Assessments

Chapter 1

1. True. In traditional organizations, development is often tasked with creating changes to software, while operations is responsible for maintaining the stability of the target systems for these changes. Since changes inherently carry risk and may disturb stability, operations is often resistant to change.
2. False. While, in theory, it is possible to practice the different DevOps practices in isolation from on another, the real value comes from combining them. For example, continuous deployment without continuous integration and test automation does not only make very little sense; it is even dangerous to continuously deploy changes without the quality assurances that continuous integration and test automation offer.
3. The incorrect answer is number 4. DevOps is not a job title, but a cultural movement. Actually, creating a new DevOps team in between development and operations...

Chapter 2

1. The main difference between centralized and decentralized source control is that in a decentralized source control system, every user of the system has the full history of the sources. In a centralized system, only the server has the full history. Decentralized systems work best when working disconnected from the server, whereas centralized systems often allow for more detailed access control.
2. True. Git is the best known decentralized source control system.
3. The correct answer is number 3. Rebasing is not a branching strategy, but a merging strategy.

4. When working with Git, a pull request is used to request the merging of changes from one branch with another. Pull requests can be reviewed, approved, or denied. To enforce the use of pull requests, Git policies can be used.
5. The correct answer is number 2. Trunk-based development is not a merging strategy, but a branching...

Chapter 3

1. False. Continuous integration is about integrating the work of every developer with that of their colleagues at least daily and building and testing the integrated sources. Just running a daily build does not constitute continuous integration.
2. True. A classic build pipeline is always connected to a source code repository. It might be that the sources are not used in the build pipeline, but the connection is always there.
3. False. It is possible to create a YAML pipeline that starts directly with a stage. A link to a source control repository is no longer mandatory.
4. The correct answer is number 1: a service connection. Service connections are configured in the organization or project that contains the pipeline that needs to call into the external tool. Once a service connection is configured, it can be used from one or more pipelines.
5. The correct answers are numbers 1...

Chapter 4

1. False. It is also possible to trigger a new release on a schedule or manually.
2. All of the answers are correct.
3. Numbers 2 and 3 are correct. Both ring-based deployments and canary deployments expose only a limited group of users to the new version of your application. Feature toggles are also used for progressive exposure, but are not used to limit the risks of a deployment but that of a new feature release.

4. True. Deployment groups are used to perform tasks from a release pipeline not on one agent in the group, but on all agents. Deployment groups are intended to be used to deploy software on the machine that is also running the agent.
5. One possible advantage is that end-to-end traceability of all steps is retained in Azure DevOps. If you also manage your work items and source code in Azure DevOps, you will keep end-to-end traceability from the work item to release...

Chapter 5

1. False. A version of a package can be visible in more than one view.
2. False. Pipeline artifacts can only be consumed from within other pipelines within Azure DevOps.
3. True. Azure Artifact feeds can be used to share universal packages to other products. This allows you to compile an application in Azure DevOps, upload the binaries as a universal package, and download it again in another product. This is useful when using another deployment tool, for example, Octopus Deploy.
4. The correct answers are numbers 2 and 4. Answer number 1 is incorrect since the package references (either in a .csproj file or in a nuget.config file) should only reference packages by name and version. Answer number 3 is incorrect since consumer is not a valid access level in Azure Artifact feeds. The correct access level is reader (or higher), making answer number 2 correct. Answer number 4 is also...

Chapter 6

1. True. ARM templates allow you to specify the end state for all resources in an Azure resource group. Applying an ARM template will always result in the creation of missing resources and updates for existing resources. If a deployment mode of complete is specified, even resources not in the template will be removed.
2. The correct answer is number 2. Modules, Run As accounts, and variables are all constructs that were discussed in Chapter 6, Infrastructure and Configuration as Code.
3. False. ARM template parameters allow the referencing of values in an Azure Key Vault, so as to prevent users from having to enter secrets or other sensitive information in source control. At the time of deployment, the secrets are retrieved and used within Azure, provided the identity that starts the operation has access to that key vault.
4. True. You can define one or more schedules within an...

Chapter 7

1. True. Entity Framework and Entity Framework Core both have built-in support to generate a migration after changes to the schema definition have been made.
2. False. Most migration-based approaches use an extra table to keep track of which migrations have already been applied to the database.
3. True. End state-based approaches work by comparing the current schema to the target schema. This results in the generation of a one-time SQL script that is run against the database to update the schema. There is no state stored between runs.

4. The correct answers are numbers 1 and 2. Running side by side, if done correctly, reduces change risks dramatically. If there are issues, you can always remove all new code, along with the database copy, and restart afresh from a working situation. Having both situations working correctly also allows for very precise performance measurements...

Chapter 8

1. True. In a unit test, a individual component is tested in isolation. In an object-oriented language, this is often a single class.
2. False. In an integration test, the correct working of a group of components is verified, and not the entire assembled system. If the entire assembled and deployed system is tested, this is referred to as a system test.
3. Answer number 2 is correct. The testing pyramid prescribes a large set of unit tests that verify as many requirements as possible. Integration tests are added only for those risks that cannot be covered using unit tests, resulting in a lower number of integration tests. Even fewer system tests are added, only to cover the risks not covered by either unit or integration tests.
4. Answer number 3 is correct. All other types of testing are covered in this chapter.
5. Two techniques that can be mentioned here are code reviews and pipeline...

Chapter 9

1. False. To securely create and deliver software, the whole process, and especially the pipeline, needs to be secured. Just adding security at the end will not work, as security has to be woven through all different steps of the delivery process.
2. The OWASP Zed Attack Proxy (ZAP) can be used for this type of testing.
3. True. In modern applications, up to 80% of the code can be from open source libraries or frameworks.
4. The correct answers are 1, 2, 4, and 6. There is no such thing as Azure DevOps Secure Variables or Azure DevOps Key Vault.
5. Azure Policy can be used to prohibit or list undesired Azure configurations, often relating to infrastructure provisioning or configuration. Azure Security Center can be used to identify and remediate runtime security risks.

Chapter 10

1. False. The platform metrics that are emitted by Azure are defined by every individual service and cannot be changed.
2. 93 days. This number guarantees that there is always at least 3 months of history.
3. True. Custom metrics can be calculated in your own application code and emitted to Application Insights through the SDK or REST API.
4. Alert fatigue.
5. True. Azure allows for the creation of action groups that can contain webhooks to be called in response to an alert being raised.

Chapter 11

1. False. One possible downside is losing a competitive edge in the market. If competitors know what you are going to develop next, they may anticipate in that regard.
2. Possible concerns are that some users or groups of users are more vocal than others, which might result in a difference between the general opinion and the opinion that is heard. Also, feedback on a public roadmap is most likely coming from existing users only. While it is important to retain those, prospects might not comment on your roadmap with features they are missing.
3. Two examples that are discussed in this chapter are sentiment on social media channels and the number and severity of support requests.

4. Answer number 3 is correct. A hypothesis states a belief that a certain feature is needed – the hypothesis. The second part is a measurable user response that is to be observed before the belief...

Chapter 12

1. The benefits of containers for DevOps are consistency, the separation of concerns, and platform portability.
2. True: Depending on the host operating system, it does not matter where the container is hosted.
3. Yes, this is possible. This can be done by adding Docker support and a project level.
4. The RUN command is used for the installation of components or for performing operations during the process of building the container image.
5. Nods and pods can be scheduled within Azure Kubernetes Service. Both of these components can be scaled manually or automatically.

Chapter 13

1. False. Some information can travel to other regions or is available globally. For example, sometimes, agents are running in other regions when capacity in the chosen region is low.
2. Work item | Project | Organization | Region. An Azure DevOps organization is the top-level construct that can be created by users. Every organization is in precisely one region, which is maintained by Microsoft. Within an organization, one or more projects can be created. In turn, a project can contain many work items, such as user stories, features, or epics.
3. False. The general recommendation is to have just enough projects: the fewer the better. Isolation and very strict authorization boundaries may be reasons for choosing to use multiple projects.

4. Authorizations and licensing. Authorizations can be set up to the limit that can be accessed by every individual user or a group of users...