AZ-400 Design and implement build and release pipelines Practice Test 19 — 15 Questions

Question 1

Your organization uses Azure Pipelines and wants to enforce that all builds must pass a security scan before being deployed to production. The security scan is performed by a third-party tool that is not available as a built-in task. You have installed the tool on a self-hosted agent. What is the best way to integrate the security scan into the pipeline?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a command-line task (e.g., Bash, PowerShell) to execute the security scan tool.. The security scan tool is installed on a self-hosted agent but not available as a built-in task or marketplace extension. Using a command-line task (Bash or PowerShell) allows you to directly invoke the tool's executable from the agent's file system, passing necessary parameters and capturing exit codes to determine success or failure. This approach integrates seamlessly with Azure Pipelines' standard task execution model without requiring custom extensions or external service hooks.

Answer

Add the tool as a capability of the agent pool and use the 'Install Tool' task.

Answer

Add the 'Run Security Scan' task from the Azure DevOps marketplace.

Answer

Create a custom service hook to trigger the scan externally and wait for results.

Question 2

You need to configure a release pipeline that deploys to Azure App Service. The deployment should use the 'slot swap' strategy to minimize downtime. Which deployment slot should you initially deploy to?

Accepted Answer

Staging slot. The slot swap strategy in Azure App Service deploys to a non-production slot (typically 'staging') first, allowing validation before swapping with the production slot. This eliminates downtime by warming up the staging slot and then routing traffic to it via a zero-downtime swap operation. Deploying directly to production would cause downtime or require manual traffic management.

Answer

Production slot

Answer

Warmup slot

Answer

All slots simultaneously

Question 3

Which TWO actions should you take to implement a CI/CD pipeline for a microservices application using Azure Pipelines? (Choose two.)

Accepted Answer

Publish build artifacts and use them in the release stages.. Options B and D are correct. B: Publishing build artifacts and using them in release stages ensures consistency between build and deploy. D: Using a multi-stage YAML pipeline allows you to define build, test, and deploy stages in a single file. Option A is wrong because classic release pipelines are not recommended; YAML is preferred for CI/CD. Option C is wrong because credentials should not be stored in YAML; use variable groups or Azure Key Vault. Option E is wrong because a single multi-stage pipeline can handle multiple microservices using matrix strategies; separate pipelines increase complexity.

Answer

Use a classic release pipeline instead of YAML for the deployment stages.

Answer

Store deployment credentials directly in the YAML file.

Answer

Create a separate pipeline for each microservice.

Question 4

Which THREE components are required to set up a self-hosted agent in Azure Pipelines? (Choose three.)

Accepted Answer

A personal access token (PAT) with Agent Pools (read, manage) scope. A personal access token (PAT) with Agent Pools (read, manage) scope is required because the self-hosted agent uses this token to authenticate with Azure DevOps during the configuration step. The agent registers itself into the specified agent pool, and the PAT must have the 'Agent Pools (read, manage)' scope to authorize this registration and subsequent communication.

Answer

An Azure Resource Manager service connection

Answer

An Azure Active Directory account for the agent

Question 5

Which TWO benefits does using deployment groups provide in Azure Pipelines? (Choose two.)

Accepted Answer

You can deploy to a specific set of target servers (e.g., all web servers in a farm).. Deployment groups in Azure Pipelines allow you to define a logical set of target machines (e.g., all web servers in a farm) and deploy to them collectively. This enables targeted, multi-machine deployments without needing to manage individual agents per environment. Option B is correct because deployment groups support rolling deployments with built-in health validation, where the pipeline can monitor application health after each batch of updates and automatically roll back on failure.

Answer

You can assign multiple deployment groups to a single agent.

Answer

Each target server must have its own agent.

Answer

Deployment groups can only be used with classic release pipelines.

Question 6

The exhibit shows a deployment job in an Azure Pipelines YAML file. The deployment fails with the error 'No package found with pattern: $(Pipeline.Workspace)/drop/*.zip'. What is the most likely cause?

Accepted Answer

The artifact is not downloaded to the expected path; the artifact name must be included in the path.. The error indicates the deployment job is looking for a .zip file in a folder named 'drop' directly under the pipeline workspace. However, in Azure Pipelines, artifacts are downloaded to a folder named after the artifact, and the published artifact contains a 'drop' folder inside it (or 'drop' is merely a folder, not the artifact name). The correct path must include the artifact name first, e.g., '$(Pipeline.Workspace)/<artifact-name>/drop/*.zip'. Option A correctly identifies that the artifact name is missing from the path.

Answer

The wildcard pattern '*.zip' is not supported.

Answer

The Azure service connection has expired.

Answer

The pipeline is using a Microsoft-hosted agent that does not support the download task.

Question 7

The exhibit shows a parameters file for an ARM template deployment. During a release pipeline, the deployment fails with the error 'The provided value for the template parameter 'sku' is not valid'. The ARM template defines the 'sku' parameter as an allowed value set of ['F1', 'D1', 'B1', 'S1']. What could be the issue?

Accepted Answer

The parameter file contains an extra space or hidden character in the 'sku' value.. The error indicates that the value provided for the 'sku' parameter is not within the allowed set ['F1','D1','B1','S1']. Even if the exhibit appears to show 'S1', the actual value might contain invisible characters (e.g., leading/trailing spaces, newline, tab, or a BOM) or a typographical variation (like a different dash or letter), causing it to not exactly match 'S1'. Option B is incorrect because a missing '$schema' property would produce a different error about the parameter file schema, not about parameter value validation. Option C is incorrect because defining 'sku' in the variables section would be a template error (or a different parameter-related error), and the error explicitly mentions the parameter 'sku', so it exists as a parameter. Option D is incorrect because an API version mismatch would cause a resource-manager-specific error about the API or resource, not the parameter value.

Answer

The parameter file is missing the '$schema' property.

Answer

The 'sku' parameter is defined in the 'variables' section instead of 'parameters'.

Answer

The ARM template expects a different API version for the resource.

Question 8

The exhibit shows an Azure CLI command to run a pipeline. What does this command do?

Accepted Answer

Runs the pipeline named 'MyPipeline' on the 'main' branch with a variable 'myVar' set to 'value1'.. The Azure CLI command `az pipelines run --name MyPipeline --branch main --variables myVar=value1` triggers an existing pipeline named 'MyPipeline' on the 'main' branch, passing a plain-text variable 'myVar' with the value 'value1'. The `--variables` parameter sets pipeline variables at runtime, but they are not automatically marked as secret; to set a secret variable, you must use the `--secret-variables` parameter instead. This matches option C exactly.

Answer

Runs the pipeline on all branches with the variable.

Answer

Runs the pipeline and sets a secret variable.

Answer

Creates a new pipeline named 'MyPipeline' with a variable.

Question 9

Your team uses GitHub Actions to build and deploy a Node.js application to Azure App Service. The deployment succeeds, but the app crashes after startup with an error indicating a missing module. The build artifact includes the node_modules folder. What is the most likely cause?

Accepted Answer

The Node.js version on the runner differs from the App Service runtime, causing native module incompatibility.. The most likely cause is that the Node.js version on the GitHub Actions runner differs from the version on Azure App Service, leading to native module incompatibility. Native modules (e.g., those using node-gyp) are compiled against the specific Node.js ABI (Application Binary Interface) of the build environment. If the runtime version differs, the compiled .node binaries will fail to load, resulting in a 'missing module' error even though the node_modules folder is present in the artifact.

Answer

The .gitignore file excludes node_modules from the artifact.

Answer

The workflow YAML has an indentation error that causes the deploy step to fail silently.

Answer

The build step does not run npm ci, so the package-lock.json is ignored.

Question 10

You need to enforce that all builds in Azure Pipelines use a specific version of the .NET SDK. What is the best approach?

Accepted Answer

Add a UseDotNet task to the pipeline that specifies the required SDK version.. The UseDotNet task in Azure Pipelines can be configured to download and install a specific version of the .NET SDK, ensuring that all builds use exactly that version, regardless of what is pre-installed on the agent. Option B is incorrect because setting a pipeline variable DotNetVersion and using it in the DotNetCoreCLI task does not enforce the SDK version; the DotNetCoreCLI task uses the SDK already available on the agent, unless explicitly redirected, and the variable alone does not install or enforce a specific SDK. Option C is incorrect because installing the SDK manually via a script is not a reliable or repeatable approach; it depends on the agent's state and does not automatically enforce the version across different agents or pipeline runs. Option D is incorrect because including a global.json file in the repository does not guarantee that the required SDK version is installed on the agent; the build agent may not respect global.json if the specified SDK is not present, and there is no enforcement mechanism without additional steps.

Answer

Set a pipeline variable DotNetVersion and use it in the DotNetCoreCLI task.

Answer

Install the SDK manually on the build agent using a script.

Answer

Include a global.json file in the repository and rely on the build agent to respect it.

Question 11

Your Azure DevOps pipeline deploys to multiple environments (Dev, Test, Prod) using YAML multi-stage pipelines. The Prod deployment requires manual approval. However, the approval gate shows 'Pending' even after an authorized user approves. What is the most likely cause?

Accepted Answer

The approval gate is configured to require approval on the latest commit, but a newer commit was pushed after the approval.. In Azure DevOps, approvals are associated with a specific pipeline run and its commit. When a new commit is pushed after an approval, it triggers a new pipeline run. The new run has its own approval requirement, so it remains 'Pending' until approved. The previous approval does not carry over to the new run.

Answer

The pipeline run was triggered by a PR merge, and the approval needs to be re-applied after the build completes.

Answer

The build pipeline includes a step that modifies the approval settings.

Answer

The approver is not a member of the security group defined in the approval settings.

Question 12

You are designing a release pipeline for a .NET Core application that must comply with regulatory requirements. The pipeline must sign the assembly with a code-signing certificate stored in Azure Key Vault. Which THREE actions should you perform?

Accepted Answer

Add a step to download the certificate from Key Vault using the AzureKeyVault task.. The AzureKeyVault task can download the certificate from Azure Key Vault. Option B is correct because after downloading the certificate, a script task like signtool.exe must be used to sign the assembly. Option C is correct because the Azure Pipelines service principal must be granted access to the Key Vault to retrieve the certificate. Option D is incorrect because the certificate should not be stored in a secure file in the build artifact; it should remain in Key Vault for security. Option E is incorrect because signing should occur before packaging; packaging after signing is typical to avoid corruption.

Answer

Store the certificate in a secure file in the build artifact.

Answer

Package the application before signing to avoid signature corruption.

Question 13

Refer to the exhibit. You have an Azure Pipelines YAML file for a .NET Core application. The pipeline is triggered on changes to the main branch, but only for files under src/. After a push to main that modifies a file in src/, the pipeline does not start. What is the most likely reason?

Accepted Answer

The path filter 'src/*' does not match files in subdirectories of src/.. The path filter `src/*` uses a single asterisk, which only matches files directly within the `src/` directory, not files in subdirectories (e.g., `src/app/main.cs`). Azure Pipelines path filters require a double asterisk `src/**` to recursively match all files under `src/`. Since the modified file is in a subdirectory, the trigger condition is not met, and the pipeline does not start.

Answer

The branch filter is missing the 'refs/heads/' prefix.

Answer

The trigger configuration has a syntax error: 'include' should be 'includes'.

Answer

The variable 'buildConfiguration' is not defined at the top level.

Question 14

Refer to the exhibit. You deploy this Bicep template to create an Azure App Service with a custom container. The deployment succeeds, but the container fails to start with an error 'Container didn't respond to HTTP pings'. What is the most likely missing configuration?

Accepted Answer

The template is missing the 'healthCheckPath' property in siteConfig.. The error 'Container didn't respond to HTTP pings' indicates that Azure App Service's built-in health check mechanism is failing to reach the container. By default, App Service pings the root path ('/') on the container's exposed port. If the container's application does not respond on that path, the health check fails. Adding the 'healthCheckPath' property in siteConfig allows you to specify a custom endpoint (e.g., '/health') that the container can respond to, resolving the issue.

Answer

The container image is not publicly accessible.

Answer

The WEBSITES_ENABLE_APP_SERVICE_STORAGE should be set to 'true'.

Answer

The template is missing the app setting 'WEBSITES_PORT'.

Question 15

Your team uses GitHub Actions to build a Python application. The workflow includes a step to run unit tests with pytest. The tests pass locally but fail in CI with 'ModuleNotFoundError: No module named 'myapp''. The repository structure has the application code in a subdirectory 'src/'. What is the most likely fix?

Accepted Answer

Set the environment variable PYTHONPATH to 'src/' before running tests.. The Python interpreter cannot find the 'myapp' module when tests run in CI, even though the code is present in the 'src/' subdirectory. Setting PYTHONPATH to 'src/' tells Python to include that directory in the module search path, allowing 'import myapp' to resolve correctly without moving or copying files. This is the most direct fix for a missing module path issue in a CI environment where the working directory is not automatically set to the source folder.

Answer

Set the working directory of the test step to 'src/'.

Answer

Add a step to install dependencies with 'pip install -r requirements.txt'.

Answer

Add a step to run 'pip install -e .' from the repository root.