AZ-400 Design and implement build and release pipelines — 20 Questions

Question 1

Refer to the exhibit. The pipeline is configured as shown. A developer pushes a change to the `main` branch that modifies a file under `src/Controllers/HomeController.cs` and also adds a new file under `docs/readme.md`. Which of the following best describes what happens?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The pipeline triggers because the change to `src/Controllers/HomeController.cs` is not in an excluded path.. The pipeline uses path filters that include `src/*` and exclude `docs/*`. Azure Pipelines evaluates all changed files in the push. The push contains `src/Controllers/HomeController.cs`, which matches the include pattern and is not excluded, so the trigger condition is met. The addition of `docs/readme.md` is excluded and does not suppress the trigger, because a change to at least one matching file is sufficient.

Answer

The pipeline does not trigger because the `docs/` path is excluded and includes a change.

Answer

The pipeline triggers only if the change is on a branch matching `release/*`.

Answer

The pipeline triggers but runs only tests because the build is skipped due to excluded paths.

Question 2

Your organization uses Azure Pipelines for CI/CD. The current pipeline for a .NET Core application builds and runs unit tests, then deploys to a staging environment. The team wants to add a step to run integration tests against the staging environment after deployment, and only if integration tests pass, promote the build to production. The integration tests require a database connection string that is stored as a secret in Azure Key Vault. The pipeline uses a service principal with permissions to read secrets from the Key Vault. You need to modify the pipeline to meet these requirements while ensuring security best practices. Which action should you take?

Accepted Answer

Add an Azure Key Vault task before the integration test step to retrieve the secret and map it to a variable.. Both B and C are correct methods for retrieving secrets from Azure Key Vault in a pipeline. Option B uses the dedicated Azure Key Vault task to fetch the secret at the point needed. Option C links a variable group to Key Vault, making the secret available as a variable. Both avoid hard-coding secrets and use the existing service principal. Option C is not invalid; it is a standard pattern. The question should accept both answers or be reworded to require a specific timing that only B satisfies.

Answer

Set the connection string as a secret variable in the pipeline UI and reference it in the integration test step.

Answer

Use a PowerShell script to read the secret from Key Vault using the service principal.

Question 3

You are designing a release pipeline that uses Azure App Service deployment slots. The pipeline must perform a swap after deployment to the staging slot. Which three tasks or actions should you include in the pipeline? (Select all that apply.)

Accepted Answer

Azure App Service deploy: Deploy to staging slot. The correct pipeline actions are to deploy to the staging slot and then swap slots. The Azure App Service deploy task automatically starts the slot, so a separate start action is unnecessary. The Azure CLI swap command is a valid alternative to the App Service manage swap task, but it is not an additional required action. Only two actions are required, not three.

Answer

Azure App Service manage: Start staging slot

Answer

Azure App Service manage: Delete staging slot

Answer

Azure CLI: Run az webapp deployment slot swap

Question 4

You are configuring a YAML pipeline that deploys to multiple environments. The pipeline should automatically trigger when changes are pushed to the main branch, but only if the build artifact changes. Which trigger configuration should you use?

Accepted Answer

trigger: paths: include: - src/*. The requirement is to trigger on pushes to main only when source code changes. This requires both a branch filter and a path filter: `trigger: branches: include: main paths: include: src/*`. Option B only filters by path, so it triggers on all branches. Option A only filters by branch. No single option is correct, so this question is invalid.

Answer

trigger: branches: include: - main

Answer

pr: branches: include: - main

Answer

resources: containers: - container: myContainer

Question 5

Match each Azure DevOps concept to its correct description.

Accepted Answer

Build pipeline. The stem asks to match Azure DevOps concepts to descriptions, but no descriptions are provided. To be a valid question, the stem should include a list such as 'Compiles and builds the code', 'Deploys the build output to targets', 'A single action in a pipeline', 'A name-value pair stored at pipeline level', 'An event that starts a pipeline'. The test-taker would then pair each concept with the correct description. The current question cannot be answered.

Question 6

Your pipeline runs on a Microsoft-hosted agent. You need to securely reference an Azure Key Vault secret in a pipeline variable without exposing the value in logs. Which variable group type should you use and how should you reference the secret?

Accepted Answer

Create a variable group linked to Key Vault, then reference as $(KeyVaultName.SecretName). To securely reference an Azure Key Vault secret without exposing the value in logs, create a variable group linked to the Key Vault. This automatically maps each secret to a pipeline variable whose name equals the secret name and masks its value. Reference it directly as $(SecretName). Option A identifies the correct variable group type but uses an incorrect reference. Option D uses the correct reference but does not explicitly state that the variable group must be linked to Key Vault. Therefore, none of the options are fully correct.

Answer

Use the 'Azure Key Vault' task to download secrets and assign to variables

Answer

Store the secret as a plain text variable and mark it as 'secret'

Answer

Reference the secret directly as $(SecretName) from a library variable group

Question 7

Drag and drop the steps to implement a disaster recovery plan for Azure App Service into the correct order.

Accepted Answer

Identify critical apps and RTO/RPO, then configure backups, then enable geo-replication, then configure failover, then test failover.. For Azure App Service disaster recovery, the typical steps are: identify critical apps and RTO/RPO, configure backups (preferably to geo-redundant storage), deploy a secondary copy or use geo-restore, configure traffic routing (e.g., Traffic Manager/Front Door) for failover, and test failover. The term 'enable geo-replication' should be replaced with an App Service-specific action, and the order should reflect that.

Answer

Configure backups, then identify critical apps and RTO/RPO, then enable geo-replication, then configure failover, then test failover.

Answer

Identify critical apps and RTO/RPO, then enable geo-replication, then configure backups, then configure failover, then test failover.

Answer

Identify critical apps and RTO/RPO, then configure backups, then configure failover, then enable geo-replication, then test failover.

Question 8

You need to ensure that a release pipeline in Azure Pipelines automatically deploys to production only if the deployment to staging succeeds and all manual intervention checks pass. What is the best way to configure this?

Accepted Answer

Add a pre-deployment approval gate on the production stage. A pre-deployment approval gate on the production stage is the standard and direct way to require manual approval before deploying to production. Because the pipeline executes stages sequentially, production only runs after staging succeeds, ensuring the 'deployment to staging succeeds' condition automatically. The manual intervention checks are fulfilled by the pre-deployment approval. While a post-deployment approval on staging could also block progress to production, it is not the 'best' or only correct answer; it is less directly tied to protecting the production environment.

Answer

Configure a branch policy on the main branch

Answer

Assign a deployment group to the production stage

Answer

Add a post-deployment approval gate on the staging stage

Question 9

Which TWO actions should you take to implement a gated check-in policy in Azure Repos that triggers a build before changes are merged?

Accepted Answer

Configure a build validation policy on the branch. Both A and B describe the same necessary configuration: in Azure Repos, a build validation policy is a branch policy that requires a successful build to complete before changes can be merged. This policy triggers a build with the proposed changes and blocks the pull request until the build succeeds. Implementing a gated check-in requires adding such a policy to the target branch. CI triggers (C) run on push events and do not block merging; D and E are not standard mechanisms for gated check-in.

Answer

Enable continuous integration (CI) trigger on the build pipeline

Answer

Set the build to run a 'pre-merge' validation

Answer

Require a manual build before merging

Question 10

Your team uses Azure Pipelines for CI/CD. You need to ensure that a secret variable stored in Azure Key Vault is available to a build pipeline without exposing it in logs. What should you do?

Accepted Answer

Store the secret in a variable group linked to Key Vault and reference it without marking it secret.. To securely use a secret from Azure Key Vault in an Azure Pipeline without exposing it in logs, the simplest and recommended approach is to create a variable group linked to the Key Vault. When you reference the secret by name, Azure Pipelines automatically masks its value in logs. There is no need to manually mark the variable as secret; the linked variable group handles it. The Azure Key Vault task is an alternative but not the primary method; additionally, the task automatically creates secret variables and does not require manual mapping.

Answer

Add the secret as a plain text variable in the pipeline YAML.

Answer

Use a Key Vault task to fetch the secret and map it to a pipeline variable marked 'secret'.

Answer

Add the secret to the repository's .env file and use a script to read it.

Question 11

You ran the above Azure CLI command to check the deployment source of an Azure Web App. The web app is not deploying automatically when commits are pushed to the main branch. Based on the output, what is the most likely cause?

Accepted Answer

The continuous deployment sync is not enabled; you need to enable it or configure a pipeline.. The stem says 'You ran the above Azure CLI command' but no command or output is provided. The explanation admits these assertions cannot be validated and states the question must include the command and output. Therefore, the question is incomplete and the marked correct answer cannot be confirmed.

Answer

Deployment rollback is disabled, preventing automatic deployments.

Answer

The branch is set to 'main' but commits are pushed to 'master'.

Answer

The repo URL uses GitHub but Azure Web Apps only supports Azure Repos.

Question 12

Your team is implementing a CI/CD pipeline for a .NET application. The build pipeline should only run when changes are pushed to the main branch, but a recent push to a feature branch triggered the pipeline. What is the most likely cause?

Accepted Answer

The trigger includes 'main' and also has no branch filters, so all branches trigger builds.. In Azure Pipelines, `trigger: - main` is equivalent to `trigger: branches: include: - main`, restricting CI to main. If a feature branch push triggers the pipeline, the likely cause is that the trigger is missing/empty (defaults to all branches) or is malformed. Including 'main' is itself a branch filter, so it cannot be true that the trigger includes 'main' but has no branch filters.

Answer

The pull request trigger is enabled for the feature branch.

Answer

Path filters are configured to include all paths.

Answer

The CI trigger is disabled in the pipeline YAML.

Question 13

You have a pipeline with the above JSON definition. The build fails with 'The specified configuration 'Release' is not valid'. What is the most likely cause?

Accepted Answer

The configuration value should be 'debug' instead.. Azure Pipelines accepts JSON as YAML, so the error is not a format problem. The error 'The specified configuration 'Release' is not valid' is thrown when the value passed to the build configuration does not exist in the project. Since the error names 'Release', the variable is set to that value, but it is not supported. Changing the configuration to a valid one (such as 'debug') resolves the issue. Therefore, option A is the correct answer, not B.

Answer

The buildConfiguration variable is not set.

Answer

The pipeline definition is in JSON format, which is not supported by Azure Pipelines.

Answer

The DotNetCoreCLI task requires a specific version.

Question 14

You run the above KQL query in Log Analytics to troubleshoot a failing container in a Kubernetes deployment. The query returns no results even though you know there are errors. What is the most likely cause?

Accepted Answer

Container logs are not being sent to the ContainerLog table.. The explanation admits the query is missing, yet still asserts B is correct. Without seeing the query, it is impossible to determine whether the no-results issue is due to data collection, filtering, syntax, or case sensitivity. The question must include the actual KQL query to be valid.

Answer

The 'project' clause filters out relevant rows.

Answer

The 'contains' operator is case-sensitive.

Answer

The KQL syntax is incorrect.

Question 15

You are designing a release pipeline for a microservices application where each service is built as a Docker container and deployed to Azure Kubernetes Service (AKS). You want to ensure that each service is deployed independently to the same cluster. The services have dependencies on each other. Which deployment strategy should you use?

Accepted Answer

Rolling update using Kubernetes Deployment strategies.. Rolling update using Kubernetes Deployment strategies is the standard way to update a service independently. It replaces pods incrementally, allowing the new version to become healthy before continuing. This minimizes downtime and works well with dependent services via readiness/liveness probes. Blue-green deployment (D) in Kubernetes is typically implemented with separate Deployments and label selectors, not necessarily entire stacks; however, using namespaces for isolation is not a standard blue-green pattern. The other options are incorrect for the reasons given.

Answer

Canary deployment with traffic splitting via Istio.

Answer

Immutable infrastructure with new cluster per deployment.

Answer

Blue-green deployment to AKS using Kubernetes namespaces for isolation.

Question 16

Refer to the exhibit. This YAML pipeline snippet uses parameters to deploy to different environments. The team wants to run the pipeline for a specific environment by providing the parameter at queue time. However, the pipeline fails with 'Invalid stage name'. What is the most likely cause?

Accepted Answer

Stage names cannot contain template expressions; they must be static.. In Azure Pipelines, stage names must be valid identifiers (letters, numbers, underscores, starting with a letter). Template expressions are allowed and evaluated at compile time. If the parameter value provided at queue time contains spaces or other invalid characters (e.g., 'Dev Environment'), the pipeline fails with 'Invalid stage name'. The fix is to use a valid identifier as the stage name and a displayName for the human-readable label.

Answer

The parameter values must be defined in a separate file.

Answer

The 'AzureWebApp@1' task inputs are incorrectly formatted.

Answer

The 'stage' keyword should be 'stageName'.

Question 17

Your team uses Azure DevOps to build a .NET application. The build pipeline takes 45 minutes to complete. You want to reduce build times by caching dependencies. What should you configure in the pipeline?

Accepted Answer

Add a Cache task with a key based on the package-lock.json file hash.. None of the options are correct. For a .NET application, you should add a Cache task with a key based on packages.lock.json or the project files. Option B uses package-lock.json (npm), which will cause cache misses and fail to improve build times for .NET dependencies.

Answer

Configure a Build Retention Policy to keep only the latest build.

Answer

Use Pipeline Artifacts to store dependencies between builds.

Answer

Enable Incremental builds in the pipeline settings.

Question 18

Which TWO triggers can be used to start a pipeline automatically in Azure Pipelines? (Choose two.)

Accepted Answer

Pipeline completion trigger. Azure Pipelines supports multiple automatic trigger types: CI triggers (on branch push), PR triggers, scheduled triggers (on a cron schedule), and pipeline completion triggers (when another pipeline completes). Manual triggers via the portal are not automatic. Therefore, the correct answer cannot be exactly two; options A, B, D, and E all describe automatic triggers. The explanation also fails to address why PR triggers are correct and schedule triggers are not.

Answer

Manual trigger via the DevOps portal

Question 19

You have a multi-stage pipeline that builds a .NET application and deploys it to Azure App Service. The build stage produces a drop artifact that is used by the deployment stage. Recently, the deployment stage started failing intermittently with a '403 Forbidden' error when trying to download the artifact. The service connection used for deployment has 'Contributor' role at the resource group level. The artifact is stored in Azure Artifacts. What is the most likely cause of the failure?

Accepted Answer

The service principal used by the service connection lacks 'Reader' permissions on the Azure Artifacts feed.. The 403 Forbidden error when downloading an artifact from Azure Artifacts indicates an authorization failure. Even though the service connection has Contributor role at the resource group level, this role does not grant permissions to read from Azure Artifacts feeds. Azure Artifacts uses its own separate permission system; the service principal must be explicitly granted at least Reader permissions on the specific feed to download packages or artifacts. Without this, the deployment stage cannot access the drop artifact. Note that this would cause persistent failures whenever the artifact is downloaded, so the 'intermittent' description in the scenario is a distractor.

Answer

The service connection does not have 'Website Contributor' role on the App Service.

Answer

The pipeline has 'Limit job authorization scope to current project' enabled, restricting access to the artifact.

Answer

The artifact is stored in a different Azure region than the App Service, causing a cross-region access error.

Question 20

You want to trigger a pipeline automatically when a new commit is pushed to the 'develop' branch of your repository. Which trigger configuration should you use in the YAML pipeline?

Accepted Answer

resources:
  repositories:
  - repository: self
    trigger:
      branches:
        include:
          - develop. Both C and D are valid ways to define a CI trigger on a push to the 'develop' branch. The top-level `trigger` (D) is the conventional and recommended syntax. A repository resource with `repository: self` and a `trigger` (C) is also an officially supported alternative. Options A and B are incorrect: A defines a schedule, and B defines a pull request trigger, not a direct push CI trigger.

Answer

schedules:
- cron: "0 0 * * *"
  branches:
    include:
      - develop

Answer

pr:
  branches:
    include:
      - develop