AZ-400 Design and implement build and release pipelines Practice Test 29 — 15 Questions

Question 1

Your organization uses GitHub Actions for CI/CD. You need to ensure that secrets stored in GitHub are not exposed in logs. A developer reports that a secret value appeared in the workflow run log. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The secret was printed using a script that bypassed automatic masking.. GitHub Actions automatically masks secrets in log output, but this masking can be bypassed if the secret is printed via a script that outputs it directly (e.g., using `echo` with a variable that contains the secret value, or printing it in a manipulated form). The most likely reason the secret appeared is that the developer used a script that directly printed the secret value, bypassing the automatic masking. Option A is incorrect because the trigger type (repository_dispatch) does not affect logging. Option C is incorrect because secret names are not masked; only their values are masked. Option D is incorrect because the 'debug' log level does not disable masking; masking applies to all log levels.

Answer

The workflow was triggered via repository_dispatch.

Answer

The secret name was used in the log output.

Answer

The workflow used 'debug' log level.

Question 2

You are designing a release pipeline for a .NET application. The pipeline must deploy to multiple environments (Dev, Test, Prod) with manual approval at each stage. Which release trigger should you configure for the production stage?

Accepted Answer

Manual trigger with pre-deployment approvals.. The requirement specifies manual approval at each stage, and for the production stage, a manual trigger with pre-deployment approvals ensures that deployments only occur after explicit human authorization. This aligns with the need for controlled, gated releases to production, preventing automatic or scheduled deployments that bypass approval.

Answer

Pull request trigger from the main branch.

Answer

Continuous deployment trigger after a successful build.

Answer

Scheduled trigger set to run nightly.

Question 3

Your release pipeline uses deployment groups to deploy to on-premises servers. You want to ensure that only one deployment runs at a time on each server. Which option should you configure?

Accepted Answer

Set the deployment queue to 'Deploy one at a time' with 'Exclusive lock'.. Setting the deployment queue to 'Deploy one at a time' with 'Exclusive lock' ensures that only one deployment runs at a time on each server in the deployment group. This lock prevents concurrent deployments to the same target, which is essential for on-premises servers that cannot handle parallel updates without conflicts.

Answer

Configure a pre-deployment condition that checks the current deployment status.

Answer

Add a manual approval step before each deployment.

Answer

Set the deployment queue to 'Deploy all in parallel' with 'Number of parallel deployments' set to 1.

Question 4

Which TWO tasks can be used to deploy an Azure Web App using YAML pipelines in Azure DevOps?

Accepted Answer

AzureWebApp. The AzureWebApp task is correct because it is the dedicated Azure DevOps YAML pipeline task for deploying code to an Azure Web App (App Service). It supports deployment methods like Web Deploy (msdeploy), Kudu REST API, and ZIP deploy, making it the standard choice for web app deployments.

Answer

CopyFilesOverSSH

Answer

AzureFunctionApp

Answer

AzureVMAppDeployment

Question 5

Which THREE features are available in GitHub Actions for managing secrets across environments?

Accepted Answer

Organization-level secrets. GitHub Actions supports three types of secrets for managing sensitive data: organization-level secrets, which are encrypted and shared across multiple repositories within an organization; repository-level secrets, which are available to all workflows in a single repository; and environment-specific secrets, which are scoped to a particular environment (e.g., production) within a repository. Together these allow centralized and scoped management of secrets across different environments and repositories. Options A and C are incorrect: 'encrypted variables in workflows' is not the official GitHub Actions secret feature, and secret scanning alerts is a reactive security service, not a secret management feature.

Answer

Encrypted variables in workflows

Answer

Secret scanning alerts

Question 6

Which TWO triggers can be used to start a release pipeline in Azure DevOps?

Accepted Answer

Scheduled release trigger. B is correct because a scheduled release trigger allows you to define a recurring time (e.g., daily at 2:00 AM) to automatically start a release pipeline, which is essential for scenarios like nightly builds or periodic deployments. C is correct because a continuous deployment trigger automatically starts a release pipeline whenever a new build artifact is available from a linked build pipeline, enabling immediate deployment after a successful build. Both triggers are native to Azure Pipelines and are configured directly on the release pipeline's 'Triggers' tab.

Answer

Continuous integration trigger

Answer

Pull request trigger

Answer

Branch policy trigger

Question 7

Your company uses Azure DevOps for CI/CD. You have a YAML build pipeline that builds a .NET Core application and publishes artifacts. The build runs on a Microsoft-hosted agent. Recently, the build started failing with the error 'The process cannot access the file because it is being used by another process.' This occurs intermittently during the 'dotnet build' step. The pipeline uses multiple jobs that run in parallel. You suspect that one job is interfering with another because they share the same workspace on the agent. You need to ensure that each job runs in its own isolated workspace. What should you do?

Accepted Answer

Set 'clean: all' on the checkout step in each job.. Setting 'clean: all' on the checkout step ensures that the workspace is cleaned before each job runs, preventing file conflicts caused by shared workspace on the agent. Option A is wrong because 'demands' are for selecting agents with specific capabilities, not for workspace isolation. Option B is wrong because 'workspace: clean' is not a valid setting at the pipeline root; workspace cleaning is configured per checkout step. Option C is wrong because a multi-job configuration with a matrix is used for parallelizing builds across different configurations, not for isolating workspaces.

Answer

Add a 'demands' section to the job to ensure each job runs on a different agent.

Answer

Set 'workspace: clean' in the pipeline root.

Answer

Use a 'multi-job' configuration with a matrix to run each job in separate folders.

Question 8

Your organization uses Azure DevOps. You have a classic release pipeline that deploys to multiple stages: Dev, QA, and Prod. Each stage has a pre-deployment approval gate. Recently, the QA team complained that they are not receiving approval notifications. You have verified that the approval configuration is correct and the approvers are members of the 'QA Approvers' group. The release pipeline is set to send email notifications to the approvers. However, the QA approvers report they do not receive any emails when a release is pending their approval. What should you check first?

Accepted Answer

Verify that the organization-level notification settings allow email notifications for approvals.. The correct first step. Even if the pipeline's approval configuration is correct and the approvers are in the correct group, the organization-level notification settings in Azure DevOps can override individual pipeline settings. If email notifications for approvals are disabled at the organization level, no emails will be sent regardless of the pipeline configuration. Therefore, checking the organization-level notification settings should be the first troubleshooting step. Option A is not the first step because while spam filters could cause missed emails, the issue is more likely a system-level configuration problem. Option C is incorrect because Azure DevOps automatically sends approval notifications; adding a manual 'Send email' task is unnecessary and not a standard fix. Option D is incorrect because checking release pipeline logs might reveal delivery failures, but the most efficient first step is to verify the notification settings at the organization level.

Answer

Ask the QA team to check their spam folder.

Answer

Add a 'Send email' task in the pipeline before the approval gate.

Answer

Check the 'Release Pipeline' logs for a warning about email delivery failure.

Question 9

Your company uses Azure DevOps for CI/CD. You have a build pipeline that compiles a C++ application and runs unit tests. The pipeline uses a Microsoft-hosted agent. The build takes approximately 45 minutes to complete. You want to reduce the build time. You notice that the pipeline downloads dependencies from a NuGet feed every time. You have a private NuGet feed in Azure Artifacts. The pipeline restores packages using 'nuget restore'. You want to cache the NuGet packages on the agent to avoid downloading them on every build. What should you do?

Accepted Answer

Add a CacheBeta task before the restore step to cache the packages folder.. The CacheBeta task enables caching of the NuGet packages folder between pipeline runs, avoiding repeated downloads from the feed. This directly reduces build time. Option A is wrong because while self-hosted agents can have persistent storage, the question specifies using a Microsoft-hosted agent, and the CacheBeta task works even with Microsoft-hosted agents. Option B is wrong because using upstream sources in Azure Artifacts does not cache packages locally on the agent; it still requires downloading them each time. Option C is wrong because increasing compute resources does not affect the time spent downloading dependencies; caching addresses the root cause.

Answer

Use a self-hosted agent with persistent storage.

Answer

Use a hosted Azure Artifacts feed with upstream sources.

Answer

Increase the agent's compute resources by selecting a higher SKU.

Question 10

Your team uses GitHub Actions to deploy a microservices application to a Kubernetes cluster. The workflow builds Docker images and pushes them to a container registry, then updates the Kubernetes deployment. The deployment often fails due to image pull errors, specifically 'ErrImagePull' and 'ImagePullBackOff'. You investigate and find that the image tag in the Kubernetes manifest is the commit SHA. The workflow uses the 'azure/k8s-deploy@v1' action. You suspect that the image is not being pulled because the registry credentials are not properly configured. You have stored the registry credentials as secrets. What is the most likely cause and solution?

Accepted Answer

The action does not automatically create imagePullSecrets; you need to add a step to create the secret in the cluster and reference it in the deployment.. The 'azure/k8s-deploy@v1' action deploys to Kubernetes but does not automatically create imagePullSecrets for private container registries. Even if the registry credentials are stored as secrets in GitHub, they are not automatically applied to the cluster. You must explicitly create a Kubernetes secret of type docker-registry and add an imagePullSecrets entry to the deployment manifest. Option A is wrong because using 'latest' tag is not a best practice and does not address authentication. Option B is wrong because the image name is likely correct; the issue is pulling due to lack of credentials. Option C is wrong because the action does support private registries when credentials are properly configured.

Answer

The commit SHA tag is not valid; use 'latest' tag instead.

Answer

The image name is incorrect; verify the registry URL.

Answer

The 'azure/k8s-deploy' action does not support private registries; use a different action.

Question 11

Your team uses Azure Pipelines to build a .NET application. You need to implement a secure build pipeline that meets the following requirements:
- Secrets must be injected at build time without being exposed in logs or YAML files.
- The build must use Microsoft-hosted agents.
- All builds must be auditable.
Which TWO actions should you take? (Choose two.)

Accepted Answer

Use a variable group linked to Azure Key Vault to store secrets, and reference the variable group in the pipeline.. To securely inject secrets without exposing them in logs or YAML, use a variable group linked to Azure Key Vault (B) to store secrets, and then use a token replacement task like Replace Tokens (D) to inject those secret variables into configuration files during the build. This avoids putting secrets in YAML, masks them in logs, and is auditable via Azure Key Vault and Azure DevOps audit logs. Option A, while the token is masked, is for Azure DevOps API access, not secret injection, and enabling it increases exposure risk.

Answer

Enable 'Allow scripts to access the OAuth token' on the agent job and use the token in scripts.

Answer

Store secrets as plain-text environment variables in the pipeline YAML file.

Answer

Deploy a self-hosted agent on-premises to keep secrets within the corporate network.

Question 12

You manage a release pipeline for a Java application that is deployed to Azure App Service. The pipeline currently uses manual approval gates. You need to implement automated quality gates to reduce manual intervention. Which THREE conditions can you use in the 'Post-deployment approvals' settings of a release pipeline? (Choose three.)

Accepted Answer

Invoke Azure Functions. 'Invoke Azure Functions' is a valid gate type in Azure DevOps release pipelines. It allows you to call an Azure Function as a quality gate, enabling custom automated checks (e.g., validating deployment health or running custom logic) without manual intervention. This directly supports the goal of reducing manual approvals by automating post-deployment validation.

Answer

Azure Policy

Answer

Manual approval

Question 13

Your organization uses GitHub Actions for CI/CD. You need to ensure that secrets stored in GitHub are not exposed in logs. A developer reports that a secret value appeared in the workflow run log. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a workflow to the repository that runs tests and reports a conclusion status.. A workflow that runs tests and reports a conclusion status provides the status check that branch protection rules can require. Option E is correct because enabling 'Require status checks to pass before merging' under branch protection rules in the repository settings enforces that the specific workflow's status check must succeed before a pull request can be merged into the main branch.

Answer

Configure a GitHub environment with required reviewers.

Answer

Use a repository ruleset to require status checks.

Answer

Set up branch policies in Azure Repos for the main branch.

Question 14

Your company develops a microservices-based application deployed on Azure Kubernetes Service (AKS). The CI/CD pipeline uses Azure Pipelines. The development team has recently adopted a trunk-based development strategy where all feature work is done on short-lived branches that merge to main at least daily. The release pipeline must automatically deploy to a development environment on each commit to main, and to a staging environment after a manual approval. The staging environment is used for integration tests and must remain stable. You need to design the release pipeline strategy to support this workflow. What should you do?

Accepted Answer

Create a single release pipeline with two stages: 'Dev' triggered automatically on successful build, and 'Staging' with a pre-deployment approval gate.. It creates a single release pipeline with two stages: 'Dev' triggered automatically on successful build, and 'Staging' with a pre-deployment approval gate. This meets the requirements: automatic deployment to dev on each commit to main, and manual approval before deploying to staging, keeping staging stable. Option A is wrong because deploying to both environments simultaneously bypasses the manual approval needed for staging. Option C is wrong because separate pipelines add maintenance overhead and don't leverage pipeline stages for approval gates. Option D is wrong because a post-deployment approval gate would deploy to staging first, then require approval, which doesn't prevent deployment without approval. Also disabling continuous deployment trigger for staging would require manual promotion, which is not desired.

Answer

Create a single release pipeline with one stage that deploys to both dev and staging simultaneously, and add a manual intervention task before staging deployment.

Answer

Create two separate release pipelines: one for dev with continuous deployment trigger, and one for staging with a manual trigger.

Answer

Create a single release pipeline with two stages: 'Dev' triggered automatically, and 'Staging' with a post-deployment approval gate and disable continuous deployment trigger.

Question 15

You are designing a build pipeline for a Python application that uses multiple third-party packages from the public PyPI repository. Your organization has security policies that require all build dependencies to be scanned for known vulnerabilities before being used. The build pipeline runs on Microsoft-hosted agents. You need to integrate vulnerability scanning into the build pipeline with minimal overhead and without storing credentials in the pipeline. What should you do?

Accepted Answer

Add a dependency scanning task from the Azure DevOps marketplace to the build pipeline.. The correct approach is to add a dependency scanning task from the Azure DevOps marketplace to the build pipeline. These tasks, such as WhiteSource Bolt or Snyk, integrate seamlessly with Azure Pipelines, automatically scan dependencies from PyPI for known vulnerabilities, and require no credential storage in the pipeline. Option A is incorrect because connecting to a private vulnerability database adds unnecessary complexity and overhead. Option B is incorrect because using a custom script with pip audit would require maintaining the script and potentially storing credentials for external services. Option C is incorrect because manual review is not automated and defeats the purpose of a CI/CD pipeline.

Answer

Configure a service connection to a private vulnerability database and use a script to scan.

Answer

Write a custom script that uses pip audit to scan the requirements.txt file.

Answer

Use a pre-build validation step in the pipeline to manually review dependencies.