Free AZ-400 Exam Braindumps
Designing and Implementing Microsoft DevOps Solutions Questions 106–110 (page: 23)

Updated On: 10-Mar-2026

You have an Azure DevOps organization that contains a repo named Repo1 that contains infrastructure as code (IaC) resources.

You plan to deploy the resources by using a GitHub Actions workflow.

You need to configure an authentication method for the workflow.

What should you configure?

  1. a GitHub token
  2. an X.509 certificate
  3. a Microsoft Entra user-assigned managed identity
  4. a Microsoft Entra external identity

Answer(s): C

Explanation:

To connect a GitHub Actions workflow to an Azure DevOps repo for infrastructure as code (IaC) deployments, authentication is typically achieved using Personal Access Tokens (PATs), Service Principals with OpenID Connect (OIDC), or Managed Identities. PATs offer a straightforward approach, while Service Principals and Managed Identities provide more robust and secure authentication for automated deployments.
Note: Use GitHub Actions to connect to Azure
The Azure Login action supports different ways of authenticating with Azure:
Sign in with OpenID Connect using a Microsoft Entra application or a user-assigned managed identity Sign in with a managed identity configured on an Azure virtual machine (Only available for self-hosted GitHub runners)
Sign in with a service principal and secret (Not recommended)


Reference:

https://learn.microsoft.com/en-us/azure/developer/github/connect-from-azure



HOTSPOT (Drag and Drop is not supported)

You have an Azure Pipelines pipeline that has the following definition.



For each of the following statements, select Yes if the statement is true. Otherwise, select No.

Note: Each correct selection is worth one point.

Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:




Box 1: No
No - The secrets in kv1 are available to CopyFiles@2.

The CopyFiles@2 task is run first, before AzureKeyVault@2 task, which refers to kv1.

Note:
A task performs an action in a pipeline and is a packaged script or procedure that's abstracted with a set of inputs. Tasks are the building blocks for defining automation in a pipeline.

When you run a job, all the tasks are run in sequence, one after the other.

Box 2: No
No - The connection string is recorded in the log file.

The secret variable will not be logged.

Note: Azure Pipelines, Secret variables
Azure Pipelines makes an effort to mask secrets when emitting data to pipeline logs, so you may see additional variables and data masked in output and logs that are not set as secrets.

Box 3: Yes
Yes - The secrets in kv1 is available to AzureFunctionsApp@2.


Reference:

https://learn.microsoft.com/en-us/azure/devops/pipelines/process/tasks https://learn.microsoft.com/en-us/azure/devops/pipelines/process/set-secret-variables



HOTSPOT (Drag and Drop is not supported)

You have a GitHub organization that contains a repository and an organizational secret named DB_Credential.

You need to build a workflow that will configure a server by using PowerShell and DB_Credential.

How should you complete the code? To answer, select the appropriate options in the answer area.

Note: Each correct selection is worth one point.

Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:




Box 1: : ${{ secrets.DB_Credential}}

Box 2: "$env:DB_Credential"
Using secrets in a workflow
To provide an action with a secret as an input or environment variable, you can use the secrets context to access secrets you've created in your repository.

Example using PowerShell steps:
- shell: pwsh env:
SUPER_SECRET: ${{ secrets.SuperSecret }}
run: |
example-command "$env:SUPER_SECRET"


Reference:

https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets



HOTSPOT (Drag and Drop is not supported)

You have an Azure subscription.

You plan to use Azure Pipelines to deploy an infrastructure solution that will include an app named App1.

You need to store the secrets that will be used during the deployment. The solution must meet the following requirements:

The database connection string must be accessible to the deployment pipeline and to App1.

Signing certificates must only be available for use in the deployment pipeline.

The solution must minimize development effort.

What should you use to store each type of secret? To answer, select the appropriate options in the answer area.

Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:




Box 1: Secure files
Signing certificates

To store signing certificates for use only in your 2026 deployment pipelines with minimal development effort, Azure Pipelines Secure Files is the superior choice for simple binary assets like certificates.

Secure Files provides the most streamlined experience for infrastructure and app deployment because it handles the binary file format natively without requiring additional code to "reconstruct" the certificate from a vault secret.



Box 2: Azure Key Vault

The database connection string

The industry-standard "best" practice for storing and accessing a database connection string in Azure Pipelines and an app is to use Azure Key Vault combined with Managed Identities. This approach ensures the secret is never hardcoded, is encrypted at rest, and remains invisible in logs.

1. Store the Secret in Azure Key Vault
Create a Secret: Store your database connection string in an Azure Key Vault as a "Secret". Security: This centralizes sensitive data, removing it from source control and configuration files.

2. Access the Secret in Azure Pipelines

3. Provide the Secret to the App
For the application to access the connection string without code changes:
Key Vault Reference:
In the Azure App Service configuration, set the connection string value to a Key Vault Reference. The syntax is @Microsoft.KeyVault(SecretUri=...). Managed Identity: Enable a System-assigned Managed Identity for your App


Reference:

https://learn.microsoft.com/en-us/azure/devops/pipelines/library/secure-files?view=azure-devops https://stackoverflow.com/questions/61496963/seperating-connectionstring-from-source-control-and-be-able- to-perform-integrati



View Related Case Study

HOTSPOT (Drag and Drop is not supported)

How should you configure the release retention policy for the investment planning depletions suite? To answer, select the appropriate options in the answer area.

Note: Each correct selection is worth one point.

Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:




Box 1: Shared Access Authorization token

Every request made against a storage service must be authorized, unless the request is for a blob or container resource that has been made available for public or signed access. One option for authorizing a request is by using Shared Key.

Box 2: Azure Storage with HTTPS access

Scenario: The mobile applications must be able to call the share pricing service of the existing retirement fund management system. Until the system is upgraded, the service will only support basic authentication over HTTPS.
The investment planning application suite will include one multi-tier web application and two iOS mobile application. One mobile application will be used by employees; the other will be used by customers.


Reference:

https://docs.microsoft.com/en-us/rest/api/storageservices/authorize-with-shared-key



Viewing page 23 of 72
Viewing questions 111 - 115 out of 398 questions


Post your Comments and Discuss Microsoft AZ-400 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!