AZ-400 Design and implement build and release pipelines Practice Test 23 — 15 Questions

Question 1

Refer to the exhibit. You run the Azure CLI command to trigger a pipeline run. The pipeline fails because tests were skipped but should have run. What is the most likely issue?

Accepted Answer

The JSON value for skipTests must be a boolean without quotes.. The Azure DevOps CLI `az pipelines run` supports `--variables` and `--parameters` but not `--variables-parameters`. If that invalid flag were used, the command would fail before any pipeline run is triggered. The symptom says the pipeline ran and skipped tests, which is typically caused by passing `skipTests` as a string value (e.g., `"false"`) rather than a boolean `false`. In Azure DevOps, pipeline variables are strings, so a value of `'false'` is interpreted as a non-empty string and evaluated as `true` in conditional logic. For runtime parameters of type boolean, the correct syntax is `--parameters '{"skipTests":false}'` (value without quotes).

Answer

The pipeline name is incorrect.

Answer

The command uses a flag '--variables-parameters' which is not a valid Azure DevOps CLI option.

Answer

The branch 'feature/new-feature' does not exist.

Question 2

Refer to the exhibit. You deploy this Bicep template to create an Azure App Service with a custom container. The deployment succeeds, but the container fails to start with an error 'Container didn't respond to HTTP pings'. What is the most likely missing configuration?

Accepted Answer

The template is missing the 'healthCheckPath' property in siteConfig.. The error 'Container didn't respond to HTTP pings' indicates that Azure App Service's built-in health check mechanism is failing to reach the container. By default, App Service pings the root path ('/') on the container's exposed port. If the container's application does not respond on that path, the health check fails. Adding the 'healthCheckPath' property in siteConfig allows you to specify a custom endpoint (e.g., '/health') that the container can respond to, resolving the issue.

Answer

The container image is not publicly accessible.

Answer

The WEBSITES_ENABLE_APP_SERVICE_STORAGE should be set to 'true'.

Answer

The template is missing the app setting 'WEBSITES_PORT'.

Question 3

Your team uses GitHub Actions to build a Python application. The workflow includes a step to run unit tests with pytest. The tests pass locally but fail in CI with 'ModuleNotFoundError: No module named 'myapp''. The repository structure has the application code in a subdirectory 'src/'. What is the most likely fix?

Accepted Answer

Set the environment variable PYTHONPATH to 'src/' before running tests.. The Python interpreter cannot find the 'myapp' module when tests run in CI, even though the code is present in the 'src/' subdirectory. Setting PYTHONPATH to 'src/' tells Python to include that directory in the module search path, allowing 'import myapp' to resolve correctly without moving or copying files. This is the most direct fix for a missing module path issue in a CI environment where the working directory is not automatically set to the source folder.

Answer

Set the working directory of the test step to 'src/'.

Answer

Add a step to install dependencies with 'pip install -r requirements.txt'.

Answer

Add a step to run 'pip install -e .' from the repository root.

Question 4

Your team uses GitHub Actions to build a Docker image and push it to Azure Container Registry (ACR). The workflow fails with the error 'unauthorized: authentication required'. The workflow uses the 'azure/docker-login@v1' action. What is the most likely cause?

Accepted Answer

The service principal used for authentication lacks the AcrPush role on the ACR.. The 'azure/docker-login@v1' action authenticates Docker with Azure Container Registry using a service principal. If the service principal lacks the AcrPush role, Docker login succeeds but the subsequent push fails with 'unauthorized: authentication required' because the identity does not have permission to push images. The error occurs at push time, not login time, which is a key diagnostic clue.

Answer

The 'azure/docker-login@v1' action does not support ACR.

Answer

The Dockerfile is not in the repository root.

Answer

The workflow uses the registry admin credentials, which are disabled.

Question 5

Your team uses Azure Pipelines to build a React application. The build process runs npm install, npm test, and npm run build. The build succeeds, but the application loads slowly in the browser due to large bundle sizes. What should you add to the pipeline to optimize the build?

Accepted Answer

Add a step to run Webpack bundle analyzer and implement code splitting.. The issue is large bundle sizes causing slow load times. Running Webpack bundle analyzer identifies which modules contribute most to the bundle, and implementing code splitting (e.g., dynamic imports or React.lazy) allows splitting the bundle into smaller chunks loaded on demand, reducing initial payload size.

Answer

Add a step to cache the node_modules folder.

Answer

Add a step to minify JavaScript using Terser.

Answer

Add a step to run additional unit tests to catch performance issues.

Question 6

You need to ensure that only specific branches can trigger a release to production in Azure Pipelines. What should you configure?

Accepted Answer

Add a branch filter to the release pipeline's artifact trigger.. A branch filter on the release pipeline's artifact trigger allows you to specify which branches of the source artifact (e.g., a build pipeline) should automatically trigger a release. By configuring this filter to only include branches like 'main' or 'release/*', you ensure that only builds from those specific branches can initiate a release to production, providing precise control over deployment triggers.

Answer

Add an approval gate that requires a manager to approve the release.

Answer

Add a deployment gate that checks the source branch.

Answer

Add a branch filter to the build pipeline trigger.

Question 7

Your team uses a YAML-based build pipeline in Azure Pipelines. You need to ensure that the pipeline runs automatically when a pull request is created against the main branch, but only if the changes include modifications to the 'src/' directory. Which trigger configuration should you use?

Accepted Answer

trigger: none; pr: branches: include: - main paths: include: - src/*. It sets `trigger: none` to disable CI triggers on commits, and uses a PR trigger with `branches: include: - main` and `paths: include: - src/*` to ensure the pipeline only runs automatically when a pull request targets the main branch and the changes include modifications to the 'src/' directory. This configuration meets the requirement of conditional PR-triggered builds based on file paths.

Answer

trigger: - main; pr: none

Answer

trigger: none; pr: - main

Answer

pr: - main; trigger: - main

Question 8

Your Azure Pipelines release pipeline deploys to multiple stages. You need to implement a manual approval gate that requires two specific users to approve before deployment proceeds to production. The approval should expire after 8 hours. Which configuration should you use?

Accepted Answer

Pre-deployment conditions: Add approvers (user1, user2) with 'All' policy and set timeout to 480 minutes. It configures a pre-deployment approval gate requiring both user1 and user2 to approve (the 'All' policy) before the production stage proceeds, and sets the timeout to 480 minutes (8 hours) to expire the approval request. This matches the requirement for two specific users to approve and an 8-hour expiration.

Answer

Pre-deployment conditions: Add approvers (user1, user2) with 'Any one' policy

Answer

Pre-deployment conditions: Add approvers (user1, user2) with 'All' policy and set 'Allow deployment without approval' to true

Answer

Post-deployment conditions: Add approvers (team) with 'All' policy

Question 9

Your build pipeline uses a hosted agent. You notice that every build starts with a clean workspace, increasing build time. You want to improve performance by caching the Node.js 'node_modules' folder. Which task should you add to the pipeline?

Accepted Answer

Cache task. The Cache task (option D) is correct because it allows you to cache the 'node_modules' folder between pipeline runs on hosted agents, avoiding the need to reinstall dependencies from scratch each time. By specifying a cache key (e.g., based on package-lock.json) and the path to cache, subsequent builds can restore the folder from cache, significantly reducing build time.

Answer

Publish Build Artifacts task

Answer

Copy Files task

Answer

Download Build Artifacts task

Question 10

You have the YAML pipeline snippet shown in the exhibit. The first run produces version 1.0.0. What will be the version produced on the third run?

Accepted Answer

1.0.2. The YAML pipeline uses a counter expression `$[counter(format('{0}.{1}', variables['major'], variables['minor']), 0)]` for the patch version. The counter starts at 0 for the first run, producing version 1.0.0. Each subsequent run increments the counter by 1, so the second run produces 1.0.1, and the third run produces 1.0.2. Therefore, option C is correct.

Answer

1.0.1

Answer

1.0.3

Answer

1.0.0

Question 11

Your release pipeline deploys to Azure App Service using a deployment slot. You need to ensure that after swapping slots, the staging slot retains the previous production configuration for rollback. Which deployment strategy should you use?

Accepted Answer

Swap with preview. Swap with preview (multi-phase swap) is the correct strategy because it uses Azure App Service deployment slots to validate the staged version before completing the swap. When the swap is completed, the staging slot receives the previous production code and configuration, preserving a rollback state. If a problem occurs, you can swap back to the staging slot. Note that a standard slot swap also preserves the previous production state in staging, but swap with preview adds the benefit of preview validation before finalizing the swap, which aligns with the requirement of maintaining rollback capability.

Answer

Rolling deployment

Answer

Blue-green deployment

Answer

Canary deployment

Question 12

You need to integrate security scanning into your build pipeline to detect vulnerable open-source dependencies. Which Azure DevOps extension should you use?

Accepted Answer

WhiteSource Bolt. WhiteSource Bolt is a free Azure DevOps extension that integrates directly into build pipelines to automatically scan open-source dependencies for known vulnerabilities. It identifies vulnerable components, provides remediation guidance, and enforces security policies without requiring additional configuration or external tools, making it the correct choice for this scenario.

Answer

Azure Policy

Answer

GitHub Advanced Security

Answer

SonarQube

Question 13

Your build pipeline runs on a self-hosted agent pool. You need to ensure that only authorized pipelines can use these agents. Which security measure should you implement?

Accepted Answer

Set permissions on the agent pool. In Azure DevOps, agent pool security is controlled through the pool's permissions. By setting permissions on the agent pool, you can restrict which projects, pipelines, or users are allowed to use the agents, ensuring only authorized pipelines can run on them. This is the direct, built-in mechanism for securing a self-hosted agent pool.

Answer

Use agent tokens

Answer

Use variable groups

Answer

Configure agent queues

Question 14

You run the Azure CLI command shown in the exhibit as part of a release pipeline to deploy a ZIP package to an Azure App Service. The deployment succeeds, but the app does not start. What is the most likely cause?

Accepted Answer

The app's startup command is not configured. The Azure CLI command `az webapp deploy` deploys the ZIP package to the App Service, but it does not configure the startup command. If the application (e.g., a Node.js or Python app) requires a specific startup file or script (like `npm start` or `gunicorn`), the App Service will fail to start because it defaults to a generic handler. The startup command must be set via the `--startup-file` parameter in `az webapp config set` or in the Azure portal.

Answer

The resource group name is incorrect

Answer

The runtime stack is not specified in the command

Answer

The deployment slot is not specified

Question 15

Your team uses GitHub for source control and wants to set up continuous integration using GitHub Actions. Which file should you create in the repository to define the workflow?

Accepted Answer

.github/workflows/ci.yml. GitHub Actions workflows are defined in YAML files stored in the .github/workflows directory at the root of the repository. The file can have any name but must have a .yml or .yaml extension, and ci.yml is a common convention. This file contains the workflow definition, including triggers (on), jobs, and steps. GitHub automatically detects and runs workflows from this directory.

Answer

Jenkinsfile

Answer

Dockerfile

Answer

azure-pipelines.yml