AZ-400 Design and implement build and release pipelines Practice Test 6 — 15 Questions

Question 1

You are designing a release pipeline in Azure Pipelines that deploys a web app to multiple environments (dev, test, prod). You want to ensure that the same build artifact is deployed to each environment without rebuilding. Which trigger type should you use?

Accepted Answer

Continuous deployment trigger on the release pipeline. Option A is correct because a release pipeline uses a build artifact trigger to start deployment after a build completes. Option B is wrong because continuous deployment trigger happens after a build artifact is available. Option C is wrong because schedule triggers are time-based. Option D is wrong because pull request triggers are for builds, not releases.

Answer

Pull request trigger

Answer

Schedule trigger

Answer

Build completion trigger

Question 2

Your Azure Pipelines build fails intermittently due to transient network errors when downloading NuGet packages. You want to implement retry logic. What is the best approach?

Accepted Answer

Add a PowerShell task that wraps the NuGet restore in a retry loop. Option C is correct because a retry task with an inline script can handle transient errors. Option A is wrong because a build retention policy does not affect retries. Option B is wrong because parallel jobs do not retry. Option D is wrong because a deployment group is for deployments, not builds.

Answer

Increase the number of parallel jobs to average out failures

Answer

Use a deployment group to deploy the build to a staging environment

Answer

Configure a build retention policy to automatically retry failed builds

Question 3

You are implementing a multi-stage YAML pipeline in Azure Pipelines for a microservices application. You need to ensure that the 'deploy' stage only runs if the 'build' stage succeeds and that the 'test' stage runs in parallel with 'build' for different services. How should you structure the pipeline?

Accepted Answer

Define stages 'build', 'test', 'deploy' with 'dependsOn: []' on 'test' and 'dependsOn: build' on 'deploy'. Option B is correct because stages run sequentially by default, and you can use dependsOn with 'none' for parallel stages. Option A is wrong because 'dependsOn: build' on test makes it sequential. Option C is wrong because stages cannot run in parallel if they depend on each other. Option D is wrong because you cannot run stages in parallel without using dependsOn.

Answer

Define stages 'build', 'test', 'deploy' with 'dependsOn: build' on 'test' and 'dependsOn: test' on 'deploy' but use 'condition: always()' on test

Answer

Define stages 'build', 'test', 'deploy' with 'dependsOn: build' on 'test' and 'dependsOn: test' on 'deploy'

Answer

Define stages 'build', 'test', 'deploy' with no dependsOn; by default they run sequentially

Question 4

You need to ensure that a release pipeline in Azure Pipelines automatically deploys to production only if the deployment to staging succeeds and all manual intervention checks pass. What is the best way to configure this?

Accepted Answer

Add a post-deployment approval gate on the staging stage. Option A is correct because a post-deployment approval gate can require manual sign-off after staging deployment. Option B is wrong because a pre-deployment approval is before staging. Option C is wrong because a branch policy is for repositories. Option D is wrong because a deployment group is for targets.

Answer

Add a pre-deployment approval gate on the production stage

Answer

Configure a branch policy on the main branch

Answer

Assign a deployment group to the production stage

Question 5

Your Azure Pipelines build uses a self-hosted agent that runs on a Windows VM. The build fails with the error 'Access to the path 'C:\agent\_work\1\s\bin' is denied.' What is the most likely cause?

Accepted Answer

The agent service account does not have write permissions on the working directory. Option A is correct because the agent runs as a service with a specific account that may not have write permissions. Option B is wrong because the issue is not about checkout. Option C is wrong because the error is about access, not file in use. Option D is wrong because the agent is registered and working.

Answer

The agent is not configured to use the correct agent pool

Answer

The build is trying to overwrite a file that is locked by another process

Answer

The source code checkout failed due to incorrect credentials

Question 6

You are setting up a GitHub Actions workflow to deploy a containerized application to Azure Kubernetes Service (AKS). You need to securely authenticate to the AKS cluster using a service principal. What is the recommended way to store and use the service principal credentials?

Accepted Answer

Store the service principal credentials as GitHub Actions secrets and reference them in the 'azure/login' action. Option B is correct because GitHub Actions secrets are encrypted and the 'azure/login' action can use them. Option A is wrong because environment variables are exposed in logs. Option C is wrong because the Kubernetes secret is for cluster secrets, not workflow secrets. Option D is wrong because the service principal is not stored in AKS.

Answer

Use managed identity for GitHub Actions and assign it to the AKS cluster

Answer

Store the service principal credentials in a Kubernetes secret in the AKS cluster

Answer

Store the service principal credentials as environment variables in the workflow file

Question 7

Your team uses Azure Pipelines to build a .NET Core application. You notice that the build takes too long because it restores NuGet packages every time. What is the best way to improve build performance?

Accepted Answer

Enable the 'Cache' task to cache the NuGet packages folder. Option B is correct because caching package restore speeds up builds. Option A is wrong because piped builds are not a concept. Option C is wrong because a hosted agent does not cache by default. Option D is wrong because a self-hosted agent does not automatically cache.

Answer

Configure the build to use a self-hosted agent with previously restored packages

Answer

Use a private agent with a faster network connection

Answer

Use a Microsoft-hosted agent with a larger SKU

Question 8

Which TWO actions should you take to implement a gated check-in policy in Azure Repos that triggers a build before changes are merged?

Accepted Answer

Configure a build validation policy on the branch. Option A is correct because a build validation policy triggers a build on pull request. Option C is correct because a branch policy is required to enforce the build. Option B is wrong because a pre-merge build is part of build validation, not a separate policy. Option D is wrong because manual builds are not automatic. Option E is wrong because a CI trigger is for commits, not pull requests.

Answer

Enable continuous integration (CI) trigger on the build pipeline

Answer

Set the build to run a 'pre-merge' validation

Answer

Require a manual build before merging

Question 9

Which THREE components are required to set up a self-hosted agent pool in Azure Pipelines?

Accepted Answer

The agent software installed on the target machine. Option A is correct because the self-hosted agent requires the Azure Pipelines agent software to be installed on the target machine. This software, which includes the agent listener and worker processes, is what registers the machine with the agent pool and executes pipeline jobs. Without the agent software, the machine cannot communicate with Azure Pipelines or run any tasks.

Answer

A deployment group target

Answer

Azure VM extension for Azure Pipelines Agent

Question 10

Which TWO triggers can start a release in Azure Pipelines?

Accepted Answer

Schedule. In Azure Pipelines, a release can be triggered by a schedule, which allows you to define a cron-based trigger to deploy at specific times (e.g., nightly builds). The 'Build completion' trigger starts a release when a specific build pipeline completes, enabling chained deployments. Both are native release triggers in classic release pipelines.

Answer

Continuous integration

Answer

Work item state change

Answer

Pull request

Question 11

Your team uses Azure Pipelines for CI/CD. You need to ensure that a secret variable stored in Azure Key Vault is available to a build pipeline without exposing it in logs. What should you do?

Accepted Answer

Use a Key Vault task to fetch the secret and map it to a pipeline variable marked 'secret'.. Option C is correct because mapping a Key Vault secret to a pipeline variable and marking it as 'secret' ensures it is not logged. Option A is wrong because inline secrets are logged. Option B is wrong because variable groups don't automatically mask secrets. Option D is wrong because secret variables are not available in checkout tasks.

Answer

Store the secret in a variable group linked to Key Vault and reference it without marking it secret.

Answer

Add the secret as a plain text variable in the pipeline YAML.

Answer

Add the secret to the repository's .env file and use a script to read it.

Question 12

You have a multi-stage YAML pipeline that deploys to multiple environments. You want to enforce that a manual approval is required before deploying to the production environment, but not for other environments. How should you configure the pipeline?

Accepted Answer

Create an environment named 'Production', add an approval check, and reference the environment in the deployment job.. Option B is correct because environment approvals are configured on the 'Production' environment, and the deployment job references that environment. Option A is wrong because stages don't have approval gates. Option C is wrong because branch policies are for PRs, not pipeline approvals. Option D is wrong because pipeline-level approvals apply to all runs.

Answer

Set a pipeline-level approval check that applies to all stages.

Answer

Add an approval gate on the 'Production' stage in the pipeline settings.

Answer

Configure branch policy on the main branch to require approval for all changes.

Question 13

Your build pipeline fails intermittently with the error: 'The job running on agent 'Azure Pipelines' exceeded the maximum execution time of 60 minutes.' How can you resolve this issue?

Accepted Answer

Increase the 'timeoutInMinutes' property in the pipeline YAML for the job.. Option A is correct because increasing the timeout allows the job to run longer. Option B is wrong because using a self-hosted agent does not change timeout limits. Option C is wrong because parallel jobs affect concurrency, not duration. Option D is wrong because reducing stages may not address the timeout.

Answer

Split the pipeline into multiple stages to reduce job duration.

Answer

Enable parallel jobs to run the pipeline faster.

Answer

Use a self-hosted agent with more CPU cores.

Question 14

You are designing a release pipeline for a critical application. The pipeline must automatically roll back to the previous version if the deployment to staging fails health checks. Which deployment strategy should you implement?

Accepted Answer

Rolling update with health checks and automatic rollback.. Option C is correct because rolling updates can be configured with health probes and automatic rollback on failure. Option A is wrong because blue-green requires manual switch. Option B is wrong because canary routes traffic gradually but does not auto-rollback. Option D is wrong because redeploying the same version doesn't fix the issue.

Answer

Canary deployment with manual promotion.

Answer

Blue-green deployment with manual swap.

Answer

Recreate deployment by redeploying the same version.

Question 15

Your CI pipeline includes a step that runs unit tests. You want to fail the pipeline if code coverage drops below 80%, but continue if tests pass with lower coverage. How should you configure the test step?

Accepted Answer

Use the 'PublishCodeCoverageResults' task with a 'codeCoverageThreshold' setting.. Option B is correct because the PublishCodeCoverageResults task can set a coverage threshold and fail the pipeline if not met. Option A is wrong because the test runner does not enforce thresholds. Option C is wrong because the build summary doesn't fail the pipeline. Option D is wrong because quality gates apply to release, not CI.

Answer

Configure a quality gate in the release pipeline to check coverage.

Answer

Add a script task that reads the coverage report and prints a warning.

Answer

Use the VSTest task with the 'codeCoverageEnabled' option set to true.