Microsoft AZ-400 - Microsoft Azure DevOps Solutions

Scenario: Implement Project3, Project5,Project6, and Project7 based on the planned changes

Step 1: Open the release pipeline editor.

In the Releases tab of Azure Pipelines, select your release pipeline and choose Edit to open the pipeline editor.

Step 2: Enable Gates.

Choose thepre-deployment conditions icon for the Production stage to open the conditions panel. Enable gates by using the switch control in the Gates section.

Step 3: Add Query Work items.

Choose + Add and select the Query Work Items gate.

Configure the gate by selecting an existing work item query.

Note: A case for release gate is:

Incident and issues management. Ensure the required status for work items, incidents, and issues. For example, ensure deployment occurs only if no priority zero bugs exist, and validation that there are no active incidents takes place after deployment.

Step 1: Create a Desired State Configuration (DSC) configuration file that has an extension of .ps1.

Step 2: Run the Import-AzureRmAutomationDscConfiguration Azure Powershell cmdlet

TheImport-AzureRmAutomationDscConfiguration cmdlet imports an APS Desired State Configuration (DSC) configuration into Azure Automation. Specify the path of an APS script that contains a single DSC configuration.

Example:

PS C:\>Import-AzureRmAutomationDscConfiguration -AutomationAccountName "Contoso17"-ResourceGroupName "ResourceGroup01" -SourcePath "C:\DSC\client.ps1" -Force

This command imports the DSC configuration in the file named client.ps1 into the Automation account named Contoso17. The command specifies the Force parameter. If there is an existing DSC configuration, this command replaces it.

Step 3: Run the Start-AzureRmAutomationDscCompilationJob Azure Powershell cmdlet

The Start-AzureRmAutomationDscCompilationJob cmdlet compiles an APS Desired State Configuration (DSC) configuration in Azure Automation.

To store signed images in an Azure Container Registry (ACR) instance and support your planned images while minimizing costs, you need to modify the SKU of your ACR instance to one that supports content trust and image signing. Here’s how you can do it:

Determine the Appropriate SKU:

Content trust and image signing are features of thePremiumservice tier of Azure ContainerRegistry1.

If cost minimization is a priority, ensure that the Premium tier is necessary for your use case. If you require content trust, the Premium tier is the appropriate choice.

Modify the SKU of the ACR Instance:

Navigate to the Azure Portal.

Go to your ACR instanceaz40038443478act1.

SelectUpdatefrom the overview pane.

Choose thePremiumSKU from the SKU drop-down menu2.

Review the changes and pricing, then save the configuration.

By upgrading to the Premium SKU, you’ll be able to store signed images in your ACR instance. Remember to monitor your usage and costs to ensure they align with your budget and requirements.

Task 10: Create a Variable Group in Azure DevOps

Step 1: Navigate to Library

In your Azure DevOps Project (Project1), click on the Pipelines section in the left menu.

In the Pipelines submenu, click on Library.

Step 2: Create a New Variable Group

Click on the + Variable group button.

Enter the Name:

nginx

Copy

varGroup1

Step 3: Add Variables

Add the first variable:

Click Add.

In the Name field, enter:

nginx

Copy

username

In the Value field, enter:

Copy

Userl-48901628

Add the second variable:

Click Add again.

In the Name field, enter:

nginx

Copy

password

In the Value field, enter:

Copy

aFpJ2j+6M!

Check the box Keep this value secret.

Step 4: Save the Variable Group

Click Save at the top to save the variable group.

Step 1: Write the KQL Query

Open Azure Data Explorer:

Navigate to Azure Data Explorer and sign in with your credentials.

Access the Securitylogs Database:

Open the Securitylogs database.

Write the Query:

Use the following KQL query tocount the number of inbound requests for each source IP address:

InboundBrowsing

| where Timestamp between (datetime(2021-10-01) .. datetime(2021-12-31))

| summarize NumberOfRequests = count() by SourceIP

| project SourceIP, NumberOfRequests

Step 2: Export the Query Results

Run the Query:

Execute the query in Azure Data Explorer.

Export the Results:

Once the query results are displayed, click on the Export button.

Choose the export format (e.g., CSV) and specify the export path as C:\Samples.

By following these steps, you will have successfully written a KQL query to count the number of inbound requests for each source IP address during the last three months of 2021 and exported the results to C:\Samples

To prepare a Network Security Group (NSG) namedaz400-38443478-nsg1for hosting an Azure DevOps pipeline agent, while allowing only the required outbound port for Azure DevOps and denying all other inbound and outbound access to the Internet, follow these steps:

Create the NSG:

Navigate to the Azure Portal.

Go toNetwork Security Groupsand click on+ Create.

Fill in the details, including the nameaz400-38443478-nsg1, and create the NSG.

ConfigureOutbound Security Rules:

Once the NSG is created, go to its settings.

Navigate toOutbound security rules.

Click on+ Addto create a new rule.

Set theDestination port rangesto443, which is the required port for Azure DevOps12.

Set theProtocoltoTCP.

Set theActiontoAllow.

Assign aPrioritynumber (e.g.,100) that does not conflict with existing rules.

Provide a meaningfulNamefor the rule (e.g.,AllowAzureDevOps).

Configure Default Rules to Deny All Other Traffic:

In the sameOutbound security rulessection, edit the default rule to deny alltraffic.

Change theActiontoDenyfor the rule with the lowest priority (highest number).

Ensure that this rule applies to all protocols, source and destination IP ranges, and port ranges.

Associate the NSG with the Appropriate Resource:

Associate the NSGwith the subnet or network interface of the virtual machine or resource where the Azure DevOps pipeline agent will be hosted.

By following these steps, you will ensure that the Azure DevOps pipeline agent can communicate with Azure DevOps services over the required port while blocking all other inbound and outbound Internet access, adhering to the principle of least privilege and security best practices.

Task 9: Initialize the main branch (if it doesn’t exist) and create a pull request-triggered pipeline for .NET Core build

Step 1: Initialize the main Branch

In your Azure DevOps Project (Project1), navigate to Repos.

In the left menu, click Files.

If you see a message like “This repository is empty,” click Initialize.

Create a README.md file (or another file) and set the default branch name to main.

Click Initialize.

If the main branch already exists, you can skip this step.

Step 2: Create a New Branch for the Pipeline

In Repos > Files, click on the Branches tab.

Click New branch.

Enter:

Branch name: azure-pipelinesT

Based on: main

Click Create.

This creates a new branch named azure-pipelinesT from main.

Step 3: Create the Pipeline YAML File in the New Branch

Switch to the azure-pipelinesT branch.

In Files, click New file.

Name the file: azure-pipelines.yml.

Step 4: Write the YAML Pipeline for .NET Core Build

Here’s a sample YAML file:

trigger: none

pr:

branches:

include:

- main

pool:

vmImage: 'windows-latest'

variables:

buildConfiguration: 'Release'

steps:

- task: UseDotNet@2

displayName: 'Install .NET Core SDK'

inputs:

packageType: 'sdk'

version: '8.x' # Or specify the exact version of .NET Core SDK you need

installationPath: $(Agent.ToolsDirectory)/dotnet

- script: dotnet build src --configuration $(buildConfiguration)

displayName: 'Build .NET Core project'

This pipeline:

Runs only when a pull request is created or updated targeting the main branch.

Uses the windows-latest agent.

Installs the .NET SDK and builds the project in the src directory.

Step 5: Commit the Pipeline File

In the bottom commit message box:

Message: Add PR-triggered pipeline for .NET Core build

Ensure the branch is set to azure-pipelinesT.

Click Commit.

Step 6: Create the Pipeline in Azure DevOps

In the left menu, click Pipelines.

Click New pipeline.

Select:

Azure Repos Git.

Select your repository.

Choose Existing Azure Pipelines YAML file.

In the branch selector, choose the azure-pipelinesT branch.

Select the YAML file path (azure-pipelines.yml).

Click Continue and Run to validate.

Step 7: Test the Pipeline Trigger

Create a new branch (e.g., feature/test-pr).

Push a commit and create a pull request targeting main.

Verify that the pipeline runs automatically for this PR in Pipelines.

You can usea system-assigned managed identity for a Windows virtual machine (VM) to access Azure Key Vault.

Sign in to Azure portal

Locate virtual machine VM1.

Select Identity

Enable the system-assigned identity for VM1 by setting the Status to On.

Note:Enabling a system-assigned managed identity is a one-click experience. You can either enable it during the creation of a VM or in the properties of an existing VM.