AZ-400 Design and implement build and release pipelines Practice Test 25 — 15 Questions

Question 1

Your build pipeline uses a self-hosted agent in your on-premises network. The agent pool is configured to use the 'latest' agent version. Recently, a new version of the Azure Pipelines agent was released, and your builds started failing because the new agent requires .NET 6.0, which is not installed on the agent machine. What is the best way to prevent this issue in the future?

Accepted Answer

Configure the agent pool to use a specific agent version (e.g., '2.210.0') and test new versions in a separate pool before updating.. Option C is correct because pinning the agent to a specific major version allows you to control updates and test compatibility before upgrading. Option A is wrong because disabling updates is not recommended and may cause security issues. Option B is wrong because installing .NET 6.0 is a reactive fix, not a preventive measure. Option D is wrong because using Microsoft-hosted agents avoids the issue but is not always feasible for on-premises needs.

Answer

Switch to using Microsoft-hosted agents instead of self-hosted.

Answer

Disable automatic agent updates on the self-hosted agents.

Answer

Install .NET 6.0 on the agent machine to meet the new requirement.

Question 2

You are designing a release pipeline for a multi-tenant SaaS application that is deployed to Azure App Service. Each tenant has its own App Service instance. The pipeline must deploy a new version of the application to a staging slot for each tenant, run smoke tests, and then swap the staging slot to production. You need to ensure that if the smoke tests fail for any tenant, the swap is not performed for that tenant, while other tenants continue. Which release pipeline configuration should you use?

Accepted Answer

Create a release with multiple jobs (one per tenant) in the same stage, each deploying to a tenant's staging slot, running tests, and conditionally swapping. Set the 'Run this job' condition to 'Only when all previous jobs have succeeded' or use custom conditions to skip swap on failure.. Option D is correct because using a multi-job release allows each tenant deployment to be independent, and you can configure pre-deployment conditions or failure conditions to skip the swap for that tenant if tests fail. Option A is wrong because stages are sequential and a failure in one tenant would block others. Option B is wrong because a single job with multiple tasks would still block all tenants if one fails. Option C is wrong because a parallel execution in a single job is not possible; you need multiple jobs.

Answer

Create a single stage with a 'foreach' loop over tenants, and if smoke tests fail, skip the swap using a condition.

Answer

Create a single job with parallel tasks for each tenant, and configure failure conditions to skip the swap.

Answer

Create a single stage with multiple deployment tasks, one per tenant, and use a 'continue on error' option on each task.

Question 3

Your team uses GitHub Actions for CI/CD. You want to automatically deploy to Azure App Service whenever a pull request is merged to the main branch. Which event trigger should you use in the GitHub Actions workflow?

Accepted Answer

pull_request: types: [closed] branches: [main]. Option C is correct because the 'pull_request' event with type 'closed' and branch filter 'main' triggers when a PR is merged (closed) to main. Option A is wrong because 'push' triggers on every push, not just PR merges. Option B is wrong because 'pull_request' without type triggers on all PR events, including opened, synchronize, etc. Option D is wrong because 'release' triggers on release creation, not PR merge.

Answer

pull_request: branches: [main]

Answer

push: branches: [main]

Answer

release: types: [published]

Question 4

Which TWO actions should you take to protect sensitive information (e.g., API keys, passwords) in Azure Pipelines? (Choose two.)

Accepted Answer

Define secrets as pipeline secret variables and reference them as $(secretName).. Options B and D are correct. Option B: Using Azure Key Vault to store secrets and linking them to pipeline variables ensures secure access. Option D: Using secret variables prevents exposure in logs. Option A is wrong because storing secrets in YAML files is insecure. Option C is wrong because using plain text variables exposes them. Option E is wrong because using environment variables in the agent is not secure as they can be read by other processes.

Answer

Store secrets in environment variables on the agent machine.

Answer

Store secrets in a YAML file and include the file in the repository.

Answer

Use plain text variables in the pipeline and mask them using the 'Logging Command' feature.

Question 5

Which THREE conditions must be met for you to use the 'Approvals' feature in Azure Pipelines to control deployments to a production environment? (Choose three.)

Accepted Answer

The approver must have the 'Approve pipeline permissions' permission for the environment.. Options A, B, and D are correct. Option A: The pipeline must be a release pipeline or a YAML pipeline with environment resource checks. Option B: You must define an environment and add an approval check to it. Option D: The user approving must have the 'Approve pipeline permissions' permission (or be a member of the Approvers group). Option C is wrong because approvers can be groups, not just individuals. Option E is wrong because approvals can be set on environments, not just stages.

Answer

The approver must be an individual user, not a group.

Answer

The approval must be configured in the release pipeline's pre-deployment conditions.

Question 6

Which TWO are valid strategies for reducing build times in Azure Pipelines? (Choose two.)

Accepted Answer

Implement caching for package dependencies (e.g., npm, NuGet, Maven) to avoid restoring on every build.. Options A and D are correct. Option A: Using incremental builds (e.g., with the 'dotnet build' incremental feature) reduces build time by only rebuilding changed files. Option D: Using a build cache (e.g., for NuGet packages, npm, or Maven) avoids downloading and restoring dependencies on every build. Option B is wrong because using multiple agents without parallelization does not reduce build time. Option C is wrong because using a single agent with more steps increases build time. Option E is wrong because disabling tests is not a valid strategy as it compromises quality.

Answer

Reduce the number of parallel jobs and increase the number of steps in a single job.

Answer

Remove unit tests from the build pipeline and run them only in the release pipeline.

Answer

Increase the number of agents in the pool and run all jobs on the same agent.

Question 7

Which THREE are benefits of using 'Environment' resources in YAML pipelines compared to classic release pipelines? (Choose three.)

Accepted Answer

Environments provide a dashboard showing the deployment history and resource health.. Options A, C, and D are correct. Option A: YAML pipelines with environments support Kubernetes resources for tracking deployments to AKS. Option C: Environments provide a centralized view of deployments and live resource health. Option D: Environments support checks such as approvals, gates, and manual intervention. Option B is wrong because YAML pipelines do not support pre-deployment gates directly; they use checks. Option E is wrong because environments are available in both YAML and classic pipelines.

Answer

Environments can only be used in classic release pipelines.

Answer

Environments allow you to define pre-deployment and post-deployment gates using the classic release pipeline interface.

Question 8

Your organization uses a monorepo in Azure Repos containing multiple microservices. You need to design a build pipeline that only builds and tests the services that have changed in a given commit, to optimize build times. The pipeline must trigger on any push to any branch, but only the affected services should be built. You also need to ensure that dependent services are rebuilt if their dependencies change. The services are located in subdirectories: /services/serviceA, /services/serviceB, etc. Each service has a Dockerfile and a unit test project. You plan to use a script to determine which services changed. Which approach should you use to implement this pipeline?

Accepted Answer

Use a script step to determine which services changed, then output variables to dynamically create a job matrix or use the 'each' keyword to iterate over changed services.. Option D is correct because the pipeline can use a script to detect changed files in the commit, map them to services, and then dynamically create jobs or stages for each affected service. This is efficient and flexible. Option A is wrong because using a single job that runs all tests ignores the requirement to only build changed services. Option B is wrong because using multiple jobs for all services would build everything every time, not optimizing. Option C is wrong because using a multi-stage pipeline with stages for each service would also build all services every time.

Answer

Create a multi-stage pipeline where each stage represents a service, and use a 'dependsOn' condition to run stages only if the corresponding service changed.

Answer

Create a single job that runs all unit tests for all services on every commit. Use caching to speed up the build.

Answer

Create a job for each service that runs in parallel on every commit. Use conditions to skip jobs if the service has not changed, but the conditions would need to check every service, which is complex.

Question 9

You are setting up a release pipeline for an ASP.NET Core application that is deployed to Azure App Service (Windows). The application uses Entity Framework Core for database migrations. You need to automate the execution of database migrations during deployment, ensuring that the migrations run only once and that the application is not started until the migration completes. You also need to handle rollback in case the migration fails. The pipeline should deploy to staging slot, run migrations, swap to production, and then run post-swap migrations if needed. Currently, the pipeline deploys the code and then runs a script to execute 'dotnet ef database update'. However, during swap, the staging slot's migrations may conflict with production. What is the recommended architecture for handling database migrations with zero-downtime deployment?

Accepted Answer

Use Idempotent migrations and run them in the staging slot before swap. Then, after swap, run migrations again in the production slot to ensure any remaining changes are applied.. Option C is correct because using Idempotent migrations allows you to run them before swap without affecting production, and running them again after swap ensures any additional changes are applied. Running migrations before swap ensures the staging slot has the updated schema, and after swap, the production slot also gets the updates. Idempotent migrations ensure that running them multiple times is safe. Option A is wrong because running migrations only in staging before swap does not update production's database unless you run migrations after swap. Option B is wrong because running migrations only after swap causes downtime during migration. Option D is wrong because disabling automatic migration and using manual scripts adds risk and does not ensure zero-downtime.

Answer

Run migrations only in the staging slot before swap. After swap, the production slot will use the new schema automatically.

Answer

Run migrations only after the swap is complete, in the production slot. The application is stopped during migration to avoid errors.

Answer

Disable automatic migration execution in the pipeline. Instead, have a separate manual process to run migrations using a dedicated tool.

Question 10

Your team uses Azure Pipelines with GitHub for source control. You need to ensure that whenever a pull request is created against the main branch, a validation build runs automatically. Which YAML trigger should you configure in the pipeline?

Accepted Answer

pr: main. Option A is correct because the pr trigger on main runs a validation build on pull requests targeting main. Option B is wrong because branches spec limits PR trigger to branches when PR source is from that branch. Option C is wrong because trigger is for CI builds, not PR validation. Option D is wrong because exclude removes branches from CI trigger.

Answer

pr: branches: include: - main

Answer

trigger: branches: exclude: - main

Answer

trigger: main

Question 11

You are designing a release pipeline for a microservices application deployed to Azure Kubernetes Service (AKS). You need to implement a strategy that minimizes downtime during updates by gradually shifting traffic to the new version while monitoring for errors. Which deployment strategy should you use?

Accepted Answer

Canary deployment. Option C is correct because canary deployment gradually shifts traffic and allows monitoring. Option A is wrong because rolling replacement updates pods incrementally but doesn't shift traffic gradually. Option B is wrong because blue-green deploys a full new environment and switches all traffic, not gradual. Option D is wrong because recreate replaces all pods at once, causing downtime.

Answer

Recreate deployment

Answer

Blue-green deployment

Answer

Rolling update

Question 12

Your build pipeline uses a self-hosted agent that runs on a Windows machine. The pipeline fails with the error: 'The task 'DotNetCoreCLI' is not supported on this agent.' What is the most likely cause?

Accepted Answer

The agent does not have the required capabilities (e.g., .NET Core SDK installed).. Option B is correct because the agent's capabilities do not include the required .NET Core SDK. Option A is wrong because the error specifically says the task is not supported, not that execution policy is an issue. Option C is wrong because the error doesn't mention network or credentials. Option D is wrong because the error is about the task not being supported, not about agent pool access.

Answer

The agent's execution policy is restricted.

Answer

The agent is not authorized to run the pipeline.

Answer

The agent cannot connect to the internet to download the task.

Question 13

You maintain a classic release pipeline that deploys to multiple environments. You need to ensure that a deployment to the Production environment only proceeds after a manual approval from a specific group of users. Which feature should you configure?

Accepted Answer

Pre-deployment approvals on the Production environment. Option A is correct because pre-deployment approvals can be set on the Production environment. Option B is wrong because post-deployment approvals occur after deployment. Option C is wrong because gates are automated checks, not manual approvals. Option D is wrong because deployment queue settings control parallelism, not approvals.

Answer

Post-deployment approvals on the Production environment

Answer

Deployment queue settings on the Production environment

Answer

Deployment gates on the Production environment

Question 14

Refer to the exhibit. You have a YAML pipeline with the above steps. The pipeline publishes a web app and deploys to Azure App Service. The deployment fails with error: 'Could not find the package in the specified path.' What is the most likely cause?

Accepted Answer

The package path is wrong; the zip file is in $(Build.ArtifactStagingDirectory).. Option C is correct because the publish step outputs the zip file to $(Build.ArtifactStagingDirectory), not $(System.DefaultWorkingDirectory). Option A is wrong because the AzureWebApp task is correct. Option B is wrong because the service connection would cause a different error. Option D is wrong because the dotnet publish command produces a zip file when zipAfterPublish is true.

Answer

The AzureWebApp task input 'appType' is incorrect.

Answer

The dotnet publish command did not generate a zip file.

Answer

The service connection 'MyServiceConnection' is not authorized.

Question 15

Your organization uses GitHub Actions for CI/CD. You need to ensure that secrets are securely passed to workflows without being exposed in logs. What should you use?

Accepted Answer

GitHub Secrets. Option A is correct because GitHub secrets are encrypted and automatically masked in logs. Option B is wrong because environment variables are not encrypted and may be logged. Option C is wrong because encrypted variables in Azure DevOps are not a GitHub feature. Option D is wrong because hardcoding secrets is insecure.

Answer

Environment variables in the workflow YAML

Answer

Hardcode the secrets in the workflow file

Answer

Azure Key Vault with Azure DevOps encrypted variables