You have an Azure subscription that contains an Azure pipeline named Pipeline1 and a GitHub repository named Repo1. Repo1 contains Bicep modules. Pipeline1 deploys Azure resources by using the Bicep modules.
You need to ensure that all releases comply with Azure Policy before they are deployed to production.
What should you do?
A. To Pipeline1, add a step that runs a What if deployment before the deployment step.
B. Configure a deployment gate for Pipeline1 that uses Azure Automation to run a What If deployment.
C. Create an Azure DevOps build that runs on the creation of a pull request and assesses the code for compliance.
D. Configure a deployment gate for Pipeline1 and include the Azure DevOps Security and compliance assessment task.
Show Answer
Correct Answer: D
Explanation: Configure a pre-deployment gate for the production stage and use the Security and compliance assessment task to check policy compliance before the release proceeds. A What-If deployment previews expected changes, but it does not provide the required compliance gate.
Question 22
DRAG DROP
-
You create a Git repository named Repo1 in Azure Repos.
You need to configure Repo1 to meet the following requirements:
• Work items must be linked to a pull request.
• Pull requests must have a minimum of two reviewers.
• Pull requests must complete a code review by using a third-party tool.
The solution must minimize administrative effort.
Which type of policy should you use for each requirement? To answer, drag the appropriate policy types to the correct requirements. Each type policy may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Work items linked to a pull request: Branch
Third-party code review: Status
Minimum of two reviewers: Branch
Explanation: Branch policies enforce work-item linking and reviewer counts. A status policy requires the third-party tool to report a successful review before the pull request can be completed.
Question 22
You have an Azure Pipelines pipeline named Pipeline1 and a user named User1. Pipeline1 contains a temporary final stage named final1.
You need to ensure that User1 can delete final1 when testing is complete. The solution must follow the principle of least privilege.
At which level should you grant permissions to User1?
A. pipeline
B. organization
C. stage
D. project
Show Answer
Correct Answer: A
Explanation: For Azure Pipelines (YAML/build pipelines), permissions are assigned at organization, project, or pipeline scope—not at the individual stage level. A stage such as 'final1' is part of the pipeline definition and cannot have its own ACL. To allow a user to modify the pipeline definition (including removing a temporary stage) while following least privilege, grant the necessary permission at the pipeline level rather than project or organization scope.
Question 23
DRAG DROP
-
You have an Azure Repos repository that contains large PSD files.
You need to configure Git LFS to manage all the files.
How should you complete the script? To answer, drag the appropriate values to the correct targets. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Explanation: Track PSD files with Git LFS, migrate PSD files already in the repository’s history, then push the changes.
Question 24
HOTSPOT
-
You have an Azure Pipelines pipeline that has the following definition.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Yes
Yes
No
Explanation: By default, jobs depend on the previous job unless `dependsOn: []` removes that dependency. Job B and Job C have no dependencies and can start immediately. Job D depends on C, so it must wait for C to finish but is independent of B.
Question 24
You are integrating an Azure Boards project and a GitHub repository.
You need to authenticate Azure Boards to GitHub.
Which two authentication methods can you use? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A. a publisher certificate
B. a trusted root certificate
C. Microsoft Azure Active Directory (Azure AD), part of Microsoft Entra
D. GitHub user credentials
E. a personal access token (PAT)
Show Answer
Correct Answer: D, E
Explanation: Azure Boards can authenticate to GitHub using GitHub user credentials or a GitHub personal access token (PAT). Certificates and Azure AD/Entra credentials are not the GitHub authentication methods for this integration.
Question 25
DRAG DROP
-
You have a project in Azure DevOps named Project that has a release pipeline in Azure Pipeline named ReleaseP1.
You need to ensure that when a new release is generated for ReleaseP1, a new release note document is created. The release notes must contain new features and bug fixes.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select.
Show Answer
Correct Answer: 1. Create a personal access token (PAT).
2. Create a query that retrieves the feature and bug fix information.
3. Create a PowerShell task in ReleaseP1 that writes the retrieved data to a markdown file.
Explanation: The PAT provides access to Azure DevOps data, the query identifies the relevant work items, and the release-pipeline task generates the release note document for each new release.
Question 26
You use Azure Pipelines pipeline to build and deploy an app named App1.
You need to ensure that before App1 is deployed, all the code for the app passes a security validation by using a custom tool.
What should you do?
A. Add a status check to the policies of the branch used by your company's development department.
B. Add a status check to the policies of the main branch.
C. Add a service hook to the project.
D. Limit the job authorization scope to the current project for all the release pipelines.
Show Answer
Correct Answer: B
Explanation: The appropriate way to require a custom security validation before code can progress to deployment is to enforce it as a required status check on the protected branch that feeds deployments. In Azure Repos, branch policies on the main branch can require a successful status check from an external/custom service before pull requests are completed, preventing unvalidated code from being merged and subsequently deployed.
Question 26
DRAG DROP
-
You have a GitHub repository named repo1.
You migrate repo1 to an Azure Repos repository named repo2.
After the migration, changes are made to repo1.
You need to sync the changes to repo2.
How should you complete the script? To answer, drag the appropriate values to the correct targets. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Explanation: Clone the Azure Repos repository as a bare repository, then add the original GitHub repository as the upstream remote. Fetch its changes and push them to origin (repo2).
Question 27
SIMULATION
-
You need to create a personal access token (PAT) named Token1 that has only the following capabilities:
• Read, write, and manage code
• Read and execute builds
• Read releases
Token1 must expire in 60 days.
Explanation: In Azure DevOps, create a new Personal Access Token, set the name and 60-day expiration, then enable only the required scopes: Code (Read, write, & manage), Build (Read & execute), and Release (Read). Leave all other scopes disabled.
$19
Get all 541 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
