Design and implement a DevOps infrastructure practice questions

Azure RBAC

Why wrong: RBAC controls permissions, not resource configuration like tags.

Azure Blueprints

Why wrong: Azure Blueprints deploy environments but do not enforce tags in real-time during resource group creation.

Azure Resource Graph

Why wrong: Resource Graph is a query tool, not a compliance enforcement mechanism.

Use Azure App Configuration with Key Vault references

Why wrong: App Configuration can reference Key Vault, but for pipeline secrets, Variable Groups with Key Vault is the recommended approach.

Use Azure Kubernetes Service secrets

Why wrong: AKS secrets are for Kubernetes workloads, not for Azure DevOps pipeline secrets.

Use pipeline variables marked as 'secret'

Why wrong: Even though masked, the secret values are still stored in the pipeline definition and can be exposed if someone has access.

Use parallel jobs in the pipeline

Why wrong: Parallel jobs run multiple builds concurrently, not reduce the time of a single build.

Use a self-hosted agent with more CPU

Why wrong: CPU might help but the bottleneck is network download of packages, not CPU.

Enable incremental builds

Why wrong: Incremental builds are already used; the main time is spent restoring packages.

Branch policy with required reviewers

Why wrong: Branch policies control merging, not environment lifecycle.

Pipeline trigger on branch deletion

Why wrong: Branch deletion triggers don't automatically clean up environments.

Service hook to Azure Functions

Why wrong: Service hooks can trigger external processes but are not the built-in feature for environment cleanup.

Create two separate pipelines for staging and production

Why wrong: Separate pipelines increase complexity and don't provide automatic swap.

Use Azure Traffic Manager to route traffic

Why wrong: Traffic Manager routes traffic but doesn't manage deployment slots.

Use an App Service plan with multiple instances

Why wrong: Multiple instances provide scaling, not staging.

Store the state file in a local folder and commit to Git

Why wrong: Local state is not shared and committing to Git can expose secrets and cause conflicts.

Store the state file in Terraform Cloud

Why wrong: Terraform Cloud is a SaaS solution but not Azure-native; Azure Storage is the recommended backend for Azure.

Store the state file in a Git repository with manual locking

Why wrong: Git doesn't support state locking, leading to corruption.

Add a tag to the main branch

Why wrong: Tags are for marking releases, not enforcing reviews.

Repository permissions

Why wrong: Permissions control who can push but not the review process.

Configure a service hook

Why wrong: Service hooks notify external systems but don't enforce branch policies.

Use Azure Front Door to route traffic between clusters

Why wrong: Front Door can route between regions but not for canary inside a single AKS cluster.

Use deployment slots in Azure App Service

Why wrong: Slots are for App Service, not AKS.

Use Azure Container Instances as a staging environment

Why wrong: ACI is useful for isolated containers but not for canary within AKS.

Azure App Configuration with Key Vault references

Why wrong: App Configuration is for application configuration, not pipeline secrets.

Storing secrets in a pipeline YAML file with encryption

Why wrong: YAML files are not encrypted and secrets would be visible in source control.

Removes the need for testing

Why wrong: Testing is still required for IaC templates.

Eliminates the need for documentation

Why wrong: IaC code serves as documentation but doesn't eliminate all documentation needs.

Lower infrastructure costs

Why wrong: IaC does not directly lower costs; it improves consistency and repeatability.

Unit test framework

Why wrong: Unit tests are a good practice but not a prerequisite.

Docker container registry

Why wrong: Docker is not required for .NET Core; it can be deployed directly.

Scheduled trigger

Why wrong: Scheduled triggers run at specified times, not on PR creation.

Continuous integration trigger

Why wrong: CI triggers run on commits, not PRs.

Pipeline completion trigger

Why wrong: Pipeline completion triggers run when another pipeline completes, not on PR creation.

The policy will only apply if the storage account is in a specific resource group

Why wrong: The policy does not specify a resource group scope in the rule.

The storage account will be created but HTTPS will be enforced

Why wrong: The policy denies, not modifies.

The storage account will be created and an audit event will be logged

Why wrong: The effect is 'deny', not 'audit'.

An error because the query syntax is incorrect

Why wrong: The query syntax is valid.

A list of all VMs in the subscription

Why wrong: The query filters by location 'eastus'.

A list of all VMs in the westus location

Why wrong: The query filters by eastus.

Reduce the number of agents to 5 to avoid conflicts

Why wrong: Fewer agents will increase queue times and not resolve conflicts.

Move all microservices into a single repository and use a single pipeline

Why wrong: Monorepo approach changes architecture but doesn't directly solve agent conflicts.

Increase the number of parallel jobs in the agent pool to 20

Why wrong: More parallel jobs require more agents, increasing cost, and don't prevent conflicts if agents share dependencies.

Use Azure Load Balancer in front of two separate App Services.

Why wrong: Overly complex; deployment slots are designed for this.

Configure auto-scaling rules.

Why wrong: Auto-scaling handles load, not deployment strategy.

Use Azure Traffic Manager to route traffic between slots.

Why wrong: Traffic Manager is for global traffic routing, not slot swapping.

Use Azure Policy to enforce vulnerability scanning.

Why wrong: Azure Policy can audit but not automatically scan on push.

Configure a Jenkins job to scan images before pushing to ACR.

Why wrong: This would add latency to the build pipeline and not cover images from other sources.

Configure a webhook in ACR to notify Jenkins to scan the image.

Why wrong: Webhook adds complexity and Jenkins might not be always available.

Azure Role-Based Access Control (RBAC)

Why wrong: RBAC controls who can deploy, not what they deploy.

Azure Blueprints

Why wrong: Blueprints define a repeatable set of resources but don't enforce template approval.

Azure Management Groups

Why wrong: Management Groups organize subscriptions hierarchically.

Use the Azure SQL Database deployment task to run a SQL script manually.

Why wrong: Manual script execution is error-prone and not automated.

Use Azure SQL Database backup and restore to update the schema.

Why wrong: Backup/restore does not apply incremental schema changes.

Add a PowerShell task that runs SQLCMD.

Why wrong: SQLCMD can run scripts but lacks versioning and rollback capabilities.

Publish all microservice artifacts to the same Azure Artifacts feed.

Why wrong: Artifact feed is unrelated to pipeline reuse.

Store all pipeline variables in a single variable group.

Why wrong: Better to use per-service variable groups.

Create a single pipeline that handles all microservices.

Why wrong: Single pipeline reduces independence.