AZ-400 Design and implement build and release pipelines Practice Test 21 — 15 Questions

Question 1

Refer to the exhibit. You have a YAML pipeline that deploys an ARM template. The pipeline runs successfully on the first commit to main, but subsequent commits fail with 'The resource group myResourceGroup already exists'. How should you modify the pipeline to avoid this error?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a condition to check if the resource group exists before creating it.. Adding a condition to check if the resource group exists before creating it avoids the error when the resource group already exists from a previous deployment. Options A, C, and D are incorrect: changing the location (A) does not prevent the existence error, using a different service connection (C) does not address resource group existence, and renaming the pipeline (D) triggers a new pipeline but does not affect resource group existence.

Answer

Change the location to a different region.

Answer

Use a different service connection for each deployment.

Answer

Rename the pipeline to trigger a clean build.

Question 2

Which TWO actions should you take to implement a secure CI/CD pipeline that uses Azure Pipelines and prevents unauthorized access to production? (Choose two.)

Accepted Answer

Configure deployment approvals and checks on the production stage.. Deployment approvals and checks in Azure Pipelines require manual sign-off or automated policy validation before a release proceeds to production, preventing unauthorized or unverified changes. Option D is correct because using a service connection with a managed identity eliminates the need to store static credentials, reducing the risk of credential exposure and unauthorized access to Azure resources during deployment.

Answer

Store production secrets as pipeline variables marked as 'Secret'.

Answer

Enable PR triggers for the production stage to validate changes.

Answer

Use self-hosted agents running on-premises for all pipelines.

Question 3

Which TWO practices help improve the security of container images in a CI/CD pipeline? (Choose two.)

Accepted Answer

Sign container images to verify their integrity.. Option C is correct because signing container images (e.g., with Docker Content Trust/Notary or Sigstore Cosign) creates a cryptographic signature that lets the pipeline and runtime verify image integrity and provenance, preventing tampered or spoofed images from being deployed. Option E is correct because integrating an image vulnerability scanner (such as Trivy, Clair, or Grype) into the build stage detects known CVEs in OS packages and dependencies early, allowing the pipeline to fail or block promotion of vulnerable images. Option A is wrong because running containers as root increases the attack surface and violates least-privilege; non-root users or user namespaces should be used instead. Option B is wrong because public registries expose images to unauthorized pulls and tampering; private, access-controlled registries are preferred. Option D is wrong because the mutable 'latest' tag is non-deterministic and can silently pull unvetted or breaking changes; pinned, immutable tags or digests should be used.

Answer

Run containers with root privileges to avoid permission issues.

Answer

Store container images in a public registry for easy access.

Answer

Use the 'latest' tag for base images to always get the newest patches.

Question 4

Your team uses Azure DevOps to deploy a Node.js web app to Azure App Service on Linux. The build pipeline runs `npm install` and `npm run build`, then publishes the `dist` folder. The release pipeline uses the 'Azure App Service deploy' task. Recently, deployments fail intermittently with 'ERR_MODULE_NOT_FOUND' for a custom module. The module is listed in `package.json` and is present in the `node_modules` folder on the build agent. What is the most likely cause?

Accepted Answer

The build artifact does not include node_modules; the app requires them at runtime.. The most likely cause is that the build artifact does not include the `node_modules` folder. The build pipeline runs `npm install` and `npm run build`, which installs dependencies on the build agent, but only the `dist` folder is published as the artifact. At deployment time, the Azure App Service on Linux expects the `node_modules` folder to be present in the deployed artifact because it does not automatically run `npm install` for Node.js apps on Linux (unlike Windows-based App Services). Without `node_modules`, the app cannot resolve custom modules at runtime, leading to the `ERR_MODULE_NOT_FOUND` error.

Answer

The 'Azure App Service deploy' task modifies package.json during deployment.

Answer

The 'Azure App Service deploy' task runs npm install on the target, but it fails due to network restrictions.

Answer

The deployment slot's Kudu service fails to sync the dist folder.

Question 5

You are designing a multi-stage YAML pipeline for a .NET Core application. The pipeline must build, test, and deploy to a staging environment. You want to ensure that the deployment stage only runs if the build and test stages succeed, and that the staging deployment uses the exact same bits that were built. Which strategy should you use?

Accepted Answer

Create separate stages for build, test, and deploy. Use the 'dependsOn' keyword and publish artifact in build stage, download in deploy stage.. Using separate stages with 'dependsOn' ensures the deployment stage only runs after successful build and test stages. Publishing the build artifact in the build stage and downloading it in the deploy stage guarantees that the exact same compiled bits are used for deployment, maintaining consistency across environments.

Answer

Set up a release pipeline that uses the same build artifact and requires manual approval.

Answer

Use a build trigger on the staging branch to deploy after each commit, ignoring test results.

Answer

Define the pipeline with a single stage and use a condition to skip test on failure.

Question 6

You are implementing a build pipeline for a .NET application that uses GitHub Advanced Security (GHAS) for code scanning. The pipeline must run CodeQL analysis on every pull request to the main branch. You have added the CodeQL task to the pipeline. However, the analysis results are not appearing in the 'Security' tab of the repository on GitHub. What is the most likely cause?

Accepted Answer

The pipeline is missing the 'Publish Security Analysis Logs' step to upload SARIF results to GitHub.. CodeQL analysis results are uploaded to GitHub as SARIF files. Without the 'Publish Security Analysis Logs' step (or the equivalent 'upload-sarif' action), the SARIF file generated by CodeQL is not sent to GitHub, so the findings never appear in the Security tab. The pipeline must explicitly include this step to complete the integration with GitHub Advanced Security.

Answer

The GitHub repository is private, so security alerts are disabled.

Answer

The .NET project is not supported by CodeQL.

Answer

CodeQL analysis is not supported on pull request triggers.

Question 7

Your team uses Azure Pipelines to deploy a Docker container to Azure Kubernetes Service (AKS). The pipeline builds a Docker image, pushes it to Azure Container Registry (ACR), and then runs a deployment to AKS. You want to ensure that the deployment uses the exact image that was built in the same pipeline run. Which approach should you use?

Accepted Answer

Generate a unique tag (e.g., Build.BuildId) and pass it to both the Docker build and Kubernetes manifest via variable substitution.. Using a unique tag like Build.BuildId ensures that the exact image built in the pipeline is referenced in the Kubernetes manifest. This prevents deployment from accidentally using a stale or overwritten image, as the tag is unique per run and passed consistently via variable substitution from the Docker build to the deployment YAML.

Answer

Use two separate pipelines: one for build/push, one for deploy, and share the image tag via a variable group.

Answer

Use a single task for build and push, and rely on ACR's internal pull-through cache.

Answer

Tag the image as 'latest' and reference it in the Kubernetes manifest.

Question 8

You are setting up a release pipeline for a web application. The pipeline must deploy to three environments: Dev, Test, and Prod. The deployment to Prod must be triggered only after a successful deployment to Test and after a manual approval. How should you configure the pipeline?

Accepted Answer

Add a pre-deployment approval gate on the Prod environment.. In Azure Pipelines, environment-level checks such as pre-deployment approvals are the correct mechanism to gate a stage on human authorization. Approvals configured on the Prod environment (or on a service connection) block the deployment until an approver signs off, and the stage's dependency on Test ensures it only runs after Test succeeds. This combines the two required conditions — Test success and manual approval — declaratively.

Answer

Add a manual intervention task before the Prod deployment in the pipeline.

Answer

Use a condition on the Prod stage to require success from Test and manual intervention variable.

Answer

Schedule the Prod deployment to run after Test, and require manual trigger.

Question 9

Your organization uses GitHub Actions for CI/CD. You have a workflow that builds a .NET application and runs tests. The workflow uses a self-hosted runner on an on-premises Windows server. Recently, builds started failing with 'Access to the path is denied' errors when the runner tries to restore NuGet packages. The runner has been working for months. What is the most likely cause?

Accepted Answer

The runner service account's permissions have changed, and it no longer has write access to the working directory or cache.. The 'Access to the path is denied' error during NuGet restore on a self-hosted runner typically indicates a file system permission issue. Since the runner has been working for months, the most likely cause is that the service account under which the runner runs no longer has write access to the working directory or the NuGet cache folder, often due to a group policy change, account modification, or folder permission drift.

Answer

The runner's authentication token to GitHub has expired.

Answer

The NuGet cache directory on the runner has been deleted.

Answer

The runner has been updated to a newer version that no longer supports NuGet restore.

Question 10

You are designing a build pipeline for a Python application that uses Anaconda environments. The pipeline must create a Conda environment, install dependencies, and run tests. The pipeline should also cache the Conda environment to speed up subsequent builds. Which configuration should you use?

Accepted Answer

Use the 'CondaEnvironment' task to create the environment, and use the 'Cache' task to cache the Conda packages folder.. The 'CondaEnvironment' task is purpose-built for creating and updating Conda environments from an environment.yml file, and combining it with the 'Cache' task to cache the Conda packages folder (typically `$(Pipeline.Workspace)/conda_pkgs`) significantly reduces build time by avoiding re-downloading packages on subsequent runs. This approach aligns with Azure DevOps best practices for dependency caching and Conda environment management.

Answer

Use the 'UsePythonVersion' task with a version spec, and add a script to create the Conda environment.

Answer

Use a Docker container with Anaconda pre-installed and run the pipeline inside the container.

Answer

Use a script to run 'conda create' and 'conda install', and manually cache the environment by specifying a path.

Question 11

Which TWO actions are required to securely use Azure Key Vault secrets in an Azure Pipelines build? (Choose 2)

Accepted Answer

Use the 'Azure Key Vault' task to download secrets as pipeline variables.. The Azure Key Vault task in Azure Pipelines is the recommended way to securely download secrets from a Key Vault and expose them as pipeline variables. This task automatically handles authentication and ensures that secret values are masked in logs, preventing accidental exposure. It eliminates the need to manually manage secret retrieval and mapping in YAML. For the task to succeed, the Azure DevOps service principal (from the Azure Resource Manager service connection) must have 'Get' and 'List' permissions on the Key Vault. Without these permissions, the task cannot retrieve the secrets. Therefore, both using the Azure Key Vault task and granting the appropriate permissions are required actions.

Answer

Set the 'secrets' output variable to 'true' in the pipeline.

Answer

Use the 'Environment Variables' section in the pipeline to map secrets.

Answer

Reference the secret identifier directly in the pipeline YAML.

Question 12

Which THREE are true about using deployment groups in Azure Pipelines? (Choose 3)

Accepted Answer

Each machine in a deployment group must have the Azure Pipelines agent installed.. Each target machine in a deployment group requires the Azure Pipelines agent (either the Windows or Linux agent) to be installed and configured. The agent is responsible for executing the deployment tasks on that machine, and without it, the deployment group cannot communicate with or deploy to the machine.

Answer

Deployment groups can only be used with Windows-based machines.

Answer

Deployment groups are tied to a specific environment.

Question 13

Your team uses GitHub Actions to build and deploy a static website to Azure Storage. The workflow uses the 'azure/storage-blob-upload' action to deploy to a storage account static website. Recently, deployments started failing with 'Error: Failed to get credentials'. The workflow uses OpenID Connect (OIDC) for authentication. What is the most likely cause?

Accepted Answer

The service principal used for OIDC does not have the 'Storage Blob Data Contributor' role on the storage account.. The 'azure/storage-blob-upload' action requires the service principal used for OIDC authentication to have the 'Storage Blob Data Contributor' role on the storage account to upload static website content. Without this role, the action fails to obtain credentials for blob write operations, resulting in the 'Failed to get credentials' error.

Answer

The storage account firewall is blocking the GitHub Actions IP range.

Answer

The OIDC configuration in GitHub is missing the 'client secret' field.

Answer

The 'azure/storage-blob-upload' action does not support static websites.

Question 14

Your team uses Azure Pipelines for CI/CD. A release pipeline fails intermittently during deployment to an Azure App Service slot. The error message indicates 'Failed to fetch access token for Azure Resource Manager service endpoint.' The service principal used has been granted Contributor role on the resource group. The issue resolves after re-creating the service connection in Azure DevOps. What is the most likely cause?

Accepted Answer

The service principal client secret has expired.. Service principal credentials (client secret) can expire, causing intermittent token fetch failures. Re-creating the service connection generates a new secret, temporarily resolving the issue until it expires again. Option B is wrong because the service connection is bound to the service principal, not the user who created it; removing the user does not affect the existing connection. Option C is wrong because network restrictions would cause consistent failure, not intermittent. Option D is wrong because the service principal already has the Contributor role on the resource group.

Answer

The user who created the service connection has been removed from Azure DevOps.

Answer

The Azure DevOps organization is behind a firewall that blocks outbound requests to Azure Resource Manager.

Answer

The service principal lacks the required role on the target resource group.

Question 15

You are designing a build pipeline for a Node.js application. The pipeline must run unit tests and publish code coverage results to Azure Pipelines. Which task should you use to ensure coverage results are available in the pipeline summary?

Accepted Answer

PublishCodeCoverageResults@1. The PublishCodeCoverageResults@1 task is specifically designed to publish code coverage results (e.g., Cobertura, JaCoCo, or .coverage formats) to Azure Pipelines, making them visible in the pipeline summary and the Tests tab. This task consumes coverage data files generated by a previous test run and integrates them into the pipeline's reporting UI.

Answer

PublishTestResults@2

Answer

VSTest@2

Answer

CopyFiles@2