AZ-400 Design and implement build and release pipelines Practice Test 11 — 15 Questions

Question 1

You are designing a build pipeline that produces a NuGet package. The pipeline must conditionally sign the assembly only when the build is triggered by a tag starting with 'v' (e.g., v1.0.0). The pipeline uses a script task that signs the assembly. Which expression should you use in the condition of the script task?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

and(succeeded(), startsWith(variables['Build.SourceBranch'], 'refs/tags/v')). The condition uses `startsWith(variables['Build.SourceBranch'], 'refs/tags/v')` to check if the build was triggered by a tag whose full Git ref starts with `refs/tags/v`. This ensures the signing script runs only when the source branch is a tag reference matching the 'v' prefix, which is the standard way to identify version tags in Azure Pipelines. The `and(succeeded(), ...)` wrapper guarantees the previous tasks completed successfully before signing.

Answer

and(succeeded(), startsWith(variables['Build.SourceBranchName'], 'v'))

Answer

and(succeeded(), startsWith(variables['Build.SourceVersion'], 'v'))

Answer

and(succeeded(), eq(variables['Build.Reason'], 'IndividualCI'))

Question 2

You have a YAML pipeline that deploys to multiple environments. The pipeline uses environment approvals. You need to ensure that the pipeline waits for manual approval before deploying to the production environment. The production environment is named 'Production'. Which configuration should you add to the deployment job?

Accepted Answer

Add 'environment: Production' to the deployment job and configure approvals on the environment in the Azure DevOps portal. Environment approvals in Azure DevOps are configured on the environment resource itself, not in the pipeline YAML. By adding 'environment: Production' to the deployment job, the pipeline references the environment, and the manual approval gate is enforced by the approvals configured on that environment in the Azure DevOps portal. This ensures the pipeline waits for approval before proceeding to the production deployment job.

Answer

Add 'approvals: Production' to the deployment job

Answer

Add 'checks: Production' to the deployment job

Answer

Add 'dependsOn: ProductionApproval' and use a separate stage for approval

Question 3

You are creating a YAML pipeline that builds a .NET Core application. The pipeline must use a multi-stage build with separate stages for 'Build', 'Test', and 'Deploy'. The 'Deploy' stage should only run if both 'Build' and 'Test' succeed. Which two conditions can you use to achieve this? (Select all that apply.)

Accepted Answer

In the Deploy stage, set 'dependsOn: [Build, Test]'. Setting 'dependsOn: [Build, Test]' in the Deploy stage ensures that the Deploy stage only starts after both the Build and Test stages have completed. By default, a stage runs only if all its dependencies succeed, so this alone meets the requirement without needing an explicit condition. This is the standard way to enforce sequential execution in multi-stage YAML pipelines.

Answer

In the Deploy stage, set 'condition: and(succeeded('Build'), succeeded('Test'))'

Answer

In the Deploy stage, set 'dependsOn: [Build, Test]' and 'condition: stageDependencies.Build.result == 'Succeeded''

Question 4

You are designing a build pipeline that produces a NuGet package. The pipeline must conditionally sign the assembly only when the build is triggered by a tag starting with 'v' (e.g., v1.0.0). The pipeline uses a script task that signs the assembly. Which expression should you use in the condition of the script task?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Visual Studio Build. The correct order of tasks is: first Visual Studio Build to compile code, then Visual Studio Test to run unit tests, and finally Publish Code Coverage Results. Since the question asks for the first task in the sequence, the correct answer is Visual Studio Build (Option A).

Answer

Visual Studio Test

Answer

Publish Code Coverage Results

Question 5

You have a YAML pipeline that builds a .NET application. You need to ensure that the pipeline uses the .NET SDK version 6.0.x. Which task should you add to the pipeline?

Accepted Answer

UseDotNet@2. The UseDotNet@2 task is the correct choice because it explicitly installs a specific .NET SDK version (6.0.x) on the build agent, ensuring the pipeline uses the required SDK for building the .NET application. This task downloads and caches the SDK, making it available for subsequent tasks like DotNetCoreCLI@2.

Answer

NuGetToolInstaller@1

Answer

DotNetCoreCLI@2

Answer

PowerShell@2

Question 6

You have a release pipeline that deploys to multiple stages. You want to ensure that a manual approval is required before deploying to the production stage. Which approach should you use?

Accepted Answer

Add a pre-deployment approval on the production stage.. Pre-deployment approvals in Azure Pipelines allow you to require manual sign-off before a release proceeds to a specific stage. By adding a pre-deployment approval on the production stage, the pipeline will pause and wait for designated approvers to approve the deployment, ensuring that no code reaches production without explicit authorization.

Answer

Add a post-deployment approval on the staging stage.

Answer

Configure a deployment gate with a manual intervention task.

Answer

Use a pipeline decorator to inject approval step.

Question 7

You have a YAML pipeline that uses a multi-stage build. You want to cache the restored NuGet packages across builds to improve performance. Which caching strategy should you use?

Accepted Answer

Use the Cache@2 task with key: 'nuget | "$(Agent.OS)" | packages.lock.json', path: '$(System.DefaultWorkingDirectory)/packages'. The Cache@2 task is the recommended way to cache NuGet packages in Azure Pipelines. By using a cache key that includes the agent OS and the packages.lock.json file, the cache is invalidated only when the lock file changes, ensuring restored packages are reused across builds. The path points to the NuGet global packages folder, which is typically $(System.DefaultWorkingDirectory)/packages when NUGET_PACKAGES is set.

Answer

Use the NuGetCommand@2 task with the -Cache argument.

Answer

Set the NUGET_PACKAGES environment variable to a custom path and rely on pipeline caching plugin.

Answer

Use the DotNetCoreCLI@2 task with the --no-restore flag and manually copy packages.

Question 8

You need to run a set of tasks only when the build pipeline runs for the main branch. Which condition should you add to the job or step?

Accepted Answer

condition: eq(variables['Build.SourceBranch'], 'refs/heads/main'). The `Build.SourceBranch` variable in Azure Pipelines contains the full Git ref (e.g., `refs/heads/main`). Using `eq(variables['Build.SourceBranch'], 'refs/heads/main')` ensures the condition evaluates to true only when the pipeline runs on the main branch. This is the standard way to filter by branch in YAML pipeline conditions.

Answer

condition: eq(variables['Build.SourceBranch'], 'main')

Answer

condition: and(succeeded(), eq(variables['System.PullRequest.TargetBranch'], 'main'))

Answer

condition: ne(variables['Build.Reason'], 'PullRequest')

Question 9

You have a YAML pipeline with multiple jobs that need to run in parallel. However, one job depends on artifacts produced by a previous job. How should you configure the dependency?

Accepted Answer

Set dependsOn on the dependent job and use PublishBuildArtifacts and DownloadBuildArtifacts tasks.. In Azure DevOps YAML pipelines, job dependencies are explicitly declared using the `dependsOn` keyword, and artifacts must be published and downloaded using `PublishBuildArtifacts` and `DownloadBuildArtifacts` tasks (or the `publish` and `download` pipeline decorators). Without explicit artifact sharing, outputs from one job are not automatically available to another job, even if `dependsOn` is set.

Answer

Use the 'dependsOn' keyword only, artifacts are automatically shared.

Answer

Set the 'condition' to 'eq(variables['Agent.JobStatus'], 'Succeeded')' on the dependent job.

Answer

Use the 'pool' keyword to ensure both jobs run on the same agent.

Question 10

You are designing a release pipeline for a microservices application. Which two strategies can you use to manage configuration across different environments? (Choose two.)

Accepted Answer

Use variable groups linked to Azure Key Vault.. Options A and B are correct because variable groups provide a centralized and secure way to manage configuration across multiple environments and pipelines. Option A uses Azure Key Vault for secrets, integrating with access policies and rotation, while option B stores non-sensitive environment-specific settings. Option C is incorrect because XML transformation targets web.config files, which are legacy .NET artifacts and not typical for modern microservices that use JSON, YAML, or environment variables. Option D is incorrect because stage-level variables are scoped to a single pipeline definition and do not offer a reusable, centralized configuration mechanism across different environments or pipelines; variable groups are designed for that purpose.

Answer

Use XML transformation tasks for web.config.

Answer

Use multi-stage YAML pipelines with stage-level variables.

Question 11

You have a multi-stage YAML pipeline with stages: Build, Test, and Deploy. The Deploy stage requires approval from a specific user group. You want to ensure that the approval request is sent only after the Test stage completes successfully. Which configuration should you use?

Accepted Answer

Define an environment with required approvers and reference it in the Deploy stage.. Azure Pipelines environments allow you to define required approvers (user groups) that must approve a deployment before it proceeds. By referencing the environment in the Deploy stage, the approval request is automatically triggered only after the preceding Test stage completes successfully, since stages execute sequentially by default.

Answer

Add a manual validation task in the Deploy stage.

Answer

Use the 'condition' keyword: condition: eq(variables['Build.SourceBranch'], 'refs/heads/main')

Answer

Configure branch policies on the main branch.

Question 12

You need to create a build pipeline that runs on a Microsoft-hosted agent. You want to use the latest Ubuntu image. Which YAML snippet should you use?

Accepted Answer

pool: vmImage: 'ubuntu-latest'. In Azure Pipelines YAML, the `pool` keyword is used to specify the agent pool, and `vmImage` is a sub-property that defines the virtual machine image for Microsoft-hosted agents. Setting `vmImage: 'ubuntu-latest'` within the `pool` section selects the latest Ubuntu LTS image provided by Microsoft, ensuring the build runs on a current, maintained environment.

Answer

pool: name: 'ubuntu-latest'

Answer

agent: vmImage: 'ubuntu-latest'

Answer

resources: vmImage: 'ubuntu-latest'

Question 13

You are designing a pipeline that deploys to an Azure Kubernetes Service (AKS) cluster. You need to securely pass the Kubernetes cluster credentials to the pipeline without hardcoding them. Which approach should you use?

Accepted Answer

Use a variable group linked to Azure Key Vault.. Azure Key Vault provides a secure, centralized store for secrets like Kubernetes cluster credentials, and linking a variable group to Key Vault allows the pipeline to dynamically retrieve those secrets at runtime without exposing them in the pipeline definition or logs. This approach follows the principle of least privilege and ensures credentials are never hardcoded or stored in plaintext within the pipeline.

Answer

Store credentials in a pipeline variable with 'secret' type.

Answer

Hardcode the credentials in the pipeline YAML.

Answer

Use a secure file in the pipeline library.

Question 14

You have a release pipeline that deploys to multiple stages (Dev, QA, Prod). You want to automatically deploy to Dev and QA after a successful build, but require a manual approval for Prod. Which deployment strategy should you use?

Accepted Answer

Set pre-deployment approvals on the Prod stage.. Pre-deployment approvals control whether a release can start deploying to a stage. By setting a pre-deployment approval on the Prod stage only, Dev and QA will deploy automatically (since they have no approval requirement), while Prod requires manual sign-off before deployment begins. This matches the requirement exactly.

Answer

Set pre-deployment approvals on the Dev and QA stages.

Answer

Use a post-deployment approval on the QA stage.

Answer

Disable the automatic trigger for all stages.

Question 15

You are configuring a YAML build pipeline for a .NET Core application. Which task should you use to restore NuGet packages?

Accepted Answer

DotNetCoreCLI task with 'restore' command. The DotNetCoreCLI task with the 'restore' command is the recommended approach for restoring NuGet packages in a YAML build pipeline for a .NET Core application. It directly invokes 'dotnet restore', which is the native .NET CLI command that handles package restoration efficiently and integrates seamlessly with the .NET SDK, ensuring compatibility with project files and dependency resolution.

Answer

NuGetCommand task

Answer

PowerShell task with dotnet restore

Answer

NuGetAuthenticate task