AZ-400 Design and implement build and release pipelines Practice Test 17 — 15 Questions

Question 1

You are designing a build pipeline for a Node.js application. The pipeline must run unit tests and publish code coverage results to Azure Pipelines. Which task should you use to ensure coverage results are available in the pipeline summary?

Accepted Answer

PublishCodeCoverageResults@1. Option B is correct because the PublishCodeCoverageResults task consumes coverage data (e.g., Cobertura format) and displays it in the pipeline summary. Option A is wrong because the PublishTestResults task only publishes test results, not coverage. Option C is wrong because the Visual Studio Test task is for .NET, not Node.js. Option D is wrong because the Copy Files task only copies files, it does not process coverage.

Answer

PublishTestResults@2

Answer

VSTest@2

Answer

CopyFiles@2

Question 2

Your pipeline uses a multi-stage YAML file. You want to conditionally run a stage only when the build is triggered from the 'main' branch. Which expression should you use in the 'condition' property of the stage?

Accepted Answer

eq(variables['Build.SourceBranch'], 'refs/heads/main'). Option C is correct because eq(variables['Build.SourceBranch'], 'refs/heads/main') compares the source branch to the main branch. Option A is wrong because 'main' is not a valid branch reference; Azure Pipelines uses 'refs/heads/main'. Option B is wrong because 'Build.SourceBranchName' returns 'main' but comparing to 'refs/heads/main' would fail. Option D is wrong because 'startsWith' might match branches like 'maintenance'.

Answer

startsWith(variables['Build.SourceBranch'], 'main')

Answer

eq(variables['Build.SourceBranchName'], 'refs/heads/main')

Answer

eq(variables['Build.SourceBranch'], 'main')

Question 3

Your release pipeline deploys to multiple environments (Dev, Test, Prod) using approval gates. Recently, the Prod deployment failed because a manual validation task timed out after 30 minutes. You need to ensure that if the manual validation is not approved within 15 minutes, the pipeline automatically rejects the deployment and sends a notification. What should you do?

Accepted Answer

In the Manual Validation task, set 'Timeout' to 15 and 'On timeout' to 'Reject'.. Option D is correct because the Manual Validation task has a 'Timeout' setting; setting it to 15 minutes and configuring the 'On timeout' option to 'Reject' will automatically reject the deployment. Notifications can be set via subscription. Option A is wrong because pre-deployment approvals don't have a timeout that triggers rejection. Option B is wrong because the pipeline-level timeout is not granular enough. Option C is wrong because the 'Cancel' action would cancel the entire pipeline, not just reject the validation.

Answer

Set the 'Timeout in minutes' for the entire stage to 15.

Answer

Configure a pre-deployment approval with a timeout of 15 minutes.

Answer

Add a PowerShell task after the manual validation that checks the status and cancels the pipeline if not approved.

Question 4

Your team uses GitHub Actions for CI/CD. You want to reuse a workflow across multiple repositories without duplicating code. Which approach should you use?

Accepted Answer

Create a reusable workflow in a central repository and reference it using 'uses: owner/repo/.github/workflows/workflow.yml@ref'.. Option D is correct because GitHub Actions supports reusable workflows by using the 'uses' keyword with a path to a workflow file in another repository. Option A is wrong because composite actions are for grouping steps, not entire workflows. Option B is wrong because workflow templates are for creating new workflows from a template, not for reuse. Option C is wrong because environment secrets are for storing secrets, not for reusing workflow logic.

Answer

Store the workflow in a shared repository and use environment secrets to share credentials.

Answer

Create a composite action and reference it from each workflow.

Answer

Create a workflow template in the organization's .github repository.

Question 5

You are setting up a build pipeline for a .NET Core application. The build should run on every pull request to the 'main' branch. Which trigger configuration should you use in the YAML pipeline?

Accepted Answer

pr: branches: include: - main. Option C is correct because 'pr: branches: include: - main' triggers the pipeline on PRs targeting main. Option A is wrong because it uses 'trigger' for CI, not PR triggers. Option B is wrong because it uses 'trigger' for PRs, but the syntax is incorrect. Option D is wrong because it includes all branches, which is too broad.

Answer

trigger: pr: branches: include: - main

Answer

trigger: branches: include: - main

Answer

pr: autoCancel: false branches: include: - '*'

Question 6

Your Azure DevOps release pipeline deploys to Azure Kubernetes Service (AKS). You need to ensure that the deployment is rolled back automatically if the health checks fail within 5 minutes after deployment. The AKS cluster uses a canary deployment strategy. What should you use?

Accepted Answer

Use the Kubernetes manifest task with 'canary' deployment strategy and configure 'stabilityCheck' and 'rollback' settings.. Option B is correct because the Kubernetes manifest task can be configured with a canary strategy and automatic rollback based on deployment stability checks. Option A is wrong because the Helm task does not natively support canary rollback. Option C is wrong because the Azure CLI task would require custom scripting. Option D is wrong because the Kubectl task does not have built-in canary rollback.

Answer

Use an Azure CLI task to run 'kubectl rollout undo' in a post-deployment script.

Answer

Use a Helm upgrade task with --wait and --timeout flags.

Answer

Use the Kubectl task with a 'rollback' subcommand condition.

Question 7

Your organization uses Azure Pipelines and wants to enforce that all builds must pass a security scan before being deployed to production. The security scan is performed by a third-party tool that is not available as a built-in task. You have installed the tool on a self-hosted agent. What is the best way to integrate the security scan into the pipeline?

Accepted Answer

Use a command-line task (e.g., Bash, PowerShell) to execute the security scan tool.. Option C is correct because you can use a command-line script task (e.g., bash, PowerShell) to run the security scan tool installed on the agent. Option A is wrong because there is no generic 'Run Security Scan' task. Option B is wrong because the third-party tool may not have an API. Option D is wrong because you would need to execute it, not just install it.

Answer

Add the tool as a capability of the agent pool and use the 'Install Tool' task.

Answer

Add the 'Run Security Scan' task from the Azure DevOps marketplace.

Answer

Create a custom service hook to trigger the scan externally and wait for results.

Question 8

You need to configure a release pipeline that deploys to Azure App Service. The deployment should use the 'slot swap' strategy to minimize downtime. Which deployment slot should you initially deploy to?

Accepted Answer

Staging slot. Option B is correct because you should deploy to a non-production slot (e.g., staging), then swap it with the production slot. Option A is wrong because deploying directly to production defeats the purpose of slot swap. Option C is wrong because Azure DevOps does not have a 'warmup' slot. Option D is wrong because you should deploy to a specific slot, not all slots.

Answer

Production slot

Answer

Warmup slot

Answer

All slots simultaneously

Question 9

Which TWO actions should you take to implement a CI/CD pipeline for a microservices application using Azure Pipelines? (Choose two.)

Accepted Answer

Publish build artifacts and use them in the release stages.. Options B and D are correct. B: Using a multi-stage YAML pipeline allows you to define build, test, and deploy stages in a single file. D: Publishing build artifacts and using them in release stages ensures consistency between build and deploy. Option A is wrong because using separate pipelines for each microservice would increase complexity; you can use a single pipeline with matrix strategies. Option C is wrong because you should not store credentials in YAML; use variable groups or Azure Key Vault. Option E is wrong because Azure Pipelines supports YAML for both CI and CD.

Answer

Use a classic release pipeline instead of YAML for the deployment stages.

Answer

Store deployment credentials directly in the YAML file.

Answer

Create a separate pipeline for each microservice.

Question 10

Which THREE components are required to set up a self-hosted agent in Azure Pipelines? (Choose three.)

Accepted Answer

A personal access token (PAT) with Agent Pools (read, manage) scope. Options B, C, and D are correct. B: A personal access token (PAT) is needed for authentication. C: The agent must be installed on a machine (Windows, Linux, or macOS). D: The agent must be configured with the Azure DevOps organization URL and PAT. Option A is wrong because you don't need a service connection; the agent authenticates via PAT. Option E is wrong because Azure Pipelines agents do not require Azure Active Directory; they use PAT or other authentication.

Answer

An Azure Resource Manager service connection

Answer

An Azure Active Directory account for the agent

Question 11

Which TWO benefits does using deployment groups provide in Azure Pipelines? (Choose two.)

Accepted Answer

You can deploy to a specific set of target servers (e.g., all web servers in a farm).. Options A and D are correct. A: Deployment groups allow targeting specific sets of servers for deployments. D: They support rolling deployments with health checks. Option B is wrong because you can have multiple agents per deployment group. Option C is wrong because deployment groups are not limited to classic releases; they work with YAML pipelines too. Option E is wrong because agents in deployment groups are registered to the group, not individual machines.

Answer

You can assign multiple deployment groups to a single agent.

Answer

Each target server must have its own agent.

Answer

Deployment groups can only be used with classic release pipelines.

Question 12

The exhibit shows a deployment job in an Azure Pipelines YAML file. The deployment fails with the error 'No package found with pattern: $(Pipeline.Workspace)/drop/*.zip'. What is the most likely cause?

Accepted Answer

The artifact is not downloaded to the expected path; the artifact name must be included in the path.. Option C is correct because the 'download: current' step downloads the artifact from the current pipeline run, but the artifact path usually includes the artifact name as a subfolder. The correct path would be '$(Pipeline.Workspace)/drop' or '$(Pipeline.Workspace)/drop/**/*.zip'. Option A is wrong because the service connection is unrelated to the artifact. Option B is wrong because the wildcard is valid. Option D is wrong because the agent type does not affect artifact download behavior.

Answer

The wildcard pattern '*.zip' is not supported.

Answer

The Azure service connection has expired.

Answer

The pipeline is using a Microsoft-hosted agent that does not support the download task.

Question 13

The exhibit shows a parameters file for an ARM template deployment. During a release pipeline, the deployment fails with the error 'The provided value for the template parameter 'sku' is not valid'. The ARM template defines the 'sku' parameter as an allowed value set of ['F1', 'D1', 'B1', 'S1']. What could be the issue?

Accepted Answer

The parameter file contains an extra space or hidden character in the 'sku' value.. Option A is correct because the error indicates that the provided value 'S1' is not in the allowed values, but the exhibit shows 'S1', which should be valid. However, the error could occur if the parameter file has a typo or extra whitespace that makes it invalid. Option B is wrong because the parameter file is properly formatted. Option C is wrong because the schema version is correct. Option D is wrong because the parameter file does not include 'sku' in the wrong section.

Answer

The parameter file is missing the '$schema' property.

Answer

The 'sku' parameter is defined in the 'variables' section instead of 'parameters'.

Answer

The ARM template expects a different API version for the resource.

Question 14

The exhibit shows an Azure CLI command to run a pipeline. What does this command do?

Accepted Answer

Runs the pipeline named 'MyPipeline' on the 'main' branch with a variable 'myVar' set to 'value1'.. Option D is correct because the command runs the pipeline named 'MyPipeline' on the 'main' branch, with a variable 'myVar' set to 'value1'. Option A is wrong because it runs the pipeline, does not create one. Option B is wrong because it runs on the 'main' branch, not all branches. Option C is wrong because it sets a variable, not a secret.

Answer

Runs the pipeline on all branches with the variable.

Answer

Runs the pipeline and sets a secret variable.

Answer

Creates a new pipeline named 'MyPipeline' with a variable.

Question 15

Your team uses GitHub Actions to build and deploy a Node.js application to Azure App Service. The deployment succeeds, but the app crashes after startup with an error indicating a missing module. The build artifact includes the node_modules folder. What is the most likely cause?

Accepted Answer

The Node.js version on the runner differs from the App Service runtime, causing native module incompatibility.. Option C is correct because GitHub Actions runners may include a different Node.js version than the target App Service, causing native module incompatibility. Option A is wrong because the node_modules folder is included. Option B is wrong because the YAML syntax is valid. Option D is wrong because build optimization does not cause missing modules.

Answer

The .gitignore file excludes node_modules from the artifact.

Answer

The workflow YAML has an indentation error that causes the deploy step to fail silently.

Answer

The build step does not run npm ci, so the package-lock.json is ignored.