AZ-400 Design and implement build and release pipelines Practice Test 16 — 15 Questions

Question 1

Which THREE components are essential for implementing a canary deployment strategy using Azure Kubernetes Service (AKS) and Azure Pipelines? (Choose three.)

Accepted Answer

A service mesh like Istio or Linkerd for traffic splitting.. Options A, C, and D are correct. Option A: A service mesh (e.g., Istio, Linkerd) enables traffic splitting between canary and stable versions. Option C: Multiple Kubernetes namespaces help isolate environments. Option D: A health check endpoint is necessary to validate the canary before routing more traffic. Option B is wrong because Azure Traffic Manager is for global traffic routing, not within a cluster. Option E is wrong because Azure Front Door is for HTTP(S) load balancing at the edge, not for in-cluster traffic splitting.

Answer

Azure Traffic Manager for global load balancing.

Answer

Azure Front Door for routing traffic to the canary.

Question 2

Which TWO practices help improve the security of container images in a CI/CD pipeline? (Choose two.)

Accepted Answer

Sign container images to verify their integrity.. Options A and D are correct. Option A: Scanning images for vulnerabilities as part of the build process helps catch issues early. Option D: Using signed images ensures integrity and trust. Option B is wrong because using the 'latest' tag can lead to unpredictable updates; pinning to specific versions is more secure. Option C is wrong because storing images in a public registry exposes them to potential attacks; private registries are more secure. Option E is wrong because running containers as root is a security risk.

Answer

Run containers with root privileges to avoid permission issues.

Answer

Store container images in a public registry for easy access.

Answer

Use the 'latest' tag for base images to always get the newest patches.

Question 3

Your team uses Azure DevOps to deploy a Node.js web app to Azure App Service on Linux. The build pipeline runs `npm install` and `npm run build`, then publishes the `dist` folder. The release pipeline uses the 'Azure App Service deploy' task. Recently, deployments fail intermittently with 'ERR_MODULE_NOT_FOUND' for a custom module. The module is listed in `package.json` and is present in the `node_modules` folder on the build agent. What is the most likely cause?

Accepted Answer

The build artifact does not include node_modules; the app requires them at runtime.. Option B is correct because the App Service on Linux runs the app directly from the `dist` folder, but the `node_modules` folder is not included in the published artifact since only the `dist` folder is published. Hence, modules outside `dist` are missing. Option A is wrong because the task does not modify `package.json`. Option C is wrong because Kudu syncs all files, but the root issue is missing modules. Option D is wrong because the task does not run `npm install` by default.

Answer

The 'Azure App Service deploy' task modifies package.json during deployment.

Answer

The 'Azure App Service deploy' task runs npm install on the target, but it fails due to network restrictions.

Answer

The deployment slot's Kudu service fails to sync the dist folder.

Question 4

You are designing a multi-stage YAML pipeline for a .NET Core application. The pipeline must build, test, and deploy to a staging environment. You want to ensure that the deployment stage only runs if the build and test stages succeed, and that the staging deployment uses the exact same bits that were built. Which strategy should you use?

Accepted Answer

Create separate stages for build, test, and deploy. Use the 'dependsOn' keyword and publish artifact in build stage, download in deploy stage.. Option B is correct because using pipeline artifacts with dependency on build stage ensures the deployment uses the exact build output from the previous successful stage. Option A is wrong because the standard YAML template doesn't automatically share artifacts. Option C is wrong because triggers would not enforce stage dependency. Option D is wrong because manual intervention requires human approval, not automatic dependency.

Answer

Set up a release pipeline that uses the same build artifact and requires manual approval.

Answer

Use a build trigger on the staging branch to deploy after each commit, ignoring test results.

Answer

Define the pipeline with a single stage and use a condition to skip test on failure.

Question 5

Your build pipeline for a Java application uses Maven. You need to run unit tests and integration tests separately. Unit tests should run on every commit, while integration tests should run only when the build is triggered by a pull request to the main branch. How should you configure the pipeline?

Accepted Answer

Create two jobs: one with unit tests (always), one with integration tests conditioned on 'eq(variables['Build.Reason'], 'PullRequest')'.. Option C is correct because using two jobs with different conditions allows selective execution. Option A is wrong because the same condition applies to all steps. Option B is wrong because stages run sequentially, not conditionally. Option D is wrong because 'always()' would run both jobs regardless.

Answer

Add both test types as steps in the same job and use a step condition.

Answer

Create two separate stages: one for unit tests, one for integration tests.

Answer

Use a single job with both tests, but set the 'always()' condition on the integration test step.

Question 6

You are implementing a build pipeline for a .NET application that uses GitHub Advanced Security (GHAS) for code scanning. The pipeline must run CodeQL analysis on every pull request to the main branch. You have added the CodeQL task to the pipeline. However, the analysis results are not appearing in the 'Security' tab of the repository on GitHub. What is the most likely cause?

Accepted Answer

The pipeline is missing the 'Publish Security Analysis Logs' step to upload SARIF results to GitHub.. Option D is correct because CodeQL results are uploaded as SARIF files, and the 'CodeQL Analysis' task includes an option to upload results to GitHub. If that step is omitted or fails, results won't appear. Option A is wrong because CodeQL supports pull request analysis. Option B is wrong because CodeQL works with .NET. Option C is wrong because GitHub Advanced Security is available even in private repos.

Answer

The GitHub repository is private, so security alerts are disabled.

Answer

The .NET project is not supported by CodeQL.

Answer

CodeQL analysis is not supported on pull request triggers.

Question 7

Your team uses Azure Pipelines to deploy a Docker container to Azure Kubernetes Service (AKS). The pipeline builds a Docker image, pushes it to Azure Container Registry (ACR), and then runs a deployment to AKS. You want to ensure that the deployment uses the exact image that was built in the same pipeline run. Which approach should you use?

Accepted Answer

Generate a unique tag (e.g., Build.BuildId) and pass it to both the Docker build and Kubernetes manifest via variable substitution.. Option C is correct because using a manifest file with build-specific variables ensures the correct image tag is used. Option A is wrong because 'latest' tag can be overwritten. Option B is wrong because the ACR task can be reused. Option D is wrong because separate pipelines may have different image builds.

Answer

Use two separate pipelines: one for build/push, one for deploy, and share the image tag via a variable group.

Answer

Use a single task for build and push, and rely on ACR's internal pull-through cache.

Answer

Tag the image as 'latest' and reference it in the Kubernetes manifest.

Question 8

You are setting up a release pipeline for a web application. The pipeline must deploy to three environments: Dev, Test, and Prod. The deployment to Prod must be triggered only after a successful deployment to Test and after a manual approval. How should you configure the pipeline?

Accepted Answer

Add a pre-deployment approval gate on the Prod environment.. Option A is correct because pre-deployment approvals on the Prod stage ensure manual approval before deployment. Option B is wrong because a separate manual task would not block the pipeline. Option C is wrong because conditions alone don't enforce manual approval. Option D is wrong because schedule ignores approval.

Answer

Add a manual intervention task before the Prod deployment in the pipeline.

Answer

Use a condition on the Prod stage to require success from Test and manual intervention variable.

Answer

Schedule the Prod deployment to run after Test, and require manual trigger.

Question 9

Your organization uses GitHub Actions for CI/CD. You have a workflow that builds a .NET application and runs tests. The workflow uses a self-hosted runner on an on-premises Windows server. Recently, builds started failing with 'Access to the path is denied' errors when the runner tries to restore NuGet packages. The runner has been working for months. What is the most likely cause?

Accepted Answer

The runner service account's permissions have changed, and it no longer has write access to the working directory or cache.. Option C is correct because the runner service runs under a specific account, and if that account's permissions changed (e.g., password reset, group membership changed), it may lose access to the NuGet cache directory. Option A is wrong because the runner doesn't need to authenticate to GitHub for NuGet restore. Option B is wrong because network issues would cause different errors. Option D is wrong because the runner itself doesn't install NuGet packages; it uses dotnet restore.

Answer

The runner's authentication token to GitHub has expired.

Answer

The NuGet cache directory on the runner has been deleted.

Answer

The runner has been updated to a newer version that no longer supports NuGet restore.

Question 10

You are designing a build pipeline for a Python application that uses Anaconda environments. The pipeline must create a Conda environment, install dependencies, and run tests. The pipeline should also cache the Conda environment to speed up subsequent builds. Which configuration should you use?

Accepted Answer

Use the 'CondaEnvironment' task to create the environment, and use the 'Cache' task to cache the Conda packages folder.. Option B is correct because the 'UsePythonVersion' task can set up Python, but not Conda environments. The 'CondaEnvironment' task manages Conda environments and can be combined with caching. Option A is wrong because 'UsePythonVersion' doesn't handle Conda. Option C is wrong because script alone doesn't leverage built-in caching. Option D is wrong because Docker is unnecessary overhead.

Answer

Use the 'UsePythonVersion' task with a version spec, and add a script to create the Conda environment.

Answer

Use a Docker container with Anaconda pre-installed and run the pipeline inside the container.

Answer

Use a script to run 'conda create' and 'conda install', and manually cache the environment by specifying a path.

Question 11

Which TWO actions are required to securely use Azure Key Vault secrets in an Azure Pipelines build? (Choose 2)

Accepted Answer

Use the 'Azure Key Vault' task to download secrets as pipeline variables.. Options A and C are correct. A: The pipeline must have access to the Key Vault via a service connection with Get and List permissions. C: The pipeline can use the 'Azure Key Vault' task to download secrets as pipeline variables, or reference them via variable groups linked to Key Vault. Option B is wrong because secrets are not passed as environment variables by default. Option D is wrong because secrets are not exposed in logs by default; masking is automatic. Option E is wrong because the secret identifier can be used directly.

Answer

Set the 'secrets' output variable to 'true' in the pipeline.

Answer

Use the 'Environment Variables' section in the pipeline to map secrets.

Answer

Reference the secret identifier directly in the pipeline YAML.

Question 12

Which TWO are valid strategies to reduce build times in Azure Pipelines? (Choose 2)

Accepted Answer

Use the Cache task to cache NuGet packages or npm modules.. Options A and D are correct. A: Incremental builds only compile changed files, reducing build time. D: Using the Cache task for package dependencies avoids re-downloading. Option B is wrong because more agents increase parallelism but not per-build time. Option C is wrong because the 'dotnet build' command with '--no-restore' skips restore but doesn't reduce build time if restore is already cached; however, it saves time if restore is already done. But the question asks for strategies to reduce build times; incremental builds and caching are direct strategies. Option E is wrong because increasing timeout doesn't reduce build time.

Answer

Use 'dotnet build --no-restore' to skip restore.

Answer

Use a larger agent pool with more parallel jobs.

Answer

Increase the build job timeout.

Question 13

Which THREE are true about using deployment groups in Azure Pipelines? (Choose 3)

Accepted Answer

Each machine in a deployment group must have the Azure Pipelines agent installed.. Options A, C, and D are correct. A: Deployment groups are used to target multiple machines for rolling deployments. C: Each machine in a deployment group runs an agent that listens for jobs. D: Deployment groups can be used in release pipelines with the 'Deployment group' phase. Option B is wrong because deployment groups are not limited to Windows; they support Linux, macOS, etc. Option E is wrong because deployment groups are not environment-specific; environments are a separate concept.

Answer

Deployment groups can only be used with Windows-based machines.

Answer

Deployment groups are tied to a specific environment.

Question 14

Your team uses GitHub Actions to build and deploy a static website to Azure Storage. The workflow uses the 'azure/webapps-deploy' action to deploy to a storage account static website. Recently, deployments started failing with 'Error: Failed to get credentials'. The workflow uses OpenID Connect (OIDC) for authentication. What is the most likely cause?

Accepted Answer

The service principal used for OIDC does not have the 'Storage Blob Data Contributor' role on the storage account.. Option A is correct because OIDC authentication requires the Azure AD application (service principal) to have the appropriate role assignment on the target resource (storage account). If the role assignment is missing, the OIDC token exchange fails. Option B is wrong because OIDC does not require client secret. Option C is wrong because the action works with static websites. Option D is wrong because the issue is not network-related.

Answer

The storage account firewall is blocking the GitHub Actions IP range.

Answer

The OIDC configuration in GitHub is missing the 'client secret' field.

Answer

The 'azure/webapps-deploy' action does not support static websites.

Question 15

Your team uses Azure Pipelines for CI/CD. A release pipeline fails intermittently during deployment to an Azure App Service slot. The error message indicates 'Failed to fetch access token for Azure Resource Manager service endpoint.' The service principal used has been granted Contributor role on the resource group. The issue resolves after re-creating the service connection in Azure DevOps. What is the most likely cause?

Accepted Answer

The service principal client secret has expired.. Option A is correct because service principal credentials (client secret) can expire, causing intermittent token fetch failures. Re-creating the service connection generates a new secret, temporarily resolving the issue until it expires again. Option B is wrong because RBAC permissions do not affect token acquisition from Entra ID. Option C is wrong because network restrictions would cause consistent failure, not intermittent. Option D is wrong because the service connection is specific to the service principal, not user credentials.

Answer

The user who created the service connection has been removed from Azure DevOps.

Answer

The Azure DevOps organization is behind a firewall that blocks outbound requests to Azure Resource Manager.

Answer

The service principal lacks the required role on the target resource group.