Which protocol is used by workload identity federation to exchange tokens with Azure AD?

Security Assertion Markup Language (SAML)

Lightweight Directory Access Protocol (LDAP)

OAuth 2.0 Client Credentials Grant

Your application uses a certificate stored in Azure Key Vault. You need to ensure that the certificate is renewed automatically and that the application can always access the latest version without requiring a restart. Which approach should you use?

Use a self-signed certificate and rely on the application to trust it.

Manually upload a new certificate and update the application's configuration to point to the new version.

Use a Key Vault certificate with auto-renewal and configure the application to reference the certificate by its name without a version.

Store the certificate as a secret and update the secret value when the certificate is renewed.

Your application uses a certificate stored in Azure Key Vault. You need to deploy the certificate to multiple App Services in different regions. You want to automate the deployment and ensure that the certificate is always up to date. What should you do?

Store the certificate in a secure file and use a release pipeline to deploy it.

Export the certificate from Key Vault and upload it to each App Service manually.

Use Azure Key Vault to store the certificate and configure each App Service to reference the Key Vault certificate.

Use Azure Pipelines to download the certificate and deploy it to each App Service.

Your Azure Pipeline uses a variable group linked to Azure Key Vault to retrieve secrets. You need to ensure that a specific secret is not visible in the pipeline logs, but you also need to use it in a script that writes to a file. What should you do?

Store the secret in a plain text variable and use it in the script.

Use the Azure CLI to fetch the secret and write it to a file, then delete the file.

Use the secret in a task that automatically masks it, but do not use it in a script.

Reference the secret as a pipeline variable and use it in the script, ensuring the script does not output the value.

Microsoft Certified:DevOps Engineer Expert

Domain 4Objective 2

Design and Implement a Strategy for Managing Sensitive Information in Automation AZ-400 Practice Questions (Page 4)

Part of the Develop a security and compliance plan domain, which makes up ~19% of our current practice bank. Microsoft does not publish an official question count, but from its 140-minute exam (~55–95 total, ~10–18 in this domain), expect 3–6 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

10concepts

10 Concepts in This Objective

Azure Key Vault Basics
Managing Secrets in Azure Key Vault
Managing Keys in Azure Key Vault
Managing Certificates in Azure Key Vault
Secrets Management in GitHub Actions
Secrets Management in Azure Pipelines
Secretless Authentication with Workload Identity Federation
Managing Sensitive Files in Deployment
Azure Pipelines Secure Files
Preventing Sensitive Information Leakage

Questions 16–20

16foundation · easy
Which Azure Pipelines task is used to download a secure file during a pipeline run?
Select an answer first
17foundation · easy
Which protocol is used by workload identity federation to exchange tokens with Azure AD?
Select an answer first
18expert · hard
Your application uses a certificate stored in Azure Key Vault. You need to ensure that the certificate is renewed automatically and that the application can always access the latest version without requiring a restart. Which approach should you use?
Select an answer first
19expert · hard
Your application uses a certificate stored in Azure Key Vault. You need to deploy the certificate to multiple App Services in different regions. You want to automate the deployment and ensure that the certificate is always up to date. What should you do?
Select an answer first
20expert · hard
Your Azure Pipeline uses a variable group linked to Azure Key Vault to retrieve secrets. You need to ensure that a specific secret is not visible in the pipeline logs, but you also need to use it in a script that writes to a file. What should you do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-400

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-400” is a trademark of its owner, used for identification only.