Configuring a Build to Restore from Two NuGet Sources and Fail on Missing Packages
You are designing a build pipeline for a .NET Core application. The pipeline must run on a self-hosted agent in a private network without internet access. Which TWO actions are required to ensure the build can download NuGet packages?
⚠ Common exam trap
The trap is picking 'NuGet Authenticate' as a required action — it is helpful but not strictly required if the feed is already reachable and authenticated, and the question asks for the two actions that are actually necessary.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Install the NuGet tool on the self-hosted agent machine.
Option B is correct because a self-hosted agent in an isolated network must have the NuGet client tooling installed locally, since the pipeline's NuGet restore tasks (e.g., NuGetCommand@2 or DotNetCoreCLI restore) rely on a NuGet executable or the .NET SDK's built-in restore capability being present on the agent machine to resolve and download packages. Option D is correct because with no internet access, the agent cannot reach nuget.org, so the pipeline must point NuGet at a reachable package source such as Azure Artifacts or an internal NuGet feed configured via NuGet.config or a service connection, allowing packages to be downloaded from inside the private network. Option A is wrong because disabling NuGet restore would prevent package download entirely, defeating the build's dependency resolution. Option C is wrong because switching to a Microsoft-hosted agent contradicts the requirement to run on a self-hosted agent in a private network and would not have access to internal feeds. Option E is wrong because NuGet Authenticate only supplies credentials for Azure Artifacts; authentication alone does not provide network reachability or a configured internal feed, so it is not sufficient (and not required) to enable package download in an offline network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable the NuGet restore step in the pipeline.
Why it's wrong here
Disabling the NuGet restore step in the pipeline would prevent the download and resolution of any package dependencies, including the .NET Core SDK's own NuGet packages, leading to compilation errors because there would be no project.assets.json file and no way for the compiler to locate referenced assemblies. Even if packages are already cached in the global packages folder, the restore step is still essential to generate the assets file and produce the correct dependency graph for the build. Therefore, disabling restore is a non-viable solution because it breaks the fundamental build process regardless of the agent environment.
- ✓
Install the NuGet tool on the self-hosted agent machine.
Why this is correct
The NuGet tool (NuGet.exe) or the dotnet CLI is the client executable that actually executes restore, pack, and push commands in classic build tasks like the NuGetCommand task. On a self-hosted agent, this tool is not guaranteed to be installed, so explicitly installing it ensures the agent can perform the required NuGet operations for the pipeline. For .NET Core projects, the dotnet CLI can handle restore via the SDK, but if the pipeline uses the legacy NuGet tasks, NuGet.exe must be present and accessible on the agent's PATH. Installing the NuGet tool directly addresses the missing executable that the build pipeline relies on to interact with package feeds.
- ✗
Use a Microsoft-hosted agent instead.
Why it's wrong here
Microsoft-hosted agents are pre-configured with a wide range of tools and have full internet access to nuget.org, but they run in Microsoft's cloud and are entirely external to your network. Using one would violate the explicit requirement that the build must run in an environment without internet access, because the agent would be able to reach public endpoints and download external content. This contradicts the security, privacy, or compliance constraint that necessitates a self-hosted agent in the first place. Therefore, this option is wrong because it cannot satisfy the core infrastructure constraint.
- ✓
Configure the self-hosted agent to access Azure Artifacts or an internal NuGet feed.
Why this is correct
A self-hosted agent operating without internet access must obtain NuGet packages from a source that is reachable on its private network, such as Azure Artifacts if it is hosted in a location accessible from the agent, or an on-premises NuGet server. Configuring the agent to use this internal feed gives the restore step a valid package source. Without such a feed, even with the NuGet tool installed, restore would fail with errors like 'Unable to find package' because no source would be available. This configuration is necessary to make the offline self-hosted agent environment function correctly.
- ✗
Use the NuGet Authenticate task to authenticate with Azure Artifacts.
Why it's wrong here
The NuGet Authenticate task is used to configure credentials in NuGet.config when connecting to authenticated feeds, such as private Azure Artifacts feeds that require login. In an offline environment with an internal unauthenticated feed, this task is unnecessary because there are no credentials to provide, and it is also insufficient because it does not add a package source or install the NuGet tool. Even if the feed does require authentication, the task only handles authentication; it does not solve the lack of internet access or the missing NuGet executable on the agent. The core problems are the absence of a reachable feed and a package client, neither of which this task addresses.
Visual reference
Go deeper
Related to this question
Learn chapter
Managing Build Quality and Package Dependencies
Key term
Azure Artifacts
Azure Artifacts is a service within Azure DevOps that allows teams to create, host, and share packages like NuGet, npm, Maven, and Python, making software dependencies easier to manage across projects.
Key term
Agent
An agent is a software component that runs on a local machine to perform automated tasks, collect data, or execute commands as part of a larger system like CI/CD or monitoring.
About these practice questions
This AZ-400 question is part of Courseiva's 696-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.