AZ-400 Practice Question: Design and implement build and release pipelines
You are designing a build pipeline for a .NET Core application. The pipeline must run on a self-hosted agent in a private network without internet access. Which TWO actions are required to ensure the build can download NuGet packages?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Install the NuGet tool on the self-hosted agent machine.
To restore NuGet packages on a self-hosted agent without internet access, the NuGet tool must be installed on the agent machine (B) and the agent must be configured to access an internal NuGet feed, such as Azure Artifacts or a local feed (D). Disabling the NuGet restore step (A) would prevent packages from being downloaded. Using a Microsoft-hosted agent (C) would require internet access, which violates the private network constraint. The NuGet Authenticate task (E) is not required because authentication can be handled through feed configuration or integrated authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable the NuGet restore step in the pipeline.
Why it's wrong here
Disabling the NuGet restore step in the pipeline would prevent the download and resolution of any package dependencies, including the .NET Core SDK's own NuGet packages, leading to compilation errors because there would be no project.assets.json file and no way for the compiler to locate referenced assemblies. Even if packages are already cached in the global packages folder, the restore step is still essential to generate the assets file and produce the correct dependency graph for the build. Therefore, disabling restore is a non-viable solution because it breaks the fundamental build process regardless of the agent environment.
- ✓
Install the NuGet tool on the self-hosted agent machine.
Why this is correct
The NuGet tool (NuGet.exe) or the dotnet CLI is the client executable that actually executes restore, pack, and push commands in classic build tasks like the NuGetCommand task. On a self-hosted agent, this tool is not guaranteed to be installed, so explicitly installing it ensures the agent can perform the required NuGet operations for the pipeline. For .NET Core projects, the dotnet CLI can handle restore via the SDK, but if the pipeline uses the legacy NuGet tasks, NuGet.exe must be present and accessible on the agent's PATH. Installing the NuGet tool directly addresses the missing executable that the build pipeline relies on to interact with package feeds.
- ✗
Use a Microsoft-hosted agent instead.
Why it's wrong here
Microsoft-hosted agents are pre-configured with a wide range of tools and have full internet access to nuget.org, but they run in Microsoft's cloud and are entirely external to your network. Using one would violate the explicit requirement that the build must run in an environment without internet access, because the agent would be able to reach public endpoints and download external content. This contradicts the security, privacy, or compliance constraint that necessitates a self-hosted agent in the first place. Therefore, this option is wrong because it cannot satisfy the core infrastructure constraint.
- ✓
Configure the self-hosted agent to access Azure Artifacts or an internal NuGet feed.
Why this is correct
A self-hosted agent operating without internet access must obtain NuGet packages from a source that is reachable on its private network, such as Azure Artifacts if it is hosted in a location accessible from the agent, or an on-premises NuGet server. Configuring the agent to use this internal feed gives the restore step a valid package source. Without such a feed, even with the NuGet tool installed, restore would fail with errors like 'Unable to find package' because no source would be available. This configuration is necessary to make the offline self-hosted agent environment function correctly.
- ✗
Use the NuGet Authenticate task to authenticate with Azure Artifacts.
Why it's wrong here
The NuGet Authenticate task is used to configure credentials in NuGet.config when connecting to authenticated feeds, such as private Azure Artifacts feeds that require login. In an offline environment with an internal unauthenticated feed, this task is unnecessary because there are no credentials to provide, and it is also insufficient because it does not add a package source or install the NuGet tool. Even if the feed does require authentication, the task only handles authentication; it does not solve the lack of internet access or the missing NuGet executable on the agent. The core problems are the absence of a reachable feed and a package client, neither of which this task addresses.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Agent
An agent is a software component that runs on a local machine to perform automated tasks, collect data, or execute commands as part of a larger system like CI/CD or monitoring.
Key term
Build pipeline
A build pipeline is an automated sequence of steps that compiles source code into a deployable artifact, running tests and checks along the way.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.