AZ-400 Design and implement build and release pipelines Practice Test 28 — 15 Questions

Question 1

Your team is adopting Infrastructure as Code (IaC) using Bicep. You need to validate the Bicep file syntax and run pre-deployment checks as part of the build pipeline. Which task should you use?

Accepted Answer

Azure CLI task with 'az bicep build'. AzureCLI task can run 'az bicep build' to validate syntax. Option A is wrong because ARM template deployment task deploys, not validates. Option B is wrong because PowerShell task would need manual parsing. Option D is wrong because Bicep is not directly supported by Terraform tasks.

Answer

Azure Resource Group Deployment task

Answer

Terraform task

Answer

PowerShell task with Invoke-RestMethod

Question 2

You manage a release pipeline that deploys to multiple environments. The pipeline uses variables that differ per environment. You want to avoid duplicating variable definitions. Which strategy should you use?

Accepted Answer

Use variable groups linked to environments. Variable groups allow sharing common variables across pipelines and overriding per environment. Option A is wrong because stage-level variables duplicate per stage. Option B is wrong because Azure Key Vault stores secrets, not all variables. Option D is wrong because the variables section in YAML is still duplicated.

Answer

Use the 'variables' section in the pipeline YAML with conditions

Answer

Define variables in each stage of the YAML pipeline

Answer

Store all variables in Azure Key Vault and reference them in the pipeline

Question 3

Which TWO features can you use to enforce quality gates before a production deployment in Azure Pipelines?

Accepted Answer

Approval checks on environments. Approval checks and deployment gates are both quality gates. Option B (branch policies) applies to source control. Option D (pipeline decorators) adds steps but not gates. Option E (scheduled triggers) is for timing.

Answer

Scheduled triggers

Answer

Branch policies on repositories

Answer

Pipeline decorators

Question 4

Which THREE steps should you take to implement a secure CI/CD pipeline that uses secrets from Azure Key Vault?

Accepted Answer

Use the Azure Key Vault task to download secrets as variables. Granting agent access to Key Vault, using secret variables, and leveraging the Key Vault task are all correct. Option D (plain text) is insecure. Option E (hardcoded) is also insecure.

Answer

Store secrets as plain text variables in the pipeline library

Answer

Hardcode secrets in the YAML file and use variables to mask them

Question 5

Which TWO practices help you manage build artifacts efficiently in Azure Pipelines?

Accepted Answer

Set retention policies to automatically delete old artifacts. Publishing artifacts and using retention policies are efficient practices. Option A (manual download) is not efficient. Option D (large files) is inefficient. Option E (copying to each agent) is wasteful.

Answer

Copy artifacts to each agent's local storage

Answer

Download all artifacts manually after each build

Answer

Store artifacts as large single files to reduce number of files

Question 6

Your organization uses GitHub for source control and Azure Pipelines for CI/CD. You have a monorepo with multiple projects. You need to design a pipeline that only builds and tests the projects that have changed in each commit. You want to minimize build time and avoid unnecessary runs. The pipeline should also handle dependencies between projects. Which approach should you use?

Accepted Answer

Configure path filters in the pipeline trigger, and use a custom script to detect dependencies and build only affected projects plus their dependents. Using path filters with dependency detection is efficient. Option B builds all projects, wasting time. Option C builds changed projects but ignores dependencies. Option D uses manual triggers, which is not automated.

Answer

Create a single pipeline that builds all projects on every commit

Answer

Use a single pipeline with a condition that checks which files changed and runs only the corresponding job

Answer

Create separate pipelines for each project and trigger them manually

Question 7

Your team deploys a web application to Azure App Service using Azure Pipelines. The application requires a configuration file that contains connection strings and app settings. You need to ensure that the configuration is environment-specific and that sensitive values are not exposed in the pipeline logs. The configuration file is stored in a Git repository with different branches for each environment. You also need to support local development with the same configuration approach. Which strategy should you use?

Accepted Answer

Store environment-specific settings in Azure App Service configuration, and use variable groups in Azure Pipelines for secrets. Use token replacement in the config file during deployment.. Using environment-specific variable groups and token replacement is secure and supports local development with config transforms. Option B exposes secrets in logs. Option C relies on branch names, which is inflexible. Option D uses a single config, which is not environment-specific.

Answer

Store all settings, including secrets, in the config file in each branch. Use a script to replace tokens.

Answer

Use Azure App Service slots with sticky settings and store all settings in a single config file committed to the repository.

Answer

Use the same config file for all environments and override settings using pipeline variables based on branch name.

Question 8

You are responsible for a release pipeline that deploys a containerized application to Azure Kubernetes Service (AKS). The pipeline currently builds and pushes a Docker image to Azure Container Registry (ACR) and then updates the Kubernetes manifest. You need to implement a rollback strategy in case the deployment fails. The rollback should revert to the previous known good version of the application. Which approach should you use?

Accepted Answer

Use the Kubernetes task with the 'rollback' option, which runs 'kubectl rollout undo' on the deployment.. Using Kubernetes native rollback with 'kubectl rollout undo' is the simplest. Option B uses Helm rollback, which is similar but adds complexity. Option C relies on ACR tags, which is not immediate. Option D requires manual re-run.

Answer

Keep the previous Docker image tag in ACR and update the manifest to point to it manually.

Answer

Rerun the previous successful pipeline run.

Answer

Use Helm to manage releases and rollback using 'helm rollback' command.

Question 9

Your team uses Azure DevOps for CI/CD. You want to ensure that only code from the main branch is deployed to production. The release pipeline has a pre-deployment condition that requires approval. However, you notice that a release created from a feature branch was approved and deployed. What is the most likely cause?

Accepted Answer

The pre-deployment condition did not include a branch filter on the artifact.. Option C is correct because if the pre-deployment condition 'Require approval from a specific number of approvers' is not configured to check the artifact branch, any branch can be approved. Option A is wrong because branch filters on the artifact are the correct way to restrict, but they must be set on the trigger, not the condition. Option B is wrong because the deployment queue settings do not affect branch filtering. Option D is wrong because the artifact source itself does not enforce branch restrictions; that is done via filters.

Answer

The deployment queue settings were set to 'Deploy all in parallel'.

Answer

The artifact was published from a build pipeline that allowed any branch.

Answer

The pre-deployment condition was set to 'After release' instead of 'Before deployment'.

Question 10

Your organization uses GitHub Actions for CI/CD. You need to ensure that secrets stored in GitHub are not exposed in logs. A developer reports that a secret value appeared in the workflow run log. What is the most likely reason?

Accepted Answer

The secret was printed using a script that bypassed automatic masking.. Option D is correct because GitHub Actions automatically masks secrets in logs, but if a secret is explicitly printed or used in a way that bypasses masking (e.g., using echo with variable substitution), it may appear. Option A is wrong because the log level does not affect masking. Option B is wrong because secret names are not masked, only values. Option C is wrong because the trigger does not affect logging.

Answer

The workflow was triggered via repository_dispatch.

Answer

The secret name was used in the log output.

Answer

The workflow used 'debug' log level.

Question 11

You are designing a release pipeline for a .NET application. The pipeline must deploy to multiple environments (Dev, Test, Prod) with manual approval at each stage. Which release trigger should you configure for the production stage?

Accepted Answer

Manual trigger with pre-deployment approvals.. Option B is correct because a manual trigger with approval ensures that deployment to production only happens after explicit approval. Option A is wrong because continuous deployment trigger would skip approvals. Option C is wrong because scheduled trigger is not appropriate for manual approval. Option D is wrong because pull request trigger is for builds, not releases.

Answer

Pull request trigger from the main branch.

Answer

Continuous deployment trigger after a successful build.

Answer

Scheduled trigger set to run nightly.

Question 12

Your build pipeline uses a Microsoft-hosted agent. The pipeline fails intermittently with 'Error: No space left on device'. What is the most effective solution?

Accepted Answer

Add a step to clean up temporary files before the build completes.. Option C is correct because the best approach is to reduce the build artifacts footprint by cleaning up unnecessary files before the build completes. Option A is wrong because using a self-hosted agent might not address the disk space issue if the same amount of data is produced. Option B is wrong because increasing the agent's disk space is not possible with Microsoft-hosted agents. Option D is wrong because parallel jobs do not affect disk space on a single agent.

Answer

Increase the agent's temporary storage by setting the TMP variable.

Answer

Switch to a self-hosted agent with more disk space.

Answer

Configure the pipeline to use more parallel jobs.

Question 13

Your release pipeline uses deployment groups to deploy to on-premises servers. You want to ensure that only one deployment runs at a time on each server. Which option should you configure?

Accepted Answer

Set the deployment queue to 'Deploy one at a time' with 'Exclusive lock'.. Option A is correct because deployment groups support 'Exclusive lock' deployment queue settings to prevent concurrent deployments to the same target. Option B is wrong because parallel deployment settings control the overall number of parallel deployments, not per-target locking. Option C is wrong because stage-level pre-deployment conditions do not enforce per-target locking. Option D is wrong because environment-level approvals are for manual intervention, not concurrency control.

Answer

Configure a pre-deployment condition that checks the current deployment status.

Answer

Add a manual approval step before each deployment.

Answer

Set the deployment queue to 'Deploy all in parallel' with 'Number of parallel deployments' set to 1.

Question 14

Which TWO tasks can be used to deploy an Azure Web App using YAML pipelines in Azure DevOps?

Accepted Answer

AzureWebApp. Options A and B are correct. The AzureWebApp task and the AzureRmWebAppDeployment task are standard for deploying web apps. Option C is for Azure Functions, D is for VM applications, and E is a generic file copy task that does not perform deployment.

Answer

CopyFilesOverSSH

Answer

AzureFunctionApp

Answer

AzureVMAppDeployment

Question 15

Which THREE features are available in GitHub Actions for managing secrets across environments?

Accepted Answer

Organization-level secrets. Options B, C, and D are correct. Environments in GitHub Actions allow secret scoping, organization secrets are available across repos, and repository secrets are scoped to a single repo. Option A is secret scanning, which is a security feature but not for managing secrets across environments. Option E is about encrypted variables, which is redundant with secrets.

Answer

Encrypted variables in workflows

Answer

Secret scanning alerts