AZ-400 Design and implement build and release pipelines Practice Test 11 — 15 Questions

Question 1

You are implementing a CI pipeline for a Node.js application. The pipeline must run linting, unit tests, and build the application. Which YAML structure is most appropriate?

Accepted Answer

Define one job with multiple steps: lint, test, build.. Option B is correct because jobs allow multiple steps to run sequentially on the same agent, which is efficient for linting, testing, and building. Option A uses stages but not necessary. Option C runs steps in parallel, which may cause conflicts. Option D is not valid YAML for Azure Pipelines.

Answer

Define three separate stages: lint, test, build.

Answer

Define one job with parallel steps using 'parallel' keyword.

Answer

Define multiple jobs without dependencies.

Question 2

Your organization uses GitHub Actions for CI/CD. You need to ensure that secrets stored in GitHub are not exposed in build logs. A developer accidentally printed a secret to the console in a workflow step. How can you prevent this from happening in the future?

Accepted Answer

Enable 'Secret scanning' and 'Push protection' for the repository.. Option D is correct because enabling 'Secret scanning' and 'Push protection' in the repository automatically blocks secrets from being committed or printed in logs. Option A would mask the secret but only after it's already been printed. Option B is impractical and error-prone. Option C is not a built-in feature.

Answer

Add the secret to the 'Secret scanning' exclusion list.

Answer

Instruct developers to avoid using 'echo' and use '::set-output' instead.

Answer

Use the 'actions/secrets' action to mask secrets automatically.

Question 3

Your Azure DevOps pipeline deploys an ARM template to create a storage account. The deployment fails with 'AuthorizationFailed' error. The service principal used by the service connection has 'Contributor' role on the resource group. What is the most likely issue?

Accepted Answer

The service principal does not have 'Contributor' role at the subscription scope.. Option B is correct because ARM template deployments require 'Microsoft.Resources/deployments/write' permission, which is included in Contributor. However, if the deployment is at subscription scope, the service principal needs Contributor on the subscription. Option A is incorrect because the error is authorization, not conflict. Option C is not required. Option D is incorrect because ARM templates don't require a specific provider registration for deployment itself.

Answer

The service principal is not registered for the 'Microsoft.Storage' resource provider.

Answer

The storage account name is already taken.

Answer

The ARM template is using an unsupported API version.

Question 4

You are setting up a release pipeline that deploys to multiple environments (dev, test, prod) sequentially. Each environment requires approval before deployment. What is the best way to implement this in Azure Pipelines?

Accepted Answer

Define pipeline stages with environment resources and pre-deployment approvals.. Option C is correct because environments in Azure Pipelines support approvals and gates, and can be used in a multi-stage pipeline with manual triggers. Option A is outdated; releases are the classic approach. Option B is insufficient for approvals. Option D requires custom scripting.

Answer

Use environment resources with 'auto' trigger and no approvals.

Answer

Use classic release pipelines with approval gates per environment.

Answer

Use a custom PowerShell script to pause and prompt for approval.

Question 5

Which TWO are best practices for securing Azure Pipelines? (Choose two.)

Accepted Answer

Use variable groups linked to Azure Key Vault for secrets.. Options B and D are correct. Option B: Using variable groups with secret variables from Azure Key Vault ensures secrets are not stored in YAML. Option D: Service connections with 'Contributor' role scoped to a resource group limit blast radius. Option A is unnecessary and insecure. Option C is not a security best practice. Option E is not a security practice.

Answer

Grant 'Administrator' role to all service connections for ease of management.

Answer

Store all pipeline variables in the YAML file as plain text.

Answer

Disable pipeline logging for all jobs.

Question 6

Which THREE are valid deployment patterns for Kubernetes? (Choose three.)

Accepted Answer

Canary deployment. A canary deployment is a valid Kubernetes deployment pattern where a small subset of users (the 'canary') receives the new version of an application before a full rollout. This allows monitoring for issues with minimal impact, and Kubernetes supports this via techniques like multiple Deployments with shared labels and service mesh traffic splitting (e.g., Istio). It is a core strategy for progressive delivery in Kubernetes.

Answer

A/B testing deployment

Answer

Helm deployment

Question 7

Which TWO are true about Azure Pipelines YAML templates? (Choose two.)

Accepted Answer

Template expressions are evaluated at compile time.. Option B is correct because template expressions in Azure Pipelines YAML are evaluated at compile time, before the pipeline runs. This allows the template to inject variables, conditions, and other logic into the pipeline definition statically, ensuring that the final pipeline structure is fully resolved before execution begins.

Answer

Templates must be stored in the same repository as the main pipeline.

Answer

Templates require parameters to be defined.

Answer

Templates can only define a single job.

Question 8

Refer to the exhibit. You deploy this ARM template using Azure Pipelines. The deployment succeeds, but the storage account is created with a name that is not what you expected. What is the most likely reason?

Accepted Answer

The uniqueString function returns a hash based on the resource group ID, resulting in a non-meaningful name.. Option C is correct. The 'uniqueString(resourceGroup().id)' function generates a hash based on the resource group ID, not the storage account name parameter. The default value is a hash, not a human-readable name. Option A is incorrect because the parameter type is string. Option B is incorrect because the default value uses resourceGroup().id, not resourceGroup().location. Option D is not relevant.

Answer

The storage account name parameter is of type 'string' but the default value is an object.

Answer

The location parameter uses resourceGroup().location which is not a valid function.

Answer

The apiVersion '2022-09-01' is too new and causes a naming conflict.

Question 9

Refer to the exhibit. You have this GitHub Actions workflow YAML. The workflow does not trigger when you push to the main branch. What is the most likely issue?

Accepted Answer

The correct keyword is 'on', not 'triggers'.. Option B is correct. The 'triggers' keyword is incorrect. In GitHub Actions, the correct keyword is 'on'. The workflow should use 'on: push: branches: [main]' instead of 'triggers'. Option A is incorrect because the push event is valid. Option C is not the issue. Option D is not the cause.

Answer

The branch name should be in a list under 'branches' inside 'push'.

Answer

The 'vmImage' should be 'windows-latest' for scripts.

Answer

The 'triggers' keyword is misspelled; it should be 'trigger'.

Question 10

Refer to the exhibit. You have this Azure Pipeline YAML. When you run the pipeline, it fails because the resource group name is not correctly resolved. What is the likely cause?

Accepted Answer

The variable 'resourceGroupName' uses $(environment) which cannot reference a parameter.. Option A is correct. In Azure Pipelines, variables defined in YAML using 'variables' can reference parameters using ${{ parameters.environment }} but not $(environment). The macro syntax $(variable) is for runtime variables, but 'environment' is a parameter. So $(environment) is not resolved. Option B is incorrect because parameters can be used in templates. Option C is not the issue. Option D is incorrect because the script type is valid.

Answer

The script type 'pscore' is not supported on Ubuntu.

Answer

Parameters cannot be used in YAML pipelines; they must be defined in a template.

Answer

The 'trigger: none' prevents the pipeline from running.

Question 11

Your team uses a multi-stage YAML pipeline. The 'Build' stage compiles the code and runs unit tests. The 'Deploy' stage deploys to a staging environment. You notice that if the 'Build' stage fails, the 'Deploy' stage still starts because it depends on a condition that always evaluates to true. How should you modify the pipeline to prevent the 'Deploy' stage from running if the 'Build' stage fails?

Accepted Answer

Add 'condition: succeeded()' to the Deploy stage.. Option B is correct because using 'condition: succeeded()' ensures that the stage only runs if all previous stages succeeded. Option A is wrong because 'dependsOn: Build' alone does not enforce success. Option C is wrong because 'condition: eq(variables['Build.Succeeded'], 'true')' is not the recommended way. Option D is wrong because 'condition: and(succeeded(), eq(variables['Build.Succeeded'], 'true'))' is redundant.

Answer

Add 'condition: eq(variables['Build.Succeeded'], 'true')' to the Deploy stage.

Answer

Add 'condition: and(succeeded(), eq(variables['Build.Succeeded'], 'true'))' to the Deploy stage.

Answer

Add 'dependsOn: Build' to the Deploy stage.

Question 12

Your organization requires that all code changes must be built and tested before merging to the main branch. You plan to use branch policies in Azure Repos. Which policy enforcement will ensure that a pull request cannot be completed unless the build succeeds?

Accepted Answer

Add a build validation policy that triggers a build on each PR update.. Option C is correct because 'Build validation' enforces that a build must succeed before the PR is completed. Option A is wrong because 'Require a minimum number of reviewers' does not enforce build success. Option B is wrong because 'Comment resolution' is about comments. Option D is wrong because 'Check for linked work items' is about work items.

Answer

Require a linked work item in the pull request.

Answer

Require a minimum number of reviewers.

Answer

Reset code reviewer votes when new changes are pushed.

Question 13

You are configuring a release pipeline to deploy to Azure App Service. You want to use the 'Deploy Azure App Service' task. Which authentication method should you use to securely connect Azure DevOps to the Azure subscription?

Accepted Answer

Azure Resource Manager service connection using a service principal.. Option B is correct because the Azure Resource Manager service connection with Service Principal authentication is the recommended and secure method. Option A is wrong because Azure CLI does not provide persistent service connection. Option C is wrong because Managed Identity is not directly used by Azure DevOps. Option D is wrong because SAS tokens are for storage, not App Service.

Answer

Azure CLI authentication with a user account.

Answer

Use a SAS token for the App Service.

Answer

Managed Identity assigned to the Azure DevOps agent.

Question 14

Your team is using GitHub Actions for CI/CD. The workflow builds a container image and pushes it to Azure Container Registry (ACR). However, the workflow fails with an authentication error when pushing to ACR. What is the most likely cause?

Accepted Answer

The workflow does not include an 'azure/login' step to authenticate with Azure.. Option A is correct because the most common cause is that the Azure login action is missing or misconfigured. Option B is wrong because Docker login is handled by the Azure login action. Option C is wrong because ACR allows anonymous pull but not push. Option D is wrong because the issue is authentication, not repository name.

Answer

The repository name in the workflow is incorrect.

Answer

The Dockerfile is missing a required LABEL instruction.

Answer

The ACR allows anonymous pull access.

Question 15

You need to implement a strategy to manage secrets for your multi-stage YAML pipeline. The pipeline runs on Microsoft-hosted agents. Which approach should you use to securely pass secrets to pipeline tasks?

Accepted Answer

Use pipeline variables with 'secret: true' and reference them as $(variableName).. Option D is correct because using variables with 'secret: true' in the YAML pipeline and referencing them as $(variableName) is the recommended way. Option A is wrong because environment variables are not secure in YAML. Option B is wrong because hardcoding is insecure. Option C is wrong because Azure Key Vault task should be used to fetch secrets into variables.

Answer

Define the secrets as environment variables in the pipeline YAML directly.

Answer

Use the Azure Key Vault task to download secrets and then pass them as parameters.

Answer

Store secrets in a file in the repository and read it during the build.