Microsoft DevOps Engineer Expert

Question 1

Your team uses Azure App Configuration to manage feature flags for a web application deployed through Azure Pipelines. The product owner wants to enable a new checkout experience only for internal beta testers (identified by a specific Azure AD group) while keeping it disabled for all other users, without redeploying the application. Which App Configuration feature flag capability should you use?

Accepted Answer

A Targeting filter that specifies included groups and users for the feature flag

Answer

A Time Window filter that enables the flag during a scheduled maintenance window

Answer

A Percentage (Microsoft.Percentage) filter set to gradually increase the rollout

Answer

Separate App Configuration stores per environment with the flag hard-coded on in one store

Question 2

Your team runs an ASP.NET Core API instrumented with Application Insights. Support reports that certain checkout requests fail intermittently, but the front-end only logs a generic 500 error. You need a KQL query in Log Analytics that returns each failed checkout request together with the specific exception thrown during that same request execution, so you can identify the root-cause exception type per failing operation. Which query correctly correlates the two telemetry types?

Accepted Answer

requests | where success == false and name contains "checkout" | join kind=inner (exceptions) on operation_Id | project timestamp, name, resultCode, type, outerMessage

Answer

requests | where success == false and name contains "checkout" | union exceptions | project timestamp, name, resultCode, type

Answer

exceptions | where type contains "checkout" | join kind=leftouter (requests) on session_Id | project timestamp, type, resultCode

Answer

requests | where success == false and name contains "checkout" | lookup exceptions on itemId | project timestamp, name, type

Question 3

Your team runs an Application Insights-instrumented web API. Product management wants a weekly report showing the 99th percentile server response time grouped by each API operation (URL path), covering the last 7 days. You need to write a KQL query against the requests table that returns one row per operation with its p99 duration. Which query satisfies this requirement?

Accepted Answer

requests | where timestamp > ago(7d) | summarize percentile(duration, 99) by operation_Name

Answer

requests | where timestamp > ago(7d) | summarize avg(duration) by bin(timestamp, 1d)

Answer

requests | where timestamp > ago(7d) | top 99 by duration desc by operation_Name

Answer

requests | where timestamp > ago(7d) | project duration, operation_Name | render timechart

Question 4

Your team runs a high-traffic ASP.NET Core API instrumented with Application Insights. Finance flags that ingestion costs have spiked, and you want to reduce telemetry volume. However, the on-call engineers report that during incident investigations, related request, dependency, and exception records for the same operation are sometimes missing, making distributed traces incomplete. You need to cut ingestion volume while preserving statistically accurate metrics and keeping correlated telemetry items together for a given operation. Which approach best meets these requirements?

Accepted Answer

Keep adaptive sampling in the SDK, which retains all items belonging to a sampled-in operation and preserves aggregated metric accuracy via itemCount.

Answer

Enable ingestion sampling in the Application Insights resource and set a fixed daily data cap.

Answer

Disable sampling entirely and rely on data retention policies to control cost.

Answer

Configure a fixed 10% sampling rate per telemetry type independently so each type is reduced predictably.

Question 5

Your team runs a customer-facing web API on Azure App Service. Leadership wants proactive detection of outages from multiple global locations, including verification that a login endpoint returns a valid token before the checkout endpoint is exercised, all without deploying any code into the application. You are configuring Application Insights. Which monitoring capability should you implement?

Accepted Answer

A custom availability test that runs a multi-step sequence of authenticated requests submitted via the TrackAvailability API from an Azure Function

Answer

A standard (URL ping) availability test targeting the API base URL from five regions

Answer

A Smart Detection rule for failure anomalies on server response codes

Answer

A live metrics stream dashboard shared with the operations team

Question 6

Your microservices application is instrumented with Application Insights across five services. A customer reports that a specific checkout request failed intermittently. You have the operation_Id from the failed request captured in a support ticket. You need to reconstruct the complete end-to-end distributed trace — including all requests, dependencies, and exceptions across every service — for that single transaction using KQL. Which query approach correctly retrieves the full trace?

Accepted Answer

union requests, dependencies, exceptions, traces | where operation_Id == '<id>' | order by timestamp asc

Answer

requests | where operation_ParentId == '<id>' | project timestamp, name, resultCode

Answer

dependencies | where session_Id == '<id>' | summarize count() by target

Answer

requests | join kind=inner (dependencies) on cloud_RoleName | where operation_Name == '<id>'

Question 7

Your team runs a microservice on Azure App Service instrumented with Application Insights. After a recent release, users report intermittent slowness. You suspect a downstream SQL dependency is the cause. You need a KQL query that returns, for the last 24 hours, the 95th percentile duration of failed dependency calls grouped by the target dependency, so you can identify which dependency degraded most. Which query should you run in the Logs (Analytics) blade?

Accepted Answer

dependencies | where timestamp > ago(24h) | where success == false | summarize percentile(duration, 95) by target

Answer

requests | where timestamp > ago(24h) | summarize avg(duration) by name | where success == false

Answer

dependencies | where timestamp > ago(24h) | summarize count() by resultCode | render timechart

Answer

exceptions | where timestamp > ago(24h) | summarize percentile(duration, 95) by cloud_RoleName

Question 8

Your team uses Application Insights with Log Analytics. The reliability lead wants a dashboard tile showing the trend of the 95th percentile server response time bucketed into 15-minute intervals over the last 24 hours, visualized as a line chart. Which KQL query produces the correct result?

Accepted Answer

requests | where timestamp > ago(24h) | summarize percentile(duration, 95) by bin(timestamp, 15m) | render timechart

Answer

requests | where timestamp > ago(24h) | summarize avg(duration) by bin(timestamp, 15m) | render barchart

Answer

requests | where timestamp > ago(24h) | summarize percentile(duration, 95) by duration | render timechart

Answer

requests | where timestamp > ago(24h) | top 95 by duration | render timechart

Question 9

A production ASP.NET Core web app is instrumented with Application Insights. During a promotional event, on-call engineers report that the app is intermittently returning 500 errors, and they need to observe request rates, failure rates, and server CPU in real time as the traffic surges — with sub-second latency and without waiting for telemetry to be ingested and indexed. Which Application Insights capability should they use?

Accepted Answer

The Live Metrics Stream, which shows near real-time performance and failure counters without persisting the data to the workspace

Answer

A scheduled Log Analytics KQL query over the requests table that runs every 60 seconds

Answer

The Application Map to visualize dependencies between components

Answer

A multi-step availability test executed from five geographic regions

Question 10

Your team runs a customer-facing web API instrumented with Application Insights. Leadership wants to be automatically notified when the failure rate of the API rises abnormally compared to its typical baseline, without manually defining static numeric thresholds that would need constant tuning as traffic patterns change throughout the day. You must configure this with the least ongoing maintenance. What should you use?

Accepted Answer

Application Insights Smart Detection (failure anomalies) to detect abnormal rises in the failure rate using machine learning against the historical baseline

Answer

A static metric alert rule in Azure Monitor on the 'Failed requests' metric with a fixed threshold of 50 failures over 5 minutes

Answer

A scheduled log query alert that runs a KQL query every hour counting exceptions and emails the team a summary

Answer

A Container Insights alert on pod restart count in the AKS cluster hosting the API

Question 11

Your team publishes an internal .NET library to an Azure Artifacts feed. Leadership requires that every package version encode the release date so consumers can immediately identify the age of a dependency, and the versioning scheme must not require manual increment of a major/minor number for each release. The library is released on an unpredictable cadence, sometimes multiple times per day. Which versioning approach should you implement in the Azure Pipelines build that produces the NuGet package?

Accepted Answer

Use CalVer with a version format such as YYYY.MM.DD.rev, generating the revision from a pipeline counter expression so multiple same-day builds remain unique.

Answer

Use strict SemVer (MAJOR.MINOR.PATCH) and manually bump the PATCH number in the .csproj before each release.

Answer

Publish every build with the fixed version 1.0.0 and rely on the Azure Artifacts feed view (@Local, @Prerelease, @Release) to distinguish releases.

Answer

Append the Git commit SHA as the entire package version so each build is uniquely identifiable.

Question 12

Your organization uses an Azure Artifacts feed named 'Shared-Libs' to distribute internal NuGet packages. A new team of developers needs to restore packages from this feed in their local builds and in a pipeline, but they must not be able to publish new package versions or delete existing ones. The feed currently grants the 'Project Collection Build Service' the Contributor role. What is the most appropriate way to grant the new team the access they require while following least-privilege principles?

Accepted Answer

Add the team's security group to the feed with the Reader role.

Answer

Add the team's security group to the feed with the Collaborator role.

Answer

Add the team's security group to the feed with the Contributor role.

Answer

Add the team's security group as a feed Owner and disable publishing at the view level.

Question 13

Your team publishes NuGet packages to an Azure Artifacts feed. Developers continuously push prerelease packages during active development, but downstream consumer teams must only be able to restore packages that have passed QA validation. You want to promote validated packages so consumers can reference a stable set without changing their feed source URL to a different feed. Which approach should you implement?

Accepted Answer

Create separate @Prerelease and @Release views on the feed and promote a package to the @Release view after QA passes; have consumers connect to the @Release view endpoint.

Answer

Create a second Azure Artifacts feed named 'Release' and use a pipeline task to copy validated packages between feeds, pointing consumers at the second feed.

Answer

Configure an upstream source on the consumer feed that pulls only packages tagged as validated from the development feed.

Answer

Apply a retention policy that automatically deletes prerelease packages so only validated stable packages remain visible to consumers.

Question 14

Your team publishes internal NuGet packages to an Azure Artifacts feed. Developers consuming these packages report that when they step into library code during debugging in Visual Studio, they cannot see the original source or line-level breakpoints. You want to enable full source-level debugging of the published packages without manually distributing PDB files. What should you configure in the build pipeline that produces the packages?

Accepted Answer

Add a PublishSymbols task that publishes the .pdb files to the Azure Artifacts symbol server, and have developers configure Visual Studio to use the organization's symbol server.

Answer

Enable the retention policy on the feed to keep all package versions indefinitely so the PDBs are never deleted.

Answer

Set the NuGet package version to a SemVer prerelease tag so Visual Studio automatically downloads matching debug symbols.

Answer

Configure an upstream source on the feed pointing to nuget.org so symbols are resolved from the public symbol server.

Question 15

Your team maintains an Azure Artifacts feed named 'Contoso-NuGet' for internal .NET packages. Developers currently restore both your internal packages and public packages from nuget.org, but you want a single feed URL in the NuGet.config that resolves internal packages while also caching and vetting public packages so the same versions are always available even if nuget.org is unavailable. You also need to promote only tested internal package versions to a 'Release' view consumed by production build pipelines. Which combination of Azure Artifacts capabilities should you configure?

Accepted Answer

Enable nuget.org as an upstream source on the feed, and publish tested packages to a 'Release' view via promotion, pointing production pipelines at the '@Release' view URL.

Answer

Create a separate feed for public packages and reference both feed URLs in NuGet.config, using retention policies to keep only release-quality versions.

Answer

Set the feed's default view to '@Local' and disable upstream sources, then manually mirror required nuget.org packages by uploading .nupkg files.

Answer

Enable nuget.org as an upstream source and use branch policies to gate which package versions appear in the '@Prerelease' view for production pipelines.

Question 16

Your team runs automated tests in an Azure Pipelines build that publishes test results to Azure DevOps. Leadership wants a dashboard widget that shows the trend of automated test pass rate over the last 12 weeks so they can spot regressions in test quality across sprints. The data must reflect historical results, not just the latest run. Which dashboard widget should you configure to meet this requirement?

Accepted Answer

The Test Results Trend (Advanced) widget backed by the Analytics service, filtered by pipeline and grouped by outcome over the last 12 weeks

Answer

The Deployment Status widget scoped to the release pipeline

Answer

The Query Results widget bound to a work item query for Test Case work items

Answer

The Build History widget pinned to the CI pipeline definition

Question 17

Your team lead wants a dashboard that answers a single question: 'Once a developer starts actively working on a work item, how long does it take on average to reach the Done state?' The team uses Azure Boards with a Kanban board whose columns map to the states New, Active, Resolved, and Closed (mapped to Done). Management is NOT interested in how long items sat in the backlog before work began. Which Azure Boards analytics widget should you add to the dashboard to answer this question?

Accepted Answer

Cycle Time widget, configured to measure from the first Active state to the Closed/Done state

Answer

Lead Time widget, configured to measure from work item creation to the Closed/Done state

Answer

Cumulative Flow Diagram widget showing counts of items in each board column over time

Answer

Velocity widget showing completed story points per iteration

Question 18

Your team develops in a GitHub repository and tracks work in Azure Boards. Developers want commits and pull requests in GitHub to automatically link to Azure Boards work items so that the deployment/development section of each work item shows the related code changes. You have already installed the Azure Boards app for GitHub and connected the repository. What must developers do in their commit messages or PR descriptions to create these links?

Accepted Answer

Reference the work item using the syntax AB#123 in the commit message or PR title/description.

Answer

Reference the work item using the syntax #123, matching GitHub's native issue-linking syntax.

Answer

Add a GitHub label named azure-boards-123 to the pull request.

Answer

Include the full work item URL in a commit trailer prefixed with Fixes:.

Question 19

Your team uses GitHub for source control and Azure Boards for planning. Developers follow GitHub Flow, creating short-lived feature branches merged via pull requests. The product owner complains that when a work item is marked 'Done' in Azure Boards, there is no visibility into whether the code implementing that work item has actually reached production. You need to design a feedback cycle that surfaces the real deployment state of each work item back to the board with minimal custom development. Which approach best achieves this?

Accepted Answer

Configure the Azure Boards-GitHub integration to link commits and PRs, and use Azure Pipelines deployment jobs targeting environments so that Deployment records automatically appear on the linked work items' Development section.

Answer

Add a custom 'Deployed' state to the work item workflow and require developers to manually update it after each production release.

Answer

Create a dashboard cycle time widget filtered to the Done state so stakeholders can infer deployment timing from the average duration.

Answer

Enable branch policies requiring linked work items on every pull request so the board reflects merge status as the deployment indicator.

Question 20

Your team uses GitHub for source control and Azure Boards for work tracking. Leadership wants full end-to-end traceability so that anyone viewing a work item can see which pull requests implemented it and whether the associated build succeeded, without leaving Azure Boards. Developers already reference work items in commit messages using AB#123 syntax. What must you configure to satisfy this requirement with the least custom development?

Accepted Answer

Install the Azure Boards app from the GitHub Marketplace and connect the GitHub repository to the Azure Boards project so PRs, commits, and status appear in the Development section of work items.

Answer

Create a GitHub Actions workflow that calls the Azure DevOps REST API on each PR to append a comment to the linked work item with the build result.

Answer

Enable a service hook in Azure DevOps that posts to a GitHub webhook whenever a work item state changes so GitHub stores the traceability link.

Answer

Configure branch policies in Azure Repos requiring linked work items, then mirror the GitHub repository into Azure Repos on a schedule.

Question 21

Your organization stores code in GitHub and manages sprint planning in Azure Boards. Developers work in GitHub using GitHub Flow, opening feature branches and pull requests. Product managers want work item state in Azure Boards to automatically move to 'Closed' when the linked pull request is merged, without developers manually updating boards. You have installed the Azure Boards app on the GitHub organization. Which configuration achieves automatic state transition on PR merge?

Accepted Answer

Add an 'AB#<id>' mention in the PR description or a commit message using a state-transition keyword (e.g., 'Fixes AB#123'), which the Azure Boards GitHub integration uses to close the linked work item on merge to the default branch.

Answer

Configure a branch policy in Azure Repos requiring linked work items, which will automatically close the item when the GitHub PR merges.

Answer

Enable the 'Automatically close work items' toggle in Azure Boards Project Settings > GitHub connections, then link the PR with AB# and closure happens regardless of keyword.

Answer

Create a GitHub Actions workflow triggered on 'pull_request closed' that calls the Azure DevOps REST API with a service connection to update every referenced work item state.

Question 22

Your engineering organization uses Azure Boards for backlog management and Slack for team communication. The delivery lead wants engineers to receive a Slack message in the #team-releases channel whenever a work item in the 'Delivery' area path transitions to the 'Resolved' state, but they do NOT want notifications for any other state change or area path. The solution must require minimal ongoing maintenance and avoid custom code hosting. Which approach should you implement?

Accepted Answer

Configure the Azure Boards app for Slack and create a subscription with a filter on area path and the 'work item updated' event scoped to the Resolved state.

Answer

Create an outgoing service hook in Azure DevOps that posts to a Slack incoming webhook on every 'work item updated' event, then filter messages inside Slack with a workflow rule.

Answer

Deploy an Azure Function triggered by an Azure Boards service hook that inspects each event payload and forwards only matching events to Slack.

Answer

Enable the built-in Azure DevOps email notification for the Delivery team and configure Slack to ingest the notification mailbox.

Question 23

Your engineering leadership wants a dashboard metric that measures the total elapsed time from the moment a customer feature request is created as a work item until it is marked Done, so they can quantify overall responsiveness to customer demand. The team already tracks how long items spend actively being worked. Which Azure Boards analytics metric should you add to the dashboard to satisfy leadership's request?

Accepted Answer

Lead Time, measured from work item creation to closure

Answer

Cycle Time, measured from when work becomes active to closure

Answer

Mean Time to Recovery (MTTR) for the deployment environment

Answer

Velocity, measured as completed story points per sprint

Question 24

Your operations team wants a dashboard that reports Mean Time To Detect (MTTD) alongside MTTR for production incidents. Incidents are tracked as Azure Boards work items of type 'Incident', which capture the timestamp an outage actually began (a custom field 'Impact Start') and the timestamp the incident work item was created. MTTR is already calculated from resolved date minus created date. Which approach correctly produces MTTD for the dashboard?

Accepted Answer

Build an Analytics view and Power BI measure that averages the difference between the incident's Created Date and its 'Impact Start' custom field, then pin it as a dashboard tile.

Answer

Use the built-in Azure Boards Cycle Time widget, which automatically reports MTTD for Incident work item types.

Answer

Configure a Lead Time widget filtered to the Incident work item type, since Lead Time equals detection time.

Answer

Add a Velocity chart to the dashboard and interpret the story points completed per sprint as the detection latency.

Question 25

Your team wants a dashboard widget that visualizes how many User Stories were completed each week over the last three months, grouped by the assigned team member, so the delivery manager can spot workload imbalances. You have an existing flat-list query returning all completed User Stories with their Closed Date and Assigned To fields. What is the most appropriate way to configure this visualization in Azure Boards?

Accepted Answer

Keep the flat-list query and add a Chart for Work Items widget configured as a stacked bar chart grouped by Assigned To with a date-based x-axis

Answer

Convert the query to a tree query and add a Cumulative Flow Diagram widget pointing to it

Answer

Add a Velocity widget scoped to the team and set the number of sprints to display

Answer

Add a Burndown widget bound to a shared query filtered by Closed Date

Question 26

Your team runs sprints in Azure Boards and deploys via Azure Pipelines. Product management wants an automatically generated release notes document published to the team wiki after each successful production deployment. The notes must list all completed User Stories and Bugs associated with the commits included in that release, without requiring anyone to manually curate the list. Which approach best satisfies this requirement with the least ongoing maintenance?

Accepted Answer

Add a pipeline step that uses the built-in release notes generation to collect associated work items from the build's linked commits and publish the output as a Markdown page to the wiki via the Azure DevOps REST API.

Answer

Create a shared query in Azure Boards filtered by iteration path and manually copy its results into the wiki after each deployment.

Answer

Configure a Teams channel webhook so that every work item state change posts a message, then archive the channel history as the release notes.

Answer

Enable a dashboard widget showing the sprint burndown and export it as a PDF attached to each release.

Question 27

Your team collaborates primarily in Microsoft Teams. Product owners want a dedicated Teams channel to automatically receive a notification whenever any work item in the 'Payments' area path on the Azure Boards project transitions to the 'Resolved' state, so testers can begin verification promptly. You must configure this with the least administrative effort and without writing custom code. What should you do?

Accepted Answer

Install the Azure Boards app in the Teams channel and create a subscription filtered by area path and the 'Resolved' state transition.

Answer

Create an Azure DevOps service hook that posts to an Incoming Webhook connector in the Teams channel for every work item updated event.

Answer

Configure a personal notification subscription in Azure Boards for each product owner filtered to the 'Payments' area path.

Answer

Build an Azure Logic App triggered by the Azure Boards connector that filters work items and posts an adaptive card to the channel.

Question 28

Your platform team wants developers to self-provision ephemeral test environments in Azure on demand, but the environments must only use pre-approved infrastructure templates, be deployed into specific subscriptions per project, and be automatically tracked for cleanup. Developers should request environments through a catalog without having direct rights to write ARM/Bicep at will. Which Azure service and configuration best meets these requirements?

Accepted Answer

Azure Deployment Environments with a dev center, environment types mapped to target subscriptions, and a catalog of environment definitions sourced from a Git repository

Answer

Grant each developer Contributor on a shared subscription and provide a Bicep module registry they can deploy from manually

Answer

Create Azure DevOps release pipelines with manual approval gates that run az deployment commands using a service connection

Answer

Use Azure Blueprints assignments applied at the management group level for every developer request

Question 29

Your team wants to build a Power BI report that shows how the number of active bugs has changed week-over-week across the past 12 months, including work items that have since been closed or deleted from the backlog. The report must refresh automatically and must not be limited by the default work item query row caps. Which Azure DevOps data source should you connect Power BI to in order to satisfy these requirements with the least custom development?

Accepted Answer

An Analytics view configured with a rolling 12-month history and the required fields, connected via the Power BI Data Connector

Answer

A shared flat-list work item query saved in Azure Boards, exported to Excel and imported into Power BI

Answer

The Azure Boards REST API for Work Items, called from a custom Power BI M query on each refresh

Answer

The Cumulative Flow Diagram widget exported as an image and embedded into the Power BI report

Question 30

Your company ships proprietary software and must ensure that no open-source dependency introduces a copyleft license (such as GPL) into the codebase. You want to automatically block any Azure DevOps pipeline build that pulls in a dependency with a prohibited license, and you want the results centrally visible. Which approach best meets this requirement?

Accepted Answer

Integrate a software composition analysis (SCA) tool such as Mend (WhiteSource) or Snyk into the pipeline, configure a license policy that fails the build on prohibited licenses, and publish results as pipeline artifacts.

Answer

Enable GitHub Advanced Security secret scanning on the Azure Repos repository to detect license strings in source files.

Answer

Add a Dependabot configuration file to the repository to automatically open pull requests updating dependencies to newer license versions.

Answer

Store all approved licenses in Azure Key Vault and reference them as pipeline variables so the build only uses vaulted dependencies.

Question 31

Your team stores its source in Azure Repos. Leadership is concerned that developers occasionally commit API keys and connection strings, and they want any exposed credentials detected automatically without requiring developers to run local tools. You have enabled GitHub Advanced Security for Azure DevOps on the repositories. Which capability of GitHub Advanced Security for Azure DevOps detects secrets that already exist in the commit history and repository content after code is pushed?

Accepted Answer

Secret scanning (repository scanning) that inspects pushed content and history for known credential patterns

Answer

Push protection that blocks the commit at the client before it reaches the server

Answer

Dependency scanning that flags vulnerable open-source packages in the manifest files

Answer

Code scanning powered by CodeQL that analyzes source for security anti-patterns

Question 32

Your team's Azure DevOps pipeline signs a mobile app using a code-signing certificate (.p12) and an Apple provisioning profile. Currently a developer commits these binary files into the repository and the pipeline reads them directly. A security audit flagged this as a leakage risk. You must store the certificate and profile so that they are encrypted at rest, never checked into source control, and only usable by explicitly authorized pipelines. Which Azure DevOps feature should you use?

Accepted Answer

Upload the files to the Secure files section of the Library and reference them with the DownloadSecureFile task, protecting them with a pipeline authorization/approval check.

Answer

Add the base64-encoded contents of both files as secret variables in a variable group and decode them at runtime.

Answer

Store the files in an Azure Storage account and generate a SAS token that the pipeline uses to download them.

Answer

Commit the files to a separate private Git repository and check it out during the build using a PAT.

Question 33

Your organization has 40 Azure DevOps projects. The platform team creates an ARM service connection in a shared 'Infrastructure' project that authenticates to a production subscription. Several other project teams request access to deploy through this same connection. Security requires that only explicitly approved pipelines can use the connection, and that access can be revoked per project without deleting the connection. What should you configure?

Accepted Answer

Share the service connection to each requesting project individually, and in each project set the connection's pipeline permissions so only named pipelines are authorized (disable 'Grant access permission to all pipelines').

Answer

Recreate the service connection as organization-scoped and add every requesting pipeline to a global allow list.

Answer

Give each requesting team the Endpoint Administrator role on the Infrastructure project so they can manage the connection themselves.

Answer

Export the service principal credentials and have each team create their own identical service connection in their project.

Question 34

Your team uses an Azure Resource Manager service connection in Azure DevOps that authenticates with a service principal secret. Security policy now requires eliminating stored secrets that require manual rotation, while keeping existing pipeline YAML changes to a minimum. The subscription and target resources are in the same Azure AD tenant as your Azure DevOps organization. What should you do?

Accepted Answer

Convert the service connection to use workload identity federation so Azure DevOps exchanges a short-lived OIDC token for Azure access without a stored secret.

Answer

Rotate the service principal client secret automatically by storing it in Azure Key Vault and referencing it in a variable group.

Answer

Replace the service principal with a user-assigned managed identity assigned directly to the Microsoft-hosted agent pool.

Answer

Switch the service connection to use a personal access token (PAT) scoped to the deployment resource group.

Question 35

Your team uses Azure DevOps for source control and work tracking, but an external system running Jenkins must automatically start a build whenever code is pushed to the main branch of a specific Azure Repos Git repository. Security requires that the integration send only the relevant event data to a single HTTP endpoint, without granting Jenkins broad API access or requiring polling. What should you configure in Azure DevOps?

Accepted Answer

Create a Service Hooks subscription for the 'Code pushed' event, filtered to the repository and main branch, with a Web Hooks action pointing to the Jenkins endpoint URL.

Answer

Add a Jenkins service connection under Project Settings and reference it from a build validation branch policy on main.

Answer

Grant Jenkins a full-scope Personal Access Token and configure Jenkins to poll the Azure DevOps REST API for new commits on main.

Answer

Configure an Azure Pipelines YAML CI trigger with a path filter and a 'Publish to Jenkins' task at the end of the pipeline.

Question 36

Your team runs a containerized application on Azure Kubernetes Service (AKS) that must read connection strings from Azure Key Vault. You have enabled workload identity on the cluster and assigned a user-assigned managed identity to the workload. Security policy requires that permissions be auditable through Azure role assignments and that individual secret access be granted with the narrowest possible scope. The Key Vault currently uses the vault access policy permission model. What should you do to meet the requirements with the least ongoing administrative effort?

Accepted Answer

Switch the Key Vault to the Azure RBAC permission model and grant the managed identity the Key Vault Secrets User role scoped to the specific secret.

Answer

Keep the vault access policy model and add an access policy granting the managed identity Get and List permissions on secrets.

Answer

Switch the Key Vault to the Azure RBAC permission model and grant the managed identity the Key Vault Administrator role scoped to the vault.

Answer

Keep the vault access policy model and store the managed identity's client secret in a pipeline variable group to authenticate to the vault.

Question 37

Your team runs a customer-facing API on an Azure Virtual Machine Scale Set. Traffic is highly seasonal and follows a predictable daily pattern that shifts gradually over weeks, so a fixed CPU alert threshold either fires constantly during normal peaks or misses genuine spikes during quiet periods. You must configure an Azure Monitor metric alert that automatically adapts to the changing baseline of CPU utilization while still catching abnormal deviations, and it must require minimal ongoing manual tuning. Which alert configuration should you use?

Accepted Answer

Create a metric alert with a dynamic threshold condition that learns the metric's historical pattern and flags statistical deviations.

Answer

Create a static threshold metric alert set at 80% CPU and adjust the value manually each month as traffic patterns change.

Answer

Create a log search alert with a KQL query that averages CPU over the last 5 minutes and compares it to a hardcoded value.

Answer

Enable Application Insights Smart Detection to monitor the scale set's CPU utilization automatically.

Question 38

Your organization has a single self-hosted agent pool named 'Build' containing 12 agents. Four of these agents have the .NET 8 SDK and a licensed code-signing tool installed; the remaining eight only have the .NET 8 SDK. A YAML pipeline job must run only on the agents that can perform code signing, without creating a separate agent pool. What is the correct approach?

Accepted Answer

Add a user-defined capability (e.g., CodeSign=true) to the four signing agents, then specify a matching 'demands' entry in the job's pool definition.

Answer

Set the job's 'continueOnError' property to true so it retries on agents until it lands on one with the signing tool.

Answer

Add a 'condition' expression on the job that checks for the signing tool path using variables['Agent.OS'].

Answer

Use a matrix strategy with four legs so the job is guaranteed to run on all four signing-capable agents.

Question 39

Your team runs a self-hosted agent pool in Azure Pipelines. Over the past two weeks, several YAML pipeline runs have failed intermittently with the error 'No agent found in pool that satisfies the specified demands.' The pipelines require a demand for a custom capability named 'msbuild17'. You need to diagnose which agents can service these jobs and reduce the number of stalled runs before they eventually time out. What should you do FIRST?

Accepted Answer

In the agent pool's Agents tab, review each agent's Capabilities to confirm which agents advertise the 'msbuild17' user capability, and enable the offline agents.

Answer

Increase the pipeline's job timeout so stalled runs have more time to acquire an agent.

Answer

Convert the self-hosted pool to a Microsoft-hosted pool so demands are satisfied automatically.

Answer

Add a 'continueOnError: true' setting to the affected jobs so the pipeline reports success regardless of agent availability.

Question 40

Your team uses a multi-stage YAML pipeline in Azure Pipelines. The production stage targets an Environment that has a manual approval check configured. You set the approval to time out after 24 hours. During a weekend release, no approver responds within the 24-hour window. Compliance requires that any un-actioned production deployment must NOT proceed and must not silently linger indefinitely. Which timeout behavior and configuration ensures the deployment is stopped when the approval expires?

Accepted Answer

When the approval timeout is reached, the check times out and the stage is automatically rejected, causing the deployment run to fail.

Answer

When the approval timeout is reached, the deployment automatically proceeds because the timeout only limits how long approvers can respond before auto-approval.

Answer

When the approval timeout is reached, the run is paused indefinitely until an administrator manually cancels it.

Answer

When the approval timeout is reached, the check is skipped and the stage runs with a warning logged to the pipeline summary.

Question 41

Your team maintains an Azure resource group that should contain ONLY the resources defined in a Bicep template. During a release stage, an ARM/Bicep deployment task provisions a storage account, a Key Vault, and an App Service plan. A previous manual deployment left an orphaned public IP address and an unused network security group in the same resource group. The release pipeline must remove any resources that are not declared in the template on every deployment, while keeping the pipeline declarative. Which deployment configuration should you use?

Accepted Answer

Run the deployment in Complete mode so that Azure Resource Manager deletes resources in the resource group that are not present in the template.

Answer

Run the deployment in Incremental mode and add a separate script task that enumerates and deletes all resources not referenced by the template.

Answer

Enable the 'what-if' operation on the deployment task so ARM automatically removes resources flagged as deletions.

Answer

Run the deployment in Incremental mode with the 'rollbackToLastSuccessful' option enabled to reset the resource group state.

Question 42

Your team deploys a multi-tier Azure environment using a main ARM template that references three linked templates (network, compute, and data). During an Azure Pipelines deployment, the main template deploys successfully, but the resource group deployment fails with an error indicating the linked templates cannot be found. The linked templates are stored in an Azure Storage account container that is not publicly accessible. Which action correctly enables the deployment to resolve the linked templates?

Accepted Answer

Generate a SAS token for the storage container, append it as a query string to each linked template URI, and pass the base URI plus the token as template parameters.

Answer

Generate a SAS token for the storage container and pass it as the value for the templateSpecVersion parameter in the pipeline task.

Answer

Upload the linked templates as pipeline artifacts and reference them using the $(Pipeline.Workspace) path in the linked template URIs.

Answer

Set the storage container access level to Blob (anonymous read) so the ARM deployment engine can retrieve the templates during deployment.

Question 43

You maintain a multi-stage YAML pipeline in Azure Pipelines. The 'Build' stage compiles the application and publishes the output. A later 'Deploy' stage runs on a separate agent and must consume exactly the artifact produced by the 'Build' stage of the same pipeline run. You want the artifact to be retrieved automatically without adding an explicit download task, using the recommended modern pipeline artifact approach. Which configuration achieves this?

Accepted Answer

Use the 'PublishPipelineArtifact' task in Build and a deployment job in Deploy; the current pipeline artifacts download automatically at the start of the deployment job.

Answer

Use the 'PublishBuildArtifacts' task in Build and manually add a 'DownloadBuildArtifacts' task at the beginning of the Deploy stage.

Answer

Publish the artifact to Azure Artifacts as a Universal Package and restore it with a 'UniversalPackages' task in Deploy.

Answer

Store the compiled output in a pipeline variable in Build and reference the variable expression in the Deploy stage.

Question 44

Your team runs a production ASP.NET Core web app on Azure App Service (Standard tier). Business requires zero-downtime releases with the ability to instantly roll back if post-deployment smoke tests fail. You are designing the release stage in a multi-stage Azure Pipelines YAML file. Which approach best meets these requirements?

Accepted Answer

Deploy the new build to a 'staging' deployment slot, run smoke tests against the slot's URL, and if they pass perform a slot swap to production; if tests fail, do not swap.

Answer

Deploy directly to the production slot and configure a scheduled Azure Automation runbook to redeploy the previous artifact if Application Insights reports errors.

Answer

Use a canary strategy that routes 10% of traffic to the new version via Azure Front Door weighted routing, gradually increasing to 100% over several hours.

Answer

Stop the App Service, deploy the new build, restart it, and run smoke tests afterward against the production URL.

Question 45

Your team deploys a customer-facing API to a single Azure App Service. Leadership wants to reduce blast radius by routing only 10% of production traffic to a new revision for 30 minutes while monitoring Application Insights failure rate, then automatically shift the remaining 90% if metrics stay healthy. You must implement this in a multi-stage Azure Pipeline using a deployment job. Which strategy keyword should you configure on the deployment job to achieve incremental traffic-based rollout with pre/post traffic-routing hooks?

Accepted Answer

strategy: canary with increments and the preDeploy/routeTraffic/postRouteTraffic lifecycle hooks

Answer

strategy: rolling with maxParallel set to 10 percent of instances

Answer

strategy: runOnce with a manual approval check before the deploy hook

Answer

strategy: blue-green using deployment slot swap with preSwapWarmup

Question 46

Your team deploys to a production environment defined in Azure Pipelines. Before any deployment stage targeting this environment runs, compliance requires that an external change-management system (accessible via HTTPS) confirms an approved change ticket exists. The confirmation must be fully automated — no human clicks — and must block the stage until the external system responds successfully. Which environment check should you configure?

Accepted Answer

Add an Invoke REST API check on the environment that calls the change-management API and passes based on the response

Answer

Add a Required reviewers (Approvals) check with the change-management team assigned as approvers

Answer

Add a Business hours check so deployments only proceed during the approved change window

Answer

Add an Exclusive lock check to serialize deployments to the environment

Question 47

Your team uses Azure Pipelines with a multi-stage YAML pipeline that runs unit tests and publishes results using the PublishCodeCoverageResults task. Leadership mandates that no pull request may be completed unless the changed code meets an 80% line coverage threshold, and the check must automatically block the PR if coverage falls below that level. What should you implement to enforce this requirement?

Accepted Answer

Add a branch policy build validation on the target branch and configure the pipeline with a code coverage check (e.g., a coverage threshold step that fails the build) so the required status check blocks completion when coverage is below 80%.

Answer

Configure a release gate with an Azure Monitor query that evaluates coverage after deployment to production.

Answer

Enable the built-in 'Coverage' retention policy in project settings and set it to 80 percent.

Answer

Add an environment approval check on the build stage that requires a reviewer to manually verify coverage before the PR merges.

Question 48

Your team maintains an Azure Pipelines YAML pipeline that builds a Docker image and pushes it to a private Azure Container Registry (ACR), then deploys it to Azure Kubernetes Service (AKS). Currently the pipeline stores the ACR admin username and password as pipeline secret variables. Security has flagged that the ACR admin account is enabled and long-lived credentials are being used. You must eliminate stored registry credentials while allowing the pipeline to push images to ACR, following least-privilege and Microsoft-recommended practices. What should you do?

Accepted Answer

Create an Azure Resource Manager service connection using a workload identity federation (service principal), grant it the AcrPush role on the registry, and use the Docker task with that service connection.

Answer

Rotate the ACR admin credentials on a monthly schedule using a scheduled pipeline and store the new values in Azure Key Vault referenced as secret variables.

Answer

Generate an ACR repository-scoped token with push permissions and store the token password as a secret variable in a variable group.

Answer

Enable anonymous pull on the registry and continue using the admin account only for pushes during the build stage.

Question 49

Your team runs an Azure Pipelines YAML pipeline on a Microsoft-hosted ubuntu-latest agent. The build job requires a very specific version of Node.js (18.14.2) plus several native build tools that are not present on the hosted image, and you want to avoid spending several minutes each run installing them with a script step. You already publish a prebuilt Docker image containing exactly the required toolchain to your Azure Container Registry. What is the most efficient way to have the build steps execute inside that toolchain image on the hosted agent?

Accepted Answer

Define a container resource pointing to the ACR image and reference it with the job-level 'container' keyword so all steps run inside that container.

Answer

Add a Docker@2 task with the 'run' command as the first step so subsequent script steps execute in the container context.

Answer

Register a self-hosted agent inside the container image and target its pool from the pipeline.

Answer

Use a deployment job with the 'runOnce' strategy and set the image name in the environment resource.

Question 50

Your team deploys a .NET web application together with its SQL Server database using a multi-stage Azure Pipeline. The database schema is managed with Entity Framework Core migrations. During production releases, the pipeline occasionally fails when the same migration is re-run after a partial deployment, and DBAs require that any schema change be reviewed before it touches the production database. You must redesign the release stage so schema changes are safe to re-run and reviewable before execution. Which approach best meets these requirements?

Accepted Answer

Generate an idempotent SQL migration script with 'dotnet ef migrations script --idempotent', publish it as an artifact, gate the production stage with a manual approval, then execute the script with a SqlAzureDacpacDeployment/Sql task.

Answer

Run 'dotnet ef database update' directly against production in the deploy job, and add a rollback script that drops the database if the job fails.

Answer

Enable EF Core automatic migrations at application startup so the schema updates itself the first time the new app version handles a request in production.

Answer

Package the database as a DACPAC and deploy it with schema-compare set to drop objects not in source, running immediately after the build with no approval.

Question 51

Your team deploys a monolithic web application to a fleet of 12 on-premises IIS servers behind a load balancer. You need an Azure Pipelines mechanism that installs an agent on each server, targets the machines by tags (for example 'web' and 'db'), and rolls out the deployment to a percentage of the servers at a time so the application stays available throughout. Which Azure Pipelines feature should you use to target and orchestrate these physical servers?

Accepted Answer

Create a deployment group, register each server as a target with tags, and reference it in a deployment job that uses the 'runOnce' or 'rolling' strategy with a batch percentage.

Answer

Create an environment with a Kubernetes resource and reference it in a deployment job so pods roll out gradually.

Answer

Create a self-hosted agent pool and set the parallel job count to 12 so all servers deploy simultaneously.

Answer

Use a Microsoft-hosted agent with a matrix strategy that iterates over server hostnames using WinRM.

Question 52

Your team runs a multi-stage YAML pipeline in Azure DevOps that deploys to a production Environment. Compliance requires that every production deployment record be retained for at least two years for audit purposes, but the organization's project-level pipeline retention policy is set to keep runs for only 30 days. You notice that after 30 days, some production deployment history is being purged. What is the most reliable way to ensure the required deployment records are preserved without disabling retention cleanup for all runs?

Accepted Answer

Manually or programmatically apply a retention lease (via the 'Retain' setting) to the specific pipeline runs that performed production deployments.

Answer

Increase the project-level 'Days to keep runs' setting to 730 days so all pipeline runs are retained for two years.

Answer

Enable the 'Retain associated artifacts' checkbox on the production stage so deployment history follows the artifact lifetime.

Answer

Add a branch policy on the main branch that prevents deletion of any deployment associated with production.

Question 53

Your team deploys a web application to a production environment using an Azure Pipelines multi-stage YAML pipeline. You must implement a deployment that reroutes traffic to a newly deployed version only after health probes pass, and if the health checks fail you need to automatically restore the previous version. You want to use the built-in strategy that provides explicit lifecycle hooks (preDeploy, deploy, routeTraffic, postRouteTraffic, and on: failure/success) for this rerouting and validation logic. Which deployment job strategy should you configure?

Accepted Answer

The canary strategy, using the increments keyword to shift a percentage of traffic per iteration

Answer

The runOnce strategy, placing all rerouting and rollback commands inside a single deploy hook

Answer

The rolling strategy, using maxParallel to update batches of targets sequentially

Answer

A standard job (not a deployment job) with manual script steps that call the load balancer API

Question 54

Your team manages 40 on-premises Windows servers that host a legacy web application. You use PowerShell Desired State Configuration (DSC) with an Azure Automation State Configuration (DSC) pull server. Recently, operators have been making manual changes directly on some servers to fix urgent issues, causing configuration drift. Management wants the servers to automatically return to their compliant, defined state without manual intervention, and they want reporting on which nodes are non-compliant. Which Local Configuration Manager (LCM) setting should you configure on the nodes?

Accepted Answer

Set ConfigurationMode to ApplyAndAutoCorrect

Answer

Set ConfigurationMode to ApplyOnly

Answer

Set ConfigurationMode to ApplyAndMonitor

Answer

Set RefreshMode to Push and disable RebootNodeIfNeeded

Question 55

Your team runs a multi-stage YAML pipeline in Azure Pipelines that deploys to a shared 'Production' environment. During a recent release, two pipeline runs triggered by rapid commits both entered the production deployment stage simultaneously, causing a partially deployed, inconsistent state. You must ensure that only one pipeline run at a time can deploy to the Production environment, and that subsequent runs wait rather than fail. Which configuration should you apply?

Accepted Answer

Add an Exclusive Lock check on the Production environment so pipeline runs are queued and executed one at a time.

Answer

Set a concurrency group with cancel-in-progress at the pipeline level to stop older runs.

Answer

Configure a Business Hours check on the Production environment to restrict deployment windows.

Answer

Reduce the parallel job count in the organization's self-hosted agent pool to one.

Question 56

Your organization requires that every production deployment pipeline runs a mandatory security-scanning step and a credential-detection step that development teams cannot remove or bypass. Teams author their own YAML pipelines in separate repositories, but all pipelines must inherit the enforced steps. You want to guarantee compliance while still letting teams add their own build and test stages. Which approach should you implement?

Accepted Answer

Create an extends template in a shared repository that defines the required steps, and configure a pipeline (required template) check on the protected resource so pipelines that do not extend the approved template are blocked.

Answer

Provide a step template in a shared repository and instruct each team to include it near the top of their pipeline using the steps template syntax.

Answer

Add the security and credential-detection steps to a variable group and reference the variable group in each team's pipeline.

Answer

Use a decorator only in the build stage of each pipeline and rely on branch policies to prevent teams from editing the YAML.

Question 57

Your team's Azure Pipelines YAML build runs unit tests successfully, but integration tests fail because they require a running Redis instance. The tests connect to Redis on localhost:6379. You want the dependency to start automatically for the duration of the job on the Microsoft-hosted Linux agent, without maintaining a separate persistent server or writing custom startup scripts. What should you configure in the pipeline?

Accepted Answer

Define a container resource under 'resources.containers' and reference it in the job's 'services' section so Redis runs as a service container.

Answer

Add a 'DockerInstaller@0' task followed by a script step that runs 'docker run -d redis' before the test step.

Answer

Configure a deployment job with an 'environment' that has a Redis virtual machine resource registered.

Answer

Use a matrix strategy to run the tests across multiple Redis versions installed via a package manager.

Question 58

Your team runs an Azure Pipelines YAML build that compiles a large C++ codebase. Builds currently use Microsoft-hosted agents and consistently take 55 minutes, largely because the toolchain and third-party SDKs must be downloaded and installed at the start of every run. The organization already owns powerful on-premises Linux servers that sit mostly idle, and the build must access an internal artifact server that is not exposed to the public internet. You need to reduce build time and cost while satisfying the network requirement. What should you do?

Accepted Answer

Register the on-premises Linux servers as self-hosted agents in a self-hosted agent pool and target that pool in the pipeline.

Answer

Increase the number of Microsoft-hosted parallel jobs purchased for the organization and enable pipeline caching.

Answer

Switch the pipeline to use a Microsoft-hosted agent with a larger VM SKU and add a whitelist rule for the internal artifact server.

Answer

Convert the build into a container job running on Microsoft-hosted agents to avoid reinstalling the toolchain each run.

Question 59

Your team's Azure Pipelines YAML pipeline lives in the 'app' repository but must also build shared code from a separate 'shared-libs' repository in the same Azure DevOps project. You need the pipeline to (1) check out both repositories into the working directory during the build, and (2) automatically queue a new run whenever the 'main' branch of 'shared-libs' is updated. Which YAML configuration meets both requirements?

Accepted Answer

Define a 'resources.repositories' entry for 'shared-libs' with a 'trigger' on the main branch, and add a 'checkout' step referencing that repository resource.

Answer

Add a 'checkout: shared-libs' step and rely on the default 'trigger' section, which automatically watches all referenced repositories.

Answer

Configure a 'pr' trigger for 'shared-libs' under 'resources.repositories' and add a 'checkout: self' step for the shared repository.

Answer

Use a pipeline resource ('resources.pipelines') pointing to 'shared-libs' with a 'trigger: true' and a 'download' step to retrieve its source.

Question 60

Your team runs an Azure Pipelines multi-stage YAML pipeline. The test stage executes a large integration test suite that currently takes 40 minutes on a single Microsoft-hosted agent, creating a bottleneck for releases. The tests are independent and can be split into groups that each report results to the same run. You want to reduce wall-clock time by running the test groups simultaneously across multiple agents without duplicating the job definition manually. Which approach should you use?

Accepted Answer

Configure a 'parallel: N' job strategy to slice the suite across N agents, using System.JobPositionInPhase and System.TotalJobsInPhase to distribute test files.

Answer

Add a 'parallel' strategy with a matrix listing each test group and set 'maxParallel' to the number of agents you want to consume.

Answer

Increase the pipeline's job timeout and enable the 'continueOnError' setting so all tests complete in one job.

Answer

Split the stage into multiple sequential deployment jobs, each with the 'runOnce' strategy targeting a different environment.

Question 61

Your team runs an Azure DevOps YAML pipeline that builds and tests a large .NET solution on Microsoft-hosted agents. The pipeline is triggered on every push to any feature branch, and you have observed that concurrent runs frequently queue for long periods, driving up parallel-job costs and delaying feedback. Management wants to reduce cost and queue time without abandoning per-branch validation. Which change should you implement first?

Accepted Answer

Add a batch: true setting on the CI trigger so pushes to the same branch are batched into a single run while a build is in progress

Answer

Increase the number of purchased Microsoft-hosted parallel jobs so every push starts immediately

Answer

Convert the pipeline to a classic release pipeline to avoid parallel-job consumption

Answer

Set a scheduled trigger that runs the pipeline once per hour instead of on push

Question 62

Your team's Azure Pipelines YAML uses templates to generate stages dynamically. A senior engineer wants to conditionally include an entire deployment stage based on a value that a user selects when manually queuing the pipeline, and the stage inclusion logic uses an ${{ if }} expression at the top of the template. The value currently comes from a variable defined in a variable group, but the stage is never generated even when the value matches. What change correctly makes the conditional stage generation work?

Accepted Answer

Define the value as a runtime parameter (parameters:) with allowed values so the user selects it at queue time, and reference it in the ${{ if }} expression.

Answer

Move the variable into a Key Vault-linked variable group so it is resolved earlier during pipeline initialization.

Answer

Change the ${{ if }} template expression to a runtime condition: expression on the stage referencing the variable.

Answer

Mark the variable as settableAtQueueTime and read it with the macro $(variableName) syntax inside the ${{ if }} block.

Question 63

Your team's Azure DevOps YAML pipeline restores npm dependencies on every run, adding roughly 4 minutes per build. You want to speed up subsequent runs by reusing the previously downloaded packages across pipeline runs, while ensuring the cache is automatically invalidated whenever the dependency lock file changes. Which approach should you implement?

Accepted Answer

Add a Cache@2 task with a key that includes a hash of package-lock.json and points the path to the npm cache folder, placed before the npm install step.

Answer

Publish the node_modules folder with the PublishBuildArtifacts@1 task and download it at the start of each new run using DownloadBuildArtifacts@0.

Answer

Store node_modules in an Azure Artifacts universal package feed and use the UniversalPackages@0 task to download it before each build.

Answer

Enable pipeline retention policies to keep the previous run's workspace so the agent reuses the existing node_modules directory.

Question 64

Your team deploys a payment API to a production stage in Azure Pipelines using a deployment job. After each deployment, transient error rates spike for about 5 minutes while caches warm up before stabilizing. You configure a post-deployment release gate that queries an Azure Monitor alert rule to verify the service is healthy before the pipeline reports success. During the first few minutes the alert is active due to the expected warm-up spike, causing the gate to evaluate as failed prematurely. You must ensure the gate reflects the steady-state health without disabling the health check. What should you configure on the gate?

Accepted Answer

Set 'The delay before evaluation' so the gate waits before its first sampling begins.

Answer

Reduce 'The time between re-evaluation of gates' to sample the alert more frequently.

Answer

Enable 'On successful gates, ask for approvals' to require a manual sign-off.

Answer

Set the 'Timeout after which gates fail' to a shorter value so the gate exits quickly.

Exam domain	Exam weight	Practice
Design and implement processes and communications	12%	Practice this topic
Design and implement a source control strategy	13%	Practice this topic
Design and implement build and release pipelines	53%	Practice this topic
Develop a security and compliance plan	13%	Practice this topic
Implement an instrumentation strategy	9%	Practice this topic

Microsoft DevOps Engineer Expert (AZ-400) practice exam & study guide

Start studying AZ-400

All AZ-400 study resources

AZ-400 exam domains

Sample AZ-400 questions

Key AZ-400 terms

AZ-400 frequently asked questions

Design and implement processes and communications (12%)

Design and implement a source control strategy (13%)

Design and implement build and release pipelines (53%)

Develop a security and compliance plan (13%)

Implement an instrumentation strategy (9%)