Question 544 of 823
AZ-400 Practice Question: Design and implement build and release pipelines
You are designing a build pipeline for a Python application that uses multiple external packages from PyPI. You want to ensure that builds are reproducible and not affected by package updates. Which strategy should you use?
⚠ Common exam trap
A common trap is assuming that using a Pipfile.lock guarantees reproducibility. While Pipfile.lock does contain exact resolved versions, the Pipfile itself may specify version ranges, and if the lock file is regenerated (e.g., via 'pipenv lock'), it could resolve to different versions if the range allows updates. For true reproducibility, pinning exact versions in requirements.txt is more robust.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Pin exact versions in requirements.txt.
Pinning exact versions in requirements.txt ensures that the same package versions are installed every time, making builds reproducible. Option A is wrong because while Pipfile.lock contains exact resolved versions, the Pipfile itself typically uses version ranges; if the lock file is regenerated (e.g., via 'pipenv lock'), it may resolve to different package versions, breaking reproducibility. Option B is wrong: Dependabot is a tool for automated dependency updates, which introduces version changes and thus breaks reproducibility. Option D is wrong because 'pip install <package>' without version specifiers fetches the latest version, causing non-deterministic builds.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a Pipfile and Pipfile.lock without version pinning.
Why it's wrong here
A Pipfile.lock records the resolved dependency tree, but if the Pipfile specifies loose version ranges (e.g., "requests>=2.0"), then regenerating the lock file—such as running `pipenv install` again—can pull newer versions within those ranges. Because the lock can be refreshed to different exact versions while the Pipfile remains the same, this approach does not guarantee reproducibility unless the Pipfile itself pins exact versions with `==`.
- ✗
Use a dependency update tool like Dependabot weekly.
Why it's wrong here
Dependabot creates pull requests that update dependency versions to newer releases, and merging those PRs intentionally changes the resolved versions in your environment. Even with a lock file or pinned requirements, applying weekly updates means the build's dependencies drift over time, so the exact environment validated in earlier builds is not preserved—reproducibility is sacrificed for freshness.
- ✓
Pin exact versions in requirements.txt.
Why this is correct
Pinning exact versions in requirements.txt using `==` (e.g., `package==1.2.3`) forces pip to install the same version every time, regardless of when or where the install runs. This makes the build deterministic, ensuring that all environments—development, CI, and production—use the exact same library versions, which is the core requirement for reproducible builds.
- ✗
Use 'pip install <package>' without version specifiers.
Why it's wrong here
Running `pip install <package>` without a version specifier makes pip fetch the latest version available on PyPI at the moment the command runs. Because new releases are published over time, this means the build is non-reproducible: the same command can produce different environments on different days, breaking deterministic builds and potentially introducing untested changes.
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 20, 2026
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.