AZ-400 Design and implement build and release pipelines Practice Test 16 — 15 Questions

Question 1

You need to automatically run a security scan on every pull request in GitHub. The scan should block the PR if critical vulnerabilities are found. Which GitHub feature should you use?

Accepted Answer

GitHub Code Scanning with a CodeQL workflow. GitHub Code Scanning with a CodeQL workflow is the correct choice because it allows you to define a custom security analysis that runs on every pull request. By configuring the workflow to fail on critical-severity alerts, the pull request is automatically blocked, preventing vulnerable code from being merged. This integrates directly with GitHub's checks API to enforce the scan result as a required status check.

Answer

Dependabot version updates

Answer

Secret scanning

Answer

Branch protection rules with required status checks

Question 2

Which TWO are valid ways to pass build artifacts from one stage to another in a multi-stage YAML pipeline in Azure Pipelines?

Accepted Answer

Use the Publish Pipeline Artifact task in the first stage and Download Pipeline Artifact task in the second stage.. The Publish Pipeline Artifact task in the first stage makes the artifact available to the pipeline, and the Download Pipeline Artifact task in the second stage explicitly retrieves it. This is the standard, supported method for passing artifacts between stages in a multi-stage YAML pipeline. Option D is also correct because the Copy Files task can copy artifacts to a shared network drive accessible by subsequent stages, which is a valid alternative method. Options A and C are incorrect: A is wrong because published pipeline artifacts are not automatically available without a download task; C is wrong because the Publish/Download Build Artifacts tasks are legacy and not the recommended way for multi-stage YAML pipelines, and they do not work seamlessly across stages without additional configuration.

Answer

Use the Pipeline Artifact task to publish artifacts, which are automatically available to subsequent stages without download.

Answer

Use the Publish Build Artifacts task and then the Download Build Artifacts task.

Answer

Define variables in the first stage and reference them in the second stage.

Question 3

Which TWO are valid strategies for managing secrets in a GitHub Actions workflow?

Accepted Answer

Use OpenID Connect to authenticate to Azure without storing any credentials.. OpenID Connect (OIDC) allows GitHub Actions to exchange a short-lived token directly with Azure without storing any long-lived credentials as secrets. This eliminates the need to manage and rotate client secrets or service principal passwords, reducing the risk of credential leakage. The workflow uses the `azure/login` action with `client-id`, `tenant-id`, and `subscription-id` parameters, and Azure trusts the OIDC token issued by GitHub. Alternatively, storing the secret as an encrypted GitHub secret is also a valid strategy: GitHub encrypts secrets at rest and injects them into the workflow runtime only when referenced via `${{ secrets.SECRET_NAME }}`. This prevents hardcoding secrets in the YAML and keeps them out of logs, though it still requires managing the secret value and rotation.

Answer

Hardcode the secret in the YAML file.

Answer

Set the secret as an environment variable in the runner's shell profile.

Answer

Base64-encode the secret and include it directly in the workflow file.

Question 4

Refer to the exhibit. You are deploying this ARM template using Azure Pipelines. The pipeline passes the parameter 'environmentName' with value 'prod'. What will be the name of the virtual network?

Accepted Answer

vnet-prod. The ARM template uses the `concat` function to combine the string 'vnet-' with the value of the `environmentName` parameter. Since the pipeline passes 'prod' for `environmentName`, the resulting virtual network name is 'vnet-prod'. This is a standard pattern for parameterizing resource names in Azure Resource Manager templates.

Answer

vnet-default

Answer

vnet-prod-vnet

Answer

vnet-dev

Question 5

Refer to the exhibit. A developer creates a pull request from a branch called 'feature/update'. The workflow runs on the pull_request event. What will the output of this workflow be?

Accepted Answer

The workflow will run and output 'Running PR tests'.. The workflow is triggered on the `pull_request` event, which fires for any pull request regardless of the source branch name. The condition `github.event_name == 'pull_request'` evaluates to `true` because the event is indeed a pull_request. Therefore, the `if` condition passes, and the step runs, outputting 'Running PR tests'.

Answer

The workflow will not run because the branch is not 'main'.

Answer

The workflow will run but output nothing because the condition fails.

Answer

The workflow will fail due to a syntax error in the conditional expression.

Question 6

A team uses Azure Pipelines to build a .NET application. The build takes 30 minutes, and developers complain that the pipeline runs slowly. The pipeline uses the 'windows-latest' agent and installs the .NET SDK in each run. Which action would MOST reduce the build time?

Accepted Answer

Enable pipeline caching for the .NET SDK.. Enabling pipeline caching for the .NET SDK allows the SDK to be restored from a cache instead of being downloaded and installed on every run. This eliminates the recurring overhead of SDK installation, which is a significant portion of the 30-minute build time, directly addressing the slow pipeline complaint.

Answer

Deploy a self-hosted agent in Azure.

Answer

Increase the number of parallel jobs.

Answer

Change the agent pool to 'ubuntu-latest'.

Question 7

Your release pipeline deploys to Azure App Service using a deployment slot strategy. After a successful deployment to the staging slot, you run smoke tests, then swap slots. Recently, a swap failed because the staging slot had an incorrect application setting. What is the BEST way to prevent this issue?

Accepted Answer

Mark the application setting as a deployment slot setting.. Marking the application setting as a deployment slot setting ensures that the setting stays with the slot and is not swapped between staging and production. This prevents the staging slot from having an incorrect value that could cause a swap failure, as the setting is pinned to the slot and not part of the swap payload.

Answer

Use a manual approval gate before swap.

Answer

Configure the App Service deployment center.

Answer

Add a task to verify settings before swap.

Question 8

You are designing a build pipeline for a Python application that uses multiple external packages from PyPI. You want to ensure that builds are reproducible and not affected by package updates. Which strategy should you use?

Accepted Answer

Pin exact versions in requirements.txt.. Pinning exact versions in requirements.txt ensures that the same package versions are installed every time, making builds reproducible. Option A is wrong because while Pipfile.lock contains exact resolved versions, the Pipfile itself typically uses version ranges; if the lock file is regenerated (e.g., via 'pipenv lock'), it may resolve to different package versions, breaking reproducibility. Option B is wrong: Dependabot is a tool for automated dependency updates, which introduces version changes and thus breaks reproducibility. Option D is wrong because 'pip install <package>' without version specifiers fetches the latest version, causing non-deterministic builds.

Answer

Use a Pipfile and Pipfile.lock without version pinning.

Answer

Use a dependency update tool like Dependabot weekly.

Answer

Use 'pip install <package>' without version specifiers.

Question 9

Your Azure DevOps project uses Git for source control. You want to enforce that all code changes are reviewed before merging into the main branch. Which branch policy should you enable?

Accepted Answer

Require a minimum number of reviewers.. The 'Require a minimum number of reviewers' branch policy ensures that a specified number of reviewers must approve a pull request before it can be merged, directly enforcing code review. Option A is incorrect because 'Allow only comment resolution' pertains to how comments are resolved, not requiring approvals. Option B is incorrect because 'Require a successful build before merging' validates build status but does not enforce review. Option C is incorrect because 'Limit merge types to squash merge' controls the merge strategy, not the review process.

Answer

Allow only comment resolution.

Answer

Require a successful build before merging.

Answer

Limit merge types to squash merge.

Question 10

Your release pipeline uses Azure Kubernetes Service (AKS) and Helm charts. You need to roll back to a previous release quickly if the new release fails health checks. What is the BEST approach?

Accepted Answer

Use Helm rollback command.. Helm provides a built-in `helm rollback ` command that reverts a release to a previous revision in a single, atomic operation. This is the fastest and most reliable method for rolling back a failed Helm-based deployment on AKS, as it directly restores the exact Kubernetes manifests and configuration from the specified revision without manual intervention.

Answer

Manually redeploy the previous Helm chart version.

Answer

Use a canary deployment strategy.

Answer

Use a Kubernetes Deployment rollout undo.

Question 11

You are configuring a build pipeline for a JavaScript application. You want to run linting, unit tests, and build steps only when changes are pushed to the 'develop' branch. Which trigger should you configure?

Accepted Answer

Enable CI trigger with a branch filter for 'develop'.. Enabling a CI trigger with a branch filter for 'develop' ensures that the pipeline automatically runs linting, unit tests, and build steps only when changes are pushed to the 'develop' branch. This matches the requirement precisely, as CI triggers respond to push events, and the branch filter restricts execution to the specified branch.

Answer

Enable pull request trigger.

Answer

Enable scheduled trigger.

Answer

Enable continuous integration (CI) trigger without branch filters.

Question 12

Your build pipeline uses a YAML template to define steps. You want to pass a parameter to the template to conditionally run a task. What syntax should you use in the template?

Accepted Answer

parameters:. The 'parameters' key in a YAML template is used to define parameters that can be passed to the template, allowing conditional execution based on the parameter value. Option B is incorrect: 'arguments' is not a standard YAML key for passing parameters to templates; it is used for specifying script arguments. Option C is incorrect: 'inputs' is used for task inputs within a step, not for template parameters. Option D is incorrect: 'variables' are used to define pipeline variables, not for passing parameters to templates.

Answer

arguments:

Answer

inputs:

Answer

variables:

Question 13

You are designing a release pipeline that deploys to multiple environments (dev, test, prod) sequentially. You need to require manual approval before deploying to prod. The approver should be able to review the changes and approve or reject. Which feature should you use?

Accepted Answer

Pre-deployment conditions.. In Azure DevOps release pipelines, to require manual approval before deploying to a specific stage, you configure the pre-deployment conditions of that stage, specifically assigning pre-deployment approvers. These approvers can review the changes and then approve or reject the deployment. This satisfies the requirement directly.

Answer

Environment checks.

Answer

Approval gates.

Answer

Manual intervention task.

Question 14

Your team uses GitHub Actions for CI/CD. You want to securely store a database connection string used in a workflow. Where should you store it?

Accepted Answer

GitHub Secrets.. GitHub Secrets is the correct choice because it provides encrypted storage for sensitive data like database connection strings. When you store a value in GitHub Secrets, it is encrypted via libsodium before being stored, and it is only exposed to GitHub Actions workflows as an environment variable or input when explicitly referenced. This prevents the secret from being logged or leaked in the workflow output, unlike other storage methods that risk exposure.

Answer

Workflow environment variables.

Answer

Directly in the workflow YAML.

Answer

In a configuration file committed to repo.

Question 15

Which THREE of the following are valid steps to implement a trunk-based development workflow in Azure Repos? (Select THREE.)

Accepted Answer

Run CI builds on the main branch.. Trunk-based development requires developers to integrate into the main branch frequently. In Azure Repos, you set a CI trigger on main so every commit is built and validated (A). Developers use short-lived feature branches that are merged into main within a day (D) to keep integration conflicts small. Feature flags and pair programming are supporting practices that allow work to be integrated even before a feature is complete, avoiding long-running branches (B). Merging to main only once per week (C) contradicts the continuous-integration principle, and creating a release branch for every production release (E) is characteristic of GitFlow/release-flow, not trunk-based development.

Answer

Merge to main only once per week.

Answer

Create release branches for each production release.