AZ-400 Design and implement build and release pipelines Practice Test 2 — 15 Questions

Question 1

You are designing a build pipeline that uses a combination of tasks. The pipeline must compile code, run unit tests, and then publish code coverage results. Match each task with its appropriate placement in the pipeline order. The tasks are: 'Visual Studio Test', 'Publish Code Coverage Results', 'Visual Studio Build'. The correct order is: 1. Build, 2. Test, 3. Publish coverage.

Answer

Visual Studio Build

Answer

Visual Studio Test

Answer

Publish Code Coverage Results

Question 2

You have a YAML pipeline that builds a .NET application. You need to ensure that the pipeline uses the .NET SDK version 6.0.x. Which task should you add to the pipeline?

Accepted Answer

UseDotNet@2. The UseDotNet@2 task is the correct choice because it explicitly installs a specific .NET SDK version (6.0.x) on the build agent, ensuring the pipeline uses the required SDK for building the .NET application. This task downloads and caches the SDK, making it available for subsequent tasks like DotNetCoreCLI@2.

Answer

NuGetToolInstaller@1

Answer

DotNetCoreCLI@2

Answer

PowerShell@2

Question 3

You have a release pipeline that deploys to multiple stages. You want to ensure that a manual approval is required before deploying to the production stage. Which approach should you use?

Accepted Answer

Add a pre-deployment approval on the production stage.. Pre-deployment approvals in Azure Pipelines allow you to require manual sign-off before a release proceeds to a specific stage. By adding a pre-deployment approval on the production stage, the pipeline will pause and wait for designated approvers to approve the deployment, ensuring that no code reaches production without explicit authorization.

Answer

Add a post-deployment approval on the staging stage.

Answer

Configure a deployment gate with a manual intervention task.

Answer

Use a pipeline decorator to inject approval step.

Question 4

You have a YAML pipeline that uses a multi-stage build. You want to cache the restored NuGet packages across builds to improve performance. Which caching strategy should you use?

Accepted Answer

Use the Cache@2 task with key: 'nuget | "$(Agent.OS)" | packages.lock.json', path: '$(System.DefaultWorkingDirectory)/packages'. Option A is correct because the Cache@2 task is the recommended way to cache NuGet packages in Azure Pipelines. By using a cache key that includes the agent OS and the packages.lock.json file, the cache is invalidated only when the lock file changes, ensuring restored packages are reused across builds. The path points to the NuGet global packages folder, which is typically $(System.DefaultWorkingDirectory)/packages when NUGET_PACKAGES is set.

Answer

Use the NuGetCommand@2 task with the -Cache argument.

Answer

Set the NUGET_PACKAGES environment variable to a custom path and rely on pipeline caching plugin.

Answer

Use the DotNetCoreCLI@2 task with the --no-restore flag and manually copy packages.

Question 5

You need to run a set of tasks only when the build pipeline runs for the main branch. Which condition should you add to the job or step?

Accepted Answer

condition: eq(variables['Build.SourceBranch'], 'refs/heads/main'). Option A is correct because the `Build.SourceBranch` variable in Azure Pipelines contains the full Git ref (e.g., `refs/heads/main`). Using `eq(variables['Build.SourceBranch'], 'refs/heads/main')` ensures the condition evaluates to true only when the pipeline runs on the main branch. This is the standard way to filter by branch in YAML pipeline conditions.

Answer

condition: eq(variables['Build.SourceBranch'], 'main')

Answer

condition: and(succeeded(), eq(variables['System.PullRequest.TargetBranch'], 'main'))

Answer

condition: ne(variables['Build.Reason'], 'PullRequest')

Question 6

You have a YAML pipeline with multiple jobs that need to run in parallel. However, one job depends on artifacts produced by a previous job. How should you configure the dependency?

Accepted Answer

Set dependsOn on the dependent job and use PublishBuildArtifacts and DownloadBuildArtifacts tasks.. Option A is correct because in Azure DevOps YAML pipelines, job dependencies are explicitly declared using the `dependsOn` keyword, and artifacts must be published and downloaded using `PublishBuildArtifacts` and `DownloadBuildArtifacts` tasks (or the `publish` and `download` pipeline decorators). Without explicit artifact sharing, outputs from one job are not automatically available to another job, even if `dependsOn` is set.

Answer

Use the 'dependsOn' keyword only, artifacts are automatically shared.

Answer

Set the 'condition' to 'eq(variables['Agent.JobStatus'], 'Succeeded')' on the dependent job.

Answer

Use the 'pool' keyword to ensure both jobs run on the same agent.

Question 7

You are designing a release pipeline for a microservices application. Which two strategies can you use to manage configuration across different environments? (Choose two.)

Accepted Answer

Use variable groups linked to Azure Key Vault.. Option A is correct because variable groups linked to Azure Key Vault allow you to securely store and manage secrets (like connection strings and API keys) centrally, and reference them across multiple pipelines and environments without hardcoding sensitive values. This approach integrates with Azure Key Vault's access policies and automatic secret rotation, ensuring configuration consistency and security across environments.

Answer

Use XML transformation tasks for web.config.

Answer

Use multi-stage YAML pipelines with stage-level variables.

Question 8

You have a YAML pipeline that builds a Docker image and pushes it to Azure Container Registry (ACR). You need to ensure the pipeline uses the latest version of Docker and that the build is cached for faster subsequent runs. Which two tasks should you include? (Choose two.)

Accepted Answer

DockerInstaller@0. Option A (DockerInstaller@0) is correct because it ensures the pipeline uses the latest version of Docker by installing or upgrading the Docker engine on the build agent. Option B (Docker@2 with --cache-from) is correct because it enables layer caching by pulling the previously built image from ACR as a cache source, which speeds up subsequent builds by reusing unchanged layers.

Answer

DockerCompose@0

Answer

HelmDeploy@0

Question 9

You are configuring a YAML pipeline that deploys to multiple environments. The pipeline should automatically trigger when changes are pushed to the main branch, but only if the build artifact changes. Which trigger configuration should you use?

Accepted Answer

trigger: paths: include: - src/*. Option B is correct because the `trigger: paths: include: - src/*` configuration specifies that the pipeline should only trigger when changes are pushed to the `main` branch AND those changes affect files under the `src/` directory. This ensures that the pipeline runs only when the build artifact (source code) changes, not for other changes like documentation or configuration files. The `paths` filter works in conjunction with the branch filter to provide fine-grained control over pipeline triggers.

Answer

trigger: branches: include: - main

Answer

pr: branches: include: - main

Answer

resources: containers: - container: myContainer

Question 10

You have a multi-stage YAML pipeline with stages: Build, Test, and Deploy. The Deploy stage requires approval from a specific user group. You want to ensure that the approval request is sent only after the Test stage completes successfully. Which configuration should you use?

Accepted Answer

Define an environment with required approvers and reference it in the Deploy stage.. Option B is correct because Azure Pipelines environments allow you to define required approvers (user groups) that must approve a deployment before it proceeds. By referencing the environment in the Deploy stage, the approval request is automatically triggered only after the preceding Test stage completes successfully, since stages execute sequentially by default.

Answer

Add a manual validation task in the Deploy stage.

Answer

Use the 'condition' keyword: condition: eq(variables['Build.SourceBranch'], 'refs/heads/main')

Answer

Configure branch policies on the main branch.

Question 11

You need to create a build pipeline that runs on a Microsoft-hosted agent. You want to use the latest Ubuntu image. Which YAML snippet should you use?

Accepted Answer

pool: vmImage: 'ubuntu-latest'. Option A is correct because in Azure Pipelines YAML, the `pool` keyword is used to specify the agent pool, and `vmImage` is a sub-property that defines the virtual machine image for Microsoft-hosted agents. Setting `vmImage: 'ubuntu-latest'` within the `pool` section selects the latest Ubuntu LTS image provided by Microsoft, ensuring the build runs on a current, maintained environment.

Answer

pool: name: 'ubuntu-latest'

Answer

agent: vmImage: 'ubuntu-latest'

Answer

resources: vmImage: 'ubuntu-latest'

Question 12

You are designing a pipeline that deploys to an Azure Kubernetes Service (AKS) cluster. You need to securely pass the Kubernetes cluster credentials to the pipeline without hardcoding them. Which approach should you use?

Accepted Answer

Use a variable group linked to Azure Key Vault.. Option B is correct because Azure Key Vault provides a secure, centralized store for secrets like Kubernetes cluster credentials, and linking a variable group to Key Vault allows the pipeline to dynamically retrieve those secrets at runtime without exposing them in the pipeline definition or logs. This approach follows the principle of least privilege and ensures credentials are never hardcoded or stored in plaintext within the pipeline.

Answer

Store credentials in a pipeline variable with 'secret' type.

Answer

Hardcode the credentials in the pipeline YAML.

Answer

Use a secure file in the pipeline library.

Question 13

You have a release pipeline that deploys to multiple stages (Dev, QA, Prod). You want to automatically deploy to Dev and QA after a successful build, but require a manual approval for Prod. Which deployment strategy should you use?

Accepted Answer

Set pre-deployment approvals on the Prod stage.. Pre-deployment approvals control whether a release can start deploying to a stage. By setting a pre-deployment approval on the Prod stage only, Dev and QA will deploy automatically (since they have no approval requirement), while Prod requires manual sign-off before deployment begins. This matches the requirement exactly.

Answer

Set pre-deployment approvals on the Dev and QA stages.

Answer

Use a post-deployment approval on the QA stage.

Answer

Disable the automatic trigger for all stages.

Question 14

Which two actions can you use to validate that a deployment to a staging environment is successful before promoting to production? (Choose two.)

Accepted Answer

Configure gates on the staging environment to check health metrics.. Gates with health checks can monitor metrics like error rates before allowing promotion. Manual intervention with a post-deployment approval also allows a human to validate before proceeding. Both are valid methods.

Answer

Add a manual intervention task in the pipeline.

Answer

Use a pull request to validate the deployment.

Answer

Run a load test as part of the pipeline.

Question 15

You are designing a pipeline that must run tasks in a container. The container needs access to Azure resources using a managed identity. Which two configurations are required? (Choose two.)

Accepted Answer

Enable a system-assigned managed identity on the agent VM.. Option A is correct because a system-assigned managed identity on the agent VM allows the container to authenticate to Azure resources without storing credentials. Option D is correct because setting the 'identity' field in the container resource definition explicitly assigns that managed identity to the container, enabling it to request tokens from Azure AD for resource access.

Answer

Use the 'docker login' command in the pipeline.

Answer

Add a service principal connection to the pipeline.

Answer

Use the Azure CLI task with '–identity' flag.