AZ-400 Dependency Management & Infrastructure as Code 2 — Questions and Answers
Question 1: Your team wants to prevent developers from using packages with known critical vulnerabilities in Azure Artifacts. Which feature should you enable?
- Upstream sources blocking
- Artifact retention policies
- Package deprecation rules
- Azure Defender for DevOps vulnerability scanning with block policies (Correct answer)
Correct answer: Azure Defender for DevOps vulnerability scanning with block policies
Azure Defender for DevOps integrates with Azure Artifacts to scan packages and can enforce policies that block builds when critical vulnerabilities are detected.
Question 2: A Terraform configuration uses a module stored in a private Azure Repos Git repository. Which authentication method should be used in the module source URL?
- Personal Access Token embedded in the URL
- SSH key with git SSH protocol (Correct answer)
- Managed Identity via environment variable
- Azure CLI credential caching via az login
Correct answer: SSH key with git SSH protocol
SSH key authentication with the git SSH protocol is the recommended approach for Terraform to access private Azure Repos Git repositories without embedding credentials.
Question 3: You need to enforce that all Bicep deployments use a specific API version for a resource type. Which Azure Policy effect achieves this at deployment time?
- Audit
- Deny (Correct answer)
- Modify
- DeployIfNotExists
Correct answer: Deny
The Deny effect blocks deployments that do not meet the policy condition, ensuring non-compliant API versions cannot be deployed.
Question 4: Which command converts an existing ARM template to a Bicep file?
- az bicep build --file template.json
- bicep decompile template.json
- az bicep decompile --file template.json (Correct answer)
- bicep build --decompile template.json
Correct answer: az bicep decompile --file template.json
The `az bicep decompile --file template.json` command converts an existing ARM JSON template into a Bicep file.
Question 5: A pipeline publishes a NuGet package to Azure Artifacts on every build, causing many patch versions. You want to publish only when the version in the .csproj changes. Which approach is most efficient?
- Add a manual approval gate before the publish step
- Use a pipeline condition comparing the current version tag to the last published version (Correct answer)
- Enable artifact retention to auto-delete duplicates
- Switch to Universal Packages which ignore version conflicts
Correct answer: Use a pipeline condition comparing the current version tag to the last published version
A pipeline condition that checks whether the current version differs from the latest published version ensures packages are only published on actual version changes.
Question 6: You are using Terraform Cloud as a remote backend with Azure Pipelines. The pipeline needs to apply infrastructure changes. What is the recommended way to authenticate Terraform Cloud from the pipeline?
- Store the Terraform Cloud API token in an Azure Key Vault secret and reference it via a pipeline variable group (Correct answer)
- Hard-code the token in the terraform.tfvars file
- Use a Service Principal with Contributor role on Terraform Cloud
- Configure OAuth between Azure AD and Terraform Cloud
Correct answer: Store the Terraform Cloud API token in an Azure Key Vault secret and reference it via a pipeline variable group
Storing the Terraform Cloud API token in Azure Key Vault and referencing it through a pipeline variable group is the recommended secure approach.
Question 7: When using Azure Artifacts upstream sources, what happens when a package is requested that exists both upstream and in the local feed?
- Azure Artifacts always fetches from upstream to ensure the latest version
- The local feed version is served and upstream is not queried (Correct answer)
- Azure Artifacts returns both versions and the client picks one
- The pipeline fails with a version conflict error
Correct answer: The local feed version is served and upstream is not queried
When a package exists in the local feed, Azure Artifacts serves that cached version without querying upstream, providing speed and reliability.
AZ-400 Dependency Management & Infrastructure as Code 2
Your team wants to prevent developers from using packages with known critical vulnerabilities in Azure Artifacts.
Which feature should you enable?