AZ-400 Design and implement build and release pipelines Practice Test 5 — 15 Questions

Question 1

You need to integrate Azure Pipelines with GitHub to trigger a build when a release is published in GitHub. Which trigger type should you use in the pipeline?

Accepted Answer

resources:
  repositories:
    - repository: self
      type: github
      trigger:
        release: true. Option C is correct because Azure Pipelines supports a GitHub release trigger through the `resources` definition, where you specify a `trigger` with `release: true` under the repository configuration. This tells the pipeline to automatically start a build whenever a new release is published in the linked GitHub repository, which directly matches the requirement.

Answer

pr:

Answer

trigger:

Answer

schedules:

Question 2

Your team is designing a build pipeline for a Java application that uses Maven. The pipeline must run unit tests and integration tests separately, and fail the build if integration tests fail. However, integration tests require a running database container. Which approach should you use to ensure the database is available for the integration tests?

Accepted Answer

Use a Docker Compose task in the pipeline to start the database container before running integration tests.. Option B is correct because Docker Compose allows you to define and run multi-container Docker applications, making it easy to spin up a database container for integration tests. Option A is incorrect because it requires manual steps and is not automated. Option C is incorrect because a self-hosted agent with preinstalled database reduces flexibility. Option D is incorrect because it's not a feature of Azure DevOps.

Answer

Configure the pipeline to use a self-hosted agent that has the database already installed and running.

Answer

Install the database as a service in the pipeline using the Service Fabric task.

Answer

Use a PowerShell script in the pipeline to install and start the database on the build agent.

Question 3

Your organization uses GitHub Actions for CI/CD. You need to ensure that deployment to production only occurs after a successful deployment to a staging environment and requires approval from a senior developer. The deployment workflow is defined in a single YAML file. What is the most efficient way to achieve this?

Accepted Answer

Use two environments (staging and production) with required reviewers on the production environment, and use conditional steps to deploy to staging first.. Option C is correct because GitHub Actions supports environment protection rules, including required reviewers, and environment variables can control deployment steps. Option A is incorrect because matrix builds are for parallel builds, not sequential approvals. Option B is incorrect because workflow run is not a step. Option D is incorrect because manual triggers don't enforce sequential deployment.

Answer

Add a step that pauses the pipeline until a manual approval is received via a custom webhook.

Answer

Use a workflow_dispatch trigger and require the senior developer to manually run the production deployment.

Answer

Use a build matrix to run staging and production deployments in parallel.

Question 4

Your Azure DevOps pipeline uses a YAML template to avoid duplication. The template defines common build steps. You need to override one of the steps in a specific pipeline without modifying the template. Which approach should you use?

Accepted Answer

Use template parameters with a 'steps' object that can be injected, and use the 'replace' keyword in the pipeline to override the step.. Option D is correct because Azure DevOps YAML templates support parameterized steps objects, allowing a pipeline to inject a custom set of steps that replace the default ones defined in the template. The `replace` keyword is used within the template to designate a default steps object that can be overridden by the calling pipeline, enabling step-level customization without modifying the template file.

Answer

Use the 'overrides' keyword in the pipeline YAML to specify which steps to replace.

Answer

Create a copy of the template and modify the step directly.

Answer

Use a conditional 'if' statement in the template to skip steps based on a parameter.

Question 5

Your release pipeline deploys a .NET Core web app to Azure App Service using a deployment slot for staging. The pipeline runs integration tests against the staging slot. After tests pass, you want to swap the staging slot with production. However, the swap fails sometimes because the staging slot has different configuration settings. What is the best practice to ensure swapping succeeds?

Accepted Answer

Use slot-specific configuration settings (deployment slot settings) for connection strings and app settings that differ between slots.. Option A is correct because Azure App Service allows you to mark specific configuration settings (like connection strings and app settings) as 'deployment slot settings.' When a setting is marked as slot-specific, it stays with the slot during a swap, preventing failures caused by mismatched configurations. This ensures that the staging slot retains its test-specific settings (e.g., a test database connection string) while the production slot keeps its own settings, making the swap predictable and reliable.

Answer

Manually update the production slot settings to match staging before each swap.

Answer

Perform a swap with preview and then complete the swap after verifying the staging slot.

Answer

Write a custom PowerShell script to copy configuration from staging to production before swapping.

Question 6

Your organization uses Azure Pipelines to build a large monolithic application. The build takes over 60 minutes. Management wants to reduce the build time to under 30 minutes. The application has multiple independent modules that could be built in parallel. What is the most effective strategy to reduce build time?

Accepted Answer

Refactor the build pipeline to use multiple parallel jobs, each building a separate module.. Option C is correct because parallel jobs and multi-agent builds can significantly reduce build time by running independent modules concurrently. Option A is incorrect because larger VMs may have limited impact. Option B is incorrect because reducing code coverage is counterproductive. Option D is incorrect because using a self-hosted agent does not inherently reduce build time.

Answer

Reduce the number of unit tests run during the build.

Answer

Upgrade the build agent to a larger VM size with more CPU and memory.

Answer

Move the build to a self-hosted agent in the same network as the source code repository.

Question 7

Your Azure DevOps pipeline uses a variable group to store secrets. The variable group is linked to a Key Vault. You need to use a secret variable in a pipeline task. How should you reference the secret in the YAML pipeline?

Accepted Answer

Reference the variable as $(VariableName) in the pipeline tasks.. Option A is correct because Key Vault-backed variables are automatically mapped as secret variables, and you reference them using the variable name. Option B is incorrect because $(variable) syntax is for non-secret variables; secrets require $(). Option C is incorrect because the task name is not part of the reference. Option D is incorrect because task.getVariable is a scripting method, not YAML.

Answer

Reference the variable as $(VariableName) but only in a script task using 'env' mapping.

Answer

Use the 'task.getVariable' method in a PowerShell script.

Answer

Use the Azure Key Vault task to retrieve the secret and then reference the output variable.

Question 8

You are setting up a GitHub Actions workflow to deploy an Azure Resource Manager (ARM) template. The workflow must run whenever a pull request is opened against the main branch. Which trigger should you use?

Accepted Answer

pull_request: branches: [main] types: [opened]. Option D is correct because pull_request trigger with types: [opened] runs the workflow when a PR is opened. Option A is incorrect because push trigger runs on commits, not PRs. Option B is incorrect because pull_request_target runs in the context of the base branch and is used for PRs from forks. Option C is incorrect because workflow_dispatch requires manual trigger.

Answer

pull_request_target: branches: [main]

Answer

workflow_dispatch

Answer

push: branches: [main]

Question 9

Your Azure DevOps pipeline deploys a microservice to a Kubernetes cluster using Helm. The Helm chart requires a values file that contains environment-specific configurations. You want to store the values file securely and use it during deployment. What is the recommended approach?

Accepted Answer

Store the values file as a secure file in Azure Pipelines library.. Option C is correct because Azure Key Vault can securely store secrets and configuration files, and the HelmDeploy task can reference them. Option A is incorrect because storing values files in a separate branch is not secure. Option B is incorrect because checking secrets into the repo is a security risk. Option D is incorrect because variable groups are for simple key-value pairs, not files.

Answer

Store the values in a variable group and map them to Helm values.

Answer

Store the values file in Azure Key Vault and use the HelmDeploy task's 'overrideValues' parameter to set values.

Answer

Store the values file in a separate Git repository and clone it during the pipeline.

Question 10

Your team uses Azure Repos for source control. You need to enforce that all builds must pass unit tests before code can be merged into the main branch. Which branch policy should you configure?

Accepted Answer

Add a build validation policy that triggers the CI pipeline and requires it to succeed.. Option B is correct because a branch policy with a build validation requires a specific build pipeline to succeed before merging. Option A is incorrect because it only requires a review, not a build. Option C is incorrect because commenting is not required. Option D is incorrect because commit message requirements do not enforce builds.

Answer

Require a linked work item.

Answer

Require a minimum number of reviewers.

Answer

Require comment resolution.

Question 11

Which TWO of the following are valid ways to trigger a release pipeline in Azure DevOps? (Select TWO.)

Accepted Answer

Continuous deployment trigger after a build completes.. Option A is correct because Azure DevOps release pipelines can be configured with a continuous deployment trigger that automatically creates a release whenever a build artifact is successfully produced. This is a core feature for enabling automated delivery pipelines, where the release is triggered immediately after the build pipeline completes, ensuring rapid feedback and deployment.

Answer

Source version trigger.

Answer

Manual trigger via the 'Create release' button.

Answer

Pull request trigger.

Question 12

Which THREE of the following are best practices for managing secrets in Azure Pipelines? (Select THREE.)

Accepted Answer

Use Azure Key Vault to store secrets and link them to variable groups.. Options A, C, and E are correct. A: Using Azure Key Vault is a secure way to store secrets. C: Limiting variable group permissions ensures only authorized pipelines access secrets. E: Using secret variables with $( ) in script tasks prevents exposure. B is incorrect because pipeline logs can inadvertently output secrets; it's better to avoid logging. D is incorrect because hardcoding secrets in YAML is a security risk.

Answer

Hardcode secrets directly in the YAML file and use variable substitution at runtime.

Answer

Enable 'Allow scripts to access the OAuth token' for all build pipelines.

Question 13

Which THREE of the following are valid deployment strategies that can be implemented using Azure DevOps release pipelines? (Select THREE.)

Accepted Answer

Rolling deployment.. Options A, B, and E are correct. A: Rolling deployment updates instances gradually. B: Blue-green deployment uses two environments for switching traffic. E: Canary deployment releases to a subset before full rollout. C is incorrect because 'red-black' is not a standard term. D is incorrect because 'linear deployment' is not a recognized strategy.

Answer

Red-black deployment.

Answer

Linear deployment.

Question 14

Your team uses Azure Pipelines for CI/CD. You need to enforce that all pipeline runs use approved agents from a specific agent pool with the latest security patches. The agents are self-hosted on Azure VMs. What should you implement?

Accepted Answer

Set the agent pool to use a specific agent queue with an isolation scope. Option C is correct because setting the agent pool to use a specific agent queue with an isolation scope ensures that only approved, security-patched agents from that queue are used for pipeline runs. This configuration restricts the pool to a designated set of self-hosted agents, preventing unauthorized or unpatched agents from executing jobs.

Answer

Configure pipeline permissions for the agent pool

Answer

Create a deployment pool and assign the agents to it

Answer

Add a demand on the agent for a custom capability that only approved agents have

Question 15

Your organization uses GitHub Actions for CI/CD. You need to ensure that secrets stored in GitHub Actions are not exposed in logs. A developer accidentally logs a secret using 'echo ${{ secrets.API_KEY }}' in a workflow step. What is the default behavior?

Accepted Answer

The secret value is masked with asterisks in the log output. Option D is correct because GitHub Actions automatically masks secrets in workflow logs. When a secret is used in a step (e.g., via `${{ secrets.API_KEY }}`), GitHub replaces any occurrence of the secret's value in the log output with `***`. This redaction happens at runtime, so even if a developer accidentally echoes the secret, the log will show asterisks instead of the actual value.

Answer

The secret value is replaced with an empty string in the log

Answer

The workflow run fails with an error about secret exposure

Answer

The secret is redacted before the step runs, and the step fails if it tries to use the secret