Free AZ-400 flashcards

On an Azure Artifacts feed, which capability keeps builds working during a public registry outage and retains every external version even after upstream unlists it?

Configuring the public registry as an upstream source turns the Azure Artifacts feed into a transparent caching proxy. The first restore of a version pulls it from upstream and saves a copy into the feed; later restores are served from that saved copy. Builds survive an upstream outage and keep resolving versions even after they are unlisted at the source.

Which dependency version constraint accepts all backward-compatible 1.x minor and patch updates at or above a floor but refuses 2.0.0 and later?

A caret range such as ^1.4.2 permits any version that does not change the leftmost non-zero segment, so it floats across all 1.x minor and patch releases at or above the floor yet stops before 2.0.0. That absorbs backward-compatible updates while excluding breaking major changes.

Common misconceptionThat a tilde range such as ~1.4.2 admits new minor releases like 1.5.0. It only floats patch updates; a caret range floats across minor releases too.

Which branching strategy uses short-lived branches off an always-deployable main, reviewed via pull request and released immediately on merge?

GitHub Flow. It keeps a single main branch that stays deployable, with each change on a short-lived branch opened as a pull request for review and automated checks, then merged and deployed. The absence of long-lived develop or release branches distinguishes it from Gitflow.

In Azure Repos, how do you automatically create a traceability link from a commit or pull request to its Azure Boards work item without editing the item by hand?

Reference the work item identifier with hash syntax (for example 'Fixes #142') in the commit message or pull request description. Azure Repos parses that reference on save and writes a development link onto the named work item, so requirement-to-source traceability builds itself as developers work.

Common misconceptionThat pasting a commit URL into a work item's comments creates a tracked development link. It only adds a comment hyperlink; hash syntax in the commit or pull request is what forms the real link.

Which branching strategy minimises merge conflicts and integration debt for a team integrating many times a day?

Trunk-based development. Everyone commits small changes to a single shared trunk and any branches are short-lived, merged back within hours. Because divergence never accumulates, conflicts stay small and changes integrate continuously, which suits a team running CI on every commit.

In trunk-based development, how can a three-week feature merge to main continuously yet stay hidden and harmless in every release?

Wrap the unfinished code in a feature flag that stays off in production. The code can merge to main and ship inside deployments while remaining invisible and inert to users. The flag is enabled only once the feature is complete, so integration is continuous without breaking any release.

Common misconceptionThat a long feature branch is fine under trunk-based development as long as it merges eventually. Frequent merging to main is the actual requirement.

Which managed identity gives an Azure VM credential-free access to Azure Key Vault whose lifetime is tied strictly to that VM?

A system-assigned managed identity. It is created in Microsoft Entra, bound to the single VM, and deleted when the VM is deleted, so it shares the resource lifecycle. The VM obtains tokens from the instance metadata endpoint with no stored secret, and a Key Vault access policy granting get and list lets it read secrets.

How can an Azure Resource Manager service connection authenticate to Microsoft Entra without storing any long-lived credential?

Configure the service connection to use workload identity federation. A federated credential in Microsoft Entra trusts tokens issued by Azure DevOps, so at run time the connection presents a short-lived OpenID Connect token and exchanges it for an Azure access token. No client secret or certificate is ever stored, which removes the credential entirely rather than just hiding it.

Common misconceptionThat putting a secret in Key Vault satisfies a no-stored-credential requirement. It only relocates the credential; workload identity federation removes it entirely.