AZ-400 Design and implement build and release pipelines Practice Test 30 — 15 Questions

Question 1

Your team uses Azure DevOps to manage a monolithic .NET Framework application that is deployed to on-premises Windows servers. You plan to modernize the application by containerizing it and moving it to Azure Kubernetes Service (AKS). The existing build pipeline uses the .NET Framework build task and MSBuild. The release pipeline uses WinRM-based deployment to copy files to on-premises servers. You need to design a new CI/CD pipeline that builds a Docker image, pushes it to Azure Container Registry (ACR), and deploys it to AKS. Your solution should minimize changes to the existing codebase and leverage Azure Pipelines. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the existing build pipeline by adding a 'Docker' task to build and push the image, and modify the release pipeline to use a 'Kubernetes' task for deployment.. Adding a Docker task to build and push the image to ACR, and a Kubernetes task to deploy to AKS, minimally changes the existing pipelines. Option A is incorrect because building the Docker image via a script in the release pipeline is less integrated and does not leverage the build pipeline's Docker capabilities. Option C is incorrect because creating new pipelines from scratch is unnecessary and introduces more changes. Option D is incorrect because self-hosted agents are not required to build and push to ACR or deploy to AKS.

Answer

Keep the existing build pipeline as is, and add a script to build the Docker image in the release pipeline before deploying.

Answer

Create a new build pipeline from scratch using the 'Docker' template and a new release pipeline with the 'Deploy to Kubernetes' template.

Answer

Use self-hosted agents to build the Docker image and deploy to AKS.

Question 2

Your organization uses GitHub Flow for source control with a monorepo containing multiple microservices. Each microservice has its own build and test workflow. You need to design a CI/CD strategy that builds and tests only the services affected by a pull request to reduce build times and resource usage. You also need to ensure that all pull requests to the main branch pass required checks before merging. What should you implement?

Accepted Answer

Use separate workflows for each microservice with path filters (on: pull_request paths:) so that only workflows with changed files are triggered.. GitHub Actions path filters (on: pull_request paths:) allow you to trigger workflows only when changes occur in specific directories. This ensures that only the microservices affected by a pull request are built and tested, reducing build times and resource usage. Option A is incorrect because building all services on every push is wasteful. Option B is incorrect because manual triggering via webhook comments defeats automation and is not scalable. Option C is incorrect because a matrix strategy, while useful for parallel builds, still triggers on every pull request and would build all services, not just the changed ones.

Answer

Use a single workflow that builds and tests all microservices on every push to any branch.

Answer

Set up a webhook that triggers builds manually per service based on pull request comments.

Answer

Create a single workflow that uses a matrix strategy to build and test each microservice, and run it on every pull request.

Question 3

Your team is using Azure Pipelines to deploy a web application to Azure App Service. The application uses a configuration file (appsettings.json) that contains environment-specific settings. You need to manage these settings across development, staging, and production environments without exposing secrets in the source code. The pipeline should automatically replace the settings during deployment. What should you configure?

Accepted Answer

Use the 'File Transform' task in the release pipeline to replace tokens in the configuration file with variables defined in pipeline variable groups.. Use the 'File Transform' task to substitute variables from pipeline variables or variable groups. Option B is incorrect because build configuration transforms are for .NET projects and require specific setup. Option C is incorrect because environment variables are not directly used for file transforms. Option D is incorrect because Azure App Service application settings are for the runtime, not for transforming configuration files during deployment.

Answer

Create separate build configurations for each environment and use the 'Transform Web.config' task.

Answer

Use the 'Azure App Service Deploy' task with the 'Use Web Deploy' option and configure parameterization.

Answer

Set environment variables in the Azure App Service and read them in the application code.

Question 4

Your company uses GitHub Actions for CI/CD. The development team wants to automatically create a new GitHub release with release notes whenever a pull request is merged to the main branch. The release notes should include a list of all merged pull requests since the last release. You need to implement this automation. What should you do?

Accepted Answer

Add a workflow triggered on push to main that uses the 'softprops/action-gh-release' action to create a release with auto-generated release notes.. The 'softprops/action-gh-release' action can create a release and, when configured with `generate_release_notes: true`, generates release notes from merged PRs. Option B is incorrect because requiring a release note file via branch protection does not create a GitHub release. Option C is incorrect because GitHub does not automatically create releases from tags; a release must be created explicitly. Option D is incorrect because `gh release create` alone does not automatically generate release notes from merged PRs; it requires a manually constructed changelog.

Answer

Configure a branch protection rule to require a release note file in each pull request.

Answer

Use a workflow that runs on pull request merge and creates a Git tag, then rely on GitHub to create a release from the tag.

Answer

Add a step to the existing CI workflow that runs 'gh release create' with a changelog.

Question 5

Your organization uses Azure DevOps Server (on-premises) and plans to migrate to Azure DevOps Services. You have hundreds of classic build and release pipelines. You need to design a migration strategy that minimizes downtime and allows for a gradual transition. The team wants to use the new YAML-based pipelines after migration. What should you do?

Accepted Answer

Export the classic pipeline definitions as JSON, and manually recreate them as YAML pipelines in Azure DevOps Services.. Exporting classic pipeline definitions as JSON and manually recreating them as YAML pipelines in Azure DevOps Services allows for a gradual migration, minimizing downtime. The team can convert pipelines incrementally, ensuring familiarity with YAML syntax and validating each pipeline before moving the next. Option B is wrong because recreating all pipelines from scratch is inefficient, error-prone, and does not leverage the existing pipeline logic. Option C is wrong because the Azure DevOps Migration Tools are designed for data migration (work items, repos, etc.) and do not automatically convert classic pipelines to YAML. Option D is wrong because migrating pipelines as classic first and then planning a separate conversion project delays the adoption of YAML and introduces additional rework.

Answer

Recreate all pipelines from scratch using YAML in the new organization.

Answer

Use the Azure DevOps Migration Tools to automatically convert classic pipelines to YAML.

Answer

Migrate all pipelines as-is (classic) and then plan a separate project to convert them to YAML.

Question 6

Your team uses Azure Pipelines to build a Node.js application. The build pipeline runs linting, unit tests, and creates a production build. You want to ensure that the pipeline fails if the test coverage drops below 80%. You need to implement this check. What should you do?

Accepted Answer

Add a 'Publish Test Results' task with code coverage enabled, then use a 'Script' task that reads the coverage report and fails if below 80%.. The 'Publish Test Results' task can publish code coverage reports, and a subsequent script task can parse the report (e.g., using a tool like c8 or nyc) and exit with a non-zero code if coverage is below 80%, causing the pipeline to fail. Option A is incorrect because a pipeline variable alone cannot enforce coverage thresholds; you need a task that checks the coverage. Option B is incorrect because branch policies can enforce code review requirements but not specific code coverage percentages from build results. Option C is incorrect because the 'Visual Studio Test' task is designed for .NET applications, not Node.js; it does not work with Node.js coverage reports.

Answer

Configure a pipeline variable 'CoverageThreshold' and use it in a gate.

Answer

Set a branch policy that requires code coverage to be at least 80%.

Answer

Use the 'Visual Studio Test' task with code coverage enabled and set the 'Minimum coverage' option.

Question 7

Your organization uses GitHub Actions for CI/CD. You have a workflow that deploys to Azure App Service. The deployment uses a publish profile secret stored as a GitHub secret. You want to improve security by using OpenID Connect (OIDC) to authenticate to Azure without storing secrets. What should you do?

Accepted Answer

Configure the GitHub workflow to use the 'azure/login' action with OIDC, and set up a federated identity credential in Microsoft Entra ID for the GitHub environment.. Configuring OIDC with Microsoft Entra ID (formerly Azure AD) using a federated identity credential for the GitHub environment allows token-based authentication without storing secrets. Option A is incorrect because Azure Managed Identity cannot be used directly from a GitHub runner; Managed Identity is designed for Azure-hosted resources, not external runners. Option C is incorrect because replacing the publish profile secret with a service principal secret still requires storing a secret, which does not improve security compared to OIDC. Option D is incorrect because setting the 'Publish Profile' parameter to an empty string does not enable OIDC authentication; the deployment would fail due to missing credentials.

Answer

Remove the secret and use Azure AD Managed Identity directly from the GitHub runner.

Answer

Replace the publish profile secret with an Azure service principal secret stored as a GitHub secret.

Answer

Use the 'Azure App Service Deploy' task with the 'Publish Profile' parameter set to an empty string.

Question 8

Your organization uses Azure Pipelines and wants to implement a continuous feedback loop by collecting user analytics from the production environment and automatically creating work items in Azure Boards for critical issues. You need to design a solution that integrates monitoring data with the pipeline. What should you do?

Accepted Answer

Set up Azure Monitor alerts based on Application Insights data, and configure the alerts to invoke a webhook that calls the Azure Boards REST API to create a work item.. Azure Monitor alerts based on Application Insights data can trigger a webhook that calls the Azure Boards REST API to automatically create a work item. This integrates monitoring data with the pipeline to establish a continuous feedback loop. Option A is incorrect because Power BI visualization and email alerts do not automate work item creation. Option C is incorrect because release pipeline logs are not for collecting user analytics; Application Insights is needed. Option D is incorrect because manually reviewing dashboards is not automated.

Answer

Use Power BI to visualize Application Insights data and set up data-driven alerts that send emails to the team.

Answer

Configure the release pipeline to output logs to Azure Monitor and use Log Analytics to create work items.

Answer

Use Azure Application Insights to collect user analytics, and manually review dashboards to create work items.

Question 9

You are designing a build pipeline for a .NET Core application. The pipeline must run on a self-hosted agent in a private network without internet access. Which TWO actions are required to ensure the build can download NuGet packages?

Accepted Answer

Install the NuGet tool on the self-hosted agent machine.. To restore NuGet packages on a self-hosted agent without internet access, the NuGet tool must be installed on the agent machine (B) and the agent must be configured to access an internal NuGet feed, such as Azure Artifacts or a local feed (D). Disabling the NuGet restore step (A) would prevent packages from being downloaded. Using a Microsoft-hosted agent (C) would require internet access, which violates the private network constraint. The NuGet Authenticate task (E) is not required because authentication can be handled through feed configuration or integrated authentication.

Answer

Disable the NuGet restore step in the pipeline.

Answer

Use a Microsoft-hosted agent instead.

Answer

Use the NuGet Authenticate task to authenticate with Azure Artifacts.

Question 10

Your release pipeline deploys a web app to Azure App Service. You need to implement safe deployment practices that minimize downtime and enable quick rollback. Which THREE strategies should you recommend?

Accepted Answer

Deploy to a staging slot first, validate, then swap.. Deploying to a staging slot first allows you to validate the application in a production-like environment without affecting live traffic. Once validated, swapping the staging and production slots ensures zero-downtime deployment by instantly routing all traffic to the validated version. This is a core safe deployment practice for Azure App Service.

Answer

Use rolling deployment with manual step to approve each instance.

Answer

Deploy directly to the production slot.

Question 11

Your team uses GitHub Actions to build a multi-container application. The build must produce container images that are scanned for vulnerabilities and signed. Which THREE actions are required in the workflow?

Accepted Answer

Add a step to run a container scan tool like Trivy.. To produce container images that are scanned for vulnerabilities and signed, the workflow must include steps to scan the image (e.g., using Trivy), sign the image (e.g., using cosign), and build and push the image (e.g., using docker/build-push-action). Option A is not required because authenticating to Docker Hub specifically is not necessary if the target registry is not Docker Hub. Option D is not strictly required; checking out the code is a common first step but could be done differently or may already be available.

Answer

Use the docker/login-action to authenticate with Docker Hub.

Answer

Use the actions/checkout action to checkout the code.

Question 12

You are designing a multi-stage YAML pipeline for an application that requires approval for production deployment. The pipeline must run automatically for non-production stages. Which TWO configurations should you use?

Accepted Answer

Set the pipeline trigger to include branches used for non-production stages.. Options A and B are correct. Option A: Setting the pipeline trigger to include branches used for non-production stages enables automatic CI triggers for those branches, so non-production stages run automatically. Option B: Adding an 'approvals' block to the production stage enforces manual approval before deployment to production. Options C, D, and E are incorrect: C suggests using a release pipeline which is unnecessary; D would require manual approval for every stage, not just production; E describes a single-stage pipeline, which doesn't fit the multi-stage requirement.

Answer

Use a release pipeline instead of a YAML pipeline.

Answer

Set the pipeline to require manual approval for every stage.

Answer

Use a single-stage pipeline with conditional approval.

Question 13

Your team uses Azure Pipelines to build a Java application. The build must produce a JAR file and publish it as a pipeline artifact. Which THREE steps should be included in the build pipeline?

Accepted Answer

Use a Maven or Gradle task to compile and package the application.. A Maven or Gradle task is the standard way to compile and package a Java application into a JAR file. These tasks invoke the build tool's lifecycle (e.g., `mvn package` or `gradle build`) to produce the artifact, which is a prerequisite for publishing.

Answer

Use the DotNetCoreCLI task to build the application.

Answer

Use the NuGetCommand task to pack the JAR.

Question 14

Your company is migrating from on-premises Jenkins to Azure Pipelines. You have a Jenkins pipeline that builds a C++ application using MSBuild. The build environment requires specific Visual Studio components and SDKs. You need to set up a build agent in Azure Pipelines that matches the Jenkins environment. You want to minimize administrative overhead and ensure the agent is always up to date with the latest patches. What should you do?

Accepted Answer

Use a Microsoft-hosted agent with the 'windows-2022' image that includes Visual Studio Build Tools.. Microsoft-hosted agents include Visual Studio Build Tools and are automatically updated, minimizing administrative overhead. Option A is incorrect because using a custom image on a self-hosted agent still requires maintaining the image and applying updates. Option B is incorrect because container-based agents require building and managing a custom Docker image that includes Visual Studio and SDKs, which adds overhead. Option D is incorrect because a self-hosted agent on an Azure VM requires manual installation of required components and ongoing patching, increasing administrative effort.

Answer

Use a self-hosted agent on an Azure VM with a custom image that includes Visual Studio and SDKs.

Answer

Deploy a container-based agent using a Docker image that includes Visual Studio.

Answer

Provision a self-hosted agent on an Azure VM and install required components manually.

Question 15

You are implementing a release pipeline for a web application deployed to multiple Azure App Service instances across different regions (West US, East US, and North Europe). The deployment must follow a phased rollout: first West US, then East US, then North Europe, with a manual approval gate between each region. Each region should have its own slot for staging and production. You need to design the pipeline to minimize duplication of stages and tasks. What should you do?

Accepted Answer

Use a multi-stage YAML pipeline with environment per region and a manual approval on each environment.. For a phased rollout to multiple Azure App Service regions, you should create an environment per region and use a multi-stage YAML pipeline that contains deployment jobs (or stages) targeting those environments. Manual approval gates can be configured on each environment, enabling controlled progression from West US to East US to North Europe without duplicating tasks. This approach directly uses App Service slots and environments. Deployment group jobs (Option D) are intended for targeting on-premises or VM-based agents, not App Service instances, and do not support slots. Options B and C are incorrect because they duplicate tasks or deploy in parallel rather than in the required phased sequence.

Answer

Create three separate stages (one per region) and duplicate the deployment tasks in each.

Answer

Use a single stage with parallel deployment to all regions and add manual approvals before each region's deployment.

Answer

Use a single stage with a deployment group job that targets agents tagged with region names, and use deployment group tags to control phased rollout.