AZ-400 Practice Question: Design and implement build and release pipelines
Which TWO actions should you take to implement a secure CI/CD pipeline that uses Azure Pipelines and prevents unauthorized access to production? (Choose two.)
⚠ Common exam trap
A common mix-up: candidates confuse secret management (Option A) with access control, or think that PR triggers (Option C) or self-hosted agents (Option E) directly prevent unauthorized production access, when in fact they address different security concerns (secret protection, code validation, and agent isolation) rather than deployment authorization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure deployment approvals and checks on the production stage.
Deployment approvals and checks in Azure Pipelines require manual sign-off or automated policy validation before a release proceeds to production, preventing unauthorized or unverified changes. Option D is correct because using a service connection with a managed identity eliminates the need to store static credentials, reducing the risk of credential exposure and unauthorized access to Azure resources during deployment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store production secrets as pipeline variables marked as 'Secret'.
Why it's wrong here
Storing production secrets as pipeline variables marked as 'Secret' is risky because secrets can be inadvertently exposed in pipeline logs or via variable group access, and they do not support automatic rotation; instead, use Azure Key Vault to centrally manage and rotate secrets.
- ✓
Configure deployment approvals and checks on the production stage.
Why this is correct
Configuring deployment approvals and checks on the production stage is correct because it enforces manual authorization and integrates with Azure Policy or other gates, ensuring that only authorized personnel can approve and promote builds to production, reducing risk of unauthorized deployments.
- ✗
Enable PR triggers for the production stage to validate changes.
Why it's wrong here
Enabling PR triggers for the production stage is wrong because PR triggers are designed for validating code changes in branches, not for controlling production deployments; they could allow unauthorized changes if the PR validation pipeline has elevated permissions, and deployment should be gated by approvals, not PR triggers.
- ✓
Use a service connection with a managed identity for Azure resources.
Why this is correct
Using a service connection with a managed identity for Azure resources is correct because managed identities eliminate stored credentials, provide automatic rotation and least-privilege access, and reduce the attack surface compared to using service principals with secrets or passwords.
- ✗
Use self-hosted agents running on-premises for all pipelines.
Why it's wrong here
Using self-hosted agents running on-premises for all pipelines is not a security measure and can introduce additional risk if the agents are not properly secured, patched, or isolated; agent location does not prevent unauthorized access, and managed, scalable Microsoft-hosted agents with proper identity and access controls are often more secure.
Visual reference
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Pipeline
A pipeline is an automated series of steps that takes code from development to production, ensuring quality and speed.
Key term
Azure Pipelines
Azure Pipelines is a cloud-based CI/CD service from Microsoft that automatically builds, tests, and deploys code to any platform or cloud.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.