Microsoft AZ-400 Practice Test 21

Question 200

Another repository rotates a token but the original secret still exists in tags and cached clones. Which unsupported assumption should the engineer challenge FIRST?

Requiring a pull request does not make code from an untrusted fork safe to execute with deployment credentials.
A valid cryptographic signature does not by itself prove a change received correct code review.
A successful build attached to an earlier commit does not prove the final merge candidate is safe.
Deleting a sensitive file from the latest commit does not erase the credential from Git history.

Explanation

Correct Answer

Deleting a sensitive file from the latest commit does not erase the credential from Git history. This is the relevant unsupported assumption because secret remediation requires credential invalidation plus careful history cleanup because Git preserves earlier versions.

Incorrect Answers

This caution is valid in design and implement branching strategies for the source code, but it is not the failure assumption illustrated by this scenario. The directly relevant risk is: Deleting a sensitive file from the latest commit does not erase the credential from Git history.

Question 201

A developer accidentally deletes a branch containing an approved feature, but the team knows its most recent commit ID. Which design or operational change MOST directly satisfies the requirement?

Use Git reflog or known object identifiers to locate and restore the correct commit into a reviewed branch.
Use short-lived branches and frequent validated integration to a protected main branch, with release controls separated from integration.
Ensure required CI status checks report a conclusive result for relevant changes and that workflows cannot silently skip required checks.
Define documented naming, protected release branches and controlled emergency PR workflow with traceable approvals.

Explanation

Correct Answer

Git recovery should restore a specific verified revision rather than guess based on branch names. The most directly responsive design or operational step is: Use Git reflog or known object identifiers to locate and restore the correct commit into a reviewed branch. Confirm the result by: Inspect the recovered commit tree and run required review and tests before re-integrating it.

Incorrect Answers

Trunk-based integration limits divergence and makes failures easier to attribute when tests run on each change. The relevant control is to use Git reflog or known object identifiers to locate and restore the correct commit into a reviewed branch.

Branch protection relies on trustworthy status results that apply to the submitted change. The needed step here is to use Git reflog or known object identifiers to locate and restore the correct commit into a reviewed branch.

An emergency workflow should shorten lead time without abandoning auditable source-control safeguards. The appropriate remedy is to use Git reflog or known object identifiers to locate and restore the correct commit into a reviewed branch.

Question 202

After the team applies this response: Use Git reflog or known object identifiers to locate and restore the correct commit into a reviewed branch. In the situation—A developer accidentally deletes a branch containing an approved feature, but the team knows its most recent commit ID. Which evidence BEST demonstrates the response is effective?

Inspect the recovered commit tree and run required review and tests before re-integrating it.
Attempt a merge with an unsigned commit and verify the protection rule and identity records reject it.
Change a file covered by the rule and verify a skipped or failed required check prevents merging.
Try to move a protected release tag and compare approved tag references with shipped artifact metadata.

Explanation

Correct Answer

The governing engineering principle is: Git recovery should restore a specific verified revision rather than guess based on branch names.

Incorrect Answers

Commit authenticity controls address provenance only when verified identities and enforcement are configured. Instead, the response must inspect the recovered commit tree and run required review and tests before re-integrating it.

Branch protection relies on trustworthy status results that apply to the submitted change. The relevant control is to inspect the recovered commit tree and run required review and tests before re-integrating it.

Release labels are trustworthy only when the tagged revision and tag governance are controlled. The needed step here is to inspect the recovered commit tree and run required review and tests before re-integrating it.

Question 203

Another group loses a local commit after resetting its working branch and needs safe recovery. Which engineering principle BEST explains the relevant requirement?

Git recovery should restore a specific verified revision rather than guess based on branch names.
Protected pull-request workflows enforce separation of duties only when enforcement and exceptions are controlled.
A safe branch strategy must balance collaborative change proposals with protected shared integration.
Merge gates must verify the code state that will be integrated, not a stale earlier validation.

Explanation

Correct Answer

The second engineering situation illustrates the control boundary captured by this principle: Git recovery should restore a specific verified revision rather than guess based on branch names. The scenario is not resolved by an unrelated pipeline or policy activity.

Incorrect Answers

The second engineering situation illustrates the control boundary captured by this principle: Protected pull-request workflows enforce separation of duties only when enforcement and exceptions are controlled. What must be demonstrated is: Git recovery should restore a specific verified revision rather than guess based on branch names.

The second engineering situation illustrates the control boundary captured by this principle: A safe branch strategy must balance collaborative change proposals with protected shared integration. The appropriate comparison is: Git recovery should restore a specific verified revision rather than guess based on branch names.

The second engineering situation illustrates the control boundary captured by this principle: Merge gates must verify the code state that will be integrated, not a stale earlier validation. The relevant evidence instead is: Git recovery should restore a specific verified revision rather than guess based on branch names.

Question 204

Another group loses a local commit after resetting its working branch and needs safe recovery. Which unsupported assumption should the engineer challenge FIRST?

Preventing developers from opening change branches can push work outside the reviewed source system.
An approval on yesterday's diff is not proof that today's updated diff was reviewed.
A deleted local branch does not always mean its underlying commit objects are immediately irrecoverable.
Requiring a pull request does not make code from an untrusted fork safe to execute with deployment credentials.

Explanation

Correct Answer

A deleted local branch does not always mean its underlying commit objects are immediately irrecoverable. This is the relevant unsupported assumption because git recovery should restore a specific verified revision rather than guess based on branch names.

Incorrect Answers

This caution is valid in design and implement branching strategies for the source code, but it is not the failure assumption illustrated by this scenario. The directly relevant risk is: A deleted local branch does not always mean its underlying commit objects are immediately irrecoverable.

Question 205

A repository tag points to an artifact build with no indication whether it is a candidate or an approved production release. Which design or operational change MOST directly satisfies the requirement?

Restrict tag creation and update permissions and use protected or signed annotated release tags where supported.
Define governed tag conventions that distinguish candidate, approved release and support status with immutable references.
Define a release/hotfix branch flow with reviewed back-merges or cherry-picks into supported branches.
Use short-lived branches and frequent validated integration to a protected main branch, with release controls separated from integration.

Explanation

Correct Answer

Organized release tagging improves traceability when lifecycle meaning and ownership are explicit. The most directly responsive design or operational step is: Define governed tag conventions that distinguish candidate, approved release and support status with immutable references. Confirm the result by: Reconcile tag protections and release metadata to the approved build for a sampled deployment.

Incorrect Answers

Release labels are trustworthy only when the tagged revision and tag governance are controlled. The appropriate remedy is to define governed tag conventions that distinguish candidate, approved release and support status with immutable references.

Long-lived maintenance lines require explicit propagation of fixes to prevent divergent defects. Instead, the response must define governed tag conventions that distinguish candidate, approved release and support status with immutable references.

Trunk-based integration limits divergence and makes failures easier to attribute when tests run on each change. The relevant control is to define governed tag conventions that distinguish candidate, approved release and support status with immutable references.

Question 206

After the team applies this response: Define governed tag conventions that distinguish candidate, approved release and support status with immutable references. In the situation—A repository tag points to an artifact build with no indication whether it is a candidate or an approved production release. Which evidence BEST demonstrates the response is effective?

Verify a contributor can propose a PR and that merging still requires the required independent checks.
Reconcile tag protections and release metadata to the approved build for a sampled deployment.
Change a file covered by the rule and verify a skipped or failed required check prevents merging.
Run a sample fork PR and verify it cannot read deployment secrets or use privileged production runners.

Explanation

Correct Answer

This evidence directly verifies the proposed control under the stated failure scenario: Reconcile tag protections and release metadata to the approved build for a sampled deployment. The governing engineering principle is: Organized release tagging improves traceability when lifecycle meaning and ownership are explicit.

Incorrect Answers

A safe branch strategy must balance collaborative change proposals with protected shared integration. The needed step here is to reconcile tag protections and release metadata to the approved build for a sampled deployment.

Branch protection relies on trustworthy status results that apply to the submitted change. The appropriate remedy is to reconcile tag protections and release metadata to the approved build for a sampled deployment.

Source contribution and deployment authorization are different trust boundaries that must be enforced independently. Instead, the response must reconcile tag protections and release metadata to the approved build for a sampled deployment.

Question 207

Another service uses arbitrary tags without documented naming, signing or promotion semantics. Which engineering principle BEST explains the relevant requirement?

Feature flags can decouple code integration from user exposure when defaults and cleanup are governed.
Protected pull-request workflows enforce separation of duties only when enforcement and exceptions are controlled.
Organized release tagging improves traceability when lifecycle meaning and ownership are explicit.
Source contribution and deployment authorization are different trust boundaries that must be enforced independently.

Explanation

Correct Answer

The second engineering situation illustrates the control boundary captured by this principle: Organized release tagging improves traceability when lifecycle meaning and ownership are explicit. The scenario is not resolved by an unrelated pipeline or policy activity.

Incorrect Answers

Feature flags can decouple code integration from user exposure when defaults and cleanup are governed. That principle concerns design and implement branching strategies for the source code, whereas this specific incident is governed by: Organized release tagging improves traceability when lifecycle meaning and ownership are explicit.

Protected pull-request workflows enforce separation of duties only when enforcement and exceptions are controlled. That principle concerns design and implement branching strategies for the source code, whereas this specific incident is governed by: Organized release tagging improves traceability when lifecycle meaning and ownership are explicit.

Source contribution and deployment authorization are different trust boundaries that must be enforced independently. That principle concerns design and implement branching strategies for the source code, whereas this specific incident is governed by: Organized release tagging improves traceability when lifecycle meaning and ownership are explicit.

Question 208

Another service uses arbitrary tags without documented naming, signing or promotion semantics. Which unsupported assumption should the engineer challenge FIRST?

A tag containing the word production does not establish that its release passed production acceptance gates.
The original feature-branch SHA is not necessarily the commit identifier recorded after a squash merge.
A feature flag is not a substitute for access control, and leaving flags permanently unmanaged adds risk.
Requiring a pull request does not make code from an untrusted fork safe to execute with deployment credentials.

Explanation

Correct Answer

A tag containing the word production does not establish that its release passed production acceptance gates. This is the relevant unsupported assumption because organized release tagging improves traceability when lifecycle meaning and ownership are explicit.

Incorrect Answers

This is the relevant unsupported assumption because git merge strategies can change commit identity while preserving review provenance through stable PR references. The acceptance criterion here is: A tag containing the word production does not establish that its release passed production acceptance gates.

This is the relevant unsupported assumption because feature flags can decouple code integration from user exposure when defaults and cleanup are governed. What must be demonstrated is: A tag containing the word production does not establish that its release passed production acceptance gates.

Requiring a pull request does not make code from an untrusted fork safe to execute with deployment credentials. The appropriate comparison is: A tag containing the word production does not establish that its release passed production acceptance gates.

Question 209

A monorepo includes credentials, while external contractors should only work on the public web frontend subtree. Which design or operational change MOST directly satisfies the requirement?

Enable the applicable signed-commit requirements and validate identities and branch policy behavior at merge time.
Configure Azure Repos policies to reset or require renewed approvals when updates change the reviewed PR content.
Split privileged content into independently controlled repositories or boundaries rather than rely on sparse checkout.
Require GitHub branch protection or rulesets with independent required reviewers, review freshness and restricted bypass authority.

Explanation

Correct Answer

Git checkout optimization is not an access-control mechanism because authorized clones can request other objects. The most directly responsive design or operational step is: Split privileged content into independently controlled repositories or boundaries rather than rely on sparse checkout. Confirm the result by: Test contractor access to the separate sensitive repository and confirm authorization differs from the frontend.

Incorrect Answers

Commit authenticity controls address provenance only when verified identities and enforcement are configured. The relevant evidence instead is: Split privileged content into independently controlled repositories or boundaries rather than rely on sparse checkout.

Approval integrity requires binding review decisions to the current content of the change, not an earlier version. The acceptance criterion here is: Split privileged content into independently controlled repositories or boundaries rather than rely on sparse checkout.

Protected pull-request workflows enforce separation of duties only when enforcement and exceptions are controlled. What must be demonstrated is: Split privileged content into independently controlled repositories or boundaries rather than rely on sparse checkout.

Question 210

After the team applies this response: Split privileged content into independently controlled repositories or boundaries rather than rely on sparse checkout. In the situation—A monorepo includes credentials, while external contractors should only work on the public web frontend subtree. Which evidence BEST demonstrates the response is effective?

Verify a contributor can propose a PR and that merging still requires the required independent checks.
Introduce a new commit or target update and confirm the policy requires a current successful validation run.
Test contractor access to the separate sensitive repository and confirm authorization differs from the frontend.
Attempt a merge with an unsigned commit and verify the protection rule and identity records reject it.

Explanation

Correct Answer

The governing engineering principle is: Git checkout optimization is not an access-control mechanism because authorized clones can request other objects.

Incorrect Answers

A safe branch strategy must balance collaborative change proposals with protected shared integration. The relevant control is to test contractor access to the separate sensitive repository and confirm authorization differs from the frontend.

Merge gates must verify the code state that will be integrated, not a stale earlier validation. The needed step here is to test contractor access to the separate sensitive repository and confirm authorization differs from the frontend.

Commit authenticity controls address provenance only when verified identities and enforcement are configured. The appropriate remedy is to test contractor access to the separate sensitive repository and confirm authorization differs from the frontend.

Designing and Implementing Microsoft DevOps Solutions (AZ-400) Practice Tests

Microsoft AZ-400 Practice Test 19 - 10 Questions (Last Reviewed 27-Oct-2026)
Microsoft AZ-400 Practice Test 20 - 10 Questions (Last Reviewed 26-Oct-2026)
Microsoft AZ-400 Practice Test 21 - 10 Questions (Last Reviewed 25-Oct-2026)
Microsoft AZ-400 Practice Test 22 - 10 Questions (Last Reviewed 24-Oct-2026)
Microsoft AZ-400 Practice Test 23 - 10 Questions (Last Reviewed 23-Oct-2026)

Pass Your Microsoft AZ-400 Exam Easy!

Question 200

Explanation

Correct Answer

Incorrect Answers

Question 201

Explanation

Correct Answer

Incorrect Answers

Question 202

Explanation

Correct Answer

Incorrect Answers

Question 203

Explanation

Correct Answer

Incorrect Answers

Question 204

Explanation

Correct Answer

Incorrect Answers

Question 205

Explanation

Correct Answer

Incorrect Answers

Question 206

Explanation

Correct Answer

Incorrect Answers

Question 207

Explanation

Correct Answer

Incorrect Answers

Question 208

Explanation

Correct Answer

Incorrect Answers

Question 209

Explanation

Correct Answer

Incorrect Answers

Question 210

Explanation

Correct Answer

Incorrect Answers

Designing and Implementing Microsoft DevOps Solutions (AZ-400) Practice Tests