AZ-400 Practice Question: Design and implement build and release pipelines
You are designing a build pipeline for a Python application that uses multiple third-party packages from the public PyPI repository. Your organization has security policies that require all build dependencies to be scanned for known vulnerabilities before being used. The build pipeline runs on Microsoft-hosted agents. You need to integrate vulnerability scanning into the build pipeline with minimal overhead and without storing credentials in the pipeline. What should you do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a dependency scanning task from the Azure DevOps marketplace to the build pipeline.
The correct approach is to add a dependency scanning task from the Azure DevOps marketplace to the build pipeline. These tasks, such as WhiteSource Bolt or Snyk, integrate seamlessly with Azure Pipelines, automatically scan dependencies from PyPI for known vulnerabilities, and require no credential storage in the pipeline. Option A is incorrect because connecting to a private vulnerability database adds unnecessary complexity and overhead. Option B is incorrect because using a custom script with pip audit would require maintaining the script and potentially storing credentials for external services. Option C is incorrect because manual review is not automated and defeats the purpose of a CI/CD pipeline.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a service connection to a private vulnerability database and use a script to scan.
Why it's wrong here
Configuring a service connection to a private vulnerability database adds credential management overhead, potential secret leakage, and ongoing maintenance. A scripted scan also bypasses Azure DevOps' native integration, error handling, and reporting capabilities, making this approach less robust and more complex than a dedicated marketplace task.
- ✗
Write a custom script that uses pip audit to scan the requirements.txt file.
Why it's wrong here
Writing a custom script using pip audit to scan requirements.txt is brittle because it requires manual dependency installation, may miss transitive vulnerabilities, and needs periodic updates to stay current with vulnerability feeds. It also lacks native pipeline logging, fail-fast integration, and the broad compatibility that a maintained marketplace task provides, increasing maintenance burden without improving security coverage.
- ✗
Use a pre-build validation step in the pipeline to manually review dependencies.
Why it's wrong here
A pre-build validation step relying on manual review of dependencies is not a security control; it is an error-prone, unscalable process that cannot keep pace with CI/CD velocity. It also fails to provide an auditable, automated gate for blocked vulnerabilities, contradicting the requirement for automated scanning in a build pipeline.
- ✓
Add a dependency scanning task from the Azure DevOps marketplace to the build pipeline.
Why this is correct
Adding a dependency scanning task from the Azure DevOps marketplace is the correct approach because it integrates directly into the pipeline, supports credential-free scanning for public packages, and automatically fails the build on detected vulnerabilities. It leverages Azure DevOps' built-in reporting, governance, and extension ecosystem, providing comprehensive coverage of both direct and transitive dependencies without custom code.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Task
A Task in Azure DevOps is a predefined, reusable step that performs a specific action during a build or release pipeline, like compiling code or running tests.
Key term
Azure Pipelines
Azure Pipelines is a cloud-based CI/CD service from Microsoft that automatically builds, tests, and deploys code to any platform or cloud.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.