AZ-400 question patterns

Managed identity for code on Azure; workload identity federation for pipelines outside Azure.

Nothing to store or rotate, so nothing to leak.

Elastic self-hosted capacity inside the VNet.

Hosted agents can't reach private endpoints; always-on VMs waste money.

Put the shared logic in a YAML template (Azure Pipelines) or reusable workflow (GitHub).

Copy-pasted YAML drifts; a central template is versioned once.

Install the Azure Boards GitHub app and write AB#123 (with Fixes to close it).

#123 refers to a GitHub issue, not the Boards work item.

Lead time covers the wait in the backlog plus the work.

Cycle time only starts when work begins.

Widening bands show where work piles up; add WIP limits.

Velocity measures throughput, not where it stalls.

Subscribe the channel to the pipeline, then approve in chat.

A plain incoming webhook only posts messages.

Short-lived branches or direct commits to main, with flags hiding unfinished features.

Long-lived branches delay integration.

Cut release/1.x and release/2.x, hotfix there, merge fixes back.

Trunk-based has one live line.

Minimum reviewers plus build validation on the target branch.

Branch permissions alone don't force reviews.

Map the path to a team and turn on the protection option.

Plain required approvals can come from anyone.

GitHub rulesets support an evaluate status before activation.

Classic branch protection has no dry-run.

Track patterns in .gitattributes; pointers stay in Git.

Plain Git stores every version of every binary.

scalar clone enables partial clone, sparse checkout and background maintenance.

Shallow clone drops history but not the file-count cost.

Find the SHA and branch from it.

Reflog records where HEAD pointed locally.

Rewrite history, force push, re-clone, and clear cached refs.

Deleting the file in a new commit leaves it in history.

Upstream saves copies; promote to @Release.

Consumers on @Release only see approved packages.

MAJOR.MINOR.PATCH: breaking, feature, fix.

CalVer doesn't signal compatibility.

Use strategy: parallel or matrix and test slicing.

Steps in one job run serially.

Stages are sequential by default; jobs are parallel.

Capacity limits (parallel jobs) still apply.

Checks on the connection or environment.

Environment approval alone doesn't restrict branches.

The environment check fails runs that don't extend the template.

Normal templates are optional to use.

pr: in YAML applies to GitHub and Bitbucket only.

Azure Repos PR builds are policy-driven.

Export to YAML for builds; rebuild releases as stages; gates become checks; task groups become templates.

YAML is versioned and reviewable.

Deploy to staging, warm up, swap; swap back to roll back.

Slot-sticky settings stay with the slot.

Increment traffic and watch telemetry.

Blue-green moves all traffic at once.

Validate between rings.

Canary is a percentage, not named audiences.

Use Feature Manager and a sentinel key for refresh.

Redeploying couples release to deployment.

Run it in the PR or before production.

validate only checks syntax and basics.

Policy-assigned guest configuration, works on Arc servers.

ARM and Bicep don't configure the guest OS.

Catalog of IaC templates and environment types.

Giving developers subscription rights loses cost control.

Make backward-compatible changes first, then clean up.

Old and new app versions overlap during rollout.

Federated credential on the app registration; id-token: write in GitHub.

Short-lived token, no secret to expire.

Create it separately and attach it.

System-assigned dies with its one resource.

App installation token.

GITHUB_TOKEN events don't trigger new runs.

Free access level with limited features.

Basic costs a licence.

Deleted from the agent after the job.

Committing it exposes it.

Fetched at run time.

Copies in repo secrets mean two places to rotate.

Alerts plus security updates.

CodeQL analyses your code, not dependencies.

Default or advanced setup; security-events: write.

Secret scanning only finds credentials.

Connect GitHub or Azure DevOps; use MSDO in pipelines.

Each tool's own page is siloed.

Scan before push, fail on HIGH and CRITICAL.

CodeQL doesn't inspect image packages.

Fail or pause the stage if alerts fire.

Manual checking is slower and inconsistent.

Operation ID and W3C trace context; Application Map.

Metrics don't show a request's path.

Azure Monitor Agent plus Dependency Agent.

Host metrics don't include guest memory.

Managed agent through a DCR.

VM insights is for machines.

Baseline is learned.

Static thresholds fire falsely.

No need to edit each rule.

Deleting rules is error-prone.

Filter success == false, then render timechart.

summarize needs an aggregation and a bin for time series.