AZ-400 Design and implement build and release pipelines Practice Test 15 — 15 Questions

Question 1

You are configuring a multi-stage YAML pipeline that builds a .NET Core application and deploys it to Azure Kubernetes Service (AKS). The build stage produces a container image that is pushed to Azure Container Registry (ACR). The deploy stage needs to use the image from ACR. How should you pass the image tag from the build stage to the deploy stage?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the 'stageDependencies' syntax to retrieve the output variable of a job in the build stage.. Azure DevOps supports cross-stage output variables, allowing a job in the build stage to set a variable (e.g., imageTag) that can be consumed in the deploy stage using the stageDependencies syntax. This avoids the overhead of artifacts or external queries and ensures the exact tag produced during the build is used in deployment.

Answer

Write the image tag to a file and publish it as a build artifact, then read it in the deploy stage.

Answer

Define a pipeline variable at the top level and set it in the build stage.

Answer

Use the 'Azure CLI' task in the deploy stage to query the ACR for the latest image tag.

Question 2

Which TWO actions should you take to implement a secure build pipeline that uses Azure Key Vault to store secrets? (Choose two.)

Accepted Answer

Grant the Azure DevOps service principal 'Get' and 'List' permissions on the Key Vault.. The Azure DevOps service principal (the identity used by Azure Pipelines) must be granted 'Get' and 'List' permissions on the Key Vault's access policy. This allows the pipeline to retrieve secret values securely without storing credentials in the repository or pipeline configuration. Without these permissions, any attempt to read secrets from the vault will fail with an authorization error.

Answer

Store the Key Vault name and secret names in a secure file in the repository.

Answer

Define secrets as pipeline variables and mark them as secret.

Answer

Use the 'Azure CLI' task to run 'az keyvault secret show' for each secret.

Question 3

Which THREE options are valid strategies to reduce build times in Azure Pipelines? (Choose three.)

Accepted Answer

Enable incremental builds by using the 'Clean: false' option.. Setting 'Clean: false' enables incremental builds by retaining the workspace from the previous run. This means only changed files are rebuilt, significantly reducing build time by avoiding a full clean checkout and rebuild of unchanged code.

Answer

Break the pipeline into multiple stages running sequentially.

Answer

Increase the number of parallel jobs in the pipeline.

Question 4

Which TWO conditions should you configure in a release pipeline to ensure that a deployment to production only happens when both the staging deployment succeeded and a manual approval is granted? (Choose two.)

Accepted Answer

Add a pre-deployment approval on the production stage.. To ensure release to production only after staging success and manual approval, you need a pre-deployment approval on the production stage (B) for the manual approval, and a pre-deployment gate on production that checks that the staging deployment succeeded (E). A gate is a valid condition that verifies the required state before deployment. Option D, the deployment queue setting 'After previous deployment', only controls concurrency of the same stage and does not create a dependency on the staging stage, so it does not ensure staging succeeded.

Answer

Add a post-deployment approval on the staging stage.

Answer

Set the trigger to 'After release' and filter by artifact.

Answer

Set the deployment queue setting to 'After previous deployment' for the production stage.

Question 5

Which THREE steps should you take to implement a blue-green deployment strategy for an Azure App Service using Azure Pipelines? (Choose three.)

Accepted Answer

Create a deployment slot named 'staging' for the App Service.. In a blue-green deployment for Azure App Service using Azure Pipelines, the three key steps are: create a staging deployment slot (A), enable 'Auto swap' on the staging slot (B), and deploy the new version to the staging slot (C). Auto-swap ensures that after the new version is deployed and validated, the staging slot automatically swaps with the production slot, enabling zero-downtime updates. Option D (deleting the production slot after swapping) is incorrect because the production slot continues to hold the previous version for potential rollback. Option E (routing 100% of traffic to the staging slot) is incorrect because traffic routing is handled by the swap operation, not by manually directing traffic.

Answer

Delete the production slot after swapping.

Answer

Route 100% of traffic to the staging slot.

Question 6

You are creating a release pipeline that deploys to Azure App Service. You want to ensure that the deployment uses the 'Run from package' feature for faster deployments and reduced downtime. Which deployment method should you select in the 'Azure App Service deploy' task?

Accepted Answer

RunFromPackage. The 'Run from package' feature deploys your app as a zip package directly to Azure App Service, bypassing the file copy and compilation steps of traditional methods. This reduces deployment time and downtime because the app runs from the package without extracting it to the wwwroot folder. Selecting 'RunFromPackage' in the Azure App Service deploy task enables this behavior by setting the WEBSITE_RUN_FROM_PACKAGE app setting to 1.

Answer

Web Deploy

Answer

Container

Answer

Zip Deploy

Question 7

Your organization uses GitHub Actions for CI/CD. You want to enforce that all workflows pass required checks before a pull request can be merged. The repository is in an organization that uses GitHub Enterprise Cloud. What should you configure?

Accepted Answer

Add a branch protection rule that requires status checks to pass.. Branch protection rules in GitHub Enterprise Cloud allow you to require status checks to pass before merging a pull request. By configuring a branch protection rule on the target branch (e.g., main) and selecting the specific GitHub Actions workflow status checks that must succeed, you enforce that all required CI/CD checks pass before a merge is allowed. This directly meets the requirement to enforce workflow checks on pull requests.

Answer

Enable 'Require approval for all workflows' in the organization settings.

Answer

Set the workflow to be required in the 'Require status check' settings of each pull request.

Answer

Create a repository ruleset that requires linear history.

Question 8

Your team uses Azure Pipelines to build a .NET application. Recently, builds have been failing intermittently with NuGet restore errors. The pipeline uses a hosted agent. You need to ensure consistent package restoration. What should you do?

Accepted Answer

Use a self-hosted agent with persistent NuGet package caches.. Using a self-hosted agent with persistent NuGet package caches ensures that packages are not re-downloaded on each build, avoiding intermittent network failures. Option B would clear the cache and force re-download, worsening the issue. Option C is for Docker builds, not NuGet. Option D is unrelated to package restoration.

Answer

Clear the NuGet cache in the pipeline using 'dotnet nuget locals all --clear' before restore.

Answer

Enable multi-stage Docker builds for the application.

Answer

Configure the pipeline to use the Dapr sidecar for package management.

Question 9

Your organization is adopting GitHub Actions for CI/CD. You need to enforce that all workflows must pass required status checks before merging pull requests to the main branch. The repository is in an organization. What should you configure?

Accepted Answer

Create a branch protection rule for the main branch with required status checks.. Branch protection rules in GitHub allow you to enforce required status checks on pull requests before merging. By configuring a branch protection rule for the main branch, you can specify that certain GitHub Actions workflow runs must pass (e.g., CI checks) before a pull request can be merged. This directly enforces the policy that all workflows must pass required status checks.

Answer

Add an environment protection rule requiring approval from specific reviewers.

Answer

Set the workflow to have 'contents: write' permission.

Answer

Define a CODEOWNERS file that requires team review for main branch changes.

Question 10

You are designing a release pipeline for a mission-critical application. The pipeline must deploy to multiple environments (dev, test, prod) in sequence, with manual approval required before production deployment. Which Azure Pipelines feature should you use?

Accepted Answer

Pre-deployment approvals. Pre-deployment approvals are the correct feature because they allow you to require manual sign-off before a release proceeds to a specific stage. In this scenario, you need a manual approval gate before production deployment, which is exactly what pre-deployment approvals enforce—the release pauses at the production stage until an authorized user approves it.

Answer

Variable groups

Answer

Pipeline triggers

Answer

Deployment gates

Question 11

Your Azure Pipelines build is failing with the error: '##[error]No agent found in pool 'Default' that satisfies the specified demands: Agent.Version -gtVersion 2.200.0'. The pool 'Default' contains agents of various versions. What is the most likely cause?

Accepted Answer

The 'Default' agent pool has no agents with version greater than 2.200.0.. The error message explicitly states that no agent in the 'Default' pool satisfies the demand 'Agent.Version -gtVersion 2.200.0'. Since the pool contains agents of various versions, the most likely cause is that none of those agents have a version greater than 2.200.0. This demand is set in the pipeline YAML or classic editor to ensure the agent meets a minimum version requirement.

Answer

The pipeline YAML has a syntax error in the 'demands' section.

Answer

The pipeline is configured to run on an agentless job.

Answer

The 'demands' keyword is not supported in Azure Pipelines.

Question 12

You are implementing a CI pipeline for a Node.js application. The pipeline must run unit tests and generate code coverage reports. You want to publish the coverage results to Azure DevOps and enforce a minimum coverage threshold of 80%. Which tasks should you use?

Accepted Answer

Use the Publish Code Coverage Results task and configure the threshold in the task settings.. The Publish Code Coverage Results task is specifically designed to publish code coverage data (e.g., Cobertura or JaCoCo XML reports) to Azure DevOps and supports configuring a minimum coverage threshold directly in its settings. This meets both requirements: publishing results and enforcing the 80% threshold. Other tasks like Publish Test Results or Publish Build Artifacts do not natively handle coverage threshold enforcement.

Answer

Use the Publish Test Results task to publish coverage data.

Answer

Use the Publish Build Artifacts task with coverage files.

Answer

Use the Copy Files task to copy coverage files and then the Publish Build Artifacts task.

Question 13

Your team is using GitHub Actions to deploy a containerized application to Azure Kubernetes Service (AKS). You need to securely authenticate the workflow to AKS without storing credentials in the repository. What should you use?

Accepted Answer

Use OpenID Connect (OIDC) with a federated identity credential.. OpenID Connect (OIDC) allows GitHub Actions to exchange a short-lived token for Azure credentials using a federated identity credential, eliminating the need to store any long-lived secrets in the repository. This is the recommended approach for secure, passwordless authentication to Azure services, including AKS, because it uses token-based authentication that automatically rotates and is scoped to specific workflows.

Answer

Use the GITHUB_TOKEN to authenticate to Azure.

Answer

Use an SSH deploy key to authenticate to AKS.

Answer

Store an Azure service principal password as a GitHub secret.

Question 14

You are designing a build pipeline that must be triggered only when changes are made to specific folders in the repository. The pipeline should ignore documentation changes. Which trigger configuration should you use?

Accepted Answer

Configure a path trigger with include paths for source code and exclude paths for docs.. Azure Pipelines path triggers allow you to specify include and exclude filters on file paths. By including only source code folders and excluding the docs folder, the pipeline will only run when relevant code changes are made, ignoring documentation updates.

Answer

Configure a scheduled trigger to run the pipeline daily.

Answer

Configure a branch trigger with an include filter for the main branch.

Answer

Configure a tag trigger with a pattern that matches release tags.

Question 15

Your release pipeline deploys to multiple Azure regions. You need to ensure that if a deployment to one region fails, the pipeline continues deploying to other regions. Which deployment strategy should you use?

Accepted Answer

Rolling deployment. Rolling deployment updates instances gradually across regions. If a deployment to one region fails, the pipeline can continue deploying to other regions because each region is updated independently. Option A (immutable deployment) replaces all instances at once, so a failure would halt the entire deployment. Option C (blue-green) switches all traffic to a new environment; if that environment fails, the whole deployment fails. Option D (canary) routes a small percentage of traffic to a new version and rolls back if issues occur, but it does not ensure continued deployment to other regions upon failure.

Answer

Immutable deployment

Answer

Blue-green deployment

Answer

Canary deployment