AZ-400 Conditional signing on tag Practice Question
You are designing a build pipeline that produces a NuGet package. The pipeline must conditionally sign the assembly only when the build is triggered by a tag starting with 'v' (e.g., v1.0.0). The pipeline uses a script task that signs the assembly. Which expression should you use in the condition of the script task?
⚠ Common exam trap
It's easy for candidates to confuse `Build.SourceBranchName` (short name) with `Build.SourceBranch` (full ref), leading them to choose Option B, which would incorrectly match branches or other refs starting with 'v' instead of only tags.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
and(succeeded(), startsWith(variables['Build.SourceBranch'], 'refs/tags/v'))
The condition uses `startsWith(variables['Build.SourceBranch'], 'refs/tags/v')` to check if the build was triggered by a tag whose full Git ref starts with `refs/tags/v`. This ensures the signing script runs only when the source branch is a tag reference matching the 'v' prefix, which is the standard way to identify version tags in Azure Pipelines. The `and(succeeded(), ...)` wrapper guarantees the previous tasks completed successfully before signing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
and(succeeded(), startsWith(variables['Build.SourceBranch'], 'refs/tags/v'))
Why this is correct
The Build.SourceBranch variable holds the full Git ref, which for a tag push is exactly 'refs/tags/vX.Y.Z'. By using startsWith(..., 'refs/tags/v'), the condition first verifies that the ref is under the 'refs/tags/' namespace, ensuring it is a tag rather than a branch, and then checks that the tag name starts with 'v' to restrict to version-style tags. This accurately limits the signing step to semantic-version tags, making it the correct condition.
- ✗
and(succeeded(), startsWith(variables['Build.SourceBranchName'], 'v'))
Why it's wrong here
The SourceBranchName variable contains only the last segment of the branch or tag ref, such as 'v2.0' from refs/tags/v2.0 but also 'v2-feature' from refs/heads/v2-feature. Because this value does not encode whether the ref is a tag or a branch, startsWith(..., 'v') will match any branch whose name begins with 'v' in addition to tag names. This overbroad match would trigger signing on non-release branches like 'v2-patch-work', so it is not a safe condition for limiting signing to version tags.
- ✗
and(succeeded(), startsWith(variables['Build.SourceVersion'], 'v'))
Why it's wrong here
The Build.SourceVersion variable contains the full commit SHA of the push, not the tag name. Tags are metadata on commits, and the SHA is an opaque 40-character hex string that does not encode the tag's v-prefix. Therefore, checking startsWith(..., 'v') on SourceVersion will never reliably match a version tag, since hex characters are 0-9 and a-f, so the test will always be false or at best coincidental. This condition cannot be used to detect a tagged build.
- ✗
and(succeeded(), eq(variables['Build.Reason'], 'IndividualCI'))
Why it's wrong here
The Build.Reason value 'IndividualCI' simply indicates that the build was triggered by a single CI push to the repository, whether that push created a branch or a tag. Azure DevOps sets the same reason for tag-triggered builds as for normal branch CI builds, so this check does not constrain signing to tag-only runs. As a result, a regular commit to any branch would also pass this condition, causing the signing step to run on untagged code, which defeats the purpose of conditional signing.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-400 exam frequently reuses these exact scenarios with slightly different constraints.
✓and(succeeded(), startsWith(variables['Build.SourceBranch'], 'refs/tags/v'))Correct answer▾
Why this is correct
The Build.SourceBranch variable holds the full Git ref, which for a tag push is exactly 'refs/tags/vX.Y.Z'. By using startsWith(..., 'refs/tags/v'), the condition first verifies that the ref is under the 'refs/tags/' namespace, ensuring it is a tag rather than a branch, and then checks that the tag name starts with 'v' to restrict to version-style tags. This accurately limits the signing step to semantic-version tags, making it the correct condition.
✗and(succeeded(), startsWith(variables['Build.SourceBranchName'], 'v'))Wrong answer — click to see why▾
Why this is wrong here
Build.SourceBranchName for a tag is the tag name, so this would also work but is less precise; however, the official documentation recommends using Build.SourceBranch.
✗and(succeeded(), startsWith(variables['Build.SourceVersion'], 'v'))Wrong answer — click to see why▾
Why this is wrong here
Build.SourceVersion is the commit SHA, not the tag.
✗and(succeeded(), eq(variables['Build.Reason'], 'IndividualCI'))Wrong answer — click to see why▾
Why this is wrong here
Build.Reason checks for CI trigger, not tag.
Analysis generated from the official AZ-400blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Git
Git is a version control system that tracks changes to files so multiple people can work on the same project without overwriting each other's work.
Key term
Build pipeline
A build pipeline is an automated sequence of steps that compiles source code into a deployable artifact, running tests and checks along the way.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.