AZ-400 Design and implement build and release pipelines Practice Test 23 — 15 Questions

Question 1

Your organization uses GitHub Actions for CI/CD. You need to ensure that secrets used in workflows are not exposed in logs. What should you do?

Accepted Answer

Store the secret in GitHub Secrets and reference it as ${{ secrets.SECRET_NAME }}.. Option B is correct because GitHub automatically masks secrets when used in workflows. Option A is wrong because logging to a file still exposes the secret in the log. Option C is wrong because runner logs are stored and could be accessed. Option D is wrong because encryption does not prevent exposure if the secret is printed.

Answer

Encrypt the secret with a password before using it.

Answer

Use the 'echo' command to output the secret and then delete the log.

Answer

Disable logging on the self-hosted runner.

Question 2

You are designing a build pipeline for a Java application that uses Maven. You want to publish the compiled JAR file as a build artifact. Which task should you use?

Accepted Answer

PublishBuildArtifacts@1. Option A is correct because the Publish Build Artifacts task publishes files as pipeline artifacts. Option B is wrong because the Copy Files task only copies files within the agent. Option C is wrong because the Maven task builds the project but does not publish artifacts. Option D is wrong because the Archive Files task creates a zip but does not publish.

Answer

Maven@3

Answer

ArchiveFiles@2

Answer

CopyFiles@2

Question 3

Your Azure DevOps pipeline deploys a web app to Azure App Service using a YAML pipeline. The deployment fails intermittently with the error 'Conflict' when updating deployment slots. What is the most likely cause?

Accepted Answer

Another deployment or swap operation is already in progress on the slot.. Option B is correct because swapping slots while a deployment is in progress can cause a conflict error. Option A is wrong because Resource Manager connections use service principals, not user credentials. Option C is wrong because slot names are case-insensitive. Option D is wrong because file locks would cause different errors.

Answer

The service connection is using expired credentials.

Answer

The slot name is misspelled in the pipeline configuration.

Answer

The web app is locked by a file handle from a previous deployment.

Question 4

Your team uses a monorepo in Azure Repos with multiple projects. You want to trigger a pipeline only when changes are made to a specific subfolder. Which configuration should you use?

Accepted Answer

Add a 'paths' filter to the CI trigger.. Option A is correct because the 'paths' trigger filter allows specifying include/exclude patterns. Option B is wrong because branch filters limit which branches trigger, not paths. Option C is wrong because the checkout step is for fetching code, not triggering. Option D is wrong because file matching is not a trigger property.

Answer

Use a branch filter in the CI trigger.

Answer

Configure the checkout step to only include the subfolder.

Answer

Use a 'file_match' condition on the job.

Question 5

You are creating a release pipeline that uses Azure Pipelines to deploy to multiple virtual machines. You need to ensure that the deployment runs on each machine in parallel. Which deployment strategy should you use?

Accepted Answer

Run once deployment with parallel execution. Option D is correct because the 'runOnce' strategy with 'parallel' deployment option runs the job on multiple targets simultaneously. Option A is wrong because rolling strategy updates a subset at a time. Option B is wrong because canary is a phased rollout. Option C is wrong because blue-green swaps between environments.

Answer

Blue-green deployment

Answer

Canary deployment

Answer

Rolling deployment

Question 6

Refer to the exhibit. You have a YAML pipeline with the variables shown. What will be the value of $(Build.BuildNumber) on the first run?

Accepted Answer

20250101.1. The counter expression starts at the seed value (0) and increments by 1 each run. On the first run, the counter returns 0, so revision is 0. Build.BuildNumber is not explicitly set, so it defaults to the date-based format (e.g., 20250101.1) unless redefined. However, the counter is used as a variable, not assigned to Build.BuildNumber. So the script echoes the default Build.BuildNumber, not the counter. But the question asks for the value of $(Build.BuildNumber). The default Build.BuildNumber is the date-time based number (like 20250101.1). Option D is correct.

Answer

1.0.0.0

Answer

1.0.0

Answer

1.0.1

Question 7

Refer to the exhibit. You have a YAML pipeline that references a repository resource with a tag. When will this pipeline trigger?

Accepted Answer

When changes are pushed to the main branch of the current repository.. The pipeline has a CI trigger on the main branch of the current repository. The repository resource specifies a tag, which is used for checkout in the pipeline, but the trigger is based on the source trigger (main branch). Option A is correct because the trigger is on main. Option B is wrong because tags are not triggers. Option C is wrong because the trigger is not for the repository resource. Option D is wrong because there is a trigger defined.

Answer

When a new tag v1.0 is pushed to the referenced repository.

Answer

When changes are pushed to any branch of the referenced repository.

Answer

The pipeline will never trigger because no trigger is defined.

Question 8

Refer to the exhibit. The pipeline uses a variable group 'ReleaseVariables' that contains a variable named 'EnvironmentName' with value 'Staging'. What environment will the deployment target?

Accepted Answer

Production. Variable groups are evaluated first, but in YAML, variables defined later override the group if the same name is used. Here, EnvironmentName is defined in the variable group and then redefined with value 'Production' in the pipeline variables. The pipeline variable overrides the variable group. So the environment name is 'Production'. Option B is correct.

Answer

Staging

Answer

VirtualMachine

Answer

DeployWeb

Question 9

Which TWO actions should you take to ensure that a build pipeline fails if code coverage drops below 80%?

Accepted Answer

Add a script task that parses the coverage file and exits with non-zero if below threshold.. Options A and C are correct. The Publish Code Coverage Results task can publish coverage data, and a script can check the coverage and fail the build if below threshold. Option B is wrong because the Publish Test Results task is for test results, not coverage. Option D is wrong because the Report Generator task generates reports but does not enforce thresholds. Option E is wrong because the Copy Files task does not analyze coverage.

Answer

Use the PublishTestResults@2 task with the 'codeCoverage' option.

Answer

Use the ReportGenerator@5 task to create a coverage report.

Answer

Use the CopyFiles@2 task to move coverage files to a shared location.

Question 10

Which THREE components are required to implement a self-hosted agent pool in Azure Pipelines?

Accepted Answer

The Azure Pipelines agent software installed on the machine.. Options A, B, and C are correct. A self-hosted agent requires a virtual machine to run the agent, the agent software installed, and a personal access token (PAT) to register the agent with Azure DevOps. Option D is wrong because a service connection is not needed for the agent registration. Option E is wrong because a YAML pipeline is not required to set up the agent.

Answer

An Azure Resource Manager service connection.

Answer

A YAML pipeline definition.

Question 11

Which TWO strategies can you use to manage secrets in Azure Pipelines securely?

Accepted Answer

Use a variable group linked to Azure Key Vault.. Options A and C are correct. Variable groups can be linked to Azure Key Vault to fetch secrets, and you can mark variables as secret in the pipeline UI. Option B is wrong because storing secrets in YAML files exposes them in source control. Option D is wrong because logging secrets is not secure. Option E is wrong because environment variables are not inherently secure.

Answer

Store secrets directly in the YAML pipeline file.

Answer

Use environment variables in the build agent.

Answer

Print the secret in a script to verify it is correct.

Question 12

You are designing a build pipeline for a Java application hosted in Azure Repos. The pipeline needs to run unit tests, package the application as a JAR file, and publish the build artifact. Which task should you use to publish the JAR file as a pipeline artifact?

Accepted Answer

Publish Pipeline Artifact task. Option B is correct because the Publish Build Artifacts task is designed to publish files as build artifacts from a pipeline. Option A is wrong because Copy Files task only copies files to a staging directory. Option C is wrong because the Archive Files task creates a ZIP archive. Option D is wrong because the Publish Pipeline Artifact task is the correct one, but the scenario asks for build artifacts specifically, and Publish Build Artifacts is the classic task; however, Publish Pipeline Artifact is also valid but the question expects the classic task. Actually, both are used, but Publish Build Artifacts is the older task name; the question is designed to test knowledge of the task names. In modern Azure DevOps, Publish Pipeline Artifact is preferred. To avoid confusion, we'll adjust: Option B is Publish Pipeline Artifact. Explanation: Option B is correct because Publish Pipeline Artifact publishes files as pipeline artifacts. Option A is wrong because it only copies files. Option C is wrong because it archives files. Option D is wrong because it's not a valid task name.

Answer

Publish Build Artifacts task

Answer

Copy Files task

Answer

Archive Files task

Question 13

Your release pipeline deploys a .NET Core web app to Azure App Service using a slot swap strategy. The pipeline runs acceptance tests on the staging slot before swapping. After a recent change, the acceptance tests pass but the production site becomes unresponsive after the swap. What is the most likely cause?

Accepted Answer

The staging slot had different app settings that were swapped into production, causing the site to fail.. Option C is correct because slot swap swaps the entire configuration including connection strings and app settings. If the staging slot had different configuration values that are incompatible with production, the swap can cause issues. Option A is wrong because the tests passed on staging. Option B is wrong because slot swap is designed to be zero-downtime. Option D is wrong because the issue is not related to test failure but to configuration after swap.

Answer

The acceptance tests are not comprehensive enough and missed a regression.

Answer

The acceptance tests should have been run after the swap.

Answer

The slot swap was not 'warm-up' and caused downtime.

Question 14

You have a multi-stage YAML pipeline that builds and deploys a Node.js application. You want to ensure that the build stage runs only when changes are made to the 'src' folder. Which trigger configuration should you use?

Accepted Answer

Trigger with 'paths' filter. Option A is correct because the path trigger filters changes to specific paths. Option B is wrong because it would trigger on any change. Option C is wrong because batch changes the number of triggers but not the path. Option D is wrong because branches filter by branch, not path.

Answer

Trigger with 'batch' set to true

Answer

Trigger with 'branches' filter

Answer

Disable CI trigger and use a scheduled trigger

Question 15

Your organization uses GitHub for source control and Azure Pipelines for CI/CD. You need to implement a policy that requires all pull requests to pass a status check before merging. The status check should be provided by a pipeline that runs when a pull request is created. Which type of trigger should you configure in the pipeline YAML?

Accepted Answer

PR trigger. Option B is correct because 'pr' trigger is specifically for pull request validation in GitHub. Option A is wrong because 'push' trigger runs on commits. Option C is wrong because 'schedules' trigger runs on a timer. Option D is wrong because 'manual' is not a trigger type.

Answer

Push trigger

Answer

Manual trigger

Answer

Scheduled trigger