AZ-400 Design and implement build and release pipelines Practice Test 26 — 15 Questions

Question 1

You are designing a release pipeline for a containerized application deployed to Azure Kubernetes Service (AKS). You want to implement a strategy where the new version is deployed to a small subset of pods first, and if healthy, gradually rolled out to all pods. Which Kubernetes deployment strategy should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Canary deployment. A canary deployment is the correct strategy because it allows you to route a small percentage of traffic (e.g., 5%) to the new version of the application running on a subset of pods in AKS. If the canary is healthy (e.g., passes liveness and readiness probes), you can gradually increase the traffic percentage until 100% of pods run the new version, providing controlled rollout and rollback capabilities.

Answer

Rolling update

Answer

Blue-green deployment

Answer

Recreate deployment

Question 2

Your Azure Pipeline builds a Docker image and pushes it to Azure Container Registry (ACR). You need to ensure that the image is scanned for vulnerabilities before being pushed. Which task should you add to the pipeline?

Accepted Answer

Container scanning task from Microsoft Defender for Cloud. Microsoft Defender for Cloud provides a dedicated container scanning task that integrates directly into Azure Pipelines to scan Docker images for vulnerabilities before they are pushed to ACR. This task leverages the same vulnerability assessment engine used by Microsoft Defender for Cloud to identify CVEs in OS packages and application dependencies, ensuring only compliant images are pushed.

Answer

Azure CLI task to run 'az acr scan'

Answer

Docker task with the 'push' action

Answer

PublishBuildArtifacts task

Question 3

Your team uses Azure Pipelines and wants to automatically create a release every time a build succeeds on the main branch. Which trigger should you configure?

Accepted Answer

Build completion trigger in the release pipeline. A build completion trigger in the release pipeline allows you to automatically create a release whenever a specific build pipeline succeeds on the main branch. This trigger monitors the build pipeline for successful completions and initiates the release process, which directly matches the requirement of creating a release after every successful build on main.

Answer

Pull request trigger in the build pipeline

Answer

Continuous integration (CI) trigger in the release pipeline

Answer

Scheduled trigger in the release pipeline

Question 4

Which TWO actions can you take to improve the security of secrets in Azure Pipelines? (Choose two.)

Accepted Answer

Limit variable group permissions to specific pipelines. Limiting variable group permissions to specific pipelines ensures that only authorized pipelines can access sensitive secrets, reducing the risk of unauthorized exposure. Option D is correct because Azure Key Vault provides a centralized, auditable, and encrypted store for secrets, and mapping them as secret variables in Azure Pipelines prevents the secret values from being exposed in logs or output.

Answer

Log secret values for debugging purposes

Answer

Allow pipeline users to override secret values at queue time

Answer

Store secrets as plain text variables in the pipeline

Question 5

Which THREE are valid ways to trigger a pipeline in Azure Pipelines? (Choose three.)

Accepted Answer

Schedule trigger. A is correct because Azure Pipelines supports scheduled triggers via the `schedules` block in YAML (or the Triggers UI), which runs the pipeline on a cron-based timetable. B is correct because PR triggers (`pr:` in YAML) cause the pipeline to run when a pull request is opened or updated against specified branches, typically for validation builds. C is correct because CI triggers (`trigger:` in YAML) run the pipeline automatically whenever code is pushed to the included branches, which is the standard continuous integration mechanism. D is not a valid Azure Pipelines trigger; `on: push` is GitHub Actions syntax, not Azure Pipelines YAML. E is not a valid trigger type in Azure Pipelines; commits are picked up through CI triggers, not a separate 'commit trigger' construct.

Answer

'on: push' trigger in YAML

Answer

Commit trigger

Question 6

Refer to the exhibit. You are reviewing an ARM template used in an Azure Pipeline deployment. Which security concern should you address?

Accepted Answer

The admin password is hardcoded in the template. Hardcoding an admin password directly in an ARM template exposes credentials in source control, pipeline logs, and deployment history, creating a serious security vulnerability. The correct remediation is to reference a secret from Azure Key Vault or use a secure parameter, not to embed the value. This is the security concern the question asks you to identify.

Answer

The VM size is too small for production

Answer

The apiVersion is outdated

Answer

The location parameter has a default value

Question 7

Refer to the exhibit. The workflow runs successfully but the deployment fails because the Azure CLI is not authenticated. What should you add to the workflow to authenticate?

Accepted Answer

Add the 'azure/login' action with Azure credentials. The Azure CLI in the workflow requires authentication to interact with Azure resources. Adding the 'azure/login' action with valid Azure credentials (e.g., service principal secrets or OpenID Connect) establishes the necessary authentication context before any Azure CLI commands are executed, resolving the 'not authenticated' error.

Answer

Add the 'actions/setup-node' action

Answer

Add the 'azure/webapps-deploy' action

Answer

Add the 'actions/github-script' action to use the GitHub token

Question 8

Your organization has a multi-stage YAML pipeline that builds and deploys a containerized application to Azure Kubernetes Service (AKS). The pipeline uses environment approvals for the production stage. You need to ensure that the container image deployed to production is the same as the one that passed all previous stages. Which strategy should you implement?

Accepted Answer

Publish the container image as a pipeline artifact and reference it from each stage.. Publishing the container image as a pipeline artifact ensures that the exact same image (by digest, not just tag) is available to all stages. By referencing the artifact in each stage, you guarantee that the image deployed to production is identical to the one that passed testing, avoiding any risk of tag mutation or rebuild inconsistencies.

Answer

Use the same image tag in all stages, updating the tag as needed.

Answer

Enable immutable tags on the container registry to prevent overwrites.

Answer

Rebuild the container image in each stage to ensure freshness.

Question 9

You are configuring a release pipeline that deploys to multiple environments. You want to automate the deployment to the staging environment only if the build succeeds, and then require manual approval before deploying to production. Which strategy should you use?

Accepted Answer

Define an environment with approvals required for the production stage.. Azure Pipelines allows you to define environments with explicit approval checks. By adding a manual approval gate on the production environment stage, the pipeline will automatically deploy to staging after a successful build, but pause before production until an authorized user approves the release. This directly meets the requirement for automated staging deployment and manual production approval.

Answer

Use deployment gates in the production stage to check for manual intervention.

Answer

Use a classic release pipeline with pre-deployment approvals.

Answer

Configure a branch policy on the main branch to require approval for pull requests.

Question 10

Your team uses Azure Repos and wants to trigger a pipeline automatically when a pull request is created targeting the main branch. The pipeline should run validations and report the status to the PR. Which trigger type should you configure?

Accepted Answer

PR trigger. A PR trigger is the correct choice because it specifically initiates a pipeline when a pull request is created or updated against a target branch (main). This allows the pipeline to run validations (e.g., builds, tests, linting) and report the status back to the PR via the Azure Repos status API, enabling branch protection policies to block merging if checks fail.

Answer

Path filter

Answer

Scheduled trigger

Answer

CI trigger

Question 11

Your pipeline builds a .NET application and runs unit tests. You notice that the pipeline takes too long because it restores NuGet packages on every run. You want to cache the NuGet packages to speed up subsequent builds. Which task should you use?

Accepted Answer

Cache@2 (CacheBeta). The Cache@2 (CacheBeta) task is specifically designed to cache folders or files between pipeline runs, such as NuGet packages, to reduce restore time. By caching the NuGet packages folder (e.g., $(UserProfile)/.nuget/packages), subsequent builds can skip the full restore and reuse previously downloaded packages, significantly speeding up the pipeline.

Answer

NuGetCommand@2 with the restore command

Answer

CopyFiles@2

Answer

PowerShell@2 to manually download and cache

Question 12

Your organization uses GitHub Actions for CI/CD. You need to ensure that secrets used in workflows are not exposed in logs. What should you do?

Accepted Answer

Store the secret in GitHub Secrets and reference it as ${{ secrets.SECRET_NAME }}.. GitHub Secrets are encrypted environment variables that are automatically masked in workflow logs. When you reference a secret using the `${{ secrets.SECRET_NAME }}` syntax, GitHub Actions ensures the value is never printed in plain text, even if the workflow attempts to echo it. This is the built-in, secure method for handling sensitive data in CI/CD pipelines.

Answer

Encrypt the secret with a password before using it.

Answer

Use the 'echo' command to output the secret and then delete the log.

Answer

Disable logging on the self-hosted runner.

Question 13

You are designing a build pipeline for a Java application that uses Maven. You want to publish the compiled JAR file as a build artifact. Which task should you use?

Accepted Answer

PublishBuildArtifacts@1. The Publish Build Artifacts task publishes files as pipeline artifacts. Option B (Maven@3) is wrong because it builds the project but does not publish artifacts. Option C (ArchiveFiles@2) is wrong because it creates a zip but does not publish. Option D (CopyFiles@2) is wrong because it only copies files within the agent.

Answer

Maven@3

Answer

ArchiveFiles@2

Answer

CopyFiles@2

Question 14

Your Azure DevOps pipeline deploys a web app to Azure App Service using a YAML pipeline. The deployment fails intermittently with the error 'Conflict' when updating deployment slots. What is the most likely cause?

Accepted Answer

Another deployment or swap operation is already in progress on the slot.. The 'Conflict' error during an Azure App Service deployment slot update indicates that the slot is currently locked by another operation, such as an ongoing deployment or a swap. Azure App Service enforces mutual exclusion on slot operations to prevent race conditions, so if a previous deployment or swap has not completed, the new request is rejected with HTTP 409 Conflict.

Answer

The service connection is using expired credentials.

Answer

The slot name is misspelled in the pipeline configuration.

Answer

The web app is locked by a file handle from a previous deployment.

Question 15

Your team uses a monorepo in Azure Repos with multiple projects. You want to trigger a pipeline only when changes are made to a specific subfolder. Which configuration should you use?

Accepted Answer

Add a 'paths' filter to the CI trigger.. Azure Pipelines CI triggers support a 'paths' filter that allows you to specify include or exclude patterns for file changes. When a monorepo contains multiple projects in separate subfolders, adding a 'paths' filter to the CI trigger ensures the pipeline only runs when changes are detected within that specific subfolder, avoiding unnecessary builds for unrelated projects.

Answer

Use a branch filter in the CI trigger.

Answer

Configure the checkout step to only include the subfolder.

Answer

Use a 'file_match' condition on the job.