Microsoft AZ-400 Practice Test 20

Question 190

After the team applies this response: Use versioned shared template repositories or package sources with reviewed update and ownership workflows. In the situation—Several service repositories copy the same infrastructure deployment templates and now differ in policy enforcement. Which evidence BEST demonstrates the response is effective?

Review branch ages, merge history, test status and mainline stability across a recent release cycle.
Inspect consumers' pinned references and confirm a released template update can be adopted predictably.
Inspect a disabled feature's merge, guarded runtime behavior and subsequent enabled production release.
Attempt an unapproved PR merge and inspect required checks, reviewer approvals and the ruleset bypass log.

Explanation

Correct Answer

The governing engineering principle is: Shared repository assets should be reusable through versioned contracts rather than unmanaged copy-paste duplication.

Incorrect Answers

Trunk-based integration limits divergence and makes failures easier to attribute when tests run on each change. The relevant control is to inspect consumers' pinned references and confirm a released template update can be adopted predictably.

Feature flags can decouple code integration from user exposure when defaults and cleanup are governed. The needed step here is to inspect consumers' pinned references and confirm a released template update can be adopted predictably.

Protected pull-request workflows enforce separation of duties only when enforcement and exceptions are controlled. The appropriate remedy is to inspect consumers' pinned references and confirm a released template update can be adopted predictably.

Question 191

Another organization wants shared automation modules but cannot maintain every repo from one canonical source. Which engineering principle BEST explains the relevant requirement?

Git merge strategies can change commit identity while preserving review provenance through stable PR references.
A safe branch strategy must balance collaborative change proposals with protected shared integration.
Shared repository assets should be reusable through versioned contracts rather than unmanaged copy-paste duplication.
Merge gates must verify the code state that will be integrated, not a stale earlier validation.

Explanation

Correct Answer

The second engineering situation illustrates the control boundary captured by this principle: Shared repository assets should be reusable through versioned contracts rather than unmanaged copy-paste duplication. The scenario is not resolved by an unrelated pipeline or policy activity.

Incorrect Answers

The second engineering situation illustrates the control boundary captured by this principle: Git merge strategies can change commit identity while preserving review provenance through stable PR references. The relevant evidence instead is: Shared repository assets should be reusable through versioned contracts rather than unmanaged copy-paste duplication.

The second engineering situation illustrates the control boundary captured by this principle: A safe branch strategy must balance collaborative change proposals with protected shared integration. The acceptance criterion here is: Shared repository assets should be reusable through versioned contracts rather than unmanaged copy-paste duplication.

The second engineering situation illustrates the control boundary captured by this principle: Merge gates must verify the code state that will be integrated, not a stale earlier validation. What must be demonstrated is: Shared repository assets should be reusable through versioned contracts rather than unmanaged copy-paste duplication.

Question 192

Another organization wants shared automation modules but cannot maintain every repo from one canonical source. Which unsupported assumption should the engineer challenge FIRST?

A fix applied on one maintenance branch is not automatically present on every supported branch.
An urgent production issue does not by itself justify disabling all protected-branch rules.
Requiring a pull request does not make code from an untrusted fork safe to execute with deployment credentials.
A reference to a moving shared branch does not guarantee repeatable pipeline behavior.

Explanation

Correct Answer

A reference to a moving shared branch does not guarantee repeatable pipeline behavior. This is the relevant unsupported assumption because shared repository assets should be reusable through versioned contracts rather than unmanaged copy-paste duplication.

Incorrect Answers

This caution is valid in design and implement branching strategies for the source code, but it is not the failure assumption illustrated by this scenario. The directly relevant risk is: A reference to a moving shared branch does not guarantee repeatable pipeline behavior.

Question 193

A contractor who left the project still has direct write permission to the production deployment repository. Which design or operational change MOST directly satisfies the requirement?

Separate untrusted PR validation from privileged deployment workflows and restrict secret-bearing jobs to trusted approved contexts.
Apply least-privilege GitHub or Azure Repos roles through governed groups and promptly revoke obsolete access.
Use short-lived branches and frequent validated integration to a protected main branch, with release controls separated from integration.
Define a release/hotfix branch flow with reviewed back-merges or cherry-picks into supported branches.

Explanation

Correct Answer

Repository authorization should reflect current role ownership and not persist after a role or contract ends. The most directly responsive design or operational step is: Apply least-privilege GitHub or Azure Repos roles through governed groups and promptly revoke obsolete access. Confirm the result by: Review effective permissions and test that a removed contributor can no longer push or approve changes.

Incorrect Answers

Source contribution and deployment authorization are different trust boundaries that must be enforced independently. Instead, the response must apply least-privilege GitHub or Azure Repos roles through governed groups and promptly revoke obsolete access.

Trunk-based integration limits divergence and makes failures easier to attribute when tests run on each change. The relevant control is to apply least-privilege GitHub or Azure Repos roles through governed groups and promptly revoke obsolete access.

Long-lived maintenance lines require explicit propagation of fixes to prevent divergent defects. The needed step here is to apply least-privilege GitHub or Azure Repos roles through governed groups and promptly revoke obsolete access.

Question 194

After the team applies this response: Apply least-privilege GitHub or Azure Repos roles through governed groups and promptly revoke obsolete access. In the situation—A contractor who left the project still has direct write permission to the production deployment repository. Which evidence BEST demonstrates the response is effective?

Simulate a high-priority fix and verify authorized reviewers can approve while normal direct pushes remain blocked.
Review branch ages, merge history, test status and mainline stability across a recent release cycle.
Change a file covered by the rule and verify a skipped or failed required check prevents merging.
Review effective permissions and test that a removed contributor can no longer push or approve changes.

Explanation

Correct Answer

The governing engineering principle is: Repository authorization should reflect current role ownership and not persist after a role or contract ends.

Incorrect Answers

An emergency workflow should shorten lead time without abandoning auditable source-control safeguards. The appropriate remedy is to review effective permissions and test that a removed contributor can no longer push or approve changes.

Trunk-based integration limits divergence and makes failures easier to attribute when tests run on each change. Instead, the response must review effective permissions and test that a removed contributor can no longer push or approve changes.

Branch protection relies on trustworthy status results that apply to the submitted change. The relevant control is to review effective permissions and test that a removed contributor can no longer push or approve changes.

Question 195

A different team grants whole-organization write access because configuring per-repository roles is inconvenient. Which engineering principle BEST explains the relevant requirement?

Release labels are trustworthy only when the tagged revision and tag governance are controlled.
A safe branch strategy must balance collaborative change proposals with protected shared integration.
Commit authenticity controls address provenance only when verified identities and enforcement are configured.
Repository authorization should reflect current role ownership and not persist after a role or contract ends.

Explanation

Correct Answer

The second engineering situation illustrates the control boundary captured by this principle: Repository authorization should reflect current role ownership and not persist after a role or contract ends. The scenario is not resolved by an unrelated pipeline or policy activity.

Incorrect Answers

Release labels are trustworthy only when the tagged revision and tag governance are controlled. That principle concerns design and implement branching strategies for the source code, whereas this specific incident is governed by: Repository authorization should reflect current role ownership and not persist after a role or contract ends.

A safe branch strategy must balance collaborative change proposals with protected shared integration. That principle concerns design and implement branching strategies for the source code, whereas this specific incident is governed by: Repository authorization should reflect current role ownership and not persist after a role or contract ends.

Commit authenticity controls address provenance only when verified identities and enforcement are configured. That principle concerns design and implement branching strategies for the source code, whereas this specific incident is governed by: Repository authorization should reflect current role ownership and not persist after a role or contract ends.

Question 196

A different team grants whole-organization write access because configuring per-repository roles is inconvenient. Which unsupported assumption should the engineer challenge FIRST?

A patch merged into main does not automatically remediate an already supported older release.
An approval on yesterday's diff is not proof that today's updated diff was reviewed.
Requiring a pull request does not make code from an untrusted fork safe to execute with deployment credentials.
Removing someone from one project team does not always revoke access inherited through other groups.

Explanation

Correct Answer

Removing someone from one project team does not always revoke access inherited through other groups. This is the relevant unsupported assumption because repository authorization should reflect current role ownership and not persist after a role or contract ends.

Incorrect Answers

This caution is valid in design and implement branching strategies for the source code, but it is not the failure assumption illustrated by this scenario. The directly relevant risk is: Removing someone from one project team does not always revoke access inherited through other groups.

Question 197

A compromised credential was committed to Git six months ago and deleting the latest file leaves the secret in historical commits. Which design or operational change MOST directly satisfies the requirement?

Scope administrative bypass and require documented exception approval with audit logging for protected branch overrides.
Enable the applicable signed-commit requirements and validate identities and branch policy behavior at merge time.
Define documented naming, protected release branches and controlled emergency PR workflow with traceable approvals.
Revoke the exposed secret, scan its use and plan authorized history rewriting with coordinated repository and tag cleanup.

Explanation

Correct Answer

Secret remediation requires credential invalidation plus careful history cleanup because Git preserves earlier versions. The most directly responsive design or operational step is: Revoke the exposed secret, scan its use and plan authorized history rewriting with coordinated repository and tag cleanup. Confirm the result by: Check token invalidation, cleaned reachable history, protected tags and stakeholder re-clone guidance.

Incorrect Answers

Branch policy integrity depends on tightly limited bypass privileges and transparent exceptional use. The appropriate comparison is: Revoke the exposed secret, scan its use and plan authorized history rewriting with coordinated repository and tag cleanup.

Commit authenticity controls address provenance only when verified identities and enforcement are configured. The relevant evidence instead is: Revoke the exposed secret, scan its use and plan authorized history rewriting with coordinated repository and tag cleanup.

An emergency workflow should shorten lead time without abandoning auditable source-control safeguards. The acceptance criterion here is: Revoke the exposed secret, scan its use and plan authorized history rewriting with coordinated repository and tag cleanup.

Question 198

After the team applies this response: Revoke the exposed secret, scan its use and plan authorized history rewriting with coordinated repository and tag cleanup. In the situation—A compromised credential was committed to Git six months ago and deleting the latest file leaves the secret in historical commits. Which evidence BEST demonstrates the response is effective?

Attempt an unapproved PR merge and inspect required checks, reviewer approvals and the ruleset bypass log.
Change a file covered by the rule and verify a skipped or failed required check prevents merging.
Check token invalidation, cleaned reachable history, protected tags and stakeholder re-clone guidance.
Run a sample fork PR and verify it cannot read deployment secrets or use privileged production runners.

Explanation

Correct Answer

The governing engineering principle is: Secret remediation requires credential invalidation plus careful history cleanup because Git preserves earlier versions.

Incorrect Answers

Protected pull-request workflows enforce separation of duties only when enforcement and exceptions are controlled. The needed step here is to check token invalidation, cleaned reachable history, protected tags and stakeholder re-clone guidance.

Branch protection relies on trustworthy status results that apply to the submitted change. The appropriate remedy is to check token invalidation, cleaned reachable history, protected tags and stakeholder re-clone guidance.

Source contribution and deployment authorization are different trust boundaries that must be enforced independently. Instead, the response must check token invalidation, cleaned reachable history, protected tags and stakeholder re-clone guidance.

Question 199

Another repository rotates a token but the original secret still exists in tags and cached clones. Which engineering principle BEST explains the relevant requirement?

Secret remediation requires credential invalidation plus careful history cleanup because Git preserves earlier versions.
Long-lived maintenance lines require explicit propagation of fixes to prevent divergent defects.
Feature flags can decouple code integration from user exposure when defaults and cleanup are governed.
Source contribution and deployment authorization are different trust boundaries that must be enforced independently.

Explanation

Correct Answer

The second engineering situation illustrates the control boundary captured by this principle: Secret remediation requires credential invalidation plus careful history cleanup because Git preserves earlier versions. The scenario is not resolved by an unrelated pipeline or policy activity.

Incorrect Answers

Long-lived maintenance lines require explicit propagation of fixes to prevent divergent defects. That principle concerns design and implement branching strategies for the source code, whereas this specific incident is governed by: Secret remediation requires credential invalidation plus careful history cleanup because Git preserves earlier versions.

Feature flags can decouple code integration from user exposure when defaults and cleanup are governed. That principle concerns design and implement branching strategies for the source code, whereas this specific incident is governed by: Secret remediation requires credential invalidation plus careful history cleanup because Git preserves earlier versions.

Source contribution and deployment authorization are different trust boundaries that must be enforced independently. That principle concerns design and implement branching strategies for the source code, whereas this specific incident is governed by: Secret remediation requires credential invalidation plus careful history cleanup because Git preserves earlier versions.

Question 200

Another repository rotates a token but the original secret still exists in tags and cached clones. Which unsupported assumption should the engineer challenge FIRST?

Requiring a pull request does not make code from an untrusted fork safe to execute with deployment credentials.
A valid cryptographic signature does not by itself prove a change received correct code review.
A successful build attached to an earlier commit does not prove the final merge candidate is safe.
Deleting a sensitive file from the latest commit does not erase the credential from Git history.

Explanation

Correct Answer

Deleting a sensitive file from the latest commit does not erase the credential from Git history. This is the relevant unsupported assumption because secret remediation requires credential invalidation plus careful history cleanup because Git preserves earlier versions.

Incorrect Answers

This caution is valid in design and implement branching strategies for the source code, but it is not the failure assumption illustrated by this scenario. The directly relevant risk is: Deleting a sensitive file from the latest commit does not erase the credential from Git history.

Designing and Implementing Microsoft DevOps Solutions (AZ-400) Practice Tests

Microsoft AZ-400 Practice Test 18 - 10 Questions (Last Reviewed 28-Oct-2026)
Microsoft AZ-400 Practice Test 19 - 10 Questions (Last Reviewed 27-Oct-2026)
Microsoft AZ-400 Practice Test 20 - 10 Questions (Last Reviewed 26-Oct-2026)
Microsoft AZ-400 Practice Test 21 - 10 Questions (Last Reviewed 25-Oct-2026)
Microsoft AZ-400 Practice Test 22 - 10 Questions (Last Reviewed 24-Oct-2026)

Pass Your Microsoft AZ-400 Exam Easy!

Question 190

Explanation

Correct Answer

Incorrect Answers

Question 191

Explanation

Correct Answer

Incorrect Answers

Question 192

Explanation

Correct Answer

Incorrect Answers

Question 193

Explanation

Correct Answer

Incorrect Answers

Question 194

Explanation

Correct Answer

Incorrect Answers

Question 195

Explanation

Correct Answer

Incorrect Answers

Question 196

Explanation

Correct Answer

Incorrect Answers

Question 197

Explanation

Correct Answer

Incorrect Answers

Question 198

Explanation

Correct Answer

Incorrect Answers

Question 199

Explanation

Correct Answer

Incorrect Answers

Question 200

Explanation

Correct Answer

Incorrect Answers

Designing and Implementing Microsoft DevOps Solutions (AZ-400) Practice Tests