AZ-400 Design and implement build and release pipelines Practice Test 2 — 15 Questions

Question 1

Refer to the exhibit. This YAML pipeline snippet uses parameters to deploy to different environments. The team wants to run the pipeline for a specific environment by providing the parameter at queue time. However, the pipeline fails with 'Invalid stage name'. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Stage names cannot contain template expressions; they must be static.. In Azure Pipelines, stage names must be valid identifiers (letters, numbers, underscores, starting with a letter). Template expressions are allowed and evaluated at compile time. If the parameter value provided at queue time contains spaces or other invalid characters (e.g., 'Dev Environment'), the pipeline fails with 'Invalid stage name'. The fix is to use a valid identifier as the stage name and a displayName for the human-readable label.

Answer

The parameter values must be defined in a separate file.

Answer

The 'AzureWebApp@1' task inputs are incorrectly formatted.

Answer

The 'stage' keyword should be 'stageName'.

Question 2

Your team uses Azure DevOps to build a .NET application. The build pipeline takes 45 minutes to complete. You want to reduce build times by caching dependencies. What should you configure in the pipeline?

Accepted Answer

Add a Cache task with a key based on the package-lock.json file hash.. None of the options are correct. For a .NET application, you should add a Cache task with a key based on packages.lock.json or the project files. Option B uses package-lock.json (npm), which will cause cache misses and fail to improve build times for .NET dependencies.

Answer

Configure a Build Retention Policy to keep only the latest build.

Answer

Use Pipeline Artifacts to store dependencies between builds.

Answer

Enable Incremental builds in the pipeline settings.

Question 3

Which TWO triggers can be used to start a pipeline automatically in Azure Pipelines? (Choose two.)

Accepted Answer

Pipeline completion trigger. Azure Pipelines supports multiple automatic trigger types: CI triggers (on branch push), PR triggers, scheduled triggers (on a cron schedule), and pipeline completion triggers (when another pipeline completes). Manual triggers via the portal are not automatic. Therefore, the correct answer cannot be exactly two; options A, B, D, and E all describe automatic triggers. The explanation also fails to address why PR triggers are correct and schedule triggers are not.

Answer

Manual trigger via the DevOps portal

Question 4

You have a multi-stage pipeline that builds a .NET application and deploys it to Azure App Service. The build stage produces a drop artifact that is used by the deployment stage. Recently, the deployment stage started failing intermittently with a '403 Forbidden' error when trying to download the artifact. The service connection used for deployment has 'Contributor' role at the resource group level. The artifact is stored in Azure Artifacts. What is the most likely cause of the failure?

Accepted Answer

The service principal used by the service connection lacks 'Reader' permissions on the Azure Artifacts feed.. The 403 Forbidden error when downloading an artifact from Azure Artifacts indicates an authorization failure. Even though the service connection has Contributor role at the resource group level, this role does not grant permissions to read from Azure Artifacts feeds. Azure Artifacts uses its own separate permission system; the service principal must be explicitly granted at least Reader permissions on the specific feed to download packages or artifacts. Without this, the deployment stage cannot access the drop artifact. Note that this would cause persistent failures whenever the artifact is downloaded, so the 'intermittent' description in the scenario is a distractor.

Answer

The service connection does not have 'Website Contributor' role on the App Service.

Answer

The pipeline has 'Limit job authorization scope to current project' enabled, restricting access to the artifact.

Answer

The artifact is stored in a different Azure region than the App Service, causing a cross-region access error.

Question 5

You want to trigger a pipeline automatically when a new commit is pushed to the 'develop' branch of your repository. Which trigger configuration should you use in the YAML pipeline?

Accepted Answer

resources:
  repositories:
  - repository: self
    trigger:
      branches:
        include:
          - develop. Both C and D are valid ways to define a CI trigger on a push to the 'develop' branch. The top-level `trigger` (D) is the conventional and recommended syntax. A repository resource with `repository: self` and a `trigger` (C) is also an officially supported alternative. Options A and B are incorrect: A defines a schedule, and B defines a pull request trigger, not a direct push CI trigger.

Answer

schedules:
- cron: "0 0 * * *"
  branches:
    include:
      - develop

Answer

pr:
  branches:
    include:
      - develop

Question 6

Which THREE are required components to implement a secure CI/CD pipeline using Azure Pipelines and GitHub?

Accepted Answer

An Azure service connection to authenticate to Azure resources.. A is correct because a service connection is required to authenticate Azure Pipelines to Azure resources securely. C is correct because a YAML pipeline definition with stages and jobs is the core component that defines the CI/CD process. E is correct because branch protection rules requiring status checks ensure that code is validated before merging, a key security practice.

Answer

A container registry to store Docker images.

Answer

A GitHub personal access token stored as a plain text variable.

Question 7

Refer to the exhibit. You run an Azure CLI command during a pipeline to get the state of a web app. The output shows the state as 'Running'. You want to ensure the pipeline only proceeds if the state is 'Running'. Which task should you use to evaluate the condition?

Accepted Answer

A Bash task that runs 'az webapp show' and checks the state.. The Bash task can directly run the `az webapp show` command shown in the exhibit and use an `if` statement to check whether the `state` equals `'Running'`. If the state does not equal `'Running'`, the Bash task exits with a non-zero code, which fails the pipeline. Option C is incorrect because it assumes a state variable already exists; the scenario only mentions command output, and a PowerShell task would either need to re-run the command or have the output captured in a variable first. Thus, the Bash task is the most straightforward way to evaluate the condition directly from the command output.

Answer

A Download Build Artifacts task that verifies the state.

Answer

A PowerShell task that checks the state variable and exits with code 1 if not 'Running'.

Answer

A Publish Test Results task configured to check the state.

Question 8

Which TWO of the following are valid strategies to reduce build times in Azure Pipelines? (Select TWO.)

Accepted Answer

Use a self-hosted agent pool.. Using parallel jobs allows multiple tasks to run simultaneously across different agents, reducing overall pipeline duration. Pipeline caching for dependencies enables reuse of previously downloaded or built artifacts, eliminating redundant restore steps. Additionally, using a self-hosted agent pool can reduce build times by providing more control over hardware resources and enabling persistent caches between runs.

Answer

Increase the number of retained artifacts.

Answer

Disable test execution.

Question 9

You are designing a release pipeline that deploys a web app to Azure App Service. You need to ensure that configuration secrets (e.g., database connection strings) are not stored in the pipeline YAML file. Which approach should you use?

Accepted Answer

Use an Azure Key Vault variable group linked to the pipeline.. Azure Key Vault variable groups allow you to securely reference secrets stored in Azure Key Vault from within a pipeline without exposing them in the YAML file. The pipeline retrieves the secrets at runtime via a linked service connection, ensuring they never appear in source control or pipeline logs.

Answer

Define the secrets as agent-scoped variables in the release pipeline.

Answer

Hardcode the secrets in the App Service configuration and reference them in the pipeline.

Answer

Store the secrets as pipeline variables and mark them as 'Secret'.

Question 10

Refer to the exhibit. You run the Kusto query in Azure Monitor to analyze pipeline performance. The query returns no results even though you know some pipelines have average durations over 10 minutes. What is the most likely reason?

Accepted Answer

The column name 'RunStartTime' is incorrect; the actual column may be 'StartTime'.. The Kusto query references the column 'RunStartTime', but the actual column in Azure Monitor for pipeline runs is likely named 'StartTime'. However, in Kusto, using a non-existent column in a where clause causes a query error (column not found), not simply an empty result. The most likely reason for no results (or failure) is the column name mismatch.

Answer

The 'avg' function ignores values over 600, so no rows are returned.

Answer

The 'ago(7d)' function is not supported in Azure Monitor.

Answer

The 'RunDurationSeconds' column stores durations as strings, so the average cannot be calculated.

Question 11

Which THREE components are essential for implementing a canary deployment strategy using Azure Kubernetes Service (AKS) and Azure Pipelines? (Choose three.)

Accepted Answer

A service mesh like Istio or Linkerd for traffic splitting.. Canary deployment in AKS requires a mechanism to split traffic (service mesh), a health check endpoint to validate the canary, and a way to run the canary version alongside the stable version (typically separate deployments, not necessarily separate namespaces). The only two essential options from the list are B and C. The question must be changed to 'Choose two.'

Answer

Azure Traffic Manager for global load balancing.

Answer

Multiple Kubernetes namespaces to separate canary and stable deployments.

Answer

Azure Front Door for routing traffic to the canary.

Question 12

Your build pipeline for a Java application uses Maven. You need to run unit tests and integration tests separately. Unit tests should run on every commit, while integration tests should run only when the build is triggered by a pull request to the main branch. How should you configure the pipeline?

Accepted Answer

Create two jobs: one with unit tests (always), one with integration tests conditioned on 'eq(variables['Build.Reason'], 'PullRequest')'.. A correct configuration must run integration tests only for pull requests targeting the main branch. This requires checking both Build.Reason == 'PullRequest' and System.PullRequest.TargetBranch == 'refs/heads/main'. None of the provided options include the target branch check, so none is fully correct as written. While option A allows a step condition that could include the target branch, the option itself does not specify it. Option C is also missing the target branch check and would incorrectly run for PRs to other branches.

Answer

Add both test types as steps in the same job and use a step condition.

Answer

Create two separate stages: one for unit tests, one for integration tests.

Answer

Use a single job with both tests, but set the 'always()' condition on the integration test step.

Question 13

Which TWO are valid strategies to reduce build times in Azure Pipelines? (Choose 2)

Accepted Answer

Use the Cache task to cache NuGet packages or npm modules.. The Cache task stores and restores dependencies like NuGet packages or npm modules, avoiding re-downloads and significantly reducing build time. Using 'dotnet build --no-restore' skips the implicit restore step during build, which is a valid time-saver when a separate restore step (or cache) has already restored packages. Enabling incremental builds with 'clean: false' prevents cleaning the output directory each time, allowing the build system to skip recompiling unchanged code. Therefore, options A, B, and C are all valid strategies.

Answer

Use a larger agent pool with more parallel jobs.

Answer

Increase the build job timeout.

Question 14

Your team uses Azure Pipelines to deploy a microservices application to Azure Kubernetes Service (AKS). You need to implement a strategy that minimizes downtime during updates. Which TWO options should you use?

Accepted Answer

Configure a rolling update strategy in the Kubernetes manifest.. A rolling update (C) is the built-in Kubernetes deployment strategy that avoids downtime. A blue-green deployment (E) using separate namespaces also provides zero downtime. A canary deployment (B) can also minimize downtime, but if exactly two choices are required, the intended pair is C and E. Setting replicas to zero (A) or using recreate (D) causes downtime.

Answer

Set the deployment replica count to zero before updating.

Answer

Use a canary deployment with a service mesh.

Answer

Use a recreate deployment strategy.

Question 15

Refer to the exhibit. You run the Azure CLI command to trigger a pipeline run. The pipeline fails because tests were skipped but should have run. What is the most likely issue?

Accepted Answer

The JSON value for skipTests must be a boolean without quotes.. The Azure DevOps CLI `az pipelines run` supports `--variables` and `--parameters` but not `--variables-parameters`. If that invalid flag were used, the command would fail before any pipeline run is triggered. The symptom says the pipeline ran and skipped tests, which is typically caused by passing `skipTests` as a string value (e.g., `"false"`) rather than a boolean `false`. In Azure DevOps, pipeline variables are strings, so a value of `'false'` is interpreted as a non-empty string and evaluated as `true` in conditional logic. For runtime parameters of type boolean, the correct syntax is `--parameters '{"skipTests":false}'` (value without quotes).

Answer

The pipeline name is incorrect.

Answer

The command uses a flag '--variables-parameters' which is not a valid Azure DevOps CLI option.

Answer

The branch 'feature/new-feature' does not exist.