AZ-400 Design and implement build and release pipelines Practice Test 19 — 15 Questions

Question 1

Your organization is adopting GitHub Actions for CI/CD. You need to enforce that all workflows must pass required status checks before merging pull requests to the main branch. The repository is in an organization. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a branch protection rule for the main branch with required status checks.. Branch protection rules in GitHub allow you to enforce required status checks on pull requests before merging. By configuring a branch protection rule for the main branch, you can specify that certain GitHub Actions workflow runs must pass (e.g., CI checks) before a pull request can be merged. This directly enforces the policy that all workflows must pass required status checks.

Answer

Add an environment protection rule requiring approval from specific reviewers.

Answer

Set the workflow to have 'contents: write' permission.

Answer

Define a CODEOWNERS file that requires team review for main branch changes.

Question 2

You are designing a release pipeline for a mission-critical application. The pipeline must deploy to multiple environments (dev, test, prod) in sequence, with manual approval required before production deployment. Which Azure Pipelines feature should you use?

Accepted Answer

Pre-deployment approvals. Pre-deployment approvals are the correct feature because they allow you to require manual sign-off before a release proceeds to a specific stage. In this scenario, you need a manual approval gate before production deployment, which is exactly what pre-deployment approvals enforce—the release pauses at the production stage until an authorized user approves it.

Answer

Variable groups

Answer

Pipeline triggers

Answer

Deployment gates

Question 3

Your Azure Pipelines build is failing with the error: '##[error]No agent found in pool 'Default' that satisfies the specified demands: Agent.Version -gtVersion 2.200.0'. The pool 'Default' contains agents of various versions. What is the most likely cause?

Accepted Answer

The 'Default' agent pool has no agents with version greater than 2.200.0.. The error message explicitly states that no agent in the 'Default' pool satisfies the demand 'Agent.Version -gtVersion 2.200.0'. Since the pool contains agents of various versions, the most likely cause is that none of those agents have a version greater than 2.200.0. This demand is set in the pipeline YAML or classic editor to ensure the agent meets a minimum version requirement.

Answer

The pipeline YAML has a syntax error in the 'demands' section.

Answer

The pipeline is configured to run on an agentless job.

Answer

The 'demands' keyword is not supported in Azure Pipelines.

Question 4

You are implementing a CI pipeline for a Node.js application. The pipeline must run unit tests and generate code coverage reports. You want to publish the coverage results to Azure DevOps and enforce a minimum coverage threshold of 80%. Which tasks should you use?

Accepted Answer

Use the Publish Code Coverage Results task and configure the threshold in the task settings.. The Publish Code Coverage Results task is specifically designed to publish code coverage data (e.g., Cobertura or JaCoCo XML reports) to Azure DevOps and supports configuring a minimum coverage threshold directly in its settings. This meets both requirements: publishing results and enforcing the 80% threshold. Other tasks like Publish Test Results or Publish Build Artifacts do not natively handle coverage threshold enforcement.

Answer

Use the Publish Test Results task to publish coverage data.

Answer

Use the Publish Build Artifacts task with coverage files.

Answer

Use the Copy Files task to copy coverage files and then the Publish Build Artifacts task.

Question 5

Your team is using GitHub Actions to deploy a containerized application to Azure Kubernetes Service (AKS). You need to securely authenticate the workflow to AKS without storing credentials in the repository. What should you use?

Accepted Answer

Use OpenID Connect (OIDC) with a federated identity credential.. OpenID Connect (OIDC) allows GitHub Actions to exchange a short-lived token for Azure credentials using a federated identity credential, eliminating the need to store any long-lived secrets in the repository. This is the recommended approach for secure, passwordless authentication to Azure services, including AKS, because it uses token-based authentication that automatically rotates and is scoped to specific workflows.

Answer

Use the GITHUB_TOKEN to authenticate to Azure.

Answer

Use an SSH deploy key to authenticate to AKS.

Answer

Store an Azure service principal password as a GitHub secret.

Question 6

You are designing a build pipeline that must be triggered only when changes are made to specific folders in the repository. The pipeline should ignore documentation changes. Which trigger configuration should you use?

Accepted Answer

Configure a path trigger with include paths for source code and exclude paths for docs.. Azure Pipelines path triggers allow you to specify include and exclude filters on file paths. By including only source code folders and excluding the docs folder, the pipeline will only run when relevant code changes are made, ignoring documentation updates.

Answer

Configure a scheduled trigger to run the pipeline daily.

Answer

Configure a branch trigger with an include filter for the main branch.

Answer

Configure a tag trigger with a pattern that matches release tags.

Question 7

Your release pipeline deploys to multiple Azure regions. You need to ensure that if a deployment to one region fails, the pipeline continues deploying to other regions. Which deployment strategy should you use?

Accepted Answer

Rolling deployment. Rolling deployment updates instances gradually across regions. If a deployment to one region fails, the pipeline can continue deploying to other regions because each region is updated independently. Option A (immutable deployment) replaces all instances at once, so a failure would halt the entire deployment. Option C (blue-green) switches all traffic to a new environment; if that environment fails, the whole deployment fails. Option D (canary) routes a small percentage of traffic to a new version and rolls back if issues occur, but it does not ensure continued deployment to other regions upon failure.

Answer

Immutable deployment

Answer

Blue-green deployment

Answer

Canary deployment

Question 8

You need to automatically run a security scan on every pull request in GitHub. The scan should block the PR if critical vulnerabilities are found. Which GitHub feature should you use?

Accepted Answer

GitHub Code Scanning with a CodeQL workflow. GitHub Code Scanning with a CodeQL workflow is the correct choice because it allows you to define a custom security analysis that runs on every pull request. By configuring the workflow to fail on critical-severity alerts, the pull request is automatically blocked, preventing vulnerable code from being merged. This integrates directly with GitHub's checks API to enforce the scan result as a required status check.

Answer

Dependabot version updates

Answer

Secret scanning

Answer

Branch protection rules with required status checks

Question 9

Which THREE are required components to implement a secure CI/CD pipeline using Azure Pipelines and GitHub?

Accepted Answer

An Azure service connection to authenticate to Azure resources.. Option A is correct because an Azure service connection (a service principal or workload identity federation stored in Azure DevOps) is the mechanism Azure Pipelines uses to authenticate to Azure subscriptions and deploy resources securely without embedding credentials in code. Option C is correct because a YAML pipeline definition with stages and jobs is the declarative pipeline artifact that Azure Pipelines executes to build, test, and deploy code in a repeatable, version-controlled manner. Option E is correct because branch protection rules requiring status checks to pass prevent unreviewed or failing code from being merged, enforcing quality and security gates in the GitHub workflow. Option B is not required because a container registry is only needed when the pipeline builds and stores Docker images, which is not a universal requirement for a secure CI/CD pipeline. Option D is not required and is in fact insecure, since storing a GitHub personal access token as a plain text variable exposes the secret; tokens should be kept in Azure Key Vault or a secret variable group instead.

Answer

A container registry to store Docker images.

Answer

A GitHub personal access token stored as a plain text variable.

Question 10

Which TWO are valid strategies for managing secrets in a GitHub Actions workflow?

Accepted Answer

Use OpenID Connect to authenticate to Azure without storing any credentials.. OpenID Connect (OIDC) allows GitHub Actions to exchange a short-lived token directly with Azure without storing any long-lived credentials as secrets. This eliminates the need to manage and rotate client secrets or service principal passwords, reducing the risk of credential leakage. The workflow uses the `azure/login` action with `client-id`, `tenant-id`, and `subscription-id` parameters, and Azure trusts the OIDC token issued by GitHub. Alternatively, storing the secret as an encrypted GitHub secret is also a valid strategy: GitHub encrypts secrets at rest and injects them into the workflow runtime only when referenced via `${{ secrets.SECRET_NAME }}`. This prevents hardcoding secrets in the YAML and keeps them out of logs, though it still requires managing the secret value and rotation.

Answer

Hardcode the secret in the YAML file.

Answer

Set the secret as an environment variable in the runner's shell profile.

Answer

Base64-encode the secret and include it directly in the workflow file.

Question 11

Refer to the exhibit. You are deploying this ARM template using Azure Pipelines. The pipeline passes the parameter 'environmentName' with value 'prod'. What will be the name of the virtual network?

Accepted Answer

vnet-prod. The ARM template uses the `concat` function to combine the string 'vnet-' with the value of the `environmentName` parameter. Since the pipeline passes 'prod' for `environmentName`, the resulting virtual network name is 'vnet-prod'. This is a standard pattern for parameterizing resource names in Azure Resource Manager templates.

Answer

vnet-default

Answer

vnet-prod-vnet

Answer

vnet-dev

Question 12

Refer to the exhibit. A developer creates a pull request from a branch called 'feature/update'. The workflow runs on the pull_request event. What will the output of this workflow be?

Accepted Answer

The workflow will run and output 'Running PR tests'.. The workflow is triggered on the `pull_request` event, which fires for any pull request regardless of the source branch name. The condition `github.event_name == 'pull_request'` evaluates to `true` because the event is indeed a pull_request. Therefore, the `if` condition passes, and the step runs, outputting 'Running PR tests'.

Answer

The workflow will not run because the branch is not 'main'.

Answer

The workflow will run but output nothing because the condition fails.

Answer

The workflow will fail due to a syntax error in the conditional expression.

Question 13

A team uses Azure Pipelines to build a .NET application. The build takes 30 minutes, and developers complain that the pipeline runs slowly. The pipeline uses the 'windows-latest' agent and installs the .NET SDK in each run. Which action would MOST reduce the build time?

Accepted Answer

Enable pipeline caching for the .NET SDK.. Enabling pipeline caching for the .NET SDK allows the SDK to be restored from a cache instead of being downloaded and installed on every run. This eliminates the recurring overhead of SDK installation, which is a significant portion of the 30-minute build time, directly addressing the slow pipeline complaint.

Answer

Deploy a self-hosted agent in Azure.

Answer

Increase the number of parallel jobs.

Answer

Change the agent pool to 'ubuntu-latest'.

Question 14

Your release pipeline deploys to Azure App Service using a deployment slot strategy. After a successful deployment to the staging slot, you run smoke tests, then swap slots. Recently, a swap failed because the staging slot had an incorrect application setting. What is the BEST way to prevent this issue?

Accepted Answer

Mark the application setting as a deployment slot setting.. Marking the application setting as a deployment slot setting ensures that the setting stays with the slot and is not swapped between staging and production. This prevents the staging slot from having an incorrect value that could cause a swap failure, as the setting is pinned to the slot and not part of the swap payload.

Answer

Use a manual approval gate before swap.

Answer

Configure the App Service deployment center.

Answer

Add a task to verify settings before swap.

Question 15

Your Azure DevOps project uses Git for source control. You want to enforce that all code changes are reviewed before merging into the main branch. Which branch policy should you enable?

Accepted Answer

Require a minimum number of reviewers.. The 'Require a minimum number of reviewers' branch policy in Azure DevOps enforces that a specified number of approvers must sign off before a pull request can be completed, directly satisfying the requirement that all code changes are reviewed before merging. This policy can be set on the main branch and optionally reset votes on new pushes. It is the standard mechanism for mandatory code review in Azure Repos.

Answer

Allow only comment resolution.

Answer

Require a successful build before merging.

Answer

Limit merge types to squash merge.