AZ-400 Design and implement build and release pipelines Practice Test 22 — 15 Questions

Question 1

Your team uses Azure Pipelines with Microsoft-hosted agents. You need to ensure that sensitive variables like API keys are securely passed to build tasks, but not exposed in logs. Which approach should you use?

Accepted Answer

Store the API key as a secret variable in the pipeline library or variable group. Option B is correct because marking variables as 'secret' in Azure Pipelines ensures they are masked in logs and encrypted. Option A is wrong because environment variables are still visible in logs unless masked. Option C is wrong because Azure Key Vault can store secrets, but you still need to map them as secret variables to mask them. Option D is wrong because pipeline variables with 'isSecret: false' are visible.

Answer

Retrieve the API key from Azure Key Vault at runtime using the Azure Key Vault task, but do not mark the output as secret

Answer

Define the API key in a variable template with 'isSecret: false'

Answer

Store the API key as a plain text variable in the pipeline and use it as an environment variable

Question 2

Your organization uses GitHub Actions and needs to enforce that all workflows pass required checks before a pull request can be merged. Which GitHub feature should you configure?

Accepted Answer

Branch protection rules with required status checks. Option C is correct because branch protection rules allow you to require status checks to pass before merging. Option A is wrong because workflow triggers define when workflows run, not merge requirements. Option B is wrong because required reviewers are for manual approval, not automated checks. Option D is wrong because environment protection rules are for deployments, not pull request merges.

Answer

Workflow triggers

Answer

Required reviewers

Answer

Environment protection rules

Question 3

You are designing a release pipeline for a containerized application deployed to Azure Kubernetes Service (AKS). You want to implement a strategy where the new version is deployed to a small subset of pods first, and if healthy, gradually rolled out to all pods. Which Kubernetes deployment strategy should you use?

Accepted Answer

Canary deployment. Option B is correct because a canary deployment releases the new version to a subset of pods and gradually increases traffic. Option A is wrong because rolling update gradually replaces pods but doesn't use traffic splitting for validation. Option C is wrong because blue-green switches all traffic at once. Option D is wrong because recreate deletes all old pods before creating new ones.

Answer

Rolling update

Answer

Blue-green deployment

Answer

Recreate deployment

Question 4

Your Azure Pipeline builds a Docker image and pushes it to Azure Container Registry (ACR). You need to ensure that the image is scanned for vulnerabilities before being pushed. Which task should you add to the pipeline?

Accepted Answer

Container scanning task from Microsoft Defender for Cloud. Option C is correct because the 'Container scanning' task (from Defender for Cloud) can scan images in ACR for vulnerabilities. Option A is wrong because the 'Docker' task only builds and pushes. Option B is wrong because 'Azure CLI' task can run commands but not built-in scanning. Option D is wrong because 'PublishBuildArtifacts' publishes files, not scanning.

Answer

Azure CLI task to run 'az acr scan'

Answer

Docker task with the 'push' action

Answer

PublishBuildArtifacts task

Question 5

Your team uses Azure Pipelines and wants to automatically create a release every time a build succeeds on the main branch. Which trigger should you configure?

Accepted Answer

Build completion trigger in the release pipeline. Option D is correct because the build completion trigger in a release pipeline automatically creates a release when a build completes. Option A is wrong for a release pipeline. Option B is wrong because CI triggers are for build pipelines. Option C is wrong because scheduled triggers run at specific times, not on build completion.

Answer

Pull request trigger in the build pipeline

Answer

Continuous integration (CI) trigger in the release pipeline

Answer

Scheduled trigger in the release pipeline

Question 6

Which TWO actions can you take to improve the security of secrets in Azure Pipelines? (Choose two.)

Accepted Answer

Limit variable group permissions to specific pipelines. Options B and C are correct. Option B: Using Azure Key Vault to store secrets and mapping them as secret variables prevents exposure. Option C: Limiting variable group permissions ensures only authorized pipelines can access secrets. Option A is wrong because storing secrets as plain text variables exposes them in logs. Option D is wrong because checking 'Allow at queue time' exposes secrets to users. Option E is wrong because logging secret values defeats the purpose.

Answer

Log secret values for debugging purposes

Answer

Allow pipeline users to override secret values at queue time

Answer

Store secrets as plain text variables in the pipeline

Question 7

Which THREE are valid deployment strategies supported by Azure Pipelines and GitHub Actions? (Choose three.)

Accepted Answer

Blue-green. Options A, C, and D are correct. Canary, blue-green, and rolling are all supported deployment strategies. Option B is wrong because 'immutable' is not a built-in strategy in Azure Pipelines or GitHub Actions; it is a concept in some platforms but not as a predefined strategy. Option E is wrong because 'recreate' is not a standard strategy name; the standard is 'recreate' but it is not in the list; however, 'recreate' is actually a valid strategy in some contexts, but the question asks for supported strategies. In Azure Pipelines and GitHub Actions, canary, blue-green, and rolling are explicitly supported. Recreate is also supported, but since we need exactly three, and the options include immutable which is not, we choose A, C, D.

Answer

Immutable

Answer

Recreate

Question 8

Which TWO are valid ways to trigger a pipeline in Azure Pipelines? (Choose two.)

Accepted Answer

Pull request (PR) trigger. Options A and B are correct. A: CI trigger runs when changes are pushed to a branch. B: PR trigger runs when a pull request is created. Option C is wrong because there is no 'on: push' in Azure Pipelines YAML; that's GitHub Actions syntax. Option D is wrong because 'commit' trigger is not a term; it's CI trigger. Option E is wrong because 'schedule' trigger is valid but it's not a basic trigger; CI and PR are the primary triggers.

Answer

Schedule trigger

Answer

'on: push' trigger in YAML

Answer

Commit trigger

Question 9

Refer to the exhibit. The pipeline will trigger when changes are pushed to which branches?

Accepted Answer

The main branch and any branch starting with 'release/'. Option C is correct because the trigger includes 'main' and 'release/*' branches, so any branch matching 'main' or starting with 'release/' will trigger the pipeline. Option A is wrong because it only includes main, not release/*. Option B is wrong because it includes all branches. Option D is wrong because it only includes release/* branches.

Answer

All branches

Answer

Only the main branch

Answer

Only branches starting with 'release/'

Question 10

Refer to the exhibit. You are reviewing an ARM template used in an Azure Pipeline deployment. Which security concern should you address?

Accepted Answer

The admin password is hardcoded in the template. Option B is correct because the admin password is hardcoded in plain text, which is a security vulnerability. Option A is wrong because the param default is acceptable. Option C is wrong because API version is valid. Option D is wrong because VM size is fine.

Answer

The VM size is too small for production

Answer

The apiVersion is outdated

Answer

The location parameter has a default value

Question 11

Refer to the exhibit. The workflow runs successfully but the deployment fails because the Azure CLI is not authenticated. What should you add to the workflow to authenticate?

Accepted Answer

Add the 'azure/login' action with Azure credentials. Option B is correct because the 'azure/login' action authenticates using Azure credentials stored as secrets. Option A is wrong because 'azure/webapps-deploy' is a deployment action, not authentication. Option C is wrong because the GitHub token is for GitHub API, not Azure. Option D is wrong because 'actions/setup-node' is for Node.js, not authentication.

Answer

Add the 'actions/setup-node' action

Answer

Add the 'azure/webapps-deploy' action

Answer

Add the 'actions/github-script' action to use the GitHub token

Question 12

Your organization has a multi-stage YAML pipeline that builds and deploys a containerized application to Azure Kubernetes Service (AKS). The pipeline uses environment approvals for the production stage. You need to ensure that the container image deployed to production is the same as the one that passed all previous stages. Which strategy should you implement?

Accepted Answer

Publish the container image as a pipeline artifact and reference it from each stage.. Option C is correct because using a pipeline artifact (like the pipeline artifact published during the build stage) ensures the exact same image is used in all stages, preventing rebuilds and ensuring consistency. Option A is wrong because rebuilding in each stage can introduce variations. Option B is wrong because tags can be overwritten. Option D is wrong because container registries do not enforce immutability by default.

Answer

Use the same image tag in all stages, updating the tag as needed.

Answer

Enable immutable tags on the container registry to prevent overwrites.

Answer

Rebuild the container image in each stage to ensure freshness.

Question 13

You are configuring a release pipeline that deploys to multiple environments. You want to automate the deployment to the staging environment only if the build succeeds, and then require manual approval before deploying to production. Which strategy should you use?

Accepted Answer

Define an environment with approvals required for the production stage.. Option B is correct because environment approvals in a multistage YAML pipeline allow you to specify approvals before a stage runs. Option A is wrong because gates are for health checks, not approvals. Option C is wrong because release pipelines are legacy and not recommended for new projects. Option D is wrong because branch policies control code quality, not deployment approvals.

Answer

Use deployment gates in the production stage to check for manual intervention.

Answer

Use a classic release pipeline with pre-deployment approvals.

Answer

Configure a branch policy on the main branch to require approval for pull requests.

Question 14

Your team uses Azure Repos and wants to trigger a pipeline automatically when a pull request is created targeting the main branch. The pipeline should run validations and report the status to the PR. Which trigger type should you configure?

Accepted Answer

PR trigger. Option A is correct because PR triggers are specifically designed to run pipelines on pull request creation and report status back. Option B is wrong because CI triggers run on pushes to branches. Option C is wrong because scheduled triggers run on a schedule. Option D is wrong because path filters restrict which files trigger, not the event type.

Answer

Path filter

Answer

Scheduled trigger

Answer

CI trigger

Question 15

Your pipeline builds a .NET application and runs unit tests. You notice that the pipeline takes too long because it restores NuGet packages on every run. You want to cache the NuGet packages to speed up subsequent builds. Which task should you use?

Accepted Answer

Cache@2 (CacheBeta). Option C is correct because the Cache task (CacheBeta@2) is designed to cache dependencies like NuGet packages. Option A is wrong because the NuGet task has a restore command but no caching. Option B is wrong because the Copy Files task is for copying files. Option D is wrong because the PowerShell task can be used but is not the built-in caching solution.

Answer

NuGetCommand@2 with the restore command

Answer

CopyFiles@2

Answer

PowerShell@2 to manually download and cache