AZ-400 Design and implement build and release pipelines Practice Test 12 — 15 Questions

Question 1

Your build pipeline uses the 'NuGetCommand@2' task to restore NuGet packages. You want to use packages from an Azure Artifacts feed that requires authentication. How should you configure the pipeline to authenticate with the feed?

Accepted Answer

Add a 'NuGetAuthenticate@1' task before the NuGet restore task.. Option B is correct because the NuGetAuthenticate task handles authentication to Azure Artifacts feeds. Option A is wrong because service connection is not directly used by NuGet tasks. Option C is wrong because PAT is less secure and not recommended. Option D is wrong because the NuGet task has built-in support via NuGetAuthenticate.

Answer

Store the Personal Access Token (PAT) in a variable and use it in the NuGet config.

Answer

Create an Azure Artifacts service connection and select it in the NuGet task.

Answer

Install the NuGet credential provider on the agent manually.

Question 2

You want to trigger a pipeline automatically when a new commit is pushed to the 'develop' branch of your repository. Which trigger configuration should you use in the YAML pipeline?

Accepted Answer

trigger:
  branches:
    include:
      - develop. Option A is correct because 'trigger: develop' triggers on pushes to the 'develop' branch. Option B is wrong because 'pr: develop' triggers on pull requests. Option C is wrong because 'schedules' is for cron triggers. Option D is wrong because 'resources' is for pipeline resources.

Answer

schedules:
- cron: "0 0 * * *"
  branches:
    include:
      - develop

Answer

pr:
  branches:
    include:
      - develop

Answer

resources:
  repositories:
  - repository: self
    trigger:
      branches:
        include:
          - develop

Question 3

Your release pipeline deploys to multiple environments (Dev, QA, Prod) using approvals. You need to ensure that the deployment to Prod only proceeds if the deployment to QA succeeded and an approval is granted. Which combination of triggers and pre-deployment conditions should you configure?

Accepted Answer

Set the trigger on Prod to 'After stage' and select QA as the stage, and add a pre-deployment approval on Prod.. Option C is correct because setting the trigger to 'After stage' on the QA stage and adding a pre-deployment approval on Prod ensures both conditions. Option A is wrong because automatic trigger does not enforce QA success. Option B is wrong because 'After release' ignores QA. Option D is wrong because manual only trigger ignores QA.

Answer

Set the trigger on Prod to 'Automatic' and add a post-deployment approval on QA.

Answer

Set the trigger on Prod to 'After release' and add a pre-deployment approval on Prod.

Answer

Set the trigger on Prod to 'Manual only' and add a pre-deployment approval on Prod.

Question 4

You are designing a pipeline to build a .NET Core application. The build must run unit tests and publish code coverage results. Which task should you use to publish the code coverage results to Azure DevOps?

Accepted Answer

Use the 'PublishCodeCoverageResults@1' task.. Option D is correct because the 'PublishCodeCoverageResults@1' task publishes code coverage results to the pipeline. Option A is wrong because the 'DotNetCoreCLI@2' task can run tests but does not publish results. Option B is wrong because 'VSTest@2' is for Visual Studio tests. Option C is wrong because 'PublishTestResults@2' publishes test results, not coverage.

Answer

Use the 'PublishTestResults@2' task.

Answer

Use the 'DotNetCoreCLI@2' task with the 'test' command.

Answer

Use the 'VSTest@2' task with the 'codeCoverageEnabled' option.

Question 5

Which TWO of the following are valid strategies to reduce the build time of a container image in Azure Pipelines?

Accepted Answer

Build multiple images in parallel using matrix strategy.. Options A and D are correct. Option A reduces build time by reusing cached layers. Option D reduces build time by parallelizing image builds. Option B is wrong because using a larger agent may not reduce build time if the bottleneck is network or I/O. Option C is wrong because running all commands in a single layer reduces layers but does not significantly reduce build time. Option E is wrong because skipping security scanning does not reduce build time.

Answer

Combine multiple RUN commands into a single RUN instruction to reduce layers.

Answer

Disable security scanning for the image.

Answer

Use a larger build agent with more CPU cores.

Question 6

Which THREE of the following are true about GitHub Actions self-hosted runners?

Accepted Answer

They can have custom software installed.. Option A is correct because GitHub Actions self-hosted runners are machines you manage, allowing you to install any custom software, libraries, or tools required by your workflows. Unlike GitHub-hosted runners, which have a fixed set of pre-installed software, self-hosted runners give you full administrative control over the environment, enabling you to meet specific build or test dependencies.

Answer

They are automatically scaled by GitHub.

Answer

They are free and do not incur any costs.

Question 7

You are implementing a release pipeline with multiple stages. You want to automatically trigger the next stage only if the previous stage succeeds and the build is from the 'main' branch. Which TWO conditions should you configure?

Accepted Answer

Add a condition that checks if the source branch is 'main'.. Options A and D are correct. Option A ensures the stage runs after the previous stage succeeds. Option D ensures the build is from main branch. Option B is wrong because it does not check main branch. Option C is wrong because it does not check stage success. Option E is wrong because 'eq(variables['Build.SourceBranch'], 'refs/heads/main')' is the correct syntax, not 'main' without refs/heads.

Answer

Add a condition: 'eq(variables['Build.SourceBranch'], 'main')' to the stage.

Answer

Add a condition: 'succeeded()' to the stage.

Answer

Add a condition: 'eq(variables['Build.SourceBranch'], 'main')' with correct syntax.

Question 8

You are designing a build pipeline for a Node.js application. The team wants to ensure that the pipeline runs unit tests and publishes test results to Azure DevOps. Which task should you add to the pipeline?

Accepted Answer

Publish Test Results task. The 'Publish Test Results' task is specifically designed to publish test results in formats like JUnit, NUnit, etc., to Azure DevOps. Option A is wrong because 'npm test' only runs tests but doesn't publish results. Option B is wrong because 'Copy Files' only copies files. Option D is wrong because 'Publish Build Artifacts' publishes build outputs, not test results.

Answer

Copy Files task

Answer

npm test

Answer

Publish Build Artifacts task

Question 9

Your release pipeline deploys to multiple environments sequentially. The deployment to production fails intermittently due to a database schema migration issue. You need to implement a strategy that automatically rolls back the deployment if the migration fails. What should you do?

Accepted Answer

Add a post-deployment script that runs a rollback script on failure.. Approval gates only pause deployment; they don't roll back. Pre-deployment conditions can check conditions but not automatically roll back. Rollback scripts in the pipeline can reverse changes if a failure is detected. Using multiple stages doesn't automatically roll back; it just defines stages.

Answer

Enable 'Auto-rollback' in the release pipeline settings.

Answer

Use a multi-stage YAML pipeline with manual intervention.

Answer

Configure pre-deployment approval gates.

Question 10

You are designing a build pipeline that uses Microsoft-hosted agents. The pipeline must build a .NET Framework 4.8 application and run on a Windows agent. Due to compliance, the build must use a specific version of Visual Studio that is not pre-installed on the Microsoft-hosted agents. What should you do?

Accepted Answer

Use a self-hosted agent that has the required version of Visual Studio installed.. The only way to ensure a specific version of Visual Studio is to use a self-hosted agent with that version installed. Microsoft-hosted agents have pre-installed software but you cannot customize them to add a specific version not available. Using a Docker container with the required version is a valid approach but requires a self-hosted agent to run the container. Building with MSBuild alone might not work if the project depends on Visual Studio components.

Answer

Build the application inside a Docker container that includes the required Visual Studio version.

Answer

Specify the 'vsVersion' parameter in the MSBuild task to target the required version.

Answer

Use the 'Visual Studio Test Platform Installer' task to install the required version at build time.

Question 11

Your team uses GitHub for source control and Azure Pipelines for CI/CD. You need to ensure that only pull requests from specific branches trigger a build pipeline. Which trigger configuration should you use?

Accepted Answer

pr:
  branches:
    include:
      - main
      - develop. In Azure Pipelines, you can specify branch filters for PR triggers using 'pr:' with 'branches:' and 'include:' to list the branches. Option A is correct. Option B is wrong because 'trigger:' is for CI triggers, not PR triggers. Option C is wrong because the syntax is incorrect. Option D is wrong because 'paths:' filters changes to specific files, not branches.

Answer

pr:
  paths:
    include:
      - main
      - develop

Answer

pr:
  branches:
    only:
      - main

Answer

trigger:
  branches:
    include:
      - main
      - develop

Question 12

You are implementing a release pipeline that deploys a web app to Azure App Service. The deployment must be approved by a manager before proceeding to the production slot. However, the manager is on leave and the deployment is critical. What should you do to ensure the deployment can proceed without delaying the release?

Accepted Answer

Add an additional approver in the pre-deployment approval settings.. The best practice is to have a backup approver or a temporary override process, but since the question asks what you should do, setting up a timeout that auto-approves after a period is not secure. The correct approach is to add an additional approver (the manager's backup) in the approval settings. Skipping approval violates compliance. Changing the pipeline permanently removes approval for future releases.

Answer

Skip the approval for this deployment by overriding the settings.

Answer

Configure the approval to time out after 24 hours and automatically approve.

Answer

Remove the approval requirement from the pipeline.

Question 13

Your organization uses GitHub Actions for CI/CD. You want to ensure that the workflow runs only when a pull request is labeled 'safe-to-deploy'. Which trigger should you use?

Accepted Answer

on:
  pull_request:
    types: [labeled]
    branches: [main]. GitHub Actions supports 'pull_request' triggers with 'types' to filter on specific actions, but labeling is not a pull_request type event; it's an 'issues' or 'pull_request' event with 'labeled' type. Option A is correct. Option B is wrong because 'pull_request_target' is similar but has different security implications; it still requires correct event types. Option C is wrong because 'issue_comment' triggers on comments, not labels. Option D is wrong because 'workflow_run' triggers on completion of another workflow.

Answer

on:
  workflow_run:
    workflows: ["Build"]
    types: [completed]

Answer

on:
  issue_comment:
    types: [created]

Answer

on:
  pull_request_target:
    types: [opened, synchronize]
    branches: [main]

Question 14

You are configuring a multi-stage YAML pipeline that builds a .NET Core application and deploys it to Azure Kubernetes Service (AKS). The build stage produces a container image that is pushed to Azure Container Registry (ACR). The deploy stage needs to use the image from ACR. How should you pass the image tag from the build stage to the deploy stage?

Accepted Answer

Use the 'stageDependencies' syntax to retrieve the output variable of a job in the build stage.. The recommended way to pass variables between stages is to use 'stageDependencies' to access the output of a previous job. Option A is correct. Option B is wrong because pipeline variables defined at the top scope are not automatically available to subsequent stages unless explicitly output. Option C is wrong because build artifacts are for files, not variables. Option D is wrong because the ACR task does not automatically set a variable for the image tag.

Answer

Write the image tag to a file and publish it as a build artifact, then read it in the deploy stage.

Answer

Define a pipeline variable at the top level and set it in the build stage.

Answer

Use the 'Azure CLI' task in the deploy stage to query the ACR for the latest image tag.

Question 15

Which TWO actions should you take to implement a secure build pipeline that uses Azure Key Vault to store secrets? (Choose two.)

Accepted Answer

Grant the Azure DevOps service principal 'Get' and 'List' permissions on the Key Vault.. To securely use secrets from Azure Key Vault, you should grant the build service principal access to the vault (A) and use the 'Azure Key Vault' task to download secrets as variables (D). Option B is wrong because checking in secrets to the repository defeats the purpose of Key Vault. Option C is wrong because secrets should be stored in Key Vault, not as pipeline variables. Option E is wrong because the Key Vault task can directly retrieve secrets without using the Azure CLI.

Answer

Store the Key Vault name and secret names in a secure file in the repository.

Answer

Define secrets as pipeline variables and mark them as secret.

Answer

Use the 'Azure CLI' task to run 'az keyvault secret show' for each secret.