Microsoft AZ-400 Practice Test 84

Question 830

After the team applies this response: Prefer secure environment or controlled secret inputs and avoid command-line or log exposure for sensitive values. In the situation—A secret from Azure Pipelines is passed as a command-line parameter and appears in child process listings on self-hosted agents. Which evidence BEST demonstrates the response is effective?

Test the user's work-item actions and confirm source control and admin functions remain restricted.
Inspect sample findings across tools and confirm one tracked issue retains all relevant evidence links.
Inspect process invocation and logs during a controlled run and confirm the value is not exposed to unrelated jobs.
Verify access to the approved repository and denial to a second unrelated private repo.

Explanation

Correct Answer

This evidence directly verifies the proposed control under the stated failure scenario: Inspect process invocation and logs during a controlled run and confirm the value is not exposed to unrelated jobs. The governing engineering principle is: Secret masking in pipeline logs is not a complete defense against process or file-based leakage.

Incorrect Answers

Azure DevOps access levels and security permissions govern different aspects of a user's effective capabilities. The needed step here is to inspect process invocation and logs during a controlled run and confirm the value is not exposed to unrelated jobs.

Security automation should preserve provenance and reduce duplicate operational work without hiding distinct exposures. The appropriate remedy is to inspect process invocation and logs during a controlled run and confirm the value is not exposed to unrelated jobs.

External collaboration should use the smallest repository and permission scope required for the role. Instead, the response must inspect process invocation and logs during a controlled run and confirm the value is not exposed to unrelated jobs.

Question 831

Another project prints all process arguments during troubleshooting and accidentally records connection strings. Which engineering principle BEST explains the relevant requirement?

Final deployable images can contain risks not visible in the application source repository alone.
Authorization must be evaluated as enforced behavior rather than guessed from role labels alone.
Security automation should preserve provenance and reduce duplicate operational work without hiding distinct exposures.
Secret masking in pipeline logs is not a complete defense against process or file-based leakage.

Explanation

Correct Answer

The second engineering situation illustrates the control boundary captured by this principle: Secret masking in pipeline logs is not a complete defense against process or file-based leakage. The scenario is not resolved by an unrelated pipeline or policy activity.

Incorrect Answers

Final deployable images can contain risks not visible in the application source repository alone. That principle concerns automate security and compliance scanning, whereas this specific incident is governed by: Secret masking in pipeline logs is not a complete defense against process or file-based leakage.

The second engineering situation illustrates the control boundary captured by this principle: Authorization must be evaluated as enforced behavior rather than guessed from role labels alone. The relevant evidence instead is: Secret masking in pipeline logs is not a complete defense against process or file-based leakage.

Security automation should preserve provenance and reduce duplicate operational work without hiding distinct exposures. That principle concerns automate security and compliance scanning, whereas this specific incident is governed by: Secret masking in pipeline logs is not a complete defense against process or file-based leakage.

Question 832

Another project prints all process arguments during troubleshooting and accidentally records connection strings. Which unsupported assumption should the engineer challenge FIRST?

Starting a scanner before deployment is not the same as waiting for its result before deployment.
Removing a stored password is not sufficient if federated trust allows any repository or workflow to assume the role.
Installing an App in an organization is not proof that its token is correctly limited to one repository.
A variable marked secret in Azure Pipelines cannot guarantee a printed command-line argument stays private.

Explanation

Correct Answer

A variable marked secret in Azure Pipelines cannot guarantee a printed command-line argument stays private. This is the relevant unsupported assumption because secret masking in pipeline logs is not a complete defense against process or file-based leakage.

Incorrect Answers

This caution is valid in automate security and compliance scanning, but it is not the failure assumption illustrated by this scenario. The directly relevant risk is: A variable marked secret in Azure Pipelines cannot guarantee a printed command-line argument stays private.

This caution is valid in design and implement authentication and authorization methods, but it is not the failure assumption illustrated by this scenario. The directly relevant risk is: A variable marked secret in Azure Pipelines cannot guarantee a printed command-line argument stays private.

Question 833

A pipeline uses Key Vault secrets during a build but publishes its complete .env file inside a ZIP artifact. Which design or operational change MOST directly satisfies the requirement?

Separate security policy administration from application contribution and require independent review of scanner configuration changes.
Exclude deployment credentials from publishable packages and scan final artifacts for secret canaries.
Add container image vulnerability scanning to the release pipeline and track the exact deployed image digest.
Place blocking security scans before release promotion and require successful completion plus approved findings treatment.

Explanation

Correct Answer

Sensitive information must remain outside redistributable build outputs even when securely retrieved earlier. The most directly responsive design or operational step is: Exclude deployment credentials from publishable packages and scan final artifacts for secret canaries. Confirm the result by: Inspect produced ZIPs and container layers and verify a test secret causes release failure.

Incorrect Answers

Security gates are trustworthy only when the subjects they control cannot silently disable them. The relevant control is to exclude deployment credentials from publishable packages and scan final artifacts for secret canaries.

Final deployable images can contain risks not visible in the application source repository alone. The needed step here is to exclude deployment credentials from publishable packages and scan final artifacts for secret canaries.

A release gate must consider scan outcome and review status at decision time. The appropriate remedy is to exclude deployment credentials from publishable packages and scan final artifacts for secret canaries.

Question 834

After the team applies this response: Exclude deployment credentials from publishable packages and scan final artifacts for secret canaries. In the situation—A pipeline uses Key Vault secrets during a build but publishes its complete .env file inside a ZIP artifact. Which evidence BEST demonstrates the response is effective?

Inspect workflow token permissions and verify it can perform the required action but not unrelated repository writes.
Audit effective inherited permissions and test required contribution versus restricted policy editing.
Inspect produced ZIPs and container layers and verify a test secret causes release failure.
Open a controlled dependency-update PR and verify required checks and approvals before merge.

Explanation

Correct Answer

The governing engineering principle is: Sensitive information must remain outside redistributable build outputs even when securely retrieved earlier.

Incorrect Answers

Automation should rely on purpose-scoped integration identities rather than personal credentials. Instead, the response must inspect produced ZIPs and container layers and verify a test secret causes release failure.

Source management privileges should distinguish day-to-day contribution from changing the enforcement rules. The relevant control is to inspect produced ZIPs and container layers and verify a test secret causes release failure.

Security remediation can introduce behavioral regressions and must remain within governed change controls. The needed step here is to inspect produced ZIPs and container layers and verify a test secret causes release failure.

Question 835

Another development team removes a password from the current source file but packages an old configuration file in an image layer. Which engineering principle BEST explains the relevant requirement?

Final deployable images can contain risks not visible in the application source repository alone.
Service connection use and Azure RBAC scope jointly define automation access boundaries.
Sensitive information must remain outside redistributable build outputs even when securely retrieved earlier.
Automation credentials should use narrowly scoped non-personal identities and minimize long-lived secrets.

Explanation

Correct Answer

The second engineering situation illustrates the control boundary captured by this principle: Sensitive information must remain outside redistributable build outputs even when securely retrieved earlier. The scenario is not resolved by an unrelated pipeline or policy activity.

Incorrect Answers

Final deployable images can contain risks not visible in the application source repository alone. That principle concerns automate security and compliance scanning, whereas this specific incident is governed by: Sensitive information must remain outside redistributable build outputs even when securely retrieved earlier.

Service connection use and Azure RBAC scope jointly define automation access boundaries. That principle concerns design and implement authentication and authorization methods, whereas this specific incident is governed by: Sensitive information must remain outside redistributable build outputs even when securely retrieved earlier.

Automation credentials should use narrowly scoped non-personal identities and minimize long-lived secrets. That principle concerns design and implement authentication and authorization methods, whereas this specific incident is governed by: Sensitive information must remain outside redistributable build outputs even when securely retrieved earlier.

Question 836

Another development team removes a password from the current source file but packages an old configuration file in an image layer. Which unsupported assumption should the engineer challenge FIRST?

Inviting someone to one repository does not justify exposing every private repository in the organization.
A dependency with no known CVE is not necessarily legally approved for redistribution.
A clean static source scan does not guarantee the base container image has no vulnerable components.
Deleting a sensitive variable at the end of a script does not remove copies already embedded in artifacts.

Explanation

Correct Answer

Deleting a sensitive variable at the end of a script does not remove copies already embedded in artifacts. This is the relevant unsupported assumption because sensitive information must remain outside redistributable build outputs even when securely retrieved earlier.

Incorrect Answers

This caution is valid in design and implement authentication and authorization methods, but it is not the failure assumption illustrated by this scenario. The directly relevant risk is: Deleting a sensitive variable at the end of a script does not remove copies already embedded in artifacts.

This caution is valid in automate security and compliance scanning, but it is not the failure assumption illustrated by this scenario. The directly relevant risk is: Deleting a sensitive variable at the end of a script does not remove copies already embedded in artifacts.

Question 837

Production secrets are available to every GitHub Actions job even though only one deployment job needs them. Which design or operational change MOST directly satisfies the requirement?

Choose identity assignment based on intended reuse and lifetime, with separate least-privilege grants per application boundary.
Scope service connections and Entra RBAC to specific environments or resource groups and authorize only intended pipelines.
Scope secrets to protected deployment environments with required reviewers and trusted branch policies.
Reconcile effective user permissions across direct, group and inherited grants, then remove unnecessary paths.

Explanation

Correct Answer

Secret availability should follow environment trust and job function, not global workflow visibility. The most directly responsive design or operational step is: Scope secrets to protected deployment environments with required reviewers and trusted branch policies. Confirm the result by: Attempt secret access from an untrusted PR job and verify denial; inspect approved release access.

Incorrect Answers

User-assigned identity reuse is a deliberate shared trust boundary, not merely a configuration convenience. The acceptance criterion here is: Scope secrets to protected deployment environments with required reviewers and trusted branch policies.

Service connection use and Azure RBAC scope jointly define automation access boundaries. What must be demonstrated is: Scope secrets to protected deployment environments with required reviewers and trusted branch policies.

Effective authorization is the union of relevant role and group grants, not simply the most recent membership edit. The appropriate comparison is: Scope secrets to protected deployment environments with required reviewers and trusted branch policies.

Question 838

After the team applies this response: Scope secrets to protected deployment environments with required reviewers and trusted branch policies. In the situation—Production secrets are available to every GitHub Actions job even though only one deployment job needs them. Which evidence BEST demonstrates the response is effective?

Verify access to the approved repository and denial to a second unrelated private repo.
Attempt secret access from an untrusted PR job and verify denial; inspect approved release access.
Inspect federated trust claims, effective RBAC and deployment logs showing temporary credential use.
Commit a safe secret-scanning test pattern and verify an alert and escalation without using a live secret.

Explanation

Correct Answer

The governing engineering principle is: Secret availability should follow environment trust and job function, not global workflow visibility.

Incorrect Answers

External collaboration should use the smallest repository and permission scope required for the role. The relevant evidence instead is: Attempt secret access from an untrusted PR job and verify denial; inspect approved release access.

Automation credentials should use narrowly scoped non-personal identities and minimize long-lived secrets. The acceptance criterion here is: Attempt secret access from an untrusted PR job and verify denial; inspect approved release access.

Secret scanning complements preventive credential controls by finding exposures in committed content. What must be demonstrated is: Attempt secret access from an untrusted PR job and verify denial; inspect approved release access.

Question 839

Another service allows PR workflows to select the production environment and read its protected deployment credentials. Which engineering principle BEST explains the relevant requirement?

A release gate must consider scan outcome and review status at decision time.
External collaboration should use the smallest repository and permission scope required for the role.
Secret availability should follow environment trust and job function, not global workflow visibility.
Security remediation can introduce behavioral regressions and must remain within governed change controls.

Explanation

Correct Answer

The second engineering situation illustrates the control boundary captured by this principle: Secret availability should follow environment trust and job function, not global workflow visibility. The scenario is not resolved by an unrelated pipeline or policy activity.

Incorrect Answers

A release gate must consider scan outcome and review status at decision time. That principle concerns automate security and compliance scanning, whereas this specific incident is governed by: Secret availability should follow environment trust and job function, not global workflow visibility.

External collaboration should use the smallest repository and permission scope required for the role. That principle concerns design and implement authentication and authorization methods, whereas this specific incident is governed by: Secret availability should follow environment trust and job function, not global workflow visibility.

Security remediation can introduce behavioral regressions and must remain within governed change controls. That principle concerns automate security and compliance scanning, whereas this specific incident is governed by: Secret availability should follow environment trust and job function, not global workflow visibility.

Question 840

Another service allows PR workflows to select the production environment and read its protected deployment credentials. Which unsupported assumption should the engineer challenge FIRST?

A scan that ran on one pull request months ago is not current assurance about the default branch.
Suppressing every existing alert does not imply future alerts should automatically be ignored.
A repository secret being encrypted at rest does not mean every workflow should be allowed to read it.
A long-lived personal token becomes safe only because it is stored in a repository secret setting.

Explanation

Correct Answer

A repository secret being encrypted at rest does not mean every workflow should be allowed to read it. This is the relevant unsupported assumption because secret availability should follow environment trust and job function, not global workflow visibility.

Incorrect Answers

This caution is valid in automate security and compliance scanning, but it is not the failure assumption illustrated by this scenario. The directly relevant risk is: A repository secret being encrypted at rest does not mean every workflow should be allowed to read it.

This caution is valid in design and implement authentication and authorization methods, but it is not the failure assumption illustrated by this scenario. The directly relevant risk is: A repository secret being encrypted at rest does not mean every workflow should be allowed to read it.

Designing and Implementing Microsoft DevOps Solutions (AZ-400) Practice Tests

Microsoft AZ-400 Practice Test 82 - 10 Questions (Last Reviewed 21-Oct-2026)
Microsoft AZ-400 Practice Test 83 - 10 Questions (Last Reviewed 20-Oct-2026)
Microsoft AZ-400 Practice Test 84 - 10 Questions (Last Reviewed 19-Oct-2026)
Microsoft AZ-400 Practice Test 85 - 10 Questions (Last Reviewed 18-Oct-2026)
Microsoft AZ-400 Practice Test 86 - 10 Questions (Last Reviewed 17-Oct-2026)

Pass Your Microsoft AZ-400 Exam Easy!

Question 830

Explanation

Correct Answer

Incorrect Answers

Question 831

Explanation

Correct Answer

Incorrect Answers

Question 832

Explanation

Correct Answer

Incorrect Answers

Question 833

Explanation

Correct Answer

Incorrect Answers

Question 834

Explanation

Correct Answer

Incorrect Answers

Question 835

Explanation

Correct Answer

Incorrect Answers

Question 836

Explanation

Correct Answer

Incorrect Answers

Question 837

Explanation

Correct Answer

Incorrect Answers

Question 838

Explanation

Correct Answer

Incorrect Answers

Question 839

Explanation

Correct Answer

Incorrect Answers

Question 840

Explanation

Correct Answer

Incorrect Answers

Designing and Implementing Microsoft DevOps Solutions (AZ-400) Practice Tests