AZ-400 Design and implement build and release pipelines Practice Test 7 — 15 Questions

Question 1

Your team uses GitHub Actions for CI/CD. You need to ensure that only specific branches can trigger the deployment workflow to production. Which workflow trigger should you configure?

Accepted Answer

on: push: branches: [main]. Option C is correct because the 'on: push: branches: [main]' trigger restricts workflow to pushes on main. Option A is wrong because pull_request triggers on PRs, not branches. Option B is wrong because schedule triggers on cron. Option D is wrong because workflow_dispatch is manual.

Answer

on: pull_request: branches: [main]

Answer

on: workflow_dispatch: inputs: branch: description: 'Select branch'

Answer

on: schedule: cron: '0 0 * * *'

Question 2

You have a YAML pipeline that builds a .NET application. You want to cache the NuGet packages to speed up subsequent builds. Which task should you use?

Accepted Answer

Cache task with a key based on the packages.lock.json hash.. Option A is correct because Cache task restores/saves a cache keyed by hash. Option B is wrong because NuGet restore does not cache by itself. Option C is wrong because CopyFiles copies files, not caches. Option D is wrong because PublishBuildArtifacts is for artifacts, not caching.

Answer

CopyFiles task to copy packages to a staging directory.

Answer

NuGet restore task with 'cacheRestore' option.

Answer

PublishBuildArtifacts task to upload packages.

Question 3

Your release pipeline deploys to Azure App Service using slots. You need to ensure that after swapping, the warmup request is sent to the production slot before traffic is fully routed. What should you configure?

Accepted Answer

Enable auto swap for the deployment slot and configure a custom warmup path.. Option B is correct because auto swap with custom warmup triggers a warmup request to the target slot before swap completes. Option A is wrong because manual swap does not have warmup. Option C is wrong because deployment slot settings are sticky and not swapped. Option D is wrong because health check is different from warmup.

Answer

Add a health check to the App Service.

Answer

Perform a manual swap and then send a warmup request via a script.

Answer

Configure slot-specific app settings to enable warmup.

Question 4

You need to create a pipeline that triggers only when changes are made to files in the 'src/api' folder. Which trigger configuration should you use?

Accepted Answer

trigger: paths: include: - 'src/api/*'. Option A is correct because the 'paths' filter with 'include' triggers only for changes in that path. Option B is wrong because 'exclude' would ignore that path. Option C is wrong because 'tags' filter by tag. Option D is wrong because 'branches' filter by branch.

Answer

trigger: branches: include: - 'main'

Answer

trigger: paths: exclude: - 'src/api/*'

Answer

trigger: tags: include: - 'v*'

Question 5

Which TWO are valid strategies for managing secrets in Azure Pipelines?

Accepted Answer

Use a variable group linked to Azure Key Vault and mark variables as secret.. Option B is correct because linking a variable group to Azure Key Vault allows secrets to be securely referenced in pipelines without exposing them in plaintext. When variables are marked as secret, Azure Pipelines automatically masks their values in logs and output, ensuring sensitive data remains protected throughout the build and release process.

Answer

Store secrets in plain text in a variable group.

Answer

Store secrets in a Git repository and read them during build.

Answer

Embed secrets directly in the pipeline YAML file.

Question 6

Which THREE are required to set up a self-hosted agent for Azure Pipelines?

Accepted Answer

Network connectivity to Azure DevOps services.. Correct answers: A, C, D. A: agent must be registered with a PAT. C: agent machine needs network access to Azure DevOps. D: agent must be configured with the account. B is wrong because you don't need a VM in Azure; self-hosted can be on-premises. E is wrong because Docker is optional.

Answer

A virtual machine running in Azure.

Answer

Docker installed on the agent machine.

Question 7

Which TWO conditions must be met to use multi-stage YAML pipelines with approvals?

Accepted Answer

An environment must be created and approval checks configured on it.. Correct answers: C and D. C: approvals are configured on environments. D: deployment jobs must reference environments. A is wrong because YAML pipelines don't require classic release. B is wrong because approvals don't require a separate release pipeline.

Answer

The pipeline must be triggered by a pull request.

Answer

The pipeline must have at least one stage defined in a separate release pipeline.

Answer

The pipeline must be created using the classic release editor.

Question 8

You have the YAML pipeline exhibit above. The pipeline fails with: 'The pipeline is not valid. Could not find the template file shared-templates/build-steps.yml.' What is the most likely cause?

Accepted Answer

The template path is incorrect because it should be relative to the repository root; the repository name is 'myorg/shared-templates', so the path should be 'build-steps.yml'.. Option B is correct because the template path is relative to the repository root, but the repository name includes 'myorg/shared-templates', so the path should be 'build-steps.yml' if it is in the root. Option A is wrong because the template is referenced correctly. Option C is wrong because the ref is correct. Option D is wrong because checkout order does not affect template resolution.

Answer

The checkout step for 'shared-templates' must be before the template reference, which it is.

Answer

The template file is missing from the shared-templates repository.

Answer

The ref 'refs/heads/main' does not exist in the shared-templates repository.

Question 9

The pipeline above fails with: 'The deployment job 'DeployToProd' references environment 'Production' which does not exist.' What should you do to resolve this error?

Accepted Answer

Create an environment named 'Production' in Azure DevOps project settings.. Option D is correct because creating the 'Production' environment in Azure DevOps will resolve the reference. Option A is wrong because changing to runOnce doesn't fix missing environment. Option B is wrong because adding a new job doesn't help. Option C is wrong because removing the environment reference removes the deployment strategy.

Answer

Remove the 'environment' property from the deployment job.

Answer

Change the deployment strategy from 'runOnce' to 'rolling'.

Answer

Add a script step before the deployment job to create the environment.

Question 10

You ran the above Azure CLI command to check the deployment source of an Azure Web App. The web app is not deploying automatically when commits are pushed to the main branch. Based on the output, what is the most likely cause?

Accepted Answer

The continuous deployment sync is not enabled; you need to enable it or configure a pipeline.. Option D is correct because the output does not show a CI/CD trigger; it only shows the source. The web app may have disconnected sync. Option A is wrong because branch is main. Option B is wrong because deployment rollback is disabled, which is fine. Option C is wrong because GitHub is supported.

Answer

Deployment rollback is disabled, preventing automatic deployments.

Answer

The branch is set to 'main' but commits are pushed to 'master'.

Answer

The repo URL uses GitHub but Azure Web Apps only supports Azure Repos.

Question 11

Your team is implementing a CI/CD pipeline for a .NET application. The build pipeline should only run when changes are pushed to the main branch, but a recent push to a feature branch triggered the pipeline. What is the most likely cause?

Accepted Answer

The trigger includes 'main' and also has no branch filters, so all branches trigger builds.. Option C is correct because the trigger should be set to include 'main' branch only. Option A is wrong because disabling CI trigger would stop all automatic builds. Option B is wrong because path filters affect file paths, not branches. Option D is wrong because PR triggers are separate.

Answer

The pull request trigger is enabled for the feature branch.

Answer

Path filters are configured to include all paths.

Answer

The CI trigger is disabled in the pipeline YAML.

Question 12

You have a pipeline with the above YAML trigger configuration. A developer pushes changes to a file in 'src/app/config.json' on a branch named 'release/v1'. Which statement is true about the build trigger?

Accepted Answer

The build will be triggered.. Option A is correct because the branch 'release/v1' matches the include pattern 'release/*' and the file path is under 'src/app/'. Option B is wrong because the branch is included. Option C is wrong because the path is included. Option D is wrong because the trigger will execute.

Answer

The build will be triggered but only if no other builds are running.

Answer

The build will not be triggered because the path filter is too restrictive.

Answer

The build will not be triggered because the branch is not 'main'.

Question 13

You need to deploy a web app to Azure App Service using Azure Pipelines. The deployment slot should be 'staging' first, and after smoke tests, swap to production. Which deployment strategy should you use?

Accepted Answer

Slot swap. Option B is correct because slot swap allows deploying to staging and swapping to production. Option A is wrong because rolling update updates instances gradually without slots. Option C is wrong because blue-green requires separate environments. Option D is wrong because canary routes a small percentage of traffic.

Answer

Canary deployment

Answer

Rolling update

Answer

Blue-green deployment

Question 14

Your release pipeline uses a 'Run Azure CLI' task to execute a script. The script authenticates using a service principal. However, the deployment fails with 'insufficient privileges to complete the operation'. What is the most likely cause?

Accepted Answer

The service principal lacks the necessary RBAC role on the target resource.. Option C is correct because the service principal likely lacks the required RBAC role. Option A is wrong because the CLI task can use service principal authentication. Option B is wrong because service principal secret expiration would cause a different error. Option D is wrong because the error is about privileges, not token expiry.

Answer

The Azure CLI task is not logged in.

Answer

The service principal secret has expired.

Answer

The service principal does not have a secret.

Question 15

Your team uses Microsoft-hosted agents for builds. Recently, builds are taking longer to start. What is the best way to reduce queue times?

Accepted Answer

Provision self-hosted agents.. Option A is correct because using self-hosted agents provides dedicated capacity. Option B is wrong because reducing parallel jobs doesn't help queue time. Option C is wrong because it increases parallelism but doesn't reduce queue time per job. Option D is wrong because more jobs would increase queue time.

Answer

Increase the number of parallel jobs in the organization.

Answer

Use more pipeline triggers.

Answer

Reduce the number of parallel jobs.