Courseiva
Design and implement build and release pipelineshardMultiple SelectObjective-mapped

AZ-400 Practice Question: Design and implement build and release pipelines

Which THREE are required to set up a self-hosted agent for Azure Pipelines?

⚠ Common exam trap

Many exam-takers assume a self-hosted agent must run on an Azure VM (Option A) or require Docker (Option E), when in fact the only infrastructure requirements are network connectivity and authentication, with the agent pool configuration tying it all together.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Network connectivity to Azure DevOps services.

B is correct because the self-hosted agent must communicate with Azure Pipelines to receive job assignments and report status. This requires outbound HTTPS connectivity (port 443) to Azure DevOps services (e.g., dev.azure.com). Without network connectivity, the agent cannot register, poll for jobs, or send logs, making it non-functional.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • A virtual machine running in Azure.

    Why it's wrong here

    A self-hosted agent does not require a virtual machine in Azure; it can run on-premises or in any cloud. The only requirement is that the machine has internet connectivity and can reach Azure DevOps, so an Azure VM is just one optional hosting choice, not a prerequisite.

  • Network connectivity to Azure DevOps services.

    Why this is correct

    The agent must be able to establish an HTTPS connection to Azure DevOps services over the network to poll for job assignments, download tasks, and report status. Without network connectivity, the agent cannot participate in pipelines, making this a fundamental requirement for any self-hosted agent.

  • A Personal Access Token (PAT) to authenticate the agent.

    Why this is correct

    A Personal Access Token (PAT) is the standard authentication mechanism used during the agent registration process (e.g., config.cmd or config.sh) to validate the agent against the Azure DevOps organization. It must have Agent Pools (read/manage) scope and is required to initially associate the agent with the correct pool, though ongoing communication uses short-lived OAuth tokens.

  • An agent pool configured in Azure DevOps and the agent configured to use that pool.

    Why this is correct

    Azure DevOps uses agent pools to group agents and route pipeline jobs, so the self-hosted agent must be registered into a pool and its configuration must specify that pool name. Without this assignment, the agent would not receive jobs and the pipeline would have no target to execute on.

  • Docker installed on the agent machine.

    Why it's wrong here

    Docker is not a mandatory component for running a self-hosted agent; it is only necessary if you plan to run container-based jobs, such as those using the Docker task or requiring isolated containers. A basic self-hosted agent can operate without Docker, provided the machine has the appropriate operating system and networking prerequisites.

About these practice questions

This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.