AZ-400 Design and implement build and release pipelines Practice Test 20 — 15 Questions

Question 1

You are designing a release pipeline for a critical application that requires zero-downtime deployments. The application runs on Azure Kubernetes Service (AKS) with multiple replicas. You are using Azure Pipelines with a canary deployment strategy. What is the best approach to gradually shift traffic to the new version while monitoring for errors?

Accepted Answer

Use a service mesh like Istio to route a percentage of traffic to the new version.. Option B is correct because AKS native features for canary deployments using Istio or similar service mesh provide fine-grained traffic shifting. Option A is incorrect because blue-green with full swap does not allow gradual traffic shift. Option C is incorrect because rolling update in AKS is not canary; it replaces pods gradually but does not split traffic. Option D is incorrect because using Application Gateway does not provide gradual traffic shift at the pod level.

Answer

Use Azure Application Gateway as an ingress controller with weighted backend pools.

Answer

Use the AKS rolling update strategy with max surge.

Answer

Deploy to a staging environment, then swap VIPs with production.

Question 2

Your development team uses GitHub Actions for CI/CD. You need to ensure that secrets stored in GitHub repository secrets are not exposed in build logs. What is the best practice?

Accepted Answer

Store secrets in GitHub repository secrets and reference them in workflows using ${{ secrets.SECRET_NAME }}. GitHub automatically masks secrets in logs.. Option A is correct because GitHub automatically redacts secrets in logs. Option B is incorrect because masking is automatic, not manual. Option C is incorrect because secrets should be stored in repository secrets, not environment variables in YAML. Option D is incorrect because adding a step to delete logs does not prevent exposure.

Answer

Use a custom action to manually mask secrets in the logs.

Answer

Define secrets as environment variables directly in the workflow YAML.

Answer

After the workflow runs, delete the logs from GitHub.

Question 3

Your organization uses Azure Pipelines to build and deploy a .NET Core application to Azure App Service. The build pipeline takes 15 minutes. You want to implement continuous integration (CI) triggers but only for changes to the 'src' folder. The repository is in Azure Repos. How should you configure the trigger?

Accepted Answer

Set trigger: paths: include: - 'src/*'. Option C is correct because specifying paths in the trigger filters CI builds to only that path. Option A is incorrect because it excludes a path. Option B is incorrect because the branch filter is not needed and path is not specified. Option D is incorrect because batch changes are not relevant.

Answer

Set trigger: paths: exclude: - 'src/*'

Answer

Set trigger: branches: include: - main

Answer

Set trigger: batch: true

Question 4

You are managing a pipeline that deploys a microservices application to multiple Azure Kubernetes Service (AKS) clusters in different regions. You want to implement a progressive exposure strategy where the deployment first goes to a small cluster (canary), then to a medium cluster, and finally to all clusters. The deployment should be automated but with the ability to halt if errors occur. What should you use?

Accepted Answer

Use deployment gates with evaluation of health metrics (e.g., error rate) before proceeding to the next stage.. Option B is correct because deployment gates with metrics evaluation allow progressive exposure and automated halt. Option A is incorrect because approvals are manual. Option C is incorrect because manual validation steps require human intervention. Option D is incorrect because rolling deployment strategy is not about progressive exposure across clusters.

Answer

Use manual approval gates between stages.

Answer

Configure a rolling deployment strategy on each cluster.

Answer

Use a manual validation step in the pipeline.

Question 5

Your team uses Azure Pipelines for CI/CD. The pipeline builds a Docker image and pushes it to Azure Container Registry (ACR). You need to ensure that only the main branch triggers a build of the Docker image. What should you configure in the pipeline YAML?

Accepted Answer

Set 'trigger: branches: include: - main'. Option A is correct because the 'trigger' section with branch inclusion filters which branches trigger the pipeline. Option B is incorrect because it triggers on any branch. Option C is incorrect because the 'pr' trigger is for pull requests. Option D is incorrect because the condition evaluates at runtime, not at trigger time.

Answer

Set 'pr: branches: include: - main'

Answer

Add a condition: 'eq(variables['Build.SourceBranch'], 'refs/heads/main')' to the job.

Answer

Set 'trigger: branches: include: - *'

Question 6

You are designing a release pipeline for a Node.js application that deploys to Azure App Service. The pipeline must run integration tests against the deployed application. You want to use deployment slots to minimize downtime. What is the recommended approach?

Accepted Answer

Deploy to a staging slot, run tests against the staging slot, then swap to production.. Option C is correct because deploying to a staging slot, running tests, then swapping ensures zero downtime. Option A is incorrect because deploying to production directly causes downtime. Option B is incorrect because running tests before swap does not validate the deployed app. Option D is incorrect because deploying to staging then deleting the slot loses the deployed app.

Answer

Deploy to the production slot directly and run tests after deployment.

Answer

Deploy to a staging slot, swap, then run tests.

Answer

Deploy to a staging slot, run tests, then delete the staging slot.

Question 7

Your company uses GitHub Actions to build and deploy a Python application. The workflow includes a job that runs on a self-hosted runner. You need to ensure that sensitive environment variables are not exposed in the workflow logs. What is the best approach?

Accepted Answer

Use GitHub environment secrets and mark the secret as sensitive to ensure it is masked in logs.. Option D is correct because marking a secret as sensitive or using environment secrets with masking ensures they are redacted. Option A is incorrect because environment variables are not automatically masked. Option B is incorrect because storing in repository secrets and referencing them is good, but they are still masked in logs automatically; however, the question asks for best approach to ensure no exposure, and using environment secrets provides additional scoping. Option D is the most comprehensive.

Answer

Use a custom action to read secrets from a file.

Answer

Store secrets in GitHub repository secrets and reference them in the workflow.

Answer

Define the variables directly in the workflow YAML.

Question 8

You are configuring a continuous integration trigger in Azure Pipelines for a repository in Azure Repos. You want to trigger a build for all branches except the 'release' branch. How should you configure the trigger?

Accepted Answer

Set trigger: branches: include: - '*' exclude: - release. Option C is correct because using 'include' for all branches and 'exclude' for the release branch achieves the desired behavior. Option A is incorrect because it only includes main. Option B is incorrect because it excludes all branches. Option D is incorrect because the syntax is invalid.

Answer

Set trigger: branches: include: - main

Answer

Set trigger: branches: include: - '*' exclude: - '*'

Answer

Set trigger: branches: exclude: - release

Question 9

Which TWO actions should you take to implement a gated deployment strategy in Azure Pipelines?

Accepted Answer

Use deployment gates to evaluate metrics like error rate before allowing the next stage.. Options B and D are correct. Approval gates and deployment gates with health evaluation are key components of gated deployment. Option A is not specific to gated deployment. Option C is about monitoring, not gating. Option E is about rollback, not gating.

Answer

Configure a dashboard to monitor application health.

Answer

Use a multi-stage YAML pipeline.

Answer

Configure a rollback strategy if deployment fails.

Question 10

Which THREE options are valid strategies for implementing progressive exposure in Azure Pipelines?

Accepted Answer

Ring-based deployment.. Options A, C, and D are correct. Canary, blue-green, and ring-based deployments are all progressive exposure strategies. Option B is not progressive exposure; it's a deployment method. Option E is a deployment strategy but not typically progressive exposure.

Answer

Rolling update.

Answer

Immutable infrastructure.

Question 11

Which TWO tools can be used to manage feature flags in Azure DevOps pipelines?

Accepted Answer

LaunchDarkly.. Options A and D are correct. Azure App Configuration provides feature management. LaunchDarkly is a third-party tool that integrates. Options B, C, and E are not feature flag management tools.

Answer

Azure Policy.

Answer

Azure Monitor.

Answer

Azure Key Vault.

Question 12

Your team uses GitHub Actions for CI/CD. You need to ensure that secrets stored in GitHub repository secrets are not exposed in build logs. Which security practice should you implement?

Accepted Answer

Use GitHub Actions secrets and ensure they are marked as masked. Option B is correct because marking secrets as masked prevents them from appearing in logs. Option A is wrong because storing secrets in code is insecure. Option C is wrong because secrets in environment variables can still be logged if not masked. Option D is wrong because it does not prevent exposure in logs.

Answer

Store secrets in a YAML file within the repository

Answer

Pass secrets as environment variables in the workflow

Answer

Use a third-party secret management service and fetch secrets at runtime

Question 13

You have an Azure DevOps pipeline that deploys to multiple environments. You need to ensure that approvals are required before production deployment. Which pipeline configuration should you use?

Accepted Answer

Define an environment with required approvers for the production stage. Option C is correct because environment-level approvals gate the deployment. Option A is wrong because branch policies do not control approvals. Option B is wrong because stage-level approvals can be used but environment approvals are more granular. Option D is wrong because manual triggers do not enforce approvals.

Answer

Set the pipeline trigger to 'Manual' only

Answer

Add a 'Manual Intervention' task in the pipeline

Answer

Configure branch policies on the main branch

Question 14

You are designing a multi-stage YAML pipeline in Azure DevOps that builds, tests, and deploys a .NET Core application. The pipeline must use a self-hosted agent pool for compliance. You need to minimize agent idle time while ensuring that the agent is always available for builds. What should you do?

Accepted Answer

Deploy a scale set agent pool with autoscaling enabled. Option D is correct because scaling set with autoscaling adjusts capacity based on demand. Option A is wrong because scaling set without autoscaling does not minimize idle time. Option B is wrong because persistent agents are always running, causing idle time. Option C is wrong because multiple agents still run idle if not scaled.

Answer

Provision a virtual machine scale set with a fixed number of agents

Answer

Install multiple agents on a single VM to maximize utilization

Answer

Use a single persistent agent and queue builds when idle

Question 15

You have a pipeline that uses Azure Repos Git. You need to enforce that all commits to the main branch are associated with a work item. Which branch policy should you enable?

Accepted Answer

Require linked work items. Option B is correct because 'Require linked work items' enforces that each commit or PR has a work item. Option A is wrong because it only requires comments. Option C is wrong because it only checks build status. Option D is wrong because it limits who can push, not work item linking.

Answer

Limit merge types

Answer

Require a minimum number of reviewers

Answer

Check for comment resolution