AZ-400 Design and implement build and release pipelines Practice Test 21 — 15 Questions

Question 1

Your release pipeline uses deployment groups to deploy to Windows servers. You need to securely pass credentials to a script that runs on target machines. What is the recommended approach?

Accepted Answer

Use Azure Key Vault task to fetch secrets during deployment. Option A is correct because Azure Key Vault integration provides secure secret storage and retrieval. Option B is wrong because storing in pipeline variables exposes secrets. Option C is wrong because environment variables can be logged. Option D is wrong because plaintext in scripts is insecure.

Answer

Hardcode credentials in the script and encrypt the script file

Answer

Store credentials as pipeline variables and reference them

Answer

Use environment variables on the target machines

Question 2

You need to configure a build pipeline that triggers only when changes are pushed to the 'release/*' branch. Which trigger configuration should you use?

Accepted Answer

Set 'trigger: branches: include: - release/*'. Option C is correct because specifying a branch filter with wildcard triggers on release branches. Option A is wrong because it triggers on all branches. Option B is wrong because it disables CI. Option D is wrong because it triggers on tags only.

Answer

Set 'trigger: none' in YAML

Answer

Set 'trigger: branches: include: - main'

Answer

Set 'trigger: tags: include: - v*'

Question 3

Your organization uses GitHub Actions. You need to create a reusable workflow that builds and tests a Node.js application. Which approach should you use to define the workflow?

Accepted Answer

Define a reusable workflow with 'on: workflow_call'. Option D is correct because reusable workflows are defined in a separate file with workflow_call trigger. Option A is wrong because it defines a workflow that cannot be reused. Option B is wrong because actions are different from workflows. Option C is wrong because composite actions are for multiple steps, not entire workflows.

Answer

Define a standard workflow in .github/workflows/build.yml

Answer

Use a composite action to encapsulate the build steps

Answer

Create a custom action and reference it in multiple workflows

Question 4

You are deploying a multi-container application to Azure Kubernetes Service (AKS) using Azure Pipelines. You need to ensure that the deployment rollback automatically if the health checks fail. Which strategy should you implement?

Accepted Answer

Configure a rolling update with readiness and liveness probes. Option B is correct because Kubernetes deployment strategy with health probes enables automatic rollback. Option A is wrong because blue-green does not automatically rollback. Option C is wrong because canary does not automatically rollback. Option D is wrong because Helm alone does not provide health check-based rollback.

Answer

Use a blue-green deployment strategy

Answer

Use Helm charts with pre-upgrade hooks

Answer

Implement a canary deployment with manual verification

Question 5

You have a pipeline that builds a Docker image and pushes it to Azure Container Registry. You need to ensure that only the latest successful build image is tagged as 'latest'. Which tagging strategy should you use?

Accepted Answer

Use a conditional step that runs only when the build succeeds to tag the image as 'latest'. Option A is correct because tagging only on successful builds ensures 'latest' reflects the last successful image. Option B is wrong because tagging all images with 'latest' would overwrite even failed builds. Option C is wrong because it does not ensure success. Option D is wrong because it tags all images, not just successful ones.

Answer

Use the build ID as the tag and manually update 'latest'

Answer

Use the Git commit hash as the tag and push 'latest' separately

Answer

Always tag the image as 'latest' regardless of build status

Question 6

Which TWO practices should you adopt to improve the security of your Azure DevOps pipeline? (Choose two.)

Accepted Answer

Grant the least privilege to service connections. Options B and D are correct. B reduces the attack surface by limiting permissions. D ensures secrets are not stored in code. A is wrong because using the default agent may expose the pipeline to untrusted code. C is wrong because it bypasses security reviews.

Answer

Use the default hosted agent for all builds

Answer

Store secrets as plain text in pipeline variables

Answer

Allow contributors to bypass the required reviewer policy

Question 7

Which THREE components are required to implement a GitHub Actions self-hosted runner on a Windows virtual machine? (Choose three.)

Accepted Answer

GitHub Actions runner application installed on the VM. Options A, B, and D are correct. A is the runner agent. B is required for the runner to authenticate. D is the operating system for hosting. C is wrong because GitHub Actions does not require a web server. E is wrong because Docker is optional.

Answer

IIS (Internet Information Services) running on the VM

Answer

Docker Desktop installed on the VM

Question 8

Which TWO features of Azure Pipelines help you manage build artifacts across stages? (Choose two.)

Accepted Answer

Download Pipeline Artifact task. Options A and D are correct. A allows sharing artifacts between stages. D allows downloading artifacts from a previous stage. B is wrong because variables are not artifacts. C is wrong because build tags are for filtering, not artifact management.

Answer

Pipeline variables

Answer

Release gates

Answer

Build tags

Question 9

The pipeline fails with the error 'The resource with name 'myregistry' could not be found'. What is the most likely cause?

Accepted Answer

The Azure Container Registry name is incorrect. Option B is correct because the registry name might be incorrect or not exist. Option A is wrong because the CLI is available. Option C is wrong because authentication is not the issue if the error says not found. Option D is wrong because build ID is a variable that resolves.

Answer

The build ID variable is not defined

Answer

The service connection does not have permission to access the registry

Answer

The Azure CLI is not installed on the agent

Question 10

The pipeline fails because the artifact is empty. What is the most likely cause?

Accepted Answer

The build output is not copied to the staging directory. Option A is correct because the build output is not copied to the staging directory. Option B is wrong because the pattern is likely correct. Option C is wrong because the task name is correct. Option D is wrong because the artifact name is valid.

Answer

The projects pattern '**/*.csproj' does not match any files

Answer

The task 'PublishBuildArtifacts@1' is misspelled

Answer

The artifact name 'drop' is invalid

Question 11

What is the most likely cause of this error?

Accepted Answer

The secret name in Key Vault does not match 'myKeyVaultSecret'. Option D is correct because the secret name in Key Vault must match exactly. Option A is wrong because the variable group is linked. Option B is wrong because missing permissions would give a different error. Option C is wrong because variable groups are supported.

Answer

The variable group is not linked to the Key Vault

Answer

The service connection does not have 'Get' permission on the Key Vault

Answer

Pipeline variables cannot reference Key Vault secrets

Question 12

Your team is using YAML pipelines in Azure DevOps and wants to ensure that a specific stage runs only for changes to the 'main' branch. Which condition should you add to the stage?

Accepted Answer

condition: eq(variables['Build.SourceBranch'], 'refs/heads/main'). Option B is correct because the 'condition' property with 'eq(variables['Build.SourceBranch'], 'refs/heads/main')' ensures the stage runs only for the main branch. Option A is wrong because 'and(succeeded(), eq(...))' would also require previous stages to succeed, which is not specified. Option C is wrong because 'ne(variables['Build.SourceBranch'], 'refs/heads/main')' would run for all branches except main. Option D is wrong because 'contains(variables['Build.SourceBranch'], 'main')' could match branch names containing 'main' like 'feature/maintenance'.

Answer

condition: ne(variables['Build.SourceBranch'], 'refs/heads/main')

Answer

condition: contains(variables['Build.SourceBranch'], 'main')

Answer

condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))

Question 13

You are designing a multi-stage YAML pipeline that deploys to multiple environments. You need to ensure that the pipeline can be triggered manually for a specific stage without running previous stages. Which feature should you use?

Accepted Answer

Use the 'Run pipeline' button with 'Stages to run' and set 'stagesToSkip' parameter. Option C is correct because stage-level triggers are not supported in YAML pipelines; however, the 'stagesToSkip' parameter in the REST API when manually running a pipeline allows skipping previous stages. Option A is wrong because multi-stage YAML pipelines do not support stage-specific triggers. Option B is wrong because the 'dependsOn' condition runs all dependencies. Option D is wrong because 'condition: always()' still runs all stages if triggered.

Answer

Use 'condition: always()' on the stage

Answer

Use 'dependsOn: []' to make the stage independent

Answer

Use 'trigger: none' at the stage level

Question 14

Your organization uses GitHub Actions for CI/CD. You need to implement a deployment strategy where a new version of the application is gradually shifted from the stable environment to a canary environment, and if health checks pass, the traffic is fully shifted to the canary. Which GitHub Actions deployment strategy should you use?

Accepted Answer

Canary deployment. Option B is correct because the 'canary' deployment strategy in GitHub Actions gradually shifts traffic to the new version and promotes if health checks pass. Option A is wrong because 'blue-green' switches all traffic at once. Option C is wrong because 'rolling' updates instances in batches but doesn't use canary traffic shifting. Option D is wrong because 'recreate' replaces all instances at once.

Answer

Recreate deployment

Answer

Blue-green deployment

Answer

Rolling deployment

Question 15

Your team uses Azure Pipelines to build a .NET application. You notice that the build takes 15 minutes because of dependency restoration. You want to cache the NuGet packages to speed up subsequent builds. Which task should you add to your pipeline?

Accepted Answer

Cache task with a key based on the package lock file. Option A is correct because the 'Cache' task is used to cache dependencies including NuGet packages. Option B is wrong because 'NuGet restore' does not cache across builds. Option C is wrong because 'DownloadBuildArtifacts' is for downloading artifacts, not caching. Option D is wrong because 'DotNetCoreCLI' with 'restore' does not provide caching across builds.

Answer

DownloadBuildArtifacts task

Answer

NuGet restore task with the 'noCache' option set to false

Answer

DotNetCoreCLI task with the 'restore' command