Pass the Microsoft Microsoft Azure AZ-400 Questions and answers with CertsForce

Step 1: Navigate to the Project1 Repository

In your browser, go to your Azure DevOps organization:https://dev.azure.com/{YourOrganizationName}

In the left menu, select the project named Project1.

In the left menu under Repos, click on Files.

Step 2: Initialize the Main Branch (if it doesn’t exist)

If the main branch doesn’t exist (because the repo is empty):

In the Repos > Files view, you’ll see a message: “This repository is empty.”

Click on the Initialize button.

Choose the default branch name as main and create a README file (or any file to initialize).

Click Initialize.

This creates the main branch in your repository.

Step 3: Set Up Branch Protection for the Main Branch

Branch protection ensures that all changes go through a pull request (PR), and that PRs are linked to work items (for traceability).

In the Repos view, click on Branches in the left menu.

Locate the main branch in the list.

Click on the three dots (...) next to main and select Branch policies.

Step 4: Configure Branch Policies for main

In the Branch policies for the main branch:

Require a minimum number of reviewers:

Enable this option and set to 1 or more as per your team’s standards.

Check for linked work items:

Enable the Check for linked work items option.

This ensures that every PR has at least one linked work item.

Require a linked work item:

This enforces the traceability requirement you mentioned.

Optionally, you can also:

Enable build validation if you have a pipeline to validate builds.

Enforce merge strategies (like squash merge).

Click Save changes at the bottom.

To prepare a Network Security Group (NSG) namedaz400-38443478-nsg1for hosting an Azure DevOps pipeline agent, while allowing only the required outbound port for Azure DevOps and denying all other inbound and outbound access to the Internet, follow these steps:

Create the NSG:

Navigate to the Azure Portal.

Go toNetwork Security Groupsand click on+ Create.

Fill in the details, including the nameaz400-38443478-nsg1, and create the NSG.

ConfigureOutbound Security Rules:

Once the NSG is created, go to its settings.

Navigate toOutbound security rules.

Click on+ Addto create a new rule.

Set theDestination port rangesto443, which is the required port for Azure DevOps12.

Set theProtocoltoTCP.

Set theActiontoAllow.

Assign aPrioritynumber (e.g.,100) that does not conflict with existing rules.

Provide a meaningfulNamefor the rule (e.g.,AllowAzureDevOps).

Configure Default Rules to Deny All Other Traffic:

In the sameOutbound security rulessection, edit the default rule to deny alltraffic.

Change theActiontoDenyfor the rule with the lowest priority (highest number).

Ensure that this rule applies to all protocols, source and destination IP ranges, and port ranges.

Associate the NSG with the Appropriate Resource:

Associate the NSGwith the subnet or network interface of the virtual machine or resource where the Azure DevOps pipeline agent will be hosted.

By following these steps, you will ensure that the Azure DevOps pipeline agent can communicate with Azure DevOps services over the required port while blocking all other inbound and outbound Internet access, adhering to the principle of least privilege and security best practices.

To ensure that the webhook athttps://contoso.com/statushookis called every time the repository namedaz40038443478acr1receives a new version of an image nameddotnetapp, you can follow these steps to configure a webhook in Azure Container Registry:

Navigate to the Azure Container Registry:

Go to the Azure Portal.

Find and select yourAzure Container Registry instanceaz40038443478acr1.

Create a New Webhook:

UnderServices, selectWebhooks.

Click on+ Addto create a new webhook.

Fill in the form with the following information:

Webhook name: Enter a unique name for your webhook.

ServiceURI: Enterhttps://contoso.com/statushook.

Custom headers: (Optional) Add any headers you want to pass along with the POST request.

Trigger actions: SelectPushto trigger the webhook on image push events.

Scope: Specify the scope asaz40038443478acr1:dotnetappto target the specific image.

Status: Set toEnabled.

Save the Webhook Configuration:

Review the information and clickCreateto save the webhook.

Once configured, the webhook will send a POST request tohttps://contoso.com/statushookwhenever a new version of thedotnetappimage is pushed to theaz40038443478acr1repository in your Azure Container Registry1.

This setup will automate the notification process, ensuring that the specified webhook is called with each new image version, thus fulfilling the task requirements.

1. Open Microsoft Azure Portal

2. Log into your Azure account, select App Services in the Azure portal left navigation, and then select configureaz400-9940427-func1.

3. On the app page, select Deployment Center in the left menu.

4. On the Build provider page, select Azure Pipelines (Preview), and then select Continue.

5. On the Configure page, in the Code section:

For GitHub, drop down and select the Organization, Repository, and Branch you want to deploy continuously.

6. Select Continue.

7. On the Test page, choose whether to enable load tests, and then select Continue.

8. Depending on your App Service plan pricing tier, you may see a Deployto staging page. Choose whether to enable deployment slots, and then select Continue.

9. After you configure the build provider, review the settings on the Summary page, and then select Finish.

Step 1: Understand the Requirements

You want to ensure that audit events (such as user actions, project changes, security settings, etc.) from your Azure DevOps organization are logged and available in a Log Analytics workspace in Azure.

This enables centralized monitoring and security compliance.

Step 2: Prerequisites

Before starting, make sure:

You have an Azure subscription.

You have permission to create or use a Log Analytics workspace in the Azure portal.

You are a Project Collection Administrator or Organization Owner in Azure DevOps.

Step 3: Create or Identify a Log Analytics Workspace

Go to the Azure portal.

In the search bar, type Log Analytics workspaces and click the service.

Click + Create to create a new workspace (or select an existing workspace if you have one).

Provide the following:

Subscription: your Azure subscription.

Resource Group: create a new or use an existing one.

Name: a unique name for the workspace (like DevOpsAuditWorkspace).

Region: choose the same region as your Azure DevOps organization if possible.

Click Review + Create, then Create to deploy the workspace.

Step 4: Configure Azure DevOps to Stream Audit Logs

Azure DevOps can stream audit logs to your Log Analytics workspace using the Azure DevOps Audit Stream feature.

In your browser, go to your Azure DevOps organization:https://dev.azure.com/{YourOrganizationName}

In the bottom-left corner, click on the Organization Settings gear icon.

In the left menu, click on Audit logs.

In the top-right, click on Audit streams.

Click on + Add stream to create a new stream.

In the New audit stream pane, do the following:

Stream type: select Azure Monitor Logs (Log Analytics).

Azure subscription: select the subscription containing your Log Analytics workspace.

Resource group: select the resource group.

Log Analytics workspace: select the workspace created in Step 3.

Click Save.

Step 5: Validate the Audit Stream Connection

Go back to the Audit streams page in Azure DevOps to confirm the stream shows as Connected.

To validate logs:

In the Azure portal, go to your Log Analytics workspace.

In the left menu, click on Logs.

Use the query:

kusto

Copy

AzureDevOpsAuditing

| sort by TimeGenerated desc

You should see audit events from your Azure DevOps organization appear in the results.