage accounts based on their HTTPS configuration, not existing accounts, and it doesn't prevent HTTP traffic directly but rather denies accounts lacking HTTPS-only enforcement.
• C. The policy ensures HTTPS is required, not that it is prevented; the 'deny' effect blocks accounts without HTTPS support, the opposite of preventing HTTPS traffic.
• D. The policy concerns HTTPS traffic encryption in transit, not data encryption at rest; 'supportsHttpsTrafficOnly' relates to transport layer security, not storage encryption.

Correct answer: C. the Source control settings for the Automation account

The Source control settings for the Automation account is where you configure the connection between your Azure Automation runbook and the Azure DevOps repository. This setting enables automatic synchronization and publishing of runbook changes whenever code is committed to the repository. Service hooks, Connections, and Service connections are either not the primary mechanism for this integration or apply to different scenarios.

Why the other options are wrong

• A. Service hooks in DevOps configure notifications and integrations but are not the primary mechanism for automatic runbook updates.
• B. Connections settings in the Automation account are for general authentication, not specifically for source control integration.
• D. Service connections in DevOps are for pipeline integrations, not for Automation account source control setup.

Correct answer: C. Black Duck

Black Duck is a software composition analysis tool that detects open source libraries in code and verifies their licensing compliance. It integrates into build pipelines to automatically scan for open source components and flag licensing issues.

Why the other options are wrong

• A. Microsoft Visual SourceSafe is a legacy version control system, not a license compliance tool.
• B. Code Style is a code formatting and style analysis tool, not a license compliance scanner.
• D. Jenkins is a CI/CD automation platform that does not natively perform open source license detection.

Correct answer: B. Selenium

Selenium is the industry-standard framework for automating UI testing of web applications across multiple browsers and platforms. It supports multiple programming languages and is widely used for automated web application testing in CI/CD pipelines. JaCoco is a code coverage tool, Xamarin.UITest is for mobile app testing, and Microsoft.CodeAnalysis is for code analysis, none of which are UI testing frameworks.

Why the other options are wrong

• A. JaCoco is a code coverage tool for measuring test coverage, not a UI testing framework.
• C. Xamarin.UITest is designed for testing Xamarin mobile applications, not web application UI testing.
• D. Microsoft.CodeAnalysis is a code analysis library, not a UI testing framework.

Correct answer: B. Create an Azure Application Insights availability test and alert.

Azure Application Insights availability tests are specifically designed for URL ping testing at specified intervals from multiple Azure regions, with built-in alerting capabilities. This solution minimizes development time by providing a managed service for availability monitoring without requiring custom code or Azure Functions.

Why the other options are wrong

• A. Azure Monitor Availability metric is not a primary feature; Application Insights is the preferred service for availability testing.
• C. Writing custom Azure Functions increases development time and complexity unnecessarily.
• D. Azure Service Health alerts monitor Azure infrastructure health, not application availability from specific regions.

Correct answer: B, C. git push origin v3.0.5; git tag v3.0.5

To create and push a tag to a remote repository, you must first create the tag locally with 'git tag v3.0.5', then push it to the remote with 'git push origin v3.0.5'. The tag command creates the tag locally, and the push command with the tag name uploads it to the remote repository, making it available to other users.

Why the other options are wrong

• A. The -force flag on git push is not necessary for pushing a new tag and adds unnecessary risk.
• D. Committing with a message does not create a tag; commits and tags are separate objects.
• E. The git add command stages file changes for commit and cannot be used to create tags.

Correct answer: B. No

An email subscription is a notification delivery mechanism only and does not establish programmatic communication between Azure DevOps and Jenkins. The requirement is to send a notification to Jenkins (a system that needs to receive and process the event), not merely send an email to a person. Email notifications cannot trigger Jenkins builds or webhooks.

Why the other options are wrong

• A. Email subscriptions do not establish system-to-system integration or trigger Jenkins actions.

Correct answer: B. You should make use of views.

Views in Azure Artifacts allow you to filter and control which packages are visible and available for consumption. By using views, you can restrict access to packages still in development while allowing release-ready packages to be consumed. This enables a single feed to serve multiple build versions while maintaining quality gates for production releases.

Why the other options are wrong

• A. Static code analysis examines source code but does not control package visibility or release restrictions.
• C. Dynamic code analysis tests running code but does not manage package access or visibility in feeds.
• D. Upstream sources connect to external package feeds but do not restrict development packages from being released.

Correct answer: C, D, E. What could have gone better?; What went well?; What should we try next?

Effective sprint retrospectives focus on continuous improvement through three key reflective questions: What went well (D) identifies successes to continue; What could have gone better (C) addresses improvement areas; and What should we try next (E) defines actionable experiments for the next sprint. These questions support the inspect-and-adapt cycle of agile methodology. Questions about individual performance (A, B) are counterproductive to psychological safety and team dynamics in retrospectives, which should focus on processes and practices.

Why the other options are wrong

• A. Asking who performed well introduces individual evaluation, which undermines psychological safety in retrospectives.
• B. Asking who should have performed better is counterproductive and creates blame rather than improvement focus.

Correct answer: B. 11.2.1

In Semantic Versioning, a bug fix increments the PATCH version (the third number). The current version is 11.2.0, and since the bug fix applies to the current release line, the new version should be 11.2.1. The fact that the bug was introduced in version 10.5.1 is historical context but does not affect the versioning of the current release; you do not revert to or modify old version numbers.

Why the other options are wrong

• A. SemVer does not use a PATCH suffix notation; the patch is expressed as the third number increment.
• C. Incrementing to 10.5.2 would revert to an old major and minor version, which is incorrect.
• D. Incrementing the minor version is for new features, not bug fixes.

Correct answer: A, E. The dependency graph of a repository changes; A new advisory is added.

Dependabot scans are triggered automatically in two scenarios: when the dependency graph of a repository changes (indicating new or updated dependencies), and when a new advisory is added to GitHub's security database (alerting you to newly discovered vulnerabilities in your existing dependencies). These are the only automatic triggers; pull requests and commits do not automatically trigger Dependabot scans, and forking does not initiate scanning.

Why the other options are wrong

• B. Pull requests do not automatically trigger Dependabot scans; scans occur based on schedule or dependency changes.
• C. Forking a repository does not trigger Dependabot scanning on the fork.
• D. Arbitrary commits do not trigger Dependabot scans; only changes to dependency files trigger the dependency graph update.

Correct answer: C. a Request trigger

Azure Monitor alerts invoke a logic app through an action group that posts the alert payload to the logic app's HTTP endpoint. That endpoint is created by the Request trigger, shown in the designer as When an HTTP request is received. The logic app can then send the email and run the follow-up actions.

Why the other options are wrong

• A. An HTTP Webhook trigger subscribes to an external service's webhook and waits for a callback, which is not how Azure Monitor action groups call a logic app.
• B. An HTTP trigger polls an external endpoint on a schedule rather than receiving the alert call.
• D. An ApiConnection trigger is used with managed connectors and cannot receive an Azure Monitor alert call.

Correct answer: C. npm install

Running npm install installs both production and development dependencies as defined in package.json. To ensure WhiteSource Bolt scans only production dependencies, you should use npm install with appropriate package.json configuration that separates devDependencies from regular dependencies. This allows WhiteSource to focus on production libraries and ignore development-only packages with licensing issues.

Why the other options are wrong

• A. npm edit is used for modifying package metadata, not for controlling dependency installation scope.
• B. npm publish prepares packages for release and does not control which dependencies are scanned.
• D. npm update upgrades existing packages but does not change the scope of what gets scanned.

Correct answer: A. Third-party application access via OAuth

Third-party application access via OAuth must be enabled in Azure DevOps Organization Settings to allow Azure Pipelines for Microsoft Teams to connect and send notifications to Teams. This OAuth integration allows the Teams connector to authenticate and interact with Azure Pipelines on behalf of the organization.

Why the other options are wrong

• B. Azure AD Conditional Access Policy Validation applies to user sign-in policies, not to third-party application connections.
• C. Alternate authentication credentials are for legacy authentication methods and are not related to Teams integration.
• D. SSH authentication is for repository access, not for third-party application integrations.

Correct answer: C. Encrypt the secret value and store the value in the repository. Store the decryption key in the repository-level GitHub secrets.

Since the secret exceeds GitHub's 64-KB limit for secrets storage, the solution is to encrypt the large secret value and store it in the repository, then store only the decryption key in repository-level GitHub secrets. This approach makes the secret accessible only to the workflow, minimizes administrative effort by keeping everything in one repository, and avoids organization-level secret management complexity.

Why the other options are wrong

• A. Organization-level secrets cannot store 256-KB values and would not be workflow-specific.
• B. Repository-level GitHub secrets have a 64-KB size limit and cannot directly store a 256-KB secret.
• D. Using organization-level secrets for the decryption key introduces unnecessary administrative overhead and reduces workflow isolation compared to repository-level management.

Correct answer: A. personal access tokens (PATs) in Azure DevOps

Personal access tokens (PATs) support authentication from Git operations and can be configured to persist across multiple authentication attempts, minimizing the need to repeatedly provide credentials. PATs offer a secure, token-based approach that works seamlessly with Git clients. Alternate credentials require re-entry for each session, user Azure AD accounts do not directly support Git authentication without additional configuration, and managed identities are designed for service-to-service scenarios, not individual Git operations.

Why the other options are wrong

• B. Alternate credentials still require credential entry and are considered a legacy authentication method.
• C. Azure AD user accounts require additional configuration and are not the standard Git authentication mechanism.
• D. Managed identities are designed for applications and services, not for individual Git operations from developers.

Correct answer: A. Add a liveness probe to the YAML configuration of App1.

A liveness probe determines whether a container is still running and healthy. If the liveness probe fails, Kubernetes (and Azure Container Instances) will automatically restart the container. This is the appropriate mechanism to restart ACI1 when App1 stops responding, as the liveness probe detects when the application is unresponsive and triggers a restart.

Why the other options are wrong

• B. Readiness probes determine whether a container is ready to receive traffic but do not trigger restarts; they only remove the container from service temporarily.
• C. Connection Monitor in Network Watcher monitors network connectivity between resources but does not automatically restart containers.
• D. IP flow verify checks whether traffic is allowed between specific endpoints but does not monitor application health or trigger restarts.

Correct answer: A, B. the git filter-branch command; BFG Repo-Cleaner

Both git filter-branch and BFG Repo-Cleaner are specialized tools designed to remove files and their entire history from Git repositories. The git filter-branch command is a native Git tool that can rewrite repository history to remove sensitive files, while BFG Repo-Cleaner is a faster, dedicated alternative specifically built for this purpose. The git rebase command is used for reorganizing commits but cannot remove files from history, and GitHub Desktop is a GUI client without native history rewriting capabilities.

Why the other options are wrong

• C. git rebase reorganizes commits but does not remove files from repository history.
• D. GitHub Desktop is a user interface tool without built-in functionality to remove files from Git history.

Correct answer: C. deployment

In Azure Pipelines, a deployment group is a logical set of target machines, each running an agent, used to deploy an application to multiple virtual machines. Release pipelines use deployment group jobs to deploy to all machines in the group. Universal, security and resource groups are not used to target VMs for deployment.

Why the other options are wrong

• A. A universal group is an Active Directory group scope and cannot be used as a deployment target in Azure Pipelines.
• B. A security group controls permissions and is not a deployment target in Azure Pipelines.
• D. A resource group organizes Azure resources and is not what Azure Pipelines uses to deploy to a set of VMs.

Correct answer: C. SonarCloud analysis

SonarCloud is a cloud-based code quality and security analysis platform designed to continuously inspect code bases for common problematic patterns, code smells, bugs, and vulnerabilities. It integrates seamlessly with development workflows and provides detailed reports on code quality issues. Visual Studio test plans are for test management, Gradle wrapper scripts are build automation tools, and JavaScript task runners are not code analysis solutions.

Why the other options are wrong

• A. Visual Studio test plans manage testing rather than perform code analysis for quality patterns.
• B. Gradle wrapper scripts are build automation tools, not code inspection tools.
• D. JavaScript task runners automate tasks but do not perform continuous code quality inspection.

Correct answer: D, E. Create a branch protection rule for the main branch; Create a CODEOWNERS file.

A branch protection rule for the main branch (D) ensures changes are reviewed before deployment. A CODEOWNERS file (E) designates code owners who must review changes, effectively requiring the security department's approval before merging to main. Together, these enforce validation of all code changes by the security department. A branch protection rule on feature branches (B) does not protect the main branch itself. Signed commits (A) verify authenticity but don't ensure security review. A LICENSE file (C) is unrelated to code validation.

Why the other options are wrong

• A. Signed commits verify the committer's identity but do not enforce security department review.
• B. Protecting feature branches does not ensure validation before main branch deployment.
• C. A LICENSE file defines licensing terms and has no role in code validation or approval.

Correct answer: A. In a Maven build task, select Run PMD.

PMD (Programming Mistake Detector) is a static analysis tool for Java that detects quality issues including unused variables, empty catch blocks, and other code defects. Running PMD in a Maven build task is the standard approach for integrating this analysis into the Java development pipeline. Maven is the appropriate build system for Java applications.

Why the other options are wrong

• B. Xcode is Apple's IDE for iOS and macOS development, not for Java applications.
• C. Gulp is a JavaScript task runner and does not perform Java code analysis.
• D. Grunt is a JavaScript task runner and does not perform Java code analysis.

Correct answer: C. .p12

The .p12 file format is the required certificate file type for distributing iOS apps through App Center. This is a PKCS#12 archive that contains the private key and certificate needed for iOS code signing and distribution.

Why the other options are wrong

• A. .cer files contain only the public certificate without the private key and are not sufficient for app signing.
• B. .pfx is primarily used for Windows code signing, not iOS distribution.
• D. .pvk is a Windows private key format, not used for iOS app distribution.

Correct answer: B, C, D. Redeploy VMSS1; Upload a custom script file to sa1; Modify the Custom Script extension settings of VMSS1.

To implement limited user testing with minimal risk for a stateful application, you must: upload the modified custom script to storage (C), update the Custom Script extension settings to reference the new script version (D), and redeploy VMSS1 to apply the changes (B). Redeploying the scale set allows gradual rollout of the new version. Modifying load balancer settings (A) and updating individual VMs (E) are not appropriate for a scale set managed through custom scripts.

Why the other options are wrong

• A. Modifying load balancer settings does not deploy new application code; the scale set uses custom scripts for deployment.
• E. Updating individual VMs contradicts the scale set management model; changes should flow through the Custom Script extension configuration.

Correct answer: B. Azure Application Insights

Azure Application Insights is the appropriate tool for measuring and analyzing application performance metrics, including page load times. It provides detailed performance telemetry and diagnostics for web applications. Azure Event Hubs is a data streaming service and is not designed for performance monitoring or load time analysis.

Why the other options are wrong

• A. Azure Event Hubs is a data ingestion and streaming platform, not a performance monitoring solution for page load times.
• C. Azure Log Analytics is used for log data analysis but is not the primary tool for measuring average page load times.
• D. Azure Advisor provides optimization recommendations but does not pinpoint specific performance metrics like page load times.

Correct answer: B. From the code repository of webapp1, modify the Startup.cs file.

The Startup.cs file is where sampling rates are configured in .NET Core applications. The ApplicationInsightsServiceCollection extension method is called during application initialization to configure Application Insights, including setting fixed sampling rates programmatically. This allows fine-grained control over sampling behavior at runtime.

Why the other options are wrong

• A. ApplicationInsights.config is not used in .NET Core applications; it is specific to .NET Framework.
• C. Usage and estimated costs settings in Application Insights control data retention and cost, not sampling rates.
• D. Continuous export settings control data export destinations, not sampling configuration.

Correct answer: A, D. Add the name of the default branch to the on: push specification in the code scanning workflow; Update the code in the pull request.

To resolve the 'Analysis not found' error when running code scanning on a non-default branch pull request, you must add the name of the default branch to the on: push specification so that the workflow establishes a baseline analysis. Additionally, you should update the code in the pull request to ensure it can be scanned against that baseline. The workflow needs context from the default branch to properly compare and analyze the pull request changes.

Why the other options are wrong

• B. Adding only the non-default branch to on: push does not solve the baseline analysis problem.
• C. Deleting and re-raising the pull request does not address the underlying workflow configuration issue.
• E. Creating a new workflow is unnecessary when the existing workflow can be configured correctly.

Correct answer: B. GitHub App

A GitHub App is the recommended authentication mechanism for Azure Pipelines to access GitHub repositories because it runs under the Azure Pipelines identity, provides repository-level permissions, and enables better security through scoped access. GitHub Apps are the modern standard for service-to-service authentication with GitHub.

Why the other options are wrong

• A. Personal access tokens are user-specific credentials that do not represent the Azure Pipelines service identity.
• C. Azure AD authentication is not directly supported for GitHub repository access from Azure Pipelines.
• D. OAuth is a delegation protocol, but GitHub App is the specific OAuth-based mechanism designed for this use case.

Correct answer: B. No

Adding a code coverage step to build pipelines does not prevent project configuration from changing over time. Code coverage measures test coverage of the codebase but has no relationship to protecting Azure DevOps project configuration settings from modifications. Configuration protection requires mechanisms like branch policies, approval gates, or audit controls specifically designed to govern configuration changes.

Why the other options are wrong

• A. Code coverage steps do not prevent or protect against configuration changes in Azure DevOps.

Correct answer: C, E. bfg --delete-files data.txt git push --force; git filter-repo --invert-paths --path data.txt git push origin --force --all

BFG with --delete-files followed by force push completely removes a file from all commits in repository history. Git filter-repo with --invert-paths --path and force push all refs also completely purges a file from the repository history by rewriting all commits.

Why the other options are wrong

• A. Git checkout and reset do not purge files from history; they only affect the working directory.
• B. Git checkout and clean do not remove files from commit history.
• D. Git rm and push only remove the file from the current commit, not from historical commits.
• F. Git revert creates a new commit removing the file but leaves it in historical commits.

Correct answer: C. WhiteSource

WhiteSource is the appropriate tool for detecting when open source libraries are added to a codebase. It scans projects to identify open source components, track their licenses, and detect security vulnerabilities. Jenkins is a CI/CD automation tool but not specifically designed for open source library detection.

Why the other options are wrong

• A. Jenkins is a CI/CD automation platform, not a tool designed to detect open source library additions.
• B. SourceGear Vault is a version control system and does not specialize in open source library detection.
• D. OWASP ZAP is a security testing tool focused on web application vulnerabilities, not open source library identification.

Correct answer: B. Use the Microsoft Teams for GitHub app and configure a subscription to receive notifications in the Teams channel.

The Microsoft Teams for GitHub app is purpose-built to integrate GitHub notifications with Teams channels. It allows you to configure subscriptions directly to receive GitHub commit notifications in a Teams channel with minimal development effort. This is a pre-built integration that requires no custom code, API calls, or Azure services, making it the most efficient solution.

Why the other options are wrong

• A. Using Azure Automation and GitHub Actions API requires significant development and configuration overhead.
• C. GitHub Actions with Teams API requires custom workflow development and code maintenance.
• D. Using Azure Functions and REST API requires building and maintaining custom integration code.

Correct answer: C. Promote the package to a release view.

Promoting the package to a release view in Azure Artifacts makes it available to anonymous external users while keeping it within the same feed and publication point. Release views provide controlled access for public sharing without requiring a separate feed or external repository, thereby minimizing the number of publication points.

Why the other options are wrong

• A. Changing the feed URL does not enable anonymous access or change access permissions.
• B. Creating a new feed increases the number of publication points rather than minimizing them.
• D. Publishing to an external public repository creates an additional publication point and is unnecessary when Azure Artifacts views can be used.

Correct answer: B. an Azure Artifacts Credential Provider

The Azure Artifacts Credential Provider is the standard mechanism for automating authentication to NuGet feeds in Azure DevOps. It integrates with the NuGet restore process and handles credential management transparently without requiring manual intervention or hardcoded credentials in the project.

Why the other options are wrong

• A. Azure Automation accounts are for managing cloud resources, not for authenticating to NuGet feeds.
• C. MFA-enabled Azure AD accounts require interactive authentication, which cannot be automated in build processes.
• D. Service principals require explicit configuration and credential setup, whereas the Credential Provider automates this process.

Correct answer: D. Upgrade the license of the Azure Active Directory (Azure AD) tenant.

Azure AD Premium Plan 1 does not include Privileged Identity Management (PIM), which is required to enforce time limits and require approval for privileged access. The first step is to upgrade to Azure AD Premium Plan 2, which includes PIM and meets all the stated requirements while minimizing costs compared to other PAM solutions.

Why the other options are wrong

• A. Configuring notifications is a feature within PIM but cannot be done without the license upgrade first.
• B. Configuring alerts is a feature within PIM but cannot be done without the license upgrade first.
• C. Enforcing MFA is a security measure but does not address time limits or approval workflows required by the specifications.

Correct answer: B, D. Create an Azure logic app that has an HTTP request trigger; Modify an action group in Azure Monitor.

To send Azure Monitor alerts to Microsoft Teams, you must create an Azure Logic App with an HTTP request trigger that will receive alerts from Azure Monitor and post them to Teams. Then you modify the Action Group in Azure Monitor to include a webhook action pointing to the Logic App's HTTP endpoint. This combination enables the alert routing from Azure Monitor to Teams.

Why the other options are wrong

• A. Azure Monitor workbooks are for data visualization and analysis, not for alert routing to Teams.
• C. An Azure DevOps trigger is not needed; the flow should be triggered by Azure Monitor alerts via HTTP, not by DevOps events.
• E. Diagnostics settings control log collection and retention, not alert routing to external systems like Teams.

Correct answer: D. Smart Detection

Smart Detection is the Application Insights feature that automatically analyzes telemetry data and alerts you to sudden rises in failure rates and performance degradation. It uses machine learning to detect anomalies without requiring manual threshold configuration. Custom events (A) are for logging, Profiler (B) is for code-level diagnostics, usage analysis (C) is for user behavior, and continuous export (E) is for data archival.

Why the other options are wrong

• A. Custom events are for logging application events, not for automatic anomaly detection.
• B. Application Insights Profiler provides detailed CPU and memory profiling, not automatic failure detection.
• C. Usage analysis tracks user behavior and adoption, not performance issues.
• E. Continuous export archives telemetry to storage but does not detect or alert on anomalies.

Correct answer: B. Contributor

The Contributor access level in Azure DevOps package feeds permits developers to unlist and deprecate packages while adhering to the principle of least privilege. This role provides the necessary permissions for package management without granting excessive administrative rights.

Why the other options are wrong

• A. Collaborator is a limited role that does not include permissions to unlist or deprecate packages.
• C. Owner grants full administrative control, which exceeds the principle of least privilege for this task.

Correct answer: A. Microsoft Defender for Containers

Microsoft Defender for Containers is specifically designed to scan container images for vulnerabilities. It integrates with Kubernetes environments and can scan images both during the build process and at runtime. This solution addresses the requirement to scan app images for vulnerabilities before deployment to the Kubernetes cluster.

Why the other options are wrong

• B. Microsoft Defender for App Service is for protecting web applications and does not provide container image scanning capabilities.
• C. Microsoft Defender for DevOps protects the DevOps infrastructure and repositories but is not designed for container image vulnerability scanning.
• D. Microsoft Defender for Storage protects Azure Storage accounts and is not relevant to container image scanning.

Correct answer: B. Approve the pull request.

When Dependabot detects a dependency that requires an update, it automatically creates a pull request. The first action you should take is to approve the pull request, which then allows the dependency update to be merged into the codebase. Creating a branch or performing a commit manually would be redundant since Dependabot handles these tasks automatically when creating the pull request.

Why the other options are wrong

• A. Dependabot already creates the pull request automatically; you do not need to create one manually.
• C. Dependabot creates a branch as part of the pull request process; manual branch creation is unnecessary.
• D. Dependabot performs the commit when creating the pull request; you do not need to commit manually.

Correct answer: A. Yes

Automated security testing can include license compliance scanning and dependency vulnerability checks as part of the test suite. Tools like WhiteSource Bolt, Snyk, and OWASP Dependency-Check are security-focused solutions that identify licensing violations and prohibited libraries during automated testing phases, enabling detection as issues occur in the development process.

Correct answer: B, C. Configure pre-deployment approvals in the deployment pipeline; Integrate Azure DevOps and SonarQube.

Integrating Azure DevOps with SonarQube enables continuous code quality analysis and tracking of technical debt metrics within the build pipeline. Configuring pre-deployment approvals ensures that code quality gates are enforced before code reaches production, preventing the introduction of new technical debt. Post-deployment approvals occur after deployment and do not prevent problematic code from being released. Azure DevTest Labs is for test environment management, not technical debt analysis.

Why the other options are wrong

• A. Post-deployment approvals occur after deployment and cannot prevent technical debt from entering production.
• D. Azure DevTest Labs manages test environments but does not contribute to technical debt management or code quality analysis.

Correct answer: A, C. Automatically watch teams; Automatically watch repositories

To receive email notifications only for discussions in which you commented or are mentioned, you must clear 'Automatically watch teams' and 'Automatically watch repositories'. These settings cause you to receive notifications for all activity in watched teams and repositories. The 'Participating' and 'Watching' settings are what you want to keep enabled, as they deliver notifications for discussions where you have direct involvement or explicit interest.

Why the other options are wrong

• B. Participating should remain enabled to notify you of discussions where you are involved.
• D. Watching should remain enabled to notify you of discussions you are explicitly watching.

Correct answer: C. In Project1, create an Azure DevOps repository.

A published wiki in Azure DevOps is backed by a Git repository. Before creating a published wiki, you must first create an Azure DevOps repository within the project to store the wiki content and markdown files. This repository serves as the source for the published wiki.

Why the other options are wrong

• A. Storage settings do not relate to wiki creation.
• B. Creating a pipeline is not a prerequisite for a published wiki.
• D. Team configuration settings do not enable wiki functionality.

Correct answer: A. From Azure DevOps, configure a service hook subscription

Service hooks in Azure DevOps are the native mechanism for sending notifications about work item updates to external services like Microsoft Teams. A service hook subscription connects Azure DevOps events to a Teams webhook, triggering notifications when work items change. Configuring a Teams connector (B) is the Teams-side approach but requires the Azure DevOps service hook to initiate it. MFA settings (C), channels (D), and extensions (E) do not directly handle work item event routing.

Why the other options are wrong

• B. A Teams connector alone does not pull work item updates; Azure DevOps must push events via a service hook.
• C. External access configuration in Teams admin center is for cross-organization communication, not for work item notifications.
• D. Adding a Teams channel is a basic channel setup that does not enable work item notifications.
• E. Installing an extension in Azure DevOps may add features but does not directly send notifications to Teams without a service hook.

Correct answer: B. No

Implementing Continuous Integration does not prevent project configuration from changing over time. Continuous Integration automates build and test processes for code changes but does not provide governance or protection for Azure DevOps project configuration settings. Configuration immutability requires dedicated security controls like branch policies, RBAC restrictions, or configuration management tools specifically designed to prevent unauthorized modifications.

Why the other options are wrong

• A. Continuous Integration focuses on code building and testing, not configuration protection.

Correct answer: A, B. an Azure Automation runbook; an Azure Monitor alert that has a dynamic threshold

To automatically increase logging when usage exceeds normal patterns with minimal overhead, you need an Azure Monitor alert with dynamic threshold (which adapts to baseline behavior patterns) and an Azure Automation runbook (which executes the action to change logging levels). Dynamic thresholds automatically learn normal patterns, and runbooks automate the response, minimizing manual intervention.

Why the other options are wrong

• C. Static thresholds require manual configuration and adjustment and cannot adapt to normal usage patterns.
• D. Autoscale settings are for scaling compute resources, not for adjusting logging levels.
• E. Email actions notify administrators but do not automatically change logging levels.

Correct answer: A. The Microsoft Test & Feedback extension.

The Microsoft Test & Feedback extension is the correct tool for collecting crash reports, distributing beta releases, and gathering user feedback on mobile applications. It integrates with Azure DevOps and provides all the capabilities mentioned: crash reporting for analysis, beta distribution to testers, and user feedback collection.

Why the other options are wrong

• B. OWASP ZAP is a security testing tool, not designed for crash reporting or beta distribution.
• C. TFS Integration Platform is for integrating Team Foundation Server with other systems, not for mobile app testing and feedback.
• D. Code Style is a code quality tool, unrelated to crash reporting, beta distribution, or user feedback collection.

Correct answer: C. libsodium

Libsodium is the encryption library that GitHub uses for wrapping secrets before they are transmitted via the REST API. It implements NaCl's public-key cryptography and is the standard library GitHub requires for encrypting secrets when using the Secrets API.

Why the other options are wrong

• A. CryptoNet is not a standard encryption library used by GitHub for secrets encryption.
• B. BouncyCastle is a general cryptography library but is not the library specified by GitHub for REST API secret encryption.
• D. Hashlib is a hashing library used for creating digests, not for encrypting secrets in transit.

Correct answer: A. personal access token (PAT)

A personal access token (PAT) is the standard authentication mechanism for registering self-hosted agents in Azure DevOps. The PAT provides secure, token-based authentication that can be scoped to specific permissions and easily revoked. SSH keys, alternate credentials, and certificates are not the standard or recommended methods for agent registration in Azure DevOps.

Why the other options are wrong

• B. SSH keys are used for Git operations and server access, not for Azure DevOps agent registration.
• C. Alternate credentials are a legacy authentication method not recommended for agent registration.
• D. Certificates are not the standard authentication mechanism for Azure DevOps agent setup.

Correct answer: A. Kusto Query Language (KQL)

Kusto Query Language (KQL) is the native query language for both Azure Application Insights and Azure SQL Database Intelligent Insights. It is specifically designed for analyzing and querying telemetry and monitoring data in Azure Monitor and Application Insights. PL/pgSQL, PL/SQL, and Transact-SQL are database procedural languages not designed for querying monitoring data.

Why the other options are wrong

• B. PL/pgSQL is PostgreSQL's procedural language, not used for Azure monitoring.
• C. PL/SQL is Oracle's procedural language, not used for Azure monitoring.
• D. Transact-SQL is for SQL Server databases, not for querying monitoring telemetry.

Correct answer: B. the SHA-based hashes

SHA-based hashes provide a fixed, immutable reference to a specific version of a template in a repository. Using the SHA hash ensures that your pipeline always uses the exact version of the template you specify, preventing unintended changes if the template is later modified. This is the most reliable way to pin a template to a fixed version, superior to using branch references which can change.

Why the other options are wrong

• A. Serial is not a standard versioning mechanism in Azure Pipelines.
• C. Runner refers to the execution environment, not template versioning.
• D. Using a branch name does not guarantee a fixed version, as branch contents can be updated.