AZ-400 Design and implement build and release pipelines — 25 Questions

Question 1

You are reviewing an Azure Policy definition applied to an Azure DevOps project. The project has a build pipeline that deploys to production. What is the effect of this policy on the build pipeline?

Accepted Answer

The policy audits the pipeline but does not enforce any mandatory reviewers.. Azure Policy definitions applied to Azure DevOps projects use the 'audit' effect by default for policy types that do not support 'deny' or 'enforce' on build pipelines. Since the policy in question does not specify a mandatory reviewer requirement with enforcement, it only audits the pipeline's compliance without blocking execution. Therefore, the pipeline runs regardless, and the policy logs a compliance state.

Answer

The policy blocks the pipeline from running if fewer than two reviewers approve.

Answer

The policy requires two reviewers and blocks the pipeline if not met.

Answer

The policy does not apply to build pipelines because the field type is teamProjects.

Question 2

Refer to the exhibit. The pipeline is configured as shown. A developer pushes a change to the `main` branch that modifies a file under `src/Controllers/HomeController.cs` and also adds a new file under `docs/readme.md`. Which of the following best describes what happens?

Accepted Answer

The pipeline triggers because the change to `src/Controllers/HomeController.cs` is not in an excluded path.. The pipeline uses path filters that include `src/*` and exclude `docs/*`. Azure Pipelines evaluates all changed files in the push. The push contains `src/Controllers/HomeController.cs`, which matches the include pattern and is not excluded, so the trigger condition is met. The addition of `docs/readme.md` is excluded and does not suppress the trigger, because a change to at least one matching file is sufficient.

Answer

The pipeline does not trigger because the `docs/` path is excluded and includes a change.

Answer

The pipeline triggers only if the change is on a branch matching `release/*`.

Answer

The pipeline triggers but runs only tests because the build is skipped due to excluded paths.

Question 3

Your organization uses Azure Pipelines for CI/CD. The current pipeline for a .NET Core application builds and runs unit tests, then deploys to a staging environment. The team wants to add a step to run integration tests against the staging environment after deployment, and only if integration tests pass, promote the build to production. The integration tests require a database connection string that is stored as a secret in Azure Key Vault. The pipeline uses a service principal with permissions to read secrets from the Key Vault. You need to modify the pipeline to meet these requirements while ensuring security best practices. Which action should you take?

Accepted Answer

Add an Azure Key Vault task before the integration test step to retrieve the secret and map it to a variable.. Both B and C are correct methods for retrieving secrets from Azure Key Vault in a pipeline. Option B uses the dedicated Azure Key Vault task to fetch the secret at the point needed. Option C links a variable group to Key Vault, making the secret available as a variable. Both avoid hard-coding secrets and use the existing service principal. Option C is not invalid; it is a standard pattern. The question should accept both answers or be reworded to require a specific timing that only B satisfies.

Answer

Set the connection string as a secret variable in the pipeline UI and reference it in the integration test step.

Answer

Use a PowerShell script to read the secret from Key Vault using the service principal.

Question 4

You have a multi-stage YAML pipeline that deploys to Azure Kubernetes Service (AKS). The pipeline uses a deployment job with a strategy of 'runOnce'. You need to ensure that if the deployment fails, the pipeline automatically redeploys the previous successful version. Which strategy should you use instead?

Accepted Answer

Use the 'runOnce' strategy with a rollback task. The requirement can be met by adding a rollback task to the existing 'runOnce' strategy. When a deployment fails, the rollback task can automatically redeploy the previous successful version. Option A requires manual intervention, which contradicts the 'automatically' requirement. Option B uses invalid syntax ('on:failure: always')—the correct hook is 'on: failure: rollback'—and option C's automatic swap does not revert the deployment on failure.

Answer

Use the 'canary' strategy with manual intervention

Answer

Use the 'rolling' strategy and configure 'on:failure: always'

Answer

Use the 'blueGreen' strategy and configure automatic swap

Question 5

You are designing a release pipeline that uses Azure App Service deployment slots. The pipeline must perform a swap after deployment to the staging slot. Which three tasks or actions should you include in the pipeline? (Select all that apply.)

Accepted Answer

Azure App Service deploy: Deploy to staging slot. The correct pipeline actions are to deploy to the staging slot and then swap slots. The Azure App Service deploy task automatically starts the slot, so a separate start action is unnecessary. The Azure CLI swap command is a valid alternative to the App Service manage swap task, but it is not an additional required action. Only two actions are required, not three.

Answer

Azure App Service manage: Start staging slot

Answer

Azure App Service manage: Delete staging slot

Answer

Azure CLI: Run az webapp deployment slot swap

Question 6

You have a YAML pipeline that builds a Docker image and pushes it to Azure Container Registry (ACR). You need to ensure the pipeline uses the latest version of Docker and that the build is cached for faster subsequent runs. Which two tasks should you include? (Choose two.)

Accepted Answer

DockerInstaller@0. (DockerInstaller@0) is correct because it ensures the pipeline uses the latest version of Docker by installing or upgrading the Docker engine on the build agent. Option B (Docker@2 with --cache-from) is correct because it enables layer caching by pulling the previously built image from ACR as a cache source, which speeds up subsequent builds by reusing unchanged layers.

Answer

DockerCompose@0

Answer

HelmDeploy@0

Question 7

You are configuring a YAML pipeline that deploys to multiple environments. The pipeline should automatically trigger when changes are pushed to the main branch, but only if the build artifact changes. Which trigger configuration should you use?

Accepted Answer

trigger: paths: include: - src/*. The requirement is to trigger on pushes to main only when source code changes. This requires both a branch filter and a path filter: `trigger: branches: include: main paths: include: src/*`. Option B only filters by path, so it triggers on all branches. Option A only filters by branch. No single option is correct, so this question is invalid.

Answer

trigger: branches: include: - main

Answer

pr: branches: include: - main

Answer

resources: containers: - container: myContainer

Question 8

Which two actions can you use to validate that a deployment to a staging environment is successful before promoting to production? (Choose two.)

Accepted Answer

Configure gates on the staging environment to check health metrics.. Option A is correct because configuring gates on the staging environment lets the pipeline automatically evaluate health metrics (such as error rates, latency, or availability signals) and block promotion to production if the deployment is unhealthy, directly validating success. Option C is correct because a post-deployment approval on the staging stage pauses the pipeline after the staging deployment completes, requiring a reviewer to confirm the deployment succeeded before it can be promoted to production. Option B is not correct because a manual intervention task only pauses execution for human input and does not itself validate deployment success. Option D is not correct because a pull request validates code changes before merge, not the runtime success of a staging deployment. Option E is not correct because a load test measures performance under load and is not a general validation that the staging deployment succeeded.

Answer

Add a manual intervention task in the pipeline.

Answer

Use a pull request to validate the deployment.

Answer

Run a load test as part of the pipeline.

Question 9

You are designing a pipeline that must run tasks in a container. The container needs access to Azure resources using a managed identity. Which two configurations are required? (Choose two.)

Accepted Answer

Enable a system-assigned managed identity on the agent VM.. Enabling a system-assigned managed identity on the agent VM allows the container job to use the Azure Instance Metadata Service (IMDS) endpoint to obtain tokens for authenticating to Azure resources without storing credentials. Option D is incorrect because Azure Pipelines container job resource definitions do not have an 'identity' field; the identity is inherited from the agent VM.

Answer

Use the 'docker login' command in the pipeline.

Answer

Add a service principal connection to the pipeline.

Answer

Set the 'identity' field in the container resource definition.

Answer

Use the Azure CLI task with '–identity' flag.

Question 10

Match each Azure DevOps concept to its correct description.

Accepted Answer

Build pipeline. The stem asks to match Azure DevOps concepts to descriptions, but no descriptions are provided. To be a valid question, the stem should include a list such as 'Compiles and builds the code', 'Deploys the build output to targets', 'A single action in a pipeline', 'A name-value pair stored at pipeline level', 'An event that starts a pipeline'. The test-taker would then pair each concept with the correct description. The current question cannot be answered.

Question 11

You have a multi-stage YAML pipeline that deploys to a Linux-based Azure App Service. The pipeline uses a 'Deploy to Azure App Service' task. You need to ensure that the deployment uses the Kudu REST API with ZIP deployment. Which value should you set for the 'packageForLinux' task input?

Accepted Answer

Set 'packageForLinux' to true. The 'packageForLinux' input must be set to 'true' to force the 'Deploy to Azure App Service' task to use the Kudu REST API with ZIP deployment when targeting a Linux-based Azure App Service. This is required because Linux App Services do not support WebDeploy (MSDeploy) and rely on the Kudu endpoint for ZIP-based deployments.

Answer

Set 'enableCustomDeployment' to true

Answer

Set 'useWebDeploy' to false

Answer

Set 'enableKuduDeploy' to true

Question 12

Your pipeline runs on a Microsoft-hosted agent. You need to securely reference an Azure Key Vault secret in a pipeline variable without exposing the value in logs. Which variable group type should you use and how should you reference the secret?

Accepted Answer

Create a variable group linked to Key Vault, then reference as $(KeyVaultName.SecretName). To securely reference an Azure Key Vault secret without exposing the value in logs, create a variable group linked to the Key Vault. This automatically maps each secret to a pipeline variable whose name equals the secret name and masks its value. Reference it directly as $(SecretName). Option A identifies the correct variable group type but uses an incorrect reference. Option D uses the correct reference but does not explicitly state that the variable group must be linked to Key Vault. Therefore, none of the options are fully correct.

Answer

Use the 'Azure Key Vault' task to download secrets and assign to variables

Answer

Store the secret as a plain text variable and mark it as 'secret'

Answer

Reference the secret directly as $(SecretName) from a library variable group

Question 13

You are designing a build pipeline for a .NET Core application. You need to ensure that the pipeline restores NuGet packages from both an Azure Artifacts feed and the public NuGet gallery. The pipeline must fail if a package is not found in either source. Which two actions must you take? (Select two.)

Accepted Answer

Create a NuGet.config file that includes both feeds as package sources and reference it in the restore task.. Creating a NuGet.config file that includes both the Azure Artifacts feed and the public NuGet gallery as package sources, and referencing it in the restore task, ensures the pipeline consults both sources. Option D is incorrect because the 'CheckConsistency' flag is not related to failing on missing packages; the restore task already fails by default if a package cannot be resolved from any configured source. Options B, C, and E do not fulfill the requirement to fail on missing packages from both sources.

Answer

Set the 'NoWarn' property to NU1603 to ignore warnings about missing packages.

Answer

Use the 'dotnet restore' task with the '--no-cache' flag.

Answer

Set the 'CheckConsistency' flag to true in the restore task.

Answer

Configure the Azure Artifacts feed to use the public NuGet gallery as an upstream source.

Question 14

Drag and drop the steps to implement a disaster recovery plan for Azure App Service into the correct order.

Accepted Answer

Identify critical apps and RTO/RPO, then configure backups, then enable geo-replication, then configure failover, then test failover.. For Azure App Service disaster recovery, the typical steps are: identify critical apps and RTO/RPO, configure backups (preferably to geo-redundant storage), deploy a secondary copy or use geo-restore, configure traffic routing (e.g., Traffic Manager/Front Door) for failover, and test failover. The term 'enable geo-replication' should be replaced with an App Service-specific action, and the order should reflect that.

Answer

Configure backups, then identify critical apps and RTO/RPO, then enable geo-replication, then configure failover, then test failover.

Answer

Identify critical apps and RTO/RPO, then enable geo-replication, then configure backups, then configure failover, then test failover.

Answer

Identify critical apps and RTO/RPO, then configure backups, then configure failover, then enable geo-replication, then test failover.

Question 15

You are designing a build pipeline for a Java application that uses Maven. The build must run unit tests and integration tests separately. You want to publish test results to Azure Pipelines. Which task configuration should you use?

Accepted Answer

Use two Maven tasks with goals 'test' and 'verify', and configure the Publish Test Results task to publish results from both runs.. It uses two separate Maven tasks with the 'test' and 'verify' goals, which allows unit tests and integration tests to run independently. The Publish Test Results task is then configured to consume the test result files (typically JUnit XML reports) from both runs, enabling Azure Pipelines to display a unified test summary. This approach aligns with the requirement to run unit and integration tests separately while still publishing all results.

Answer

Use two Gradle tasks, one for unit tests and one for integration tests.

Answer

Use a single Maven task with goals 'test verify', and configure the task to publish test results.

Answer

Use two Visual Studio Test tasks, one for unit tests and one for integration tests.

Question 16

Your release pipeline deploys to Azure App Service using deployment slots. You need to ensure that traffic is gradually shifted to the new slot over 30 minutes, and if performance issues occur, it should automatically roll back. Which deployment strategy should you implement?

Accepted Answer

Use the 'Deploy to Azure App Service' task with the 'Deploy to Slot' option and configure auto-swap with monitoring.. The 'Deploy to Azure App Service' task with 'Deploy to Slot' and auto-swap with monitoring enables a gradual traffic shift over a specified duration (e.g., 30 minutes) using Azure's swap-with-preview and auto-rollback capabilities. When performance issues are detected via Application Insights or health checks, the swap is automatically aborted, rolling back to the previous slot. This meets the requirement for gradual shifting and automatic rollback without manual intervention.

Answer

Use two separate deployment slots (blue/green) and manually swap after validation.

Answer

Use a canary deployment with multiple slots and manual approval gate.

Answer

Use an A/B testing deployment by deploying to two different App Services and routing traffic via Traffic Manager.

Question 17

You are configuring a branch policy for the main branch using the Azure DevOps REST API. The JSON above is the policy configuration. A developer pushes a new commit to an existing pull request. What happens to the existing approvals?

Accepted Answer

The existing approvals remain valid.. By default, Azure DevOps branch policies do not automatically reset approvals when a new commit is pushed to a pull request. The policy configuration shown includes the 'resetOnPush' property set to false (or it is not enabled), which means existing approvals remain valid even after new commits are pushed. Only if 'resetOnPush' is explicitly set to true would approvals be invalidated.

Answer

The policy blocks the push until re-reviewed.

Answer

The pull request is automatically rejected.

Answer

All existing approvals are reset.

Question 18

Your build pipeline uses a self-hosted agent. The agent is running low on disk space. You need to clean up the agent's working directory after each build. Which option should you configure in the pipeline?

Accepted Answer

Use the 'clean' parameter in the checkout step of the YAML pipeline.. The `clean` parameter in the YAML checkout step is the native, built-in way to instruct the agent to delete the sources directory before or after the build. Setting `clean: true` or `clean: all` ensures the working directory is purged, directly addressing the low disk space issue without requiring additional tasks or marketplace extensions.

Answer

Set the 'Clean' option to 'Sources' in the pipeline settings.

Answer

Add a 'Delete Files' task at the end of the pipeline to delete the sources directory.

Answer

Add a 'Cleanup' task from the marketplace to clean the agent.

Question 19

Your team uses GitHub for source control and Azure Pipelines for CI/CD. You need to trigger a pipeline automatically when a pull request is created against the main branch. Which trigger type should you configure in the YAML pipeline?

Accepted Answer

pr:. The `pr:` trigger in Azure Pipelines YAML is specifically designed to automatically start a pipeline when a pull request is created or updated against a specified branch. By default, `pr:` triggers are enabled for all branches; however, to ensure the pipeline only runs for PRs targeting `main`, you configure `pr: main`. This triggers the pipeline on PR creation/update without needing a separate branch policy.

Answer

trigger:

Answer

schedules:

Answer

resources:

Question 20

Refer to the exhibit. A developer pushes a commit to the main branch. Which stages will run?

Accepted Answer

Only the Build stage.. The exhibit shows that the Build stage has a trigger condition that matches the 'main' branch, and the Test stage does not have a trigger condition that is satisfied by the push (e.g., it is set to a different branch condition or to manual). Therefore, when a commit is pushed to main, only the Build stage is triggered automatically; the Test stage does not run.

Answer

Only the Test stage.

Answer

Neither stage.

Answer

Both Build and Test stages.