AZ-400 Design and implement build and release pipelines Practice Test 18 — 15 Questions

Question 1

You are implementing a build pipeline for a .NET application that uses GitHub Advanced Security (GHAS) for code scanning. The pipeline must run CodeQL analysis on every pull request to the main branch. You have added the CodeQL task to the pipeline. However, the analysis results are not appearing in the 'Security' tab of the repository on GitHub. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The pipeline is missing the 'Publish Security Analysis Logs' step to upload SARIF results to GitHub.. CodeQL analysis results are uploaded to GitHub as SARIF files. Without the 'Publish Security Analysis Logs' step (or the equivalent 'upload-sarif' action), the SARIF file generated by CodeQL is not sent to GitHub, so the findings never appear in the Security tab. The pipeline must explicitly include this step to complete the integration with GitHub Advanced Security.

Answer

The GitHub repository is private, so security alerts are disabled.

Answer

The .NET project is not supported by CodeQL.

Answer

CodeQL analysis is not supported on pull request triggers.

Question 2

Your team uses Azure Pipelines to deploy a Docker container to Azure Kubernetes Service (AKS). The pipeline builds a Docker image, pushes it to Azure Container Registry (ACR), and then runs a deployment to AKS. You want to ensure that the deployment uses the exact image that was built in the same pipeline run. Which approach should you use?

Accepted Answer

Generate a unique tag (e.g., Build.BuildId) and pass it to both the Docker build and Kubernetes manifest via variable substitution.. Using a unique tag like Build.BuildId ensures that the exact image built in the pipeline is referenced in the Kubernetes manifest. This prevents deployment from accidentally using a stale or overwritten image, as the tag is unique per run and passed consistently via variable substitution from the Docker build to the deployment YAML.

Answer

Use two separate pipelines: one for build/push, one for deploy, and share the image tag via a variable group.

Answer

Use a single task for build and push, and rely on ACR's internal pull-through cache.

Answer

Tag the image as 'latest' and reference it in the Kubernetes manifest.

Question 3

You are setting up a release pipeline for a web application. The pipeline must deploy to three environments: Dev, Test, and Prod. The deployment to Prod must be triggered only after a successful deployment to Test and after a manual approval. How should you configure the pipeline?

Accepted Answer

Add a pre-deployment approval gate on the Prod environment.. Pre-deployment approval gates on the Prod environment block the release until manual approval is granted, and a stage condition ensures it runs only after successful Test deployment. Option A is wrong because manual intervention tasks are not designed for approvals and do not integrate with pipeline stages as seamlessly. Option B is wrong because conditions can't enforce manual approval; they only evaluate at runtime. Option C is wrong because scheduling doesn't provide manual approval; triggers can be manual but not combined with stage success conditions effectively.

Answer

Add a manual intervention task before the Prod deployment in the pipeline.

Answer

Use a condition on the Prod stage to require success from Test and manual intervention variable.

Answer

Schedule the Prod deployment to run after Test, and require manual trigger.

Question 4

Your organization uses GitHub Actions for CI/CD. You have a workflow that builds a .NET application and runs tests. The workflow uses a self-hosted runner on an on-premises Windows server. Recently, builds started failing with 'Access to the path is denied' errors when the runner tries to restore NuGet packages. The runner has been working for months. What is the most likely cause?

Accepted Answer

The runner service account's permissions have changed, and it no longer has write access to the working directory or cache.. The 'Access to the path is denied' error during NuGet restore on a self-hosted runner typically indicates a file system permission issue. Since the runner has been working for months, the most likely cause is that the service account under which the runner runs no longer has write access to the working directory or the NuGet cache folder, often due to a group policy change, account modification, or folder permission drift.

Answer

The runner's authentication token to GitHub has expired.

Answer

The NuGet cache directory on the runner has been deleted.

Answer

The runner has been updated to a newer version that no longer supports NuGet restore.

Question 5

You are designing a build pipeline for a Python application that uses Anaconda environments. The pipeline must create a Conda environment, install dependencies, and run tests. The pipeline should also cache the Conda environment to speed up subsequent builds. Which configuration should you use?

Accepted Answer

Use the 'CondaEnvironment' task to create the environment, and use the 'Cache' task to cache the Conda packages folder.. The 'CondaEnvironment' task is purpose-built for creating and updating Conda environments from an environment.yml file, and combining it with the 'Cache' task to cache the Conda packages folder (typically `$(Pipeline.Workspace)/conda_pkgs`) significantly reduces build time by avoiding re-downloading packages on subsequent runs. This approach aligns with Azure DevOps best practices for dependency caching and Conda environment management.

Answer

Use the 'UsePythonVersion' task with a version spec, and add a script to create the Conda environment.

Answer

Use a Docker container with Anaconda pre-installed and run the pipeline inside the container.

Answer

Use a script to run 'conda create' and 'conda install', and manually cache the environment by specifying a path.

Question 6

Which TWO actions are required to securely use Azure Key Vault secrets in an Azure Pipelines build? (Choose 2)

Accepted Answer

Use the 'Azure Key Vault' task to download secrets as pipeline variables.. The Azure Key Vault task in Azure Pipelines is the recommended way to securely download secrets from a Key Vault and expose them as pipeline variables. This task automatically handles authentication and ensures that secret values are masked in logs, preventing accidental exposure. It eliminates the need to manually manage secret retrieval and mapping in YAML. For the task to succeed, the Azure DevOps service principal (from the Azure Resource Manager service connection) must have 'Get' and 'List' permissions on the Key Vault. Without these permissions, the task cannot retrieve the secrets. Therefore, both using the Azure Key Vault task and granting the appropriate permissions are required actions.

Answer

Set the 'secrets' output variable to 'true' in the pipeline.

Answer

Use the 'Environment Variables' section in the pipeline to map secrets.

Answer

Reference the secret identifier directly in the pipeline YAML.

Question 7

Which THREE are true about using deployment groups in Azure Pipelines? (Choose 3)

Accepted Answer

Each machine in a deployment group must have the Azure Pipelines agent installed.. Each target machine in a deployment group requires the Azure Pipelines agent (either the Windows or Linux agent) to be installed and configured. The agent is responsible for executing the deployment tasks on that machine, and without it, the deployment group cannot communicate with or deploy to the machine.

Answer

Deployment groups can only be used with Windows-based machines.

Answer

Deployment groups are tied to a specific environment.

Question 8

Your team uses GitHub Actions to build and deploy a static website to Azure Storage. The workflow uses the 'azure/storage-blob-upload' action to deploy to a storage account static website. Recently, deployments started failing with 'Error: Failed to get credentials'. The workflow uses OpenID Connect (OIDC) for authentication. What is the most likely cause?

Accepted Answer

The service principal used for OIDC does not have the 'Storage Blob Data Contributor' role on the storage account.. The 'azure/storage-blob-upload' action requires the service principal used for OIDC authentication to have the 'Storage Blob Data Contributor' role on the storage account to upload static website content. Without this role, the action fails to obtain credentials for blob write operations, resulting in the 'Failed to get credentials' error.

Answer

The storage account firewall is blocking the GitHub Actions IP range.

Answer

The OIDC configuration in GitHub is missing the 'client secret' field.

Answer

The 'azure/storage-blob-upload' action does not support static websites.

Question 9

Your team uses Azure Pipelines for CI/CD. A release pipeline fails intermittently during deployment to an Azure App Service slot. The error message indicates 'Failed to fetch access token for Azure Resource Manager service endpoint.' The service principal used has been granted Contributor role on the resource group. The issue resolves after re-creating the service connection in Azure DevOps. What is the most likely cause?

Accepted Answer

The service principal client secret has expired.. Service principal credentials (client secret) can expire, causing intermittent token fetch failures. Re-creating the service connection generates a new secret, temporarily resolving the issue until it expires again. Option B is wrong because the service connection is bound to the service principal, not the user who created it; removing the user does not affect the existing connection. Option C is wrong because network restrictions would cause consistent failure, not intermittent. Option D is wrong because the service principal already has the Contributor role on the resource group.

Answer

The user who created the service connection has been removed from Azure DevOps.

Answer

The Azure DevOps organization is behind a firewall that blocks outbound requests to Azure Resource Manager.

Answer

The service principal lacks the required role on the target resource group.

Question 10

You are designing a build pipeline for a Node.js application. The pipeline must run unit tests and publish code coverage results to Azure Pipelines. Which task should you use to ensure coverage results are available in the pipeline summary?

Accepted Answer

PublishCodeCoverageResults@1. The PublishCodeCoverageResults@1 task is specifically designed to publish code coverage results (e.g., Cobertura, JaCoCo, or .coverage formats) to Azure Pipelines, making them visible in the pipeline summary and the Tests tab. This task consumes coverage data files generated by a previous test run and integrates them into the pipeline's reporting UI.

Answer

PublishTestResults@2

Answer

VSTest@2

Answer

CopyFiles@2

Question 11

Your pipeline uses a multi-stage YAML file. You want to conditionally run a stage only when the build is triggered from the 'main' branch. Which expression should you use in the 'condition' property of the stage?

Accepted Answer

eq(variables['Build.SourceBranch'], 'refs/heads/main'). The `Build.SourceBranch` variable in Azure Pipelines contains the full Git ref path (e.g., `refs/heads/main`). The `condition` property evaluates expressions at runtime, and using `eq(variables['Build.SourceBranch'], 'refs/heads/main')` precisely matches the full ref for the main branch, ensuring the stage runs only when the trigger originates from that branch.

Answer

startsWith(variables['Build.SourceBranch'], 'main')

Answer

eq(variables['Build.SourceBranchName'], 'refs/heads/main')

Answer

eq(variables['Build.SourceBranch'], 'main')

Question 12

Your release pipeline deploys to multiple environments (Dev, Test, Prod) using approval gates. Recently, the Prod deployment failed because a manual validation task timed out after 30 minutes. You need to ensure that if the manual validation is not approved within 15 minutes, the pipeline automatically rejects the deployment and sends a notification. What should you do?

Accepted Answer

In the Manual Validation task, set 'Timeout' to 15 and 'On timeout' to 'Reject'.. The Manual Validation task has a 'Timeout' setting and an 'On timeout' option. Setting Timeout to 15 minutes and On timeout to 'Reject' will automatically reject the deployment if not approved within 15 minutes. Additionally, you can configure a notification using an Azure DevOps subscription or service hook for the rejection event. Option A is incorrect because the stage timeout does not specifically handle manual validation rejection. Option C is incorrect because, although pre-deployment approvals do have a timeout that can reject on timeout, they apply to the approval gate before the stage, not to a manual validation task within the stage. Option D is incorrect because adding a PowerShell task is unnecessary and less reliable than the built-in timeout behavior.

Answer

Set the 'Timeout in minutes' for the entire stage to 15.

Answer

Configure a pre-deployment approval with a timeout of 15 minutes.

Answer

Add a PowerShell task after the manual validation that checks the status and cancels the pipeline if not approved.

Question 13

Your team uses GitHub Actions for CI/CD. You want to reuse a workflow across multiple repositories without duplicating code. Which approach should you use?

Accepted Answer

Create a reusable workflow in a central repository and reference it using 'uses: owner/repo/.github/workflows/workflow.yml@ref'.. GitHub Actions supports reusable workflows that allow you to define a workflow in a central repository and reference it from other repositories using the 'uses' syntax with the format 'owner/repo/.github/workflows/workflow.yml@ref'. This eliminates code duplication while maintaining a single source of truth for the workflow logic, and the referenced workflow can be triggered by events in the caller repository.

Answer

Store the workflow in a shared repository and use environment secrets to share credentials.

Answer

Create a composite action and reference it from each workflow.

Answer

Create a workflow template in the organization's .github repository.

Question 14

You are setting up a build pipeline for a .NET Core application. The build should run on every pull request to the 'main' branch. Which trigger configuration should you use in the YAML pipeline?

Accepted Answer

pr: branches: include: - main. In Azure Pipelines YAML, the `pr` trigger is used to define pull request validation triggers, separate from the `trigger` keyword which controls CI triggers on branch pushes. By specifying `pr: branches: include: - main`, the pipeline will automatically run on every pull request targeting the `main` branch, which matches the requirement exactly.

Answer

trigger: pr: branches: include: - main

Answer

trigger: branches: include: - main

Answer

pr: autoCancel: false branches: include: - '*'

Question 15

Your Azure DevOps release pipeline deploys to Azure Kubernetes Service (AKS). You need to ensure that the deployment is rolled back automatically if the health checks fail within 5 minutes after deployment. The AKS cluster uses a canary deployment strategy. What should you use?

Accepted Answer

Use the Kubernetes manifest task with 'canary' deployment strategy and configure 'stabilityCheck' and 'rollback' settings.. The Kubernetes manifest task in Azure DevOps supports a 'canary' deployment strategy with built-in 'stabilityCheck' and 'rollback' settings. This allows you to define a health check window (e.g., 5 minutes) and automatically trigger a rollback if the canary pods fail the stability checks, meeting the requirement without custom scripting.

Answer

Use an Azure CLI task to run 'kubectl rollout undo' in a post-deployment script.

Answer

Use a Helm upgrade task with --wait and --timeout flags.

Answer

Use the Kubectl task with a 'rollback' subcommand condition.