AZ-400 Design and implement build and release pipelines Practice Test 23 — 15 Questions

Question 1

Your team uses Azure Pipelines to build a .NET application. You notice that the build takes 15 minutes because of dependency restoration. You want to cache the NuGet packages to speed up subsequent builds. Which task should you add to your pipeline?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cache task with a key based on the package lock file. The Cache task (D) is the correct choice because it allows you to cache the NuGet packages folder (typically `~/.nuget/packages`) based on a key derived from the package lock file (e.g., `packages.lock.json`). This ensures that when the lock file hasn't changed, the cached packages are restored from the pipeline cache instead of being downloaded from the NuGet feed, significantly reducing build time. The key is computed from the lock file's content hash, so any change in dependencies automatically invalidates the cache.

Answer

DownloadBuildArtifacts task

Answer

NuGet restore task with the 'noCache' option set to false

Answer

DotNetCoreCLI task with the 'restore' command

Question 2

Your team uses Azure Pipelines with Microsoft-hosted agents. You need to ensure that sensitive variables like API keys are securely passed to build tasks, but not exposed in logs. Which approach should you use?

Accepted Answer

Store the API key as a secret variable in the pipeline library or variable group. Secret variables in Azure Pipelines are encrypted at rest and masked in logs, ensuring sensitive values like API keys are never exposed. Storing the API key as a secret in a pipeline library or variable group allows it to be securely referenced by tasks without appearing in output or debug logs.

Answer

Retrieve the API key from Azure Key Vault at runtime using the Azure Key Vault task, but do not mark the output as secret

Answer

Define the API key in a variable template with 'isSecret: false'

Answer

Store the API key as a plain text variable in the pipeline and use it as an environment variable

Question 3

Your organization uses GitHub Actions and needs to enforce that all workflows pass required checks before a pull request can be merged. Which GitHub feature should you configure?

Accepted Answer

Branch protection rules with required status checks. Branch protection rules with required status checks enforce that all configured GitHub Actions workflows must pass before a pull request can be merged. This ensures that any workflow defined in the repository (e.g., CI, linting, security scans) produces a successful check run, and the merge is blocked if any required check fails or is pending.

Answer

Workflow triggers

Answer

Required reviewers

Answer

Environment protection rules

Question 4

You are designing a release pipeline for a containerized application deployed to Azure Kubernetes Service (AKS). You want to implement a strategy where the new version is deployed to a small subset of pods first, and if healthy, gradually rolled out to all pods. Which Kubernetes deployment strategy should you use?

Accepted Answer

Canary deployment. A canary deployment is the correct strategy because it allows you to route a small percentage of traffic (e.g., 5%) to the new version of the application running on a subset of pods in AKS. If the canary is healthy (e.g., passes liveness and readiness probes), you can gradually increase the traffic percentage until 100% of pods run the new version, providing controlled rollout and rollback capabilities.

Answer

Rolling update

Answer

Blue-green deployment

Answer

Recreate deployment

Question 5

Your Azure Pipeline builds a Docker image and pushes it to Azure Container Registry (ACR). You need to ensure that the image is scanned for vulnerabilities before being pushed. Which task should you add to the pipeline?

Accepted Answer

Container scanning task from Microsoft Defender for Cloud. Microsoft Defender for Cloud provides a dedicated container scanning task that integrates directly into Azure Pipelines to scan Docker images for vulnerabilities before they are pushed to ACR. This task leverages the same vulnerability assessment engine used by Microsoft Defender for Cloud to identify CVEs in OS packages and application dependencies, ensuring only compliant images are pushed.

Answer

Azure CLI task to run 'az acr scan'

Answer

Docker task with the 'push' action

Answer

PublishBuildArtifacts task

Question 6

Your team uses Azure Pipelines and wants to automatically create a release every time a build succeeds on the main branch. Which trigger should you configure?

Accepted Answer

Build completion trigger in the release pipeline. A build completion trigger in the release pipeline allows you to automatically create a release whenever a specific build pipeline succeeds on the main branch. This trigger monitors the build pipeline for successful completions and initiates the release process, which directly matches the requirement of creating a release after every successful build on main.

Answer

Pull request trigger in the build pipeline

Answer

Continuous integration (CI) trigger in the release pipeline

Answer

Scheduled trigger in the release pipeline

Question 7

Which TWO actions can you take to improve the security of secrets in Azure Pipelines? (Choose two.)

Accepted Answer

Limit variable group permissions to specific pipelines. Limiting variable group permissions to specific pipelines ensures that only authorized pipelines can access sensitive secrets, reducing the risk of unauthorized exposure. Option D is correct because Azure Key Vault provides a centralized, auditable, and encrypted store for secrets, and mapping them as secret variables in Azure Pipelines prevents the secret values from being exposed in logs or output.

Answer

Log secret values for debugging purposes

Answer

Allow pipeline users to override secret values at queue time

Answer

Store secrets as plain text variables in the pipeline

Question 8

Which THREE are valid ways to trigger a pipeline in Azure Pipelines? (Choose three.)

Accepted Answer

Schedule trigger. In Azure Pipelines, scheduled triggers, pull request triggers, and continuous integration (CI) triggers are all valid ways to trigger a pipeline. 'on: push' is GitHub Actions syntax, not Azure Pipelines, and 'commit trigger' is not a formal trigger type in Azure Pipelines.

Answer

'on: push' trigger in YAML

Answer

Commit trigger

Question 9

Refer to the exhibit. You are reviewing an ARM template used in an Azure Pipeline deployment. Which security concern should you address?

Accepted Answer

The admin password is hardcoded in the template. The admin password is hardcoded in plain text in the ARM template, which is a significant security vulnerability. Passwords should be stored securely using Azure Key Vault or referenced as secure parameters. Option A is incorrect because VM size is not a security concern. Option B is incorrect because the apiVersion is valid. Option D is incorrect because a default value for location is acceptable.

Answer

The VM size is too small for production

Answer

The apiVersion is outdated

Answer

The location parameter has a default value

Question 10

Refer to the exhibit. The workflow runs successfully but the deployment fails because the Azure CLI is not authenticated. What should you add to the workflow to authenticate?

Accepted Answer

Add the 'azure/login' action with Azure credentials. The Azure CLI in the workflow requires authentication to interact with Azure resources. Adding the 'azure/login' action with valid Azure credentials (e.g., service principal secrets or OpenID Connect) establishes the necessary authentication context before any Azure CLI commands are executed, resolving the 'not authenticated' error.

Answer

Add the 'actions/setup-node' action

Answer

Add the 'azure/webapps-deploy' action

Answer

Add the 'actions/github-script' action to use the GitHub token

Question 11

Your organization has a multi-stage YAML pipeline that builds and deploys a containerized application to Azure Kubernetes Service (AKS). The pipeline uses environment approvals for the production stage. You need to ensure that the container image deployed to production is the same as the one that passed all previous stages. Which strategy should you implement?

Accepted Answer

Publish the container image as a pipeline artifact and reference it from each stage.. Publishing the container image as a pipeline artifact ensures that the exact same image (by digest, not just tag) is available to all stages. By referencing the artifact in each stage, you guarantee that the image deployed to production is identical to the one that passed testing, avoiding any risk of tag mutation or rebuild inconsistencies.

Answer

Use the same image tag in all stages, updating the tag as needed.

Answer

Enable immutable tags on the container registry to prevent overwrites.

Answer

Rebuild the container image in each stage to ensure freshness.

Question 12

You are configuring a release pipeline that deploys to multiple environments. You want to automate the deployment to the staging environment only if the build succeeds, and then require manual approval before deploying to production. Which strategy should you use?

Accepted Answer

Define an environment with approvals required for the production stage.. Azure Pipelines allows you to define environments with explicit approval checks. By adding a manual approval gate on the production environment stage, the pipeline will automatically deploy to staging after a successful build, but pause before production until an authorized user approves the release. This directly meets the requirement for automated staging deployment and manual production approval.

Answer

Use deployment gates in the production stage to check for manual intervention.

Answer

Use a classic release pipeline with pre-deployment approvals.

Answer

Configure a branch policy on the main branch to require approval for pull requests.

Question 13

Your team uses Azure Repos and wants to trigger a pipeline automatically when a pull request is created targeting the main branch. The pipeline should run validations and report the status to the PR. Which trigger type should you configure?

Accepted Answer

PR trigger. A PR trigger is the correct choice because it specifically initiates a pipeline when a pull request is created or updated against a target branch (main). This allows the pipeline to run validations (e.g., builds, tests, linting) and report the status back to the PR via the Azure Repos status API, enabling branch protection policies to block merging if checks fail.

Answer

Path filter

Answer

Scheduled trigger

Answer

CI trigger

Question 14

Your pipeline builds a .NET application and runs unit tests. You notice that the pipeline takes too long because it restores NuGet packages on every run. You want to cache the NuGet packages to speed up subsequent builds. Which task should you use?

Accepted Answer

Cache@2 (CacheBeta). The Cache@2 (CacheBeta) task is specifically designed to cache folders or files between pipeline runs, such as NuGet packages, to reduce restore time. By caching the NuGet packages folder (e.g., $(UserProfile)/.nuget/packages), subsequent builds can skip the full restore and reuse previously downloaded packages, significantly speeding up the pipeline.

Answer

NuGetCommand@2 with the restore command

Answer

CopyFiles@2

Answer

PowerShell@2 to manually download and cache

Question 15

Your organization uses GitHub Actions for CI/CD. You need to ensure that secrets used in workflows are not exposed in logs. What should you do?

Accepted Answer

Store the secret in GitHub Secrets and reference it as ${{ secrets.SECRET_NAME }}.. GitHub Secrets are encrypted environment variables that are automatically masked in workflow logs. When you reference a secret using the `${{ secrets.SECRET_NAME }}` syntax, GitHub Actions ensures the value is never printed in plain text, even if the workflow attempts to echo it. This is the built-in, secure method for handling sensitive data in CI/CD pipelines.

Answer

Encrypt the secret with a password before using it.

Answer

Use the 'echo' command to output the secret and then delete the log.

Answer

Disable logging on the self-hosted runner.