AZ-400 Practice Question: Design and implement build and release pipelines
You are the DevOps lead for a large enterprise that uses GitHub for source control and Azure Pipelines for CI/CD. The organization has hundreds of repositories, each with its own pipeline. Recently, the security team mandated that all pipelines must use a centralized set of tasks for secret scanning and compliance checks before any deployment. You need to design a solution that enforces these mandatory tasks across all pipelines without modifying each pipeline individually. The solution should allow pipeline authors to add their own custom steps after the mandatory steps. The mandatory steps must be versioned and updated centrally. You also need to ensure that the mandatory steps are not bypassed by pipeline authors. What should you do?
⚠ Common exam trap
A YAML template with branch protection is often mistaken for an enforcement mechanism, but it does not require pipelines to include the template.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom Azure DevOps extension that adds the mandatory tasks to all pipelines using a pre-job hook.
D is correct. A custom Azure DevOps extension with a pre-job hook (pipeline decorator) automatically injects mandatory steps into every pipeline without requiring changes to individual pipelines. It is centrally managed and versioned, and cannot be bypassed by pipeline authors. A is incorrect because it requires adding a template reference to each pipeline and the template inclusion is optional; branch protection only prevents tampering with the template, not its omission. B is invalid because Azure DevOps has no global task list injection. C is invalid because a single pipeline cannot run across all repositories with custom steps.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the mandatory tasks as a YAML template in a central repository. In each pipeline, use the 'template' reference to include the mandatory steps. Use branch protection rules on the central repository to require approval for changes to the template.
Why it's wrong here
Storing mandatory tasks as a YAML template in a central repository is the correct approach because Azure Pipelines supports template expressions that let you inject a shared set of steps into every pipeline. By referencing the template from each pipeline and protecting the central repository's main branch with branch policies requiring approvals, you enforce centralized governance, maintain versioning of the template, and ensure updates are reviewed before they affect all consumers.
- ✗
Use a global list of tasks in the Azure DevOps organization settings that automatically get injected into every pipeline.
Why it's wrong here
Azure DevOps does not provide any organization-level setting or feature that automatically injects tasks into every pipeline. Pipelines must explicitly define their own steps; there is no global 'default tasks' list in organization settings, so this option is impossible and would not enforce mandatory tasks.
- ✗
Create a single pipeline that runs across all repositories and include the mandatory tasks in that pipeline.
Why it's wrong here
Creating a single pipeline to run across all repositories is not viable because each repository typically has its own source code, build triggers, and build requirements. Azure Pipelines associates a pipeline with a specific repository and cannot automatically aggregate or run a one-size-fits-all pipeline across multiple repos, and even if it could, it would lack the per-repo context needed for varied builds.
- ✓
Create a custom Azure DevOps extension that adds the mandatory tasks to all pipelines using a pre-job hook.
Why this is correct
Custom Azure DevOps extensions cannot reliably enforce mandatory tasks in all pipelines because extensions must be installed and are not automatically injected into every pipeline. There is no supported pre-job hook in the extension model that can force tasks to run; pipeline authors can simply omit or disable the extension, so it does not provide central enforcement.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Task
A Task in Azure DevOps is a predefined, reusable step that performs a specific action during a build or release pipeline, like compiling code or running tests.
Key term
GitHub
GitHub is a cloud-based platform for storing, tracking, and collaborating on code using Git version control.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.