Azure AZ-400 cheat sheet

Azure Boards hierarchy: Epic contains Features, Features contain User Stories or Bugs, and User Stories contain Tasks; area and iteration paths classify each item.

Iteration paths define sprint start and end dates; team capacity and burndown charts use those dates and the team's assigned backlog.

Velocity equals the average story points completed per sprint over recent sprints; it is used to forecast how many items a team can finish.

Link work items to commits and pull requests with AB#; the link appears on the work item and supports end-to-end traceability.

Service hooks push Azure DevOps events to Teams, Slack, webhooks, or Azure Service Bus; notification settings control email and subscription alerts.

Delivery Plans display work items from multiple teams and iterations on a calendar view; dependency lines show cross-team blocking relationships.

Inherited processes customize Agile, Scrum, Basic, or CMMI by adding fields, rules, states, and page layouts without changing the system process.

Dashboards host widgets such as build status, sprint burndown, velocity, and query results; widgets can be scoped to a team or project.

Azure DevOps Wikis support Markdown pages, page hierarchies, and work item links; a code wiki publishes Markdown files from a Git repository folder.

Git branch policy options include minimum reviewer count, required reviewers by path, linked work items, comment resolution, build validation, and status checks.

Squash merge creates one commit on the target branch; merge commit preserves branch history; rebase and fast-forward replays commits without a merge commit.

Trunk-based development uses short-lived branches and frequent integration into main; release branches isolate stabilization while hotfix branches patch production.

Git LFS stores large binaries as pointer files; .gitignore excludes untracked build output; .gitattributes controls line endings and diff behavior.

Azure Repos supports Git and TFVC; GitHub repositories connect through service connections and GitHub-specific pipeline triggers.

Branch policy build validation requires a successful pipeline run for the pull request's merge commit before completion is allowed.

Path-based required reviewer policies add specific reviewers when a pull request changes files under configured folders.

Monorepo favors atomic cross-project changes and one version; polyrepo favors independent release cadence and access boundaries.

Tag protection restricts creation or deletion of tags matching a pattern, guarding release version labels.

YAML pipeline order: trigger, resources, variables, stages, jobs, steps; each stage can contain jobs and each job runs on an agent pool.

Deployment jobs target an environment and use strategy runOnce, rolling, or canary; approvals and checks are evaluated before deployment starts.

Templates are included with template or extended with extends; template expressions evaluate at compile time and runtime expressions at run time.

Variable groups centralize shared values and can link to Azure Key Vault; secrets should be mapped explicitly and never echoed.

Microsoft-hosted agents provide clean images per job; self-hosted agents persist software and are chosen for custom dependencies or network access.

Pipeline artifacts pass files between stages in the same run; package feeds store versioned packages for consumption across pipelines.

CI triggers support branch filters and path filters; scheduled triggers use cron syntax; pipeline completion triggers start a pipeline after another finishes.

Deployment strategies: blue-green swaps environments, canary shifts traffic gradually, rolling updates instances in batches.

Environment checks include approvals, branch control, business hours, exclusive lock, and invocation of an Azure Function or REST API.

Service connections should use workload identity federation or managed identities where possible; stored secrets have rotation and scope risks.

Pipeline permissions are granted per service connection, variable group, environment, and agent pool; disable inherited permissions for sensitive resources.

Azure Key Vault-backed variable groups fetch secrets at run time; the pipeline identity needs get and list permissions on the vault.

Secret scanning detects credentials in commits and pull requests; push protection blocks pushes containing detected secrets.

Static application security testing analyzes source code; software composition analysis scans dependencies; dynamic testing probes a running application.

Audit logs record organization events and can stream to Azure Monitor, Splunk, or an event hub for long-term retention and SIEM correlation.

Environment approvals and checks enforce separation of duties; exclusive lock prevents concurrent deployments to the same environment.

Branch policies such as required reviewers and build validation create evidence of review and testing for compliance audits.

Microsoft Defender for Cloud and Azure Policy assess Azure resources; Azure DevOps security features cover identity, pipeline, and repository risks.

Application Insights telemetry tables include requests, dependencies, exceptions, traces, events, metrics, and availability results.

The connection string identifies the Application Insights resource; instrumentation key is legacy and connection string is preferred.

Sampling reduces ingested telemetry volume; adaptive sampling adjusts rates, while fixed-rate sampling keeps a specified percentage.

Distributed tracing uses W3C Trace Context headers to correlate requests across services and dependencies.

Availability tests send synthetic requests from multiple locations and alert on failed or slow responses.

KQL queries filter with where, aggregate with summarize, join tables, and render charts in Log Analytics and workbooks.

Release annotations mark deployments in Application Insights charts, enabling correlation of version changes with telemetry shifts.

Alert rules evaluate metrics or log queries and trigger action groups for notifications or automation.

SLIs are measured indicators such as latency and error rate; SLOs set target thresholds that alerts and dashboards monitor.