AZ-400 Monitoring, Feedback & Security 3 — Questions and Answers
Question 1: Which Azure Monitor feature lets you group related alerts into a single notification to reduce alert fatigue during an incident?
- Alert rules
- Action groups
- Smart alert grouping (alert correlation) (Correct answer)
- Azure Service Health alerts
Correct answer: Smart alert grouping (alert correlation)
Smart alert grouping in Azure Monitor correlates fired alerts that are likely related into a single incident, reducing notification noise.
Question 2: Your pipeline must enforce that only signed container images are deployed to AKS. Which Kubernetes admission mechanism combined with Azure Policy achieves this?
- Pod Security Admission with baseline profile
- Azure Policy for AKS using the image signature verification constraint (Correct answer)
- Network Policy with egress rules
- Open Policy Agent Gatekeeper with a custom rego for image labels
Correct answer: Azure Policy for AKS using the image signature verification constraint
Azure Policy for AKS supports image integrity policies that verify image signatures (via Notation/Ratify) before allowing pods to start.
Question 3: A developer wants to see real-time telemetry while debugging a locally running service instrumented with Application Insights. Which feature streams live data?
- Application Map
- Transaction search
- Live Metrics Stream (Correct answer)
- Availability tests
Correct answer: Live Metrics Stream
Live Metrics Stream in Application Insights provides near-real-time telemetry (within 1 second) from a running application for immediate feedback.
Question 4: You need to ensure that Azure DevOps pipeline artifacts are not tampered with between stages. Which practice best addresses this supply chain security concern?
- Use private Azure Artifacts feeds with upstream sources disabled
- Publish artifacts to a public feed for transparency
- Sign artifacts with a code-signing certificate and verify the signature in downstream stages (Correct answer)
- Enable MFA on the pipeline service account
Correct answer: Sign artifacts with a code-signing certificate and verify the signature in downstream stages
Signing pipeline artifacts and verifying signatures in downstream stages ensures integrity and detects tampering across pipeline stages.
Question 5: Your SRE team wants to set an error budget based on a 99.9% SLO for an API. Which Application Insights query approach helps track budget burn rate?
- Use the Failures blade to count 5xx responses per day
- Write a KQL query calculating the ratio of failed requests to total requests over a rolling window (Correct answer)
- Configure a static threshold alert on request count
- Use Smart Detection to identify SLO violations
Correct answer: Write a KQL query calculating the ratio of failed requests to total requests over a rolling window
A KQL query that computes failed/total request ratio over a rolling window directly measures SLO compliance and error budget consumption.
Question 6: Which Azure Security Center (Defender for Cloud) feature provides a prioritized list of security hardening actions for your DevOps pipelines and repos?
- Security alerts
- Regulatory compliance dashboard
- DevOps security posture management (DPSM) recommendations (Correct answer)
- Just-in-time VM access
Correct answer: DevOps security posture management (DPSM) recommendations
DevOps security posture management in Defender for Cloud surfaces actionable recommendations specific to repositories, pipelines, and code security.
Question 7: You configure an Azure Monitor alert that fires when CPU exceeds 90% for 5 minutes. The alert sends an email but your team misses it. Which improvement reduces missed alerts?
- Lower the threshold to 80%
- Add an Azure Logic App action to the action group to post to Microsoft Teams (Correct answer)
- Increase the evaluation frequency to every 15 minutes
- Switch from metric alert to log alert
Correct answer: Add an Azure Logic App action to the action group to post to Microsoft Teams
Adding a Logic App action to post to Teams ensures the alert appears in the team's primary collaboration channel, reducing the chance it is missed.
AZ-400 Monitoring, Feedback & Security 3
Which Azure Monitor feature lets you group related alerts into a single notification to reduce alert fatigue during an incident?