AZ-400 Design and implement build and release pipelines Practice Test 30 — 15 Questions

Question 1

You are a DevOps engineer for a large e-commerce company. The development team uses GitHub for source control and GitHub Actions for CI/CD. The application is a microservices architecture with 15 services, each in its own repository. You need to implement a continuous delivery pipeline that builds and deploys each service to a Kubernetes cluster in Azure (AKS). The pipeline must meet the following requirements: 
- Each service must have its own pipeline that triggers on pushes to the main branch.
- Deployment to AKS must use Helm charts.
- The pipeline must automatically increment the Helm chart version and update the deployment manifest in the repository.
- Security scanning must be performed on container images before deployment.
- The pipeline must support manual approval for production deployment.
- All secrets (e.g., AKS credentials, registry credentials) must be stored securely and not exposed in logs.
You need to design the workflow. What is the best course of action?

Accepted Answer

Create a reusable workflow with OIDC authentication to Azure. Use Helm to deploy, increment chart version, and commit back. Use GitHub environments for approval gates. Integrate container scanning with Docker Scout or Trivy.. Option B satisfies every stated requirement using native GitHub Actions capabilities: reusable workflows provide DRY pipeline logic across the 15 service repos, OIDC federation eliminates long-lived AKS/registry credentials by exchanging short-lived tokens with Microsoft Entra ID, GitHub Environments supply the manual approval gate for production, and Trivy/Docker Scout integrate cleanly as a scanning step before Helm deployment. Helm handles chart versioning, and committing the bumped chart back to the repo closes the GitOps loop.

Answer

Use Azure Pipelines instead of GitHub Actions because it has better integration with AKS. Store secrets in Azure Key Vault and use variable groups.

Answer

Create a workflow per service with direct deployment. Use kubectl commands to deploy. Store all secrets in a single GitHub secret. Skip security scanning to save time.

Answer

Create a single reusable workflow that each service calls. Use Azure CLI to deploy Helm charts. Store AKS credentials as GitHub secrets. Use a manual approval step via environment protection rules.

Question 2

Your team uses Azure Pipelines for CI/CD. You need to ensure that only approved branches can trigger production deployments. Which feature should you use?

Accepted Answer

Branch control for environments. Branch control for environments in Azure Pipelines allows you to restrict which branches can trigger deployments to specific environments, such as production. By configuring branch filters on an environment, you ensure that only approved branches (e.g., main or release branches) can initiate a production deployment, providing a security and governance boundary.

Answer

YAML template expressions

Answer

Deployment gates

Answer

Pipeline decorators

Question 3

Your team needs to automatically run a pipeline whenever a pull request is created in GitHub. Which trigger should you configure in Azure Pipelines?

Accepted Answer

Pull request trigger. Azure Pipelines provides a dedicated pull request trigger that automatically starts a pipeline when a pull request is created or updated in GitHub. This trigger validates proposed changes before merging, ensuring code quality and preventing broken builds from entering the main branch.

Answer

Pipeline completion trigger

Answer

Scheduled trigger

Answer

Continuous integration trigger

Question 4

You have a multi-stage YAML pipeline that deploys to Azure App Service. The deployment to the production stage should only proceed if a manual approval is granted. How should you configure this?

Accepted Answer

Add an approval check on the production environment. Azure Pipelines supports approval checks on environments, which allow you to require manual approval before a deployment proceeds to a specific stage. By adding an approval check on the production environment, the pipeline will pause at that stage until an authorized user grants approval, meeting the requirement for manual sign-off before production deployment.

Answer

Use deployment gates with Azure Monitor metrics

Answer

Configure branch policies on the main branch

Answer

Add a pipeline decorator to require sign-off

Question 5

You are designing a build pipeline that must run on Microsoft-hosted agents. The pipeline has a dependency on a native library that is not pre-installed. You want to minimize pipeline duration. Which approach should you use?

Accepted Answer

Use a container job with a custom Docker image that includes the library. Using a container job with a custom Docker image that includes the native library allows the pipeline to run on Microsoft-hosted agents while eliminating installation overhead, thus minimizing pipeline duration. This approach meets the requirement of using Microsoft-hosted agents and avoids the time cost of installing the library in each run.

Answer

Use a self-hosted agent with the library pre-installed

Answer

Add a script step to install the library using a package manager

Answer

Download the library from Azure Blob Storage in each build

Question 6

Your team is adopting Infrastructure as Code (IaC) using Bicep. You need to validate the Bicep file syntax and run pre-deployment checks as part of the build pipeline. Which task should you use?

Accepted Answer

Azure CLI task with 'az bicep build'. The `az bicep build` command compiles a Bicep file into an ARM template and performs syntax validation, making it the correct choice for validating Bicep syntax and running pre-deployment checks in a build pipeline. This task ensures that the Bicep code is syntactically correct before any deployment attempt, aligning with Infrastructure as Code (IaC) best practices.

Answer

Azure Resource Group Deployment task

Answer

Terraform task

Answer

PowerShell task with Invoke-RestMethod

Question 7

Which TWO features can you use to enforce quality gates before a production deployment in Azure Pipelines?

Accepted Answer

Approval checks on environments. Approval checks on environments allow you to require manual sign-off before a release proceeds to a production stage. This enforces a quality gate by ensuring that a designated approver reviews and authorizes the deployment. Option E is correct because deployment gates evaluate health metrics (e.g., from Azure Monitor or Application Insights) automatically, blocking or allowing the deployment based on predefined conditions such as error rates or performance thresholds.

Answer

Scheduled triggers

Answer

Branch policies on repositories

Answer

Pipeline decorators

Question 8

Which THREE steps should you take to implement a secure CI/CD pipeline that uses secrets from Azure Key Vault?

Accepted Answer

Use the Azure Key Vault task to download secrets as variables. The Azure Key Vault task in Azure Pipelines can download secrets as pipeline variables at runtime, allowing the pipeline to securely reference them without exposing the secret values in logs or configuration. This task authenticates to Key Vault using a service connection or managed identity, ensuring secrets are never stored in the pipeline definition.

Answer

Store secrets as plain text variables in the pipeline library

Answer

Hardcode secrets in the YAML file and use variables to mask them

Question 9

Which TWO practices help you manage build artifacts efficiently in Azure Pipelines?

Accepted Answer

Set retention policies to automatically delete old artifacts. Setting retention policies (A) helps automate cleanup of old artifacts, reducing storage waste. Using the Publish Build Artifacts task (D) is the standard way to store artifacts from builds efficiently. Option B (copying to each agent) is wasteful because it duplicates artifacts unnecessarily. Option C (manual download) is inefficient because it requires human intervention and does not scale. Option E (large single files) makes downloads and incremental updates difficult.

Answer

Copy artifacts to each agent's local storage

Answer

Download all artifacts manually after each build

Answer

Store artifacts as large single files to reduce number of files

Question 10

Your organization uses GitHub for source control and Azure Pipelines for CI/CD. You have a monorepo with multiple projects. You need to design a pipeline that only builds and tests the projects that have changed in each commit. You want to minimize build time and avoid unnecessary runs. The pipeline should also handle dependencies between projects. Which approach should you use?

Accepted Answer

Configure path filters in the pipeline trigger, and use a custom script to detect dependencies and build only affected projects plus their dependents. To build only changed projects in a monorepo, you need to detect which files changed and then determine the affected projects and their dependents. Path filters in the pipeline trigger can limit the pipeline to run only when specific paths change, but they don't handle dependencies. A custom script can analyze the dependency graph and build only the affected projects plus their dependents, minimizing build time. This approach is flexible and can be implemented in Azure Pipelines using scripts or tools like Nx or Lerna.

Answer

Create a single pipeline that builds all projects on every commit

Answer

Use a single pipeline with a condition that checks which files changed and runs only the corresponding job

Answer

Create separate pipelines for each project and trigger them manually

Question 11

Your team deploys a web application to Azure App Service using Azure Pipelines. The application requires a configuration file that contains connection strings and app settings. You need to ensure that the configuration is environment-specific and that sensitive values are not exposed in the pipeline logs. The configuration file is stored in a Git repository with different branches for each environment. You also need to support local development with the same configuration approach. Which strategy should you use?

Accepted Answer

Store environment-specific settings in Azure App Service configuration, and use variable groups in Azure Pipelines for secrets. Use token replacement in the config file during deployment.. The correct strategy is to store environment-specific settings in Azure App Service configuration (which can be set per slot/environment) and use Azure Pipelines variable groups for secrets, ensuring they are not exposed in logs. Token replacement in the config file during deployment allows the same config file to be used across environments while injecting environment-specific values. This supports local development because developers can use local settings or user secrets without committing sensitive data.

Answer

Store all settings, including secrets, in the config file in each branch. Use a script to replace tokens.

Answer

Use Azure App Service slots with sticky settings and store all settings in a single config file committed to the repository.

Answer

Use the same config file for all environments and override settings using pipeline variables based on branch name.

Question 12

Your organization uses GitHub Actions for CI/CD. You need to ensure that secrets stored in GitHub are not exposed in logs. A developer reports that a secret value appeared in the workflow run log. What is the most likely reason?

Accepted Answer

The secret was printed using a script that bypassed automatic masking.. GitHub Actions automatically masks secrets in logs by replacing their values with '***', but this masking can be bypassed if a script transforms the secret (e.g., base64 encoding, splitting, or printing it in a way that changes its exact string) before outputting it. The most likely reason a secret value appeared in the log is that the script printed it in a form that bypassed the automatic masking. This is a known limitation of GitHub's secret masking.

Answer

The workflow was triggered via repository_dispatch.

Answer

The secret name was used in the log output.

Answer

The workflow used 'debug' log level.

Question 13

You are designing a release pipeline for a .NET application. The pipeline must deploy to multiple environments (Dev, Test, Prod) with manual approval at each stage. Which release trigger should you configure for the production stage?

Accepted Answer

Manual trigger with pre-deployment approvals.. The requirement specifies manual approval at each stage, and for the production stage, a manual trigger with pre-deployment approvals ensures that deployments only occur after explicit human authorization. This aligns with the need for controlled, gated releases to production, preventing automatic or scheduled deployments that bypass approval.

Answer

Pull request trigger from the main branch.

Answer

Continuous deployment trigger after a successful build.

Answer

Scheduled trigger set to run nightly.

Question 14

Which TWO tasks can be used to deploy an Azure Web App using YAML pipelines in Azure DevOps?

Accepted Answer

AzureWebApp. The AzureWebApp task is correct because it is the dedicated Azure DevOps YAML pipeline task for deploying code to an Azure Web App (App Service). It supports deployment methods like Web Deploy (msdeploy), Kudu REST API, and ZIP deploy, making it the standard choice for web app deployments.

Answer

CopyFilesOverSSH

Answer

AzureFunctionApp

Answer

AzureVMAppDeployment

Question 15

Which THREE features are available in GitHub Actions for managing secrets across environments?

Accepted Answer

Organization-level secrets. GitHub Actions supports three types of secrets for managing sensitive data: organization-level secrets, which are encrypted and shared across multiple repositories within an organization; repository-level secrets, which are available to all workflows in a single repository; and environment-specific secrets, which are scoped to a particular environment (e.g., production) within a repository. Together these allow centralized and scoped management of secrets across different environments and repositories. Options A and C are incorrect: 'encrypted variables in workflows' is not the official GitHub Actions secret feature, and secret scanning alerts is a reactive security service, not a secret management feature.

Answer

Encrypted variables in workflows

Answer

Secret scanning alerts