HOTSPOT (Drag and Drop is not supported)You have an Azure subscription that contains an Azure key vault named KV1.You plan to create an Azure Pipelines pipeline named Pipeline1 that will be used to deploy the following resources:20 virtual machinesAn Azure SQL database named DB1The virtual machines will authenticate to DB1 by using secrets retrieved from KV1.You need to recommend which type of identity and authorization method the virtual machines should use to retrieve the secrets from KV1. The solution must minimize administrative effort.What should you recommend? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: User-assigned managed identityIdentity:User-assigned identities can be used by multiple resources [20 VMs], and their life cycles are decoupled from the resources' life cycles with which they're associated.Box 2: Access policyYou can store credentials for data stores and computes in an Azure Key Vault. Azure Data Factory retrieves the credentials when executing an activity that uses the data store/compute.To reference a credential stored in Azure Key Vault, you need to:1. Retrieve data factory managed identity by copying the value of "Managed Identity Object ID" generated along with your factory. If you use ADF authoring UI, the managed identity object ID will be shown on the Azure Key Vault linked service creation window; you can also retrieve it from Azure portal.2. Grant the managed identity access to your Azure Key Vault. In your key vault -> Access policies -> Add Access Policy, search this managed identity to grant Get and List permissions in the Secret permissions dropdown. It allows this designated factory to access secret in key vault.3. Create a linked service pointing to your Azure Key Vault.4. Create data store linked service, inside which reference the corresponding secret stored in key vault.
https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/managed-identity-best- practice-recommendations https://learn.microsoft.com/en-us/azure/data-factory/store-credentials-in-key-vault
HOTSPOT (Drag and Drop is not supported)You have multiple automated workflows that interact with Azure DevOps and use the following services:Azure Command-Line Interface (CLI)Azure PowerShellAzure FunctionsYou need to recommend which authentication method to use for each service. The solution must minimize the risk of compromising credentials.What should you recommend for each service? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Microsoft Entra authenticationAzure CLIAcquire a Microsoft Entra token via Azure CLI for ad-hoc requests that lasts for one hour instead of minting a longer-lived PAT.Box 2: Azure DevOps OAuthAzure PowerShellAuthenticate Azure Pipelines Powershell task against Azure DevOps Rest API Enable access to token (option Allow Scripts to Access OAuth Token)Box 3: A managed identityAzure FunctionsCall Azure Functions from workflows in Azure Logic AppsTo run code that performs a specific job in your logic app workflow, you don't have to build a complete app or infrastructure. Instead, you can create and call an Azure function. Azure Functions provides serverless computing in the cloud.LimitationsOnly Consumption workflows support authenticating Azure function calls using a managed identity with Microsoft Entra authentication.
https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/entra https://stackoverflow.com/questions/54708685/authenticate-azure-pipelines-powershell-task-against-azure- devops-rest-api https://learn.microsoft.com/en-us/azure/logic-apps/call-azure-functions-from-workflows
You have a GitHub Enterprise organization that contains three GitHub repositories.You need to store a secret named Secret1. The solution must meet the following requirements:GitHub Actions must be able to use Secret1 in each repository.Administrative effort must be minimized.As what should you store Secret1?
Answer(s): B
Using secrets in GitHub ActionsSecrets allow you to store sensitive information in your organization, repository, or repository environments.Organization-level secrets let you share secrets between multiple repositories, which reduces the need for creating duplicate secrets.
https://docs.github.com/en/enterprise-cloud@latest/actions/security-for-github-actions/security-guides/using- secrets-in-github-actions
You use GitHub Enterprise to manage source code and deployments.From GitHub Actions, you create a reusable workflow named workflow1.You need to ensure that the secrets defined in the calling workflow are passed to workflow1.What should you include in the YAML file for the calling workflow?
Create reusable workflows in GitHub ActionsWorkflows that call reusable workflows in the same organization or enterprise can use the inherit keyword to implicitly pass the secrets.Example:jobs:call-workflow-passing-data:uses: octo-org/example-repo/.github/workflows/reusable-workflow.yml@main with:config-path: .github/labeler.yml secrets: inheritNote: Passing named secretsTo pass named inputs to a called workflow, use the with keyword in a job. Use the secrets keyword to pass named secrets. For inputs, the data type of the input value must match the type specified in the called workflow (either boolean, number, or string).jobs:call-workflow-passing-data:uses: octo-org/example-repo/.github/workflows/reusable-workflow.yml@main with:config-path: .github/labeler.yml secrets:envPAT: ${{ secrets.envPAT }}
https://resources.github.com/learn/pathways/automation/intermediate/create-reusable-workflows-in-github- actions/
DRAG DROP (Drag and Drop is not supported)You are implementing a package management solution for a Node.js application by using Azure Artifacts.You need to configure the development environment to connect to the package repository. The solution must minimize the likelihood that credentials will be leaked.Which file should you use to configure each connection? To answer, drag the appropriate files to the correct connections. Each file may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.Note: Each correct selection is worth one point.Select and Place:
Box 1: The .npmrc file in the projectFeed registry information:All Azure Artifacts feeds require authentication, so you'll need to store credentials for the feed before you can install or publish packages. npm uses .npmrc configuration files to store feed URLs and credentials. Azure DevOps Services recommends using two .npmrc files.One .npmrc should live at the root of your git repo adjacent to your project's package.json. It should contain a "registry" line for your feed and it should not contain credentials since it will be checked into git.Box 2: The .npmrc file in the user's home folderCredentials:On your development machine, you will also have a .npmrc in $home for Linux or Mac systems or $env.HOME for win systems. This .npmrc should contain credentials for all of the registries that you need to connect to. The NPM client will look at your project's .npmrc, discover the registry, and fetch matching credentials from $home/ .npmrc or $env.HOME/.npmrc.
https://docs.microsoft.com/en-us/azure/devops/artifacts/npm/npmrc
Post your Comments and Discuss Microsoft AZ-400 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-400 content, but please register or login to continue.