You have an Azure Pipelines pipeline named Pipeline1 and a user named User1. Pipeline1 contains a temporary final stage named final1.
You need to ensure that User1 can delete final1 when testing is complete. The solution must follow the principle of least privilege.
At which level should you grant permissions to User1?
A. pipeline
B. organization
C. stage
D. project
Show Answer
Correct Answer: A
Explanation: For Azure Pipelines (YAML/build pipelines), permissions are assigned at organization, project, or pipeline scope—not at the individual stage level. A stage such as 'final1' is part of the pipeline definition and cannot have its own ACL. To allow a user to modify the pipeline definition (including removing a temporary stage) while following least privilege, grant the necessary permission at the pipeline level rather than project or organization scope.
Question 23
HOTSPOT
-
You plan to build an app named App1 by using GitHub.
You need to recommend a build and deployment solution for App1. The solution must meet the following requirements:
• Ensure that the code for App1 is submitted for testing only when a build has completed successfully.
• Ensure that a build is approved by the change management team before the build is released.
What should you include in the recommendation for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Pull requests
Environments
Explanation: Require successful status checks on pull requests before merging code for testing. Use GitHub Environments with required reviewers/approvals to gate releases.
Question 24
HOTSPOT
-
You have an Azure Pipelines pipeline that has the following definition.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Yes
Yes
No
Explanation: By default, jobs depend on the previous job unless `dependsOn: []` removes that dependency. Job B and Job C have no dependencies and can start immediately. Job D depends on C, so it must wait for C to finish but is independent of B.
Question 25
You have an Azure DevOps subscription that contains the projects shown in the following table.
You build apps for the projects by using Azure Pipelines.
Which two projects meet the criteria for granting free parallel jobs? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. Project1
B. Project3
C. Project4
D. Project2
E. Project5
Show Answer
Correct Answer: A, D
Explanation: Based on Azure Pipelines free parallel job eligibility and the available context, the most likely correct projects are Project1 and Project2. The original table is not included, but these correspond to the projects that meet the stated criteria in the exam scenario.
Question 26
You use Azure Pipelines pipeline to build and deploy an app named App1.
You need to ensure that before App1 is deployed, all the code for the app passes a security validation by using a custom tool.
What should you do?
A. Add a status check to the policies of the branch used by your company's development department.
B. Add a status check to the policies of the main branch.
C. Add a service hook to the project.
D. Limit the job authorization scope to the current project for all the release pipelines.
Show Answer
Correct Answer: B
Explanation: The appropriate way to require a custom security validation before code can progress to deployment is to enforce it as a required status check on the protected branch that feeds deployments. In Azure Repos, branch policies on the main branch can require a successful status check from an external/custom service before pull requests are completed, preventing unvalidated code from being merged and subsequently deployed.
Question 27
SIMULATION
-
You need to create a personal access token (PAT) named Token1 that has only the following capabilities:
• Read, write, and manage code
• Read and execute builds
• Read releases
Token1 must expire in 60 days.
Explanation: In Azure DevOps, create a new Personal Access Token, set the name and 60-day expiration, then enable only the required scopes: Code (Read, write, & manage), Build (Read & execute), and Release (Read). Leave all other scopes disabled.
Question 28
You use an Azure Pipelines pipeline to build and test an app named App1.
Your company’s development department works in the feature branches.
You need to ensure that a pull request will merge into the main branch only when testing covers more than 90 percent of the code.
What should you do?
A. Configure a branch policy for the feature branches.
B. Configure a branch policy for the main branch.
C. Create a Publish Test Results task,
D. Create a code coverage configuration YAML file.
Show Answer
Correct Answer: B
Explanation: Configure a branch policy on the target branch (main) so pull requests must satisfy required validation, including code coverage thresholds/status, before they can be merged. Branch policies are enforced on the destination branch, not the source feature branches. Publishing test results alone does not enforce coverage, and a code coverage YAML configuration only configures collection/reporting rather than merge protection.
Question 29
DRAG DROP
-
You have an Azure subscription that contains 50 virtual machines.
You manage the configuration of the virtual machines by using Azure Automation State Configuration.
You need to ensure that Windows Defender is installed on each virtual machine and the Windows Defender service is running.
How should you complete the Desired State Configuration (DSC) code? To answer, drag the appropriate values to the correct targets. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Ensure = 'Present'
State = 'Running'
Explanation: The DSC WindowsFeature resource uses Ensure = 'Present' to install the Windows Defender feature. The Service resource uses State = 'Running' to ensure the WinDefend service is running, while StartupType = 'Automatic' ensures it starts automatically.
Question 30
HOTSPOT
-
You are using an Azure Pipelines pipeline to build and deploy a web app.
You need to implement a testing strategy that meets the following requirements:
• Validates the scalability of the app
• Tests a code module without testing the module's dependencies
• Validates the interactions and dependencies between the app and its dependent services
Which type of test should you implement for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Load
Unit
Integration
Explanation: Load testing validates scalability. Unit testing isolates a code module from its dependencies using mocks/stubs. Integration testing verifies interactions between the application and dependent services.
Question 31
You plan to create an image that will contain a .NET Core application.
You have a Dockerfile file that contains the following code. (Line numbers are included for reference only.)
You need to ensure that the image is as small as possible when the image is built.
Which line should you modify in the file?
A. 1
B. 3
C. 4
D. 7
Show Answer
Correct Answer: C
Explanation: To minimize the final image size, the runtime stage should use the lightweight ASP.NET Core runtime image rather than the larger .NET SDK image. In a multi-stage Docker build, the SDK is only needed for building and publishing, while the final image should contain only the runtime. Therefore, the line defining the final base image (line 4) should be modified.
$19
Get all 534 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.