AZ-400 Design and implement build and release pipelines Practice Test 5 — 15 Questions

Question 1

Refer to the exhibit. You run an Azure CLI command during a pipeline to get the state of a web app. The output shows the state as 'Running'. You want to ensure the pipeline only proceeds if the state is 'Running'. Which task should you use to evaluate the condition?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A Bash task that runs 'az webapp show' and checks the state.. The Bash task can directly run the `az webapp show` command shown in the exhibit and use an `if` statement to check whether the `state` equals `'Running'`. If the state does not equal `'Running'`, the Bash task exits with a non-zero code, which fails the pipeline. Option C is incorrect because it assumes a state variable already exists; the scenario only mentions command output, and a PowerShell task would either need to re-run the command or have the output captured in a variable first. Thus, the Bash task is the most straightforward way to evaluate the condition directly from the command output.

Answer

A Download Build Artifacts task that verifies the state.

Answer

A PowerShell task that checks the state variable and exits with code 1 if not 'Running'.

Answer

A Publish Test Results task configured to check the state.

Question 2

You are designing a build pipeline for a Python application that uses multiple external packages from PyPI. You want to ensure that builds are reproducible and not affected by package updates. Which strategy should you use?

Accepted Answer

Pin exact versions in requirements.txt.. Pinning exact versions in requirements.txt (e.g., 'requests==2.31.0') ensures that pip resolves the identical package versions on every build, making builds reproducible and immune to upstream package updates. This is the standard, minimal-effort approach for deterministic Python builds in CI/CD pipelines.

Answer

Use a Pipfile and Pipfile.lock without version pinning.

Answer

Use a dependency update tool like Dependabot weekly.

Answer

Use 'pip install <package>' without version specifiers.

Question 3

Which TWO of the following are valid strategies to reduce build times in Azure Pipelines? (Select TWO.)

Accepted Answer

Use a self-hosted agent pool.. Option B is correct because a self-hosted agent pool can provide pre-warmed machines with cached dependencies, faster hardware, and persistent tool installations, avoiding the cold-start and provisioning overhead of Microsoft-hosted agents, which reduces overall build time. Option C is correct because parallel jobs allow independent tasks or jobs to execute concurrently rather than sequentially, directly cutting wall-clock build duration when the work can be split. Option D is correct because pipeline caching (the Cache@2 task) stores dependencies such as npm, NuGet, or pip packages between runs, so subsequent builds restore them from the cache instead of downloading and rebuilding them, which is one of the most effective build-time reductions. Option A is not a build-time strategy at all: increasing retained artifacts only affects how long artifacts are stored for auditing or deployment and can even consume more storage, not speed up builds. Option E is not a valid strategy because disabling test execution merely skips a pipeline stage, reducing coverage and quality rather than optimizing the build itself, and it is not a legitimate build-time reduction technique.

Answer

Increase the number of retained artifacts.

Answer

Disable test execution.

Question 4

You have a YAML pipeline that uses a self-hosted agent. The agent runs on a VM in Azure. The pipeline fails intermittently with the error: '##[error]The job running on agent MyAgent has been cancelled because the agent was idle for more than the maximum idle time.' You need to resolve this issue. What should you do?

Accepted Answer

Configure the agent's idle timeout setting to a higher value or disable it.. The error indicates that the self-hosted agent was idle for longer than the configured maximum idle time, causing Azure Pipelines to cancel the job. Option A is correct because increasing or disabling the idle timeout setting on the agent (via the agent's configuration file or environment variable) directly addresses this issue by allowing longer periods of inactivity before cancellation.

Answer

Add more agents to the agent pool.

Answer

Increase the job's timeout in minutes.

Answer

Reduce the number of parallel jobs to avoid overloading the agent.

Question 5

Refer to the exhibit. You have a YAML pipeline definition that builds a .NET application. You notice that the revision number is always 0. What is the most likely cause?

Accepted Answer

The counter expression uses a variable that is not defined as a counter, causing it to reset.. The counter expression in Azure DevOps YAML pipelines requires a named counter variable to persist its value across pipeline runs. If the variable used as the first parameter of the `counter` function (e.g., `minorVersion`) is not defined as a counter variable, the counter resets to the seed value (0) on each run. Option B correctly identifies that the variable is not defined as a counter, causing the revision number to always be 0.

Answer

The 'DotNetCoreCLI@2' task does not support the counter expression.

Answer

The counter expression resets every time the pipeline runs because of the 'minorVersion' variable.

Answer

The counter expression is evaluated after the build steps, so it always returns 0.

Question 6

Refer to the exhibit. You run the Kusto query in Azure Monitor to analyze pipeline performance. The query returns no results even though you know some pipelines have average durations over 10 minutes. What is the most likely reason?

Accepted Answer

The column name 'RunStartTime' is incorrect; the actual column may be 'StartTime'.. The Kusto query references the column 'RunStartTime', but the actual column in Azure Monitor for pipeline runs is likely named 'StartTime'. However, in Kusto, using a non-existent column in a where clause causes a query error (column not found), not simply an empty result. The most likely reason for no results (or failure) is the column name mismatch.

Answer

The 'avg' function ignores values over 600, so no rows are returned.

Answer

The 'ago(7d)' function is not supported in Azure Monitor.

Answer

The 'RunDurationSeconds' column stores durations as strings, so the average cannot be calculated.

Question 7

Which THREE components are essential for implementing a canary deployment strategy using Azure Kubernetes Service (AKS) and Azure Pipelines? (Choose three.)

Accepted Answer

A service mesh like Istio or Linkerd for traffic splitting.. Option B is correct because a service mesh such as Istio or Linkerd provides the fine-grained traffic-splitting capability (e.g., Istio VirtualService weights or Linkerd TrafficSplit) needed to route a controlled percentage of requests to the canary while the rest go to the stable version. Option C is correct because a health check endpoint (readiness/liveness probe or a dedicated /health route) is essential to validate that the canary is behaving correctly before progressively increasing its traffic share or promoting it. Options A and E are not essential: Azure Traffic Manager and Azure Front Door operate at DNS/global HTTP layers and cannot perform the pod-level, percentage-based traffic splitting that a canary strategy inside AKS requires. Option D is not essential because canary and stable workloads can coexist in the same namespace and be distinguished by labels/selectors; separate namespaces are an organizational choice, not a requirement for canary deployment.

Answer

Azure Traffic Manager for global load balancing.

Answer

Multiple Kubernetes namespaces to separate canary and stable deployments.

Answer

Azure Front Door for routing traffic to the canary.

Question 8

Your build pipeline for a Java application uses Maven. You need to run unit tests and integration tests separately. Unit tests should run on every commit, while integration tests should run only when the build is triggered by a pull request to the main branch. How should you configure the pipeline?

Accepted Answer

Create two jobs: one with unit tests (always), one with integration tests conditioned on 'eq(variables['Build.Reason'], 'PullRequest')'.. A correct configuration must run integration tests only for pull requests targeting the main branch. This requires checking both Build.Reason == 'PullRequest' and System.PullRequest.TargetBranch == 'refs/heads/main'. None of the provided options include the target branch check, so none is fully correct as written. While option A allows a step condition that could include the target branch, the option itself does not specify it. Option C is also missing the target branch check and would incorrectly run for PRs to other branches.

Answer

Add both test types as steps in the same job and use a step condition.

Answer

Create two separate stages: one for unit tests, one for integration tests.

Answer

Use a single job with both tests, but set the 'always()' condition on the integration test step.

Question 9

Which TWO are valid strategies to reduce build times in Azure Pipelines? (Choose 2)

Accepted Answer

Use the Cache task to cache NuGet packages or npm modules.. Option A is correct because the Cache task (Cache@2) stores dependencies such as NuGet packages or npm modules between pipeline runs, so subsequent builds restore them from the cache instead of downloading them again, directly cutting restore time. Option B is correct because 'dotnet build --no-restore' skips the implicit NuGet restore step, avoiding redundant work when the restore has already been performed in a prior task. Option C is correct because setting 'clean: false' in the checkout step preserves the working directory between runs, enabling incremental builds so only changed files are recompiled rather than rebuilding everything. Option D is not a valid strategy for reducing build times because adding parallel jobs increases concurrency across jobs, not the speed of a single build, and a larger agent pool does not inherently make compilation faster. Option E is not valid because increasing the job timeout only allows a build to run longer before failing; it does not reduce the time a build actually takes.

Answer

Use a larger agent pool with more parallel jobs.

Answer

Increase the build job timeout.

Question 10

The exhibit shows a deployment job in an Azure Pipelines YAML file. The deployment fails with the error 'No package found with pattern: $(Pipeline.Workspace)/drop/*.zip'. What is the most likely cause?

Accepted Answer

The artifact is not downloaded to the expected path; the artifact name must be included in the path.. The error indicates the deployment job is looking for a .zip file in a folder named 'drop' directly under the pipeline workspace. However, in Azure Pipelines, artifacts are downloaded to a folder named after the artifact, and the published artifact contains a 'drop' folder inside it (or 'drop' is merely a folder, not the artifact name). The correct path must include the artifact name first, e.g., '$(Pipeline.Workspace)/<artifact-name>/drop/*.zip'. Option A correctly identifies that the artifact name is missing from the path.

Answer

The wildcard pattern '*.zip' is not supported.

Answer

The Azure service connection has expired.

Answer

The pipeline is using a Microsoft-hosted agent that does not support the download task.

Question 11

You need to enforce that all builds in Azure Pipelines use a specific version of the .NET SDK. What is the best approach?

Accepted Answer

Add a UseDotNet task to the pipeline that specifies the required SDK version.. The UseDotNet task in Azure Pipelines can be configured to download and install a specific version of the .NET SDK, ensuring that all builds use exactly that version, regardless of what is pre-installed on the agent. Option B is incorrect because setting a pipeline variable DotNetVersion and using it in the DotNetCoreCLI task does not enforce the SDK version; the DotNetCoreCLI task uses the SDK already available on the agent, unless explicitly redirected, and the variable alone does not install or enforce a specific SDK. Option C is incorrect because installing the SDK manually via a script is not a reliable or repeatable approach; it depends on the agent's state and does not automatically enforce the version across different agents or pipeline runs. Option D is incorrect because including a global.json file in the repository does not guarantee that the required SDK version is installed on the agent; the build agent may not respect global.json if the specified SDK is not present, and there is no enforcement mechanism without additional steps.

Answer

Set a pipeline variable DotNetVersion and use it in the DotNetCoreCLI task.

Answer

Install the SDK manually on the build agent using a script.

Answer

Include a global.json file in the repository and rely on the build agent to respect it.

Question 12

Your Azure DevOps pipeline deploys to multiple environments (Dev, Test, Prod) using YAML multi-stage pipelines. The Prod deployment requires manual approval. However, the approval gate shows 'Pending' even after an authorized user approves. What is the most likely cause?

Accepted Answer

The approval gate is configured to require approval on the latest commit, but a newer commit was pushed after the approval.. In Azure DevOps, approvals are associated with a specific pipeline run and its commit. When a new commit is pushed after an approval, it triggers a new pipeline run. The new run has its own approval requirement, so it remains 'Pending' until approved. The previous approval does not carry over to the new run.

Answer

The pipeline run was triggered by a PR merge, and the approval needs to be re-applied after the build completes.

Answer

The build pipeline includes a step that modifies the approval settings.

Answer

The approver is not a member of the security group defined in the approval settings.

Question 13

Your team uses Azure Pipelines to deploy a microservices application to Azure Kubernetes Service (AKS). You need to implement a strategy that minimizes downtime during updates. Which TWO options should you use?

Accepted Answer

Configure a rolling update strategy in the Kubernetes manifest.. Option C is correct because configuring a rolling update strategy (the default Deployment strategy in Kubernetes, governed by maxSurge and maxUnavailable) replaces pods incrementally while keeping a minimum number of replicas available, so the service stays reachable throughout the update and downtime is minimized. Option E is correct because a blue-green deployment using separate namespaces runs the new version (green) alongside the old version (blue) and switches traffic only after the green environment is verified, allowing instant rollback and near-zero downtime. Option A is wrong because scaling replicas to zero takes the application completely offline before the update, causing maximum downtime. Option D is wrong because the Recreate strategy terminates all existing pods before starting new ones, producing a guaranteed outage window. Option B is wrong because, while canary deployments with a service mesh do reduce risk by shifting a small percentage of traffic, the question asks for the two options to use and the marked answers are the rolling update and blue-green pattern; canary is a valid progressive-delivery technique but is not among the credited answers here.

Answer

Set the deployment replica count to zero before updating.

Answer

Use a canary deployment with a service mesh.

Answer

Use a recreate deployment strategy.

Question 14

Your organization uses Azure Pipelines to deploy a web application to multiple Azure App Service instances across regions. You need to implement a deployment strategy that allows rolling back to the previous version quickly if issues are detected. Which TWO strategies should you recommend?

Accepted Answer

Use blue-green deployment with a traffic manager endpoint.. Option D is correct because blue-green deployment keeps the previous (blue) environment fully running while the new (green) version is validated, and a Traffic Manager endpoint can shift traffic back to blue almost instantly if issues arise, enabling fast rollback. Option E is correct because deploying to a staging slot and then performing a swap with production means the previous production content remains in the staging slot after the swap, so swapping back restores the prior version immediately with no redeploy. Option A is not ideal because a rolling incremental update replaces instances progressively and does not inherently preserve a complete previous version for a quick, atomic rollback. Option B is not the best fit because canary deployment limits blast radius but rollback still requires shifting traffic and managing versions rather than the instant environment-level revert of blue-green or slot swap. Option C is not a deployment strategy at all; storing artifacts in Blob Storage supports redeployment but does not by itself provide fast rollback.

Answer

Use a rolling update with incremental deployment.

Answer

Implement a canary deployment with traffic splitting.

Answer

Store previous deployment artifacts in Azure Blob Storage.

Question 15

You are configuring a release pipeline in Azure Pipelines for a Java application. The pipeline must run integration tests after deployment to a test environment and only proceed to production if tests pass. Which THREE should you configure?

Accepted Answer

Use a pipeline condition on the production stage to run only if the test stage succeeded.. To run integration tests after deployment to a test environment and only proceed to production if tests pass, configure a pipeline condition on the production stage to run only if the test stage succeeded (A) and add a post-deployment gate that queries Azure Monitor for test failure signals (D). Option E is incorrect because a post-deployment approval on the production stage occurs after the production deployment has already happened, so it does not prevent the deployment. Option B is incorrect because agent jobs run on agents, not directly on environments. Option C is incorrect because the integration test step should run after deployment, not based on the previous build success.

Answer

Set the agent job to run on the environment itself.

Answer

Set the integration test step to run only if the previous build succeeded.

Answer

Configure a post-deployment approval for the production stage.