AZ-400 Monitoring, Feedback & Security 5 — Questions and Answers
Question 1: Which Azure DevOps feature allows teams to define automated gates that query external monitoring systems before a release proceeds to the next stage?
- Pre-deployment approvals
- Release pipeline deployment gates (Correct answer)
- Branch policies
- Environment checks
Correct answer: Release pipeline deployment gates
Release pipeline deployment gates periodically query external systems (e.g., Azure Monitor, Application Insights) and block progression until success criteria are met.
Question 2: Your organization must prove that all changes to production infrastructure are traceable to an approved work item. Which combination of controls achieves this?
- Require linked work items in branch policies and enable audit logging in Azure DevOps (Correct answer)
- Enable multi-stage pipelines and store logs in Azure Blob Storage
- Use deployment slots in Azure App Service with traffic splitting
- Configure Azure Policy deny effects on all resource groups
Correct answer: Require linked work items in branch policies and enable audit logging in Azure DevOps
Requiring linked work items on PRs and enabling Azure DevOps audit logs creates an auditable trail from work item approval through to production deployment.
Question 3: An Application Insights Snapshot Debugger capture shows a NullReferenceException in production. What does this feature provide that standard logging does not?
- Stack traces of all threads at the time of the exception
- A full memory snapshot including local variable values at the point of the exception (Correct answer)
- CPU flame graphs correlated to the exception
- A replay of the HTTP request that caused the exception
Correct answer: A full memory snapshot including local variable values at the point of the exception
Snapshot Debugger captures the full application state including local variables and heap data at the exact point of an exception, not just a stack trace.
Question 4: Your team wants to measure change failure rate as a DORA metric. What does a 'failed change' mean in this context?
- A deployment that takes longer than the SLA threshold
- A deployment that results in a degraded service or requires a hotfix, rollback, or patch (Correct answer)
- A pull request that fails CI checks
- An infrastructure change that triggers a cost anomaly alert
Correct answer: A deployment that results in a degraded service or requires a hotfix, rollback, or patch
DORA defines change failure rate as the percentage of deployments causing a service degradation or requiring remediation such as a rollback or hotfix.
Question 5: A compliance requirement mandates that all Azure DevOps pipeline runs are logged and cannot be deleted. Which Azure service fulfills this immutable audit requirement?
- Azure Monitor Diagnostic Settings sent to a storage account with immutable blob storage policy (Correct answer)
- Azure Blob Storage with soft delete enabled
- Azure DevOps audit log export to Azure Event Hubs
- Azure Log Analytics workspace with a 30-day retention
Correct answer: Azure Monitor Diagnostic Settings sent to a storage account with immutable blob storage policy
Routing pipeline audit logs to Azure Blob Storage with an immutable WORM (Write Once, Read Many) policy ensures logs cannot be deleted or altered.
Question 6: You need to detect when a dependency your application calls is becoming slow before users are affected. Which Application Insights feature provides this proactive detection?
- Availability tests
- Smart Detection for degradation in dependency duration (Correct answer)
- Transaction search filters
- Application Map manual threshold annotations
Correct answer: Smart Detection for degradation in dependency duration
Smart Detection automatically learns baseline dependency call durations and alerts when significant degradation is detected, before user-reported failures occur.
Question 7: Which control in Azure DevOps Environments prevents a pipeline from deploying to production unless a specific named individual has approved it within the last 24 hours?
- Release gate with Azure Monitor query
- Required approver check on the Environment with an expiry timeout (Correct answer)
- Branch policy with minimum reviewer count
- Variable group secret approval workflow
Correct answer: Required approver check on the Environment with an expiry timeout
Environment approval checks in Azure DevOps allow you to specify named approvers and configure a timeout after which the approval expires and must be re-granted.
AZ-400 Monitoring, Feedback & Security 5
Which Azure DevOps feature allows teams to define automated gates that query external monitoring systems before a release proceeds to the next stage?