AZ-400 Design and implement build and release pipelines Practice Test 8 — 15 Questions

Question 1

You run the above Azure CLI command to deploy a Bicep template. The deployment fails with 'The resource 'Microsoft.Storage/storageAccounts/mystgaccount' already exists'. What is the most likely cause?

Accepted Answer

The storage account 'mystgaccount' already exists in the resource group.. Option D is correct because the storage account already exists. Option A is wrong because the command uses 'create' which is correct. Option B is wrong because the error mentions 'already exists', not resource group. Option C is wrong because 'create' mode fails if resource exists; 'incremental' would update.

Answer

The command should use 'az deployment group validate' instead.

Answer

The Bicep file uses 'complete' mode.

Answer

The resource group 'MyRG' does not exist.

Question 2

Your release pipeline deploys to multiple environments (dev, test, prod). You need to ensure that only authorized users can approve production deployments. Which TWO actions should you take?

Accepted Answer

Add a 'Approval' check on the production environment.. Option A is correct because pre-deployment approvals enforce approval before deployment. Option D is correct because checks can restrict based on user or group. Option B is wrong because gates are for health checks, not approvals. Option C is wrong because environment permissions control who can create releases, not deploy to production. Option E is wrong because manual validation task is for interactive validation, not approval control.

Answer

Use a manual intervention task in the pipeline.

Answer

Set environment permissions to allow only specific users to create releases.

Answer

Configure deployment gates to check for user approval.

Question 3

Your build pipeline uses a YAML template that references variables from a variable group. The variable group is linked to a library. You need to ensure that sensitive variables are not exposed in logs. Which THREE actions should you take?

Accepted Answer

Store the secrets in Azure Key Vault and reference them in the variable group.. Option A is correct because marking variables as 'secret' masks them in logs. Option C is correct because limiting access to the variable group reduces exposure. Option E is correct because using Azure Key Vault provides secure storage. Option B is wrong because logs can still show secret variable names. Option D is wrong because logging commands can still output secrets if not handled.

Answer

Set the variable group to 'Allow access to all pipelines'.

Answer

Use 'Write-Host' to output the variable values for debugging.

Question 4

Your team wants to implement automated testing in the build pipeline. You need to ensure that tests run and results are published. Which TWO tasks should you include?

Accepted Answer

Visual Studio Test task. Option A is correct because the VSTest task runs tests. Option C is correct because the Publish Test Results task publishes results. Option B is wrong because the Copy Files task copies files, not runs tests. Option D is wrong because the Publish Build Artifacts task publishes artifacts, not test results. Option E is wrong because the Azure PowerShell task runs scripts, not tests.

Answer

Publish Build Artifacts task

Answer

Copy Files task

Answer

Azure PowerShell task

Question 5

You have a pipeline with the above JSON definition. The build fails with 'The specified configuration 'Release' is not valid'. What is the most likely cause?

Accepted Answer

The pipeline definition is in JSON format, which is not supported by Azure Pipelines.. Option C is correct because the variable syntax in YAML is '$(variableName)' but in JSON pipeline (classic) it's '$(variableName)' as well, but the issue is that the variable 'buildConfiguration' might not be defined correctly or the JSON pipeline does not support variable substitution like YAML. However, the exhibit is JSON (classic pipeline). In classic pipelines, variables are referenced as '$(buildConfiguration)' but the JSON snippet is from a YAML pipeline? Actually, the exhibit is JSON but Azure Pipelines uses YAML. In classic editor, variables are set in UI, not in JSON. The most likely cause is that the JSON format is not valid for Azure Pipelines; Azure Pipelines uses YAML. Option C is correct because Azure Pipelines does not support JSON format for pipeline definitions; it must be YAML.

Answer

The configuration value should be 'debug' instead.

Answer

The buildConfiguration variable is not set.

Answer

The DotNetCoreCLI task requires a specific version.

Question 6

You have the above YAML task in a pipeline. The task runs but no secrets are available in subsequent tasks. What is the most likely cause?

Accepted Answer

The secrets are not automatically mapped to environment variables; you must reference them using $(secretName).. Option B is correct because when RunAsPreJob is false, secrets are fetched during the job but may not be available as environment variables automatically; they need to be referenced as $(secretName). Option A is wrong because the service connection likely has permissions. Option C is wrong because the filter '*' fetches all secrets. Option D is wrong because Key Vault exists.

Answer

The SecretsFilter is set to '*' which is invalid.

Answer

The service principal does not have 'Get' permission on the key vault.

Answer

The key vault name 'mykv' does not exist.

Question 7

Your organization uses GitHub for source control and Azure Pipelines for CI/CD. You need to implement a policy that requires all pull requests to be built and pass tests before merging. What should you do?

Accepted Answer

Add a branch protection rule in the GitHub repository requiring status checks.. Option B is correct because branch protection rules in GitHub can require status checks to pass. Option A is wrong because pipeline permissions don't enforce PR checks. Option C is wrong because trigger controls build triggers, not merge requirements. Option D is wrong because environment checks are for deployments.

Answer

Set the pipeline trigger to run on pull request.

Answer

Configure pipeline permissions to require approval.

Answer

Add a pre-deployment check on the environment.

Question 8

You run the above KQL query in Log Analytics to troubleshoot a failing container in a Kubernetes deployment. The query returns no results even though you know there are errors. What is the most likely cause?

Accepted Answer

Container logs are not being sent to the ContainerLog table.. Option D is correct because container logs may be sent to a different table (e.g., ContainerLogV2) or the log collection is not configured. Option A is wrong because the query is correct syntax. Option B is wrong because 'contains' is case-insensitive. Option C is wrong because the query returns only three columns, not affecting results.

Answer

The 'project' clause filters out relevant rows.

Answer

The 'contains' operator is case-sensitive.

Answer

The KQL syntax is incorrect.

Question 9

You are designing a multi-stage YAML pipeline that builds a Docker image and deploys it to Azure Kubernetes Service (AKS). You want to reuse the Docker build steps across multiple stages. What is the best approach?

Accepted Answer

Create a YAML template and reference it from each stage.. Option C is correct because YAML templates in Azure Pipelines allow you to define reusable step, job, or stage definitions in a separate file and reference them using the `template` keyword. This approach promotes DRY (Don't Repeat Yourself) principles, simplifies maintenance, and ensures consistency when the same Docker build steps are needed across multiple stages in a multi-stage pipeline.

Answer

Use a stage template.

Answer

Define the steps as variables and reference them.

Answer

Create a separate job and call it from each stage.

Question 10

Your release pipeline includes a 'Deploy to App Service' task for a Linux web app. The deployment fails with 'Error: Failed to deploy web package to App Service'. What should you check first?

Accepted Answer

Review the App Service diagnostic logs.. Option B is correct because App Service logs provide detailed error messages. Option A is wrong because Kudu is for Windows apps, not Linux. Option C is wrong because deployment slots are optional. Option D is wrong because the web.config is for IIS, not Linux.

Answer

Verify that the deployment slot is correctly configured.

Answer

Check the Kudu console for errors.

Answer

Ensure the web.config file is present.

Question 11

Your team uses Azure Pipelines with a YAML-based build pipeline. The pipeline builds a .NET application and runs unit tests. Recently, the unit tests are failing intermittently due to flaky tests. You need to ensure that the pipeline fails only if the same test fails in two consecutive runs. Which feature should you configure?

Accepted Answer

Configure the 'retry failed tests' setting in the pipeline's test tab.. The Test Retry feature in Azure Pipelines automatically retries a failed test a specified number of times. If the test passes on retry, the pipeline is marked as succeeded with warnings. Option A is correct because it allows retrying flaky tests. Option B is a preview feature for rerunning failed stages, not tests. Option C is for rerunning failed jobs, not individual tests. Option D is a GitHub feature, not Azure Pipelines.

Answer

Implement a GitHub Actions workflow with 're-run' trigger.

Answer

Use the 'Re-run failed stages' option in the pipeline run.

Answer

Enable 'Automatically rerun failed jobs' in the pipeline settings.

Question 12

You have an Azure DevOps Pipeline that builds a Node.js application. The pipeline uses template expressions to conditionally run certain jobs based on the branch name. You notice that the condition 'eq(variables['Build.SourceBranch'], 'refs/heads/main')' is not evaluating as expected. What is the most likely cause?

Accepted Answer

The variable 'Build.SourceBranch' is misspelled; it should be 'Build.SourceBranchName'.. In Azure DevOps YAML pipelines, variables are evaluated at runtime. The correct way to reference the source branch variable is 'variables['Build.SourceBranch']' or '$(Build.SourceBranch)'. Option C is correct because the condition syntax 'eq(variables['Build.SourceBranch'], 'refs/heads/main')' is valid and should work; the issue is likely that the variable name is misspelled or the branch name is incorrect. However, the most common mistake is using 'SourceBranchName' instead of 'SourceBranch'. Option A is incorrect because template expressions are evaluated at compile time, but conditions are runtime. Option B is correct: using 'SourceBranchName' would give only the branch name without 'refs/heads/'. Option D is irrelevant.

Answer

The condition syntax is correct but the branch name should not include 'refs/heads/'.

Answer

The variable 'Build.SourceBranch' is not available in the condition context.

Answer

The condition should be in a template expression instead of a runtime condition.

Question 13

Your organization uses GitHub Actions for CI/CD. You have a workflow that builds and deploys a containerized application to Azure Kubernetes Service (AKS). The workflow uses the 'azure/aks-set-context' action to connect to the AKS cluster. Recently, the workflow started failing with authentication errors. The service principal used has Contributor role on the AKS cluster. What is the most likely cause?

Accepted Answer

The service principal lacks the 'Azure Kubernetes Service Cluster Admin Role' on the AKS cluster.. The 'azure/aks-set-context' action requires the 'Azure Kubernetes Service Cluster User Role' or 'Azure Kubernetes Service Cluster Admin Role' to get cluster credentials. Contributor role does not grant permission to retrieve admin credentials. Option A is correct because the service principal needs the 'Azure Kubernetes Service Cluster Admin Role'. Option B is incorrect as the action does not require cluster creation. Option C is incorrect because the issue is not about RBAC within the cluster. Option D is irrelevant.

Answer

The service principal must have 'Owner' role on the resource group containing the AKS cluster.

Answer

The workflow uses an incorrect Kubernetes version.

Answer

The AKS cluster has RBAC disabled, causing authentication failures.

Question 14

You have a multi-stage YAML pipeline in Azure DevOps that deploys to multiple environments. The pipeline uses a deployment job with environment approvals. You need to ensure that the deployment to the production environment is only triggered after a manual approval is granted. However, you also want the deployment to automatically roll back if the post-deployment health check fails. Which configuration should you implement?

Accepted Answer

Enable 'Auto-revert' on the production environment and set post-deployment conditions.. In Azure Pipelines, environment approvals provide manual gate before deployment. The 'post-deployment auto-revert' feature can be enabled on the environment to automatically revert to the previous successful deployment if the post-deployment conditions (like health checks) fail. Option D is correct. Option A is incorrect because the approval is pre-deployment, not post-deployment. Option B is incorrect because approvers cannot trigger rollback automatically. Option C is incorrect because 'Automatically revert' is the feature name.

Answer

Use a release pipeline with a pre-deployment approval and a post-deployment automatic rollback trigger.

Answer

Configure pre-deployment approvals on the production environment and use a post-deployment gate that fails the deployment.

Answer

Configure pre-deployment approvals and add a manual intervention task to roll back if health check fails.

Question 15

Your team uses Azure Repos Git and wants to enforce a policy that all pushes to the main branch must pass a build validation pipeline. The pipeline runs unit tests and code analysis. You need to configure this in the branch policy. Which setting should you enable?

Accepted Answer

Build validation. Azure Repos branch policies allow requiring a successful build for each push. The 'Require a minimum number of reviewers' is for pull request approvals, not pushes. Option C is correct. Option A is for comments, not builds. Option B is for merge strategies. Option D is for work item linking.

Answer

Require comment resolution

Answer

Linked work items

Answer

Limit merge types