Match each Azure Artifacts feed type to its description.
Drag a concept onto its matching description — or click a concept then click the description.
Accessible to all projects in the organization
Accessible only within a specific project
Caches packages from external sources like NuGet.org
Filters packages by release status (e.g., prerelease)
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Project-scoped feed: A feed scoped to a specific project within an organization, accessible by members of that project.
In Azure Artifacts, project-scoped feeds are limited to a specific project, organization-scoped feeds are available to the entire org, and public feeds allow anonymous access. Common confusions arise from swapping the scope of project and org feeds, or misstating public feed authentication requirements.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Project-scoped feed: A feed scoped to a specific project within an organization, accessible by members of that project.
Why this is correct
A project-scoped feed is created within a specific Azure DevOps project and derives its default permissions from that project's security model. Only project members, or users/groups explicitly granted access, can list, restore, or publish packages in this feed. This isolation makes it ideal for keeping team-specific dependencies private and separate from other projects.
Organization-scoped feed: A feed scoped to the entire organization, accessible by all members of the organization.
Why this is correct
An organization-scoped feed spans the entire Azure DevOps organization, appearing in every project's context and accessible by all authenticated users of that organization. It is not bound to a single project's permission model, making it a convenient hub for shared libraries and tools that need to be consumed across multiple projects. Its default access is broad, flowing from the organization identity rather than any project membership.
Public feed: A feed that can be accessed anonymously from outside the organization.
Why this is correct
A public feed is intentionally exposed to the internet with anonymous read access, meaning anyone who possesses the feed URL can download packages without signing in or presenting credentials. This is critical for distributing open-source packages or sharing code with external partners, but write operations—like publishing new versions—still require authentication and appropriate permissions. The defining feature is that external consumption needs no authentication at all.
Project-scoped feed: A feed scoped to the entire organization, accessible by all members.
Why it's wrong here
This statement incorrectly swaps the definitions of project-scoped and organization-scoped feeds. A feed that is scoped to the entire organization and accessible by all organization members is exactly what defines an organization-scoped feed. A project-scoped feed, in contrast, is confined to a single project and its default audience is limited to that project's members, not the whole organization.
Organization-scoped feed: A feed scoped to a specific project, accessible by project members.
Why it's wrong here
This definition describes a project-scoped feed, not an organization-scoped feed. Organization-scoped feeds are not tied to any one project; they exist at the organization level and are visible to every project within it, with all organization members having default access. A feed scoped to a specific project would be restricted to that project's membership, which is the opposite of what this option claims.
Public feed: A feed that requires authentication from external users.
Why it's wrong here
Public feeds do not require authentication from external users; in fact, they are defined by allowing anonymous read access to anyone who has the feed URL. Requiring authentication would transform it into a private or organization-scoped feed, defeating the purpose of public distribution. The correct behavior is that any external user can fetch packages without signing in, while publishing remains a privileged operation.
Go deeper
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.