AZ-400 Design and implement build and release pipelines Practice Test 27 — 15 Questions

Question 1

Your team uses Azure Pipelines for CI/CD. You need to enforce that all builds sign the assemblies with a code signing certificate stored in Azure Key Vault. What is the recommended approach?

Accepted Answer

Use the 'Azure Key Vault' task to download secrets and then a 'PowerShell' task to sign.. Use a 'Download secrets' task to retrieve the certificate from Key Vault and then use a script to sign the assemblies.

Answer

Store the certificate as a secure file in the pipeline library and use the 'Download Secure File' task.

Answer

Embed the certificate in the repository and use a script to sign.

Answer

Use the 'Azure CLI' task to retrieve the certificate and then sign.

Question 2

You want to trigger a pipeline automatically when a new tag is pushed to a GitHub repository. Which trigger should you configure in the pipeline YAML?

Accepted Answer

trigger: tags:. The 'tags' trigger under 'trigger' enables pipelines to run when specific tags are pushed.

Answer

pr:

Answer

schedules:

Answer

resources: pipelines:

Question 3

Which TWO are benefits of using deployment groups in Azure Pipelines compared to using individual virtual machines?

Accepted Answer

Simplified targeting of multiple machines with a single pipeline run.. Deployment groups allow you to target multiple machines with a single pipeline run and manage rolling updates. They do not directly improve security or reduce cost by themselves.

Answer

Built-in secrets management for connection strings.

Answer

Reduced cost because VMs are shut down when not in use.

Answer

Automatic scaling of virtual machines based on load.

Question 4

Which THREE are valid strategies for managing configuration in a multi-environment CI/CD pipeline?

Accepted Answer

Store configuration in environment-specific YAML variable files.. Using variable groups, Key Vault references, and environment-specific YAML variable files are all valid. Storing config in the container image is not recommended because it couples the image to an environment. Hardcoding in scripts is bad practice.

Answer

Embed configuration values directly into the container image.

Answer

Hardcode configuration in pipeline scripts for each environment.

Question 5

Which TWO tasks can be used to run unit tests in an Azure Pipeline?

Accepted Answer

DotNetCoreCLI@2. The VSTest task runs Visual Studio tests, and the DotNetCoreCLI task with 'test' command runs .NET tests. The NuGet task restores packages, not tests. The CopyFiles task copies files. The PublishBuildArtifacts task publishes artifacts.

Answer

NuGetCommand@2

Answer

PublishBuildArtifacts@1

Answer

CopyFiles@2

Question 6

You are a DevOps engineer for a large e-commerce company. The development team uses GitHub for source control and GitHub Actions for CI/CD. The application is a microservices architecture with 15 services, each in its own repository. You need to implement a continuous delivery pipeline that builds and deploys each service to a Kubernetes cluster in Azure (AKS). The pipeline must meet the following requirements: 
- Each service must have its own pipeline that triggers on pushes to the main branch.
- Deployment to AKS must use Helm charts.
- The pipeline must automatically increment the Helm chart version and update the deployment manifest in the repository.
- Security scanning must be performed on container images before deployment.
- The pipeline must support manual approval for production deployment.
- All secrets (e.g., AKS credentials, registry credentials) must be stored securely and not exposed in logs.
You need to design the workflow. What is the best course of action?

Accepted Answer

Create a reusable workflow with OIDC authentication to Azure. Use Helm to deploy, increment chart version, and commit back. Use GitHub environments for approval gates. Integrate container scanning with Docker Scout or Trivy.. Using GitHub Actions with OIDC to authenticate to Azure avoids storing long-lived secrets. Helm chart version bumping can be done with a script. The workflow uses environments for approval gates. Container scanning using tools like Trivy can be added as a step.

Answer

Use Azure Pipelines instead of GitHub Actions because it has better integration with AKS. Store secrets in Azure Key Vault and use variable groups.

Answer

Create a workflow per service with direct deployment. Use kubectl commands to deploy. Store all secrets in a single GitHub secret. Skip security scanning to save time.

Answer

Create a single reusable workflow that each service calls. Use Azure CLI to deploy Helm charts. Store AKS credentials as GitHub secrets. Use a manual approval step via environment protection rules.

Question 7

Your organization uses Azure DevOps Server (on-premises) and is planning to migrate to Azure DevOps Services. You have hundreds of build and release pipelines. The migration must be done with minimal downtime and with validation that each pipeline works after migration. You have a test collection of 20 critical pipelines that must be validated first. What is the best approach?

Accepted Answer

Use the Azure DevOps Migration Tools to replicate the test pipelines to a new Azure DevOps Services organization. Validate, fix issues, then migrate the remaining pipelines in batches.. Using the Azure DevOps Migration Tools to perform a trial migration to a test organization allows you to validate and fix issues before migrating the full collection. Direct upgrade is not supported. Manual recreation is error-prone and not minimal downtime. Skipping validation risks breaking pipelines.

Answer

Export all pipelines as JSON from the server and import them into Azure DevOps Services. Skip validation to save time.

Answer

Manually recreate the 20 critical pipelines in Azure DevOps Services and test them. Then recreate the rest manually.

Answer

Perform an in-place upgrade of Azure DevOps Server to the latest version, then migrate to Azure DevOps Services using the Data Migration Tool.

Question 8

You are setting up a build pipeline for a Node.js application that uses npm for package management. The pipeline should restore npm packages on every build, but you want to leverage caching to speed up the process. The pipeline runs on a Microsoft-hosted agent. You also need to ensure that the build fails if any npm audit vulnerabilities are found. Which tasks and configuration should you use?

Accepted Answer

Use the 'npm' task with 'install' command and enable caching by setting the 'workingDirectory' variable. Run a separate 'npm' task with 'audit' command and set 'failOnVulnerabilities' to 'true'.. The npm task with 'install' restores packages, and the 'npm audit' command checks for vulnerabilities. Caching is done with the Cache task using a key based on package-lock.json.

Answer

Use the 'npm' task with 'custom' command to run 'npm ci'. Use the 'Cache' task to cache 'node_modules' with a key based on 'package.json'.

Answer

Use the 'npm' task with 'install' command without caching. After install, run a PowerShell script to run 'npm audit --audit-level=high' and parse the output.

Answer

Use the 'npm' task with 'ci' command and set 'ignoreScripts' to true. Add a 'npm audit' task but set 'failOnVulnerabilities' to 'false' to avoid build failures.

Question 9

Your team uses Azure Pipelines for CI/CD. You need to ensure that only approved branches can trigger production deployments. Which feature should you use?

Accepted Answer

Branch control for environments. Branch control policies in environments restrict which branches can deploy to each environment. Option A is wrong because pipeline decorators inject steps but don't restrict branches. Option B is wrong because deployment gates check health metrics. Option D is wrong because YAML templates organize jobs, not branch permissions.

Answer

YAML template expressions

Answer

Deployment gates

Answer

Pipeline decorators

Question 10

You are designing a release pipeline for a microservices application. Each service must be deployed independently with zero downtime. Which deployment strategy should you recommend?

Accepted Answer

Blue-green deployment. Blue-green deployment allows switching traffic to the new version while keeping the old version running, enabling instant rollback. Option A is wrong because rolling update replaces instances gradually. Option B is wrong because canary releases route a subset of users. Option D is wrong because feature flags enable toggling features at runtime.

Answer

Rolling update

Answer

Feature flags

Answer

Canary release

Question 11

Refer to the exhibit. Your team uses a classic build pipeline. You notice that test assemblies are not being found during the Test phase. Which change resolves the issue?

Accepted Answer

Set searchFolder to $(Build.BinariesDirectory). The VSTest task searches for test DLLs in the source folder, but the build output goes to a subfolder like $(Build.BinariesDirectory). Setting searchFolder to the correct output path allows discovery. Option B is wrong because using full paths is not necessary if searchFolder is correct. Option C is wrong because buildConfiguration is already set correctly. Option D is wrong because the issue is not about failing tests but finding them.

Answer

Change testSelector to 'testMethod'

Answer

Use fully qualified paths in testAssemblyVer2

Answer

Add buildConfiguration: 'Release' to the DotNetCoreCLI task

Question 12

Your team needs to automatically run a pipeline whenever a pull request is created in GitHub. Which trigger should you configure in Azure Pipelines?

Accepted Answer

Pull request trigger. PR trigger automatically runs pipeline on pull request creation. Option A is wrong because continuous integration trigger runs on branch pushes. Option C is wrong because scheduled trigger runs at specific times. Option D is wrong because pipeline completion trigger runs after another pipeline finishes.

Answer

Pipeline completion trigger

Answer

Scheduled trigger

Answer

Continuous integration trigger

Question 13

You have a multi-stage YAML pipeline that deploys to Azure App Service. The deployment to the production stage should only proceed if a manual approval is granted. How should you configure this?

Accepted Answer

Add an approval check on the production environment. Environment approvals are the native way to require manual sign-off before deployment. Option B is wrong because deployment gates are automatic checks. Option C is wrong because branch policies restrict source branches. Option D is wrong because pipeline decorators add steps but don't enforce approvals.

Answer

Use deployment gates with Azure Monitor metrics

Answer

Configure branch policies on the main branch

Answer

Add a pipeline decorator to require sign-off

Question 14

You are designing a build pipeline that must run on Microsoft-hosted agents. The pipeline has a dependency on a native library that is not pre-installed. You want to minimize pipeline duration. Which approach should you use?

Accepted Answer

Use a self-hosted agent with the library pre-installed. Using a custom agent with the library pre-installed avoids repeated installation. Option A is wrong because inline scripts run each time. Option C is wrong because Docker requires pull and build each time. Option D is wrong because downloading from storage is slow.

Answer

Use a container job with a custom Docker image that includes the library

Answer

Add a script step to install the library using a package manager

Answer

Download the library from Azure Blob Storage in each build

Question 15

Your organization uses Azure DevOps and GitHub. You need to ensure that secrets such as API keys are not exposed in pipeline logs. What should you do?

Accepted Answer

Store the API key in a secret variable. Azure Pipelines allows marking variables as secret, which hides them in logs. Option A is wrong because environment variables still appear in logs. Option C is wrong because Azure Key Vault stores secrets but you need to map them to secret variables. Option D is wrong because logging warnings still expose the secret.

Answer

Store the API key in a plain text variable and reference it as $(apiKey)

Answer

Store the API key in Azure Key Vault and use a variable group linked to the vault

Answer

Use the Logging Command to suppress output