You are setting up a new Azure DevOps pipeline that deploys infrastructure to Azure. The pipeline runs on a self-hosted agent. You want to authenticate to Azure without storing any credentials in the pipeline or on the agent. What is the recommended approach?

Use a service principal with a client secret stored in Azure Key Vault and reference it in the pipeline.

Use workload identity federation with a service principal and configure the service connection to use OIDC.

Assign a managed identity to the self-hosted agent and use it in the service connection.

Create a service principal and store the client secret in a pipeline variable.

Your Azure DevOps organization has a project with a large number of users. You need to ensure that only a specific group of users can approve releases, while other users can only view the release pipeline. You also want to minimize administrative overhead. What is the most effective way to configure this?

Grant 'Approve releases' permission to the 'Contributors' group.

Create a custom security group for approvers and grant them 'Approve releases' permission on the release pipeline.

Add the approvers to the 'Release Administrators' group.

Add the approvers to the 'Project Administrators' group.

A team needs to grant an Azure VM a managed identity that can be used by multiple applications running on the same VM. Which type of managed identity should they use?

System-assigned managed identity

Microsoft Certified:DevOps Engineer Expert

Domain 4Objective 1

Design and Implement Authentication and Authorization Methods AZ-400 Practice Questions (Page 2)

Part of the Develop a security and compliance plan domain, which makes up ~19% of our current practice bank. Microsoft does not publish an official question count, but from its 140-minute exam (~55–95 total, ~10–18 in this domain), expect 3–6 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

10concepts

Questions 6–10

6application · medium
You are setting up a new Azure DevOps pipeline that deploys infrastructure to Azure. The pipeline runs on a self-hosted agent. You want to authenticate to Azure without storing any credentials in the pipeline or on the agent. What is the recommended approach?
Select an answer first
7expert · hard
Your Azure DevOps organization has a project with a large number of users. You need to ensure that only a specific group of users can approve releases, while other users can only view the release pipeline. You also want to minimize administrative overhead. What is the most effective way to configure this?
Select an answer first
8foundation · easy
A team needs to grant an Azure VM a managed identity that can be used by multiple applications running on the same VM. Which type of managed identity should they use?
Select an answer first
9foundation · easy
Which GitHub role is suitable for a user who needs to manage issues and pull requests but does not need to push code to the repository?
Select an answer first
10foundation · easy
Which Azure DevOps access level is designed for users who need to view work items and dashboards but do not need to modify code or create builds?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-400

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-400” is a trademark of its owner, used for identification only.

Design and Implement Authentication and Authorization Methods AZ-400 Practice Questions (Page 2)

Questions 6–10

You are setting up a new Azure DevOps pipeline that deploys infrastructure to Azure. The pipeline runs on a self-hosted agent. You want to authenticate to Azure without storing any credentials in the pipeline or on the agent. What is the recommended approach?

A team needs to grant an Azure VM a managed identity that can be used by multiple applications running on the same VM. Which type of managed identity should they use?

Which GitHub role is suitable for a user who needs to manage issues and pull requests but does not need to push code to the repository?

Which Azure DevOps access level is designed for users who need to view work items and dashboards but do not need to modify code or create builds?

Keep studying — Develop a security and compliance plan