AZ-400 Design and implement build and release pipelines Practice Test 20 — 15 Questions

Question 1

Your organization uses Azure Pipelines to deploy a web application to multiple Azure App Service instances across regions. You need to implement a deployment strategy that allows rolling back to the previous version quickly if issues are detected. Which TWO strategies should you recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use blue-green deployment with a traffic manager endpoint.. The correct answers are D and E. Blue-green deployment with a traffic manager endpoint allows you to quickly route traffic back to the previous version if issues are detected. Deploying to a staging slot and then swapping with production (slot swap) enables instant rollback by swapping back to the previous slot. Option A (rolling update) does not provide instant rollback because it requires redeployment. Option B (canary deployment) is designed for gradual traffic shifting, not immediate rollback. Option C (storing artifacts) is a good practice but does not itself constitute a deployment strategy for rollback.

Answer

Use a rolling update with incremental deployment.

Answer

Implement a canary deployment with traffic splitting.

Answer

Store previous deployment artifacts in Azure Blob Storage.

Question 2

Your team uses GitHub Actions to build a Docker image and push it to Azure Container Registry (ACR). The workflow fails with the error 'unauthorized: authentication required'. The workflow uses the 'azure/docker-login@v1' action. What is the most likely cause?

Accepted Answer

The service principal used for authentication lacks the AcrPush role on the ACR.. The 'azure/docker-login@v1' action authenticates Docker with Azure Container Registry using a service principal. If the service principal lacks the AcrPush role, Docker login succeeds but the subsequent push fails with 'unauthorized: authentication required' because the identity does not have permission to push images. The error occurs at push time, not login time, which is a key diagnostic clue.

Answer

The 'azure/docker-login@v1' action does not support ACR.

Answer

The Dockerfile is not in the repository root.

Answer

The workflow uses the registry admin credentials, which are disabled.

Question 3

Your organization uses Azure Pipelines to deploy a web application to multiple Azure App Service instances across regions. You need to implement a deployment strategy that allows rolling back to the previous version quickly if issues are detected. Which TWO strategies should you recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the Terraform Cloud backend with remote operations.. Both Azure Storage backend (D) and Terraform Cloud backend (B) satisfy the requirement of secure state storage and locking. Azure Storage uses blob leases; Terraform Cloud uses its own locking mechanism. The original explanation only justifies D but does not explain why B is incorrect, and it cannot be considered incorrect as written.

Answer

Store the state file in a Git repository with LFS.

Answer

Store the state file in Azure Pipelines secure files.

Question 4

Your team uses Azure Pipelines to build a React application. The build process runs npm install, npm test, and npm run build. The build succeeds, but the application loads slowly in the browser due to large bundle sizes. What should you add to the pipeline to optimize the build?

Accepted Answer

Add a step to run Webpack bundle analyzer and implement code splitting.. The issue is large bundle sizes causing slow load times. Running Webpack bundle analyzer identifies which modules contribute most to the bundle, and implementing code splitting (e.g., dynamic imports or React.lazy) allows splitting the bundle into smaller chunks loaded on demand, reducing initial payload size.

Answer

Add a step to cache the node_modules folder.

Answer

Add a step to minify JavaScript using Terser.

Answer

Add a step to run additional unit tests to catch performance issues.

Question 5

You need to ensure that only specific branches can trigger a release to production in Azure Pipelines. What should you configure?

Accepted Answer

Add a branch filter to the release pipeline's artifact trigger.. A branch filter on the release pipeline's artifact trigger allows you to specify which branches of the source artifact (e.g., a build pipeline) should automatically trigger a release. By configuring this filter to only include branches like 'main' or 'release/*', you ensure that only builds from those specific branches can initiate a release to production, providing precise control over deployment triggers.

Answer

Add an approval gate that requires a manager to approve the release.

Answer

Add a deployment gate that checks the source branch.

Answer

Add a branch filter to the build pipeline trigger.

Question 6

Your team uses a YAML-based build pipeline in Azure Pipelines. You need to ensure that the pipeline runs automatically when a pull request is created against the main branch, but only if the changes include modifications to the 'src/' directory. Which trigger configuration should you use?

Accepted Answer

trigger: none; pr: branches: include: - main paths: include: - src/*. It sets `trigger: none` to disable CI triggers on commits, and uses a PR trigger with `branches: include: - main` and `paths: include: - src/*` to ensure the pipeline only runs automatically when a pull request targets the main branch and the changes include modifications to the 'src/' directory. This configuration meets the requirement of conditional PR-triggered builds based on file paths.

Answer

trigger: - main; pr: none

Answer

trigger: none; pr: - main

Answer

pr: - main; trigger: - main

Question 7

Your Azure Pipelines release pipeline deploys to multiple stages. You need to implement a manual approval gate that requires two specific users to approve before deployment proceeds to production. The approval should expire after 8 hours. Which configuration should you use?

Accepted Answer

Pre-deployment conditions: Add approvers (user1, user2) with 'All' policy and set timeout to 480 minutes. It configures a pre-deployment approval gate requiring both user1 and user2 to approve (the 'All' policy) before the production stage proceeds, and sets the timeout to 480 minutes (8 hours) to expire the approval request. This matches the requirement for two specific users to approve and an 8-hour expiration.

Answer

Pre-deployment conditions: Add approvers (user1, user2) with 'Any one' policy

Answer

Pre-deployment conditions: Add approvers (user1, user2) with 'All' policy and set 'Allow deployment without approval' to true

Answer

Post-deployment conditions: Add approvers (team) with 'All' policy

Question 8

Your build pipeline uses a hosted agent. You notice that every build starts with a clean workspace, increasing build time. You want to improve performance by caching the Node.js 'node_modules' folder. Which task should you add to the pipeline?

Accepted Answer

Cache task. The Cache task (option D) is correct because it allows you to cache the 'node_modules' folder between pipeline runs on hosted agents, avoiding the need to reinstall dependencies from scratch each time. By specifying a cache key (e.g., based on package-lock.json) and the path to cache, subsequent builds can restore the folder from cache, significantly reducing build time.

Answer

Publish Build Artifacts task

Answer

Copy Files task

Answer

Download Build Artifacts task

Question 9

You have the YAML pipeline snippet shown in the exhibit. The first run produces version 1.0.0. What will be the version produced on the third run?

Accepted Answer

1.0.2. The YAML pipeline uses a counter expression `$[counter(format('{0}.{1}', variables['major'], variables['minor']), 0)]` for the patch version. The counter starts at 0 for the first run, producing version 1.0.0. Each subsequent run increments the counter by 1, so the second run produces 1.0.1, and the third run produces 1.0.2. Therefore, option C is correct.

Answer

1.0.1

Answer

1.0.3

Answer

1.0.0

Question 10

Your release pipeline deploys to Azure App Service using a deployment slot. You need to ensure that after swapping slots, the staging slot retains the previous production configuration for rollback. Which deployment strategy should you use?

Accepted Answer

Swap with preview. Swap with preview (multi-phase swap) is the correct strategy because it uses Azure App Service deployment slots to validate the staged version before completing the swap. When the swap is completed, the staging slot receives the previous production code and configuration, preserving a rollback state. If a problem occurs, you can swap back to the staging slot. Note that a standard slot swap also preserves the previous production state in staging, but swap with preview adds the benefit of preview validation before finalizing the swap, which aligns with the requirement of maintaining rollback capability.

Answer

Rolling deployment

Answer

Blue-green deployment

Answer

Canary deployment

Question 11

You need to integrate security scanning into your build pipeline to detect vulnerable open-source dependencies. Which Azure DevOps extension should you use?

Accepted Answer

WhiteSource Bolt. WhiteSource Bolt is a free Azure DevOps extension that integrates directly into build pipelines to automatically scan open-source dependencies for known vulnerabilities. It identifies vulnerable components, provides remediation guidance, and enforces security policies without requiring additional configuration or external tools, making it the correct choice for this scenario.

Answer

Azure Policy

Answer

GitHub Advanced Security

Answer

SonarQube

Question 12

Your build pipeline runs on a self-hosted agent pool. You need to ensure that only authorized pipelines can use these agents. Which security measure should you implement?

Accepted Answer

Set permissions on the agent pool. Agent pool permissions allow restricting which pipelines can use the agents, ensuring only authorized pipelines can access the self-hosted agents. Option B (agent tokens) is for registering agents, not for authorizing pipelines. Option C (variable groups) is for storing variables and secrets, not for agent access control. Option D (agent queues) is a legacy concept that does not provide granular pipeline-level permissions.

Answer

Use agent tokens

Answer

Use variable groups

Answer

Configure agent queues

Question 13

You run the Azure CLI command shown in the exhibit as part of a release pipeline to deploy a ZIP package to an Azure App Service. The deployment succeeds, but the app does not start. What is the most likely cause?

Accepted Answer

The app's startup command is not configured. The Azure CLI command `az webapp deploy` deploys the ZIP package to the App Service, but it does not configure the startup command. If the application (e.g., a Node.js or Python app) requires a specific startup file or script (like `npm start` or `gunicorn`), the App Service will fail to start because it defaults to a generic handler. The startup command must be set via the `--startup-file` parameter in `az webapp config set` or in the Azure portal.

Answer

The resource group name is incorrect

Answer

The runtime stack is not specified in the command

Answer

The deployment slot is not specified

Question 14

Your team uses GitHub for source control and wants to set up continuous integration using GitHub Actions. Which file should you create in the repository to define the workflow?

Accepted Answer

.github/workflows/ci.yml. GitHub Actions workflows are defined in YAML files stored in the .github/workflows directory. Option A is wrong because a Jenkinsfile is used with Jenkins, not GitHub Actions. Option C is wrong because a Dockerfile is used to build Docker images, not to define CI workflows. Option D is wrong because azure-pipelines.yml is for Azure Pipelines, not GitHub Actions.

Answer

Jenkinsfile

Answer

Dockerfile

Answer

azure-pipelines.yml

Question 15

Which TWO conditions must be met for a self-hosted agent to be used in an Azure Pipelines agent pool? (Choose two.)

Accepted Answer

The agent must have network access to Azure Pipelines.. A self-hosted agent must have outbound network connectivity to Azure Pipelines (specifically to the Azure DevOps service endpoints) in order to receive job assignments, download tasks, and report status. Without this network access, the agent cannot communicate with the orchestration layer and will remain offline. This is a fundamental requirement for any agent, whether hosted or self-hosted.

Answer

The agent must be in the Default pool.

Answer

The agent must run on Windows Server.

Answer

The agent must be installed on a virtual machine.