AZ-400 Practice Question: Design and implement build and release pipelines
You have a multi-stage YAML pipeline that builds and deploys a containerized application to Azure Kubernetes Service (AKS). The build stage runs successfully, but the deploy stage fails with an error: 'Error: failed to get credentials: context deadline exceeded'. You verify that the AKS cluster is running and that the service connection is valid. What is the most likely cause?
⚠ Common exam trap
Watch out — candidates often confuse network-level connectivity errors (timeout) with authentication or authorization errors, leading them to incorrectly select options about expired service connections or RBAC permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The build agent's IP address is not allowed by the AKS cluster's network policies.
The error 'context deadline exceeded' when running `az aks get-credentials` indicates a network timeout, not an authentication or permission failure. Since the AKS cluster is running and the service connection is valid, the most likely cause is that the build agent's IP address is blocked by AKS network policies (e.g., authorized IP ranges or a firewall), preventing the agent from reaching the cluster's API server within the default timeout.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Azure service connection has expired.
Why it's wrong here
An expired Azure service connection would cause authentication failures when the pipeline tries to connect to Azure resources, often resulting in an error like 'Access denied' or '401 Unauthorized', not a network timeout to the AKS API server. Since the scenario explicitly states the service connection is valid, this is ruled out.
- ✗
The service principal used by the pipeline does not have RBAC permissions on the cluster.
Why it's wrong here
Missing RBAC permissions on the cluster would cause authorization errors (HTTP 403 Forbidden) when the pipeline attempts to perform actions like deploying resources or reading cluster state. A timeout indicates the request never reached the API server or no response was received, which points to network-level blocking rather than permission issues.
- ✗
The container registry is not accessible from the build agent.
Why it's wrong here
The container registry is used for storing and pulling container images, and if it were inaccessible from the build agent, the pipeline would fail during image push/pull steps with registry-specific errors (e.g., 'unauthorized' or 'connection refused'). In contrast, the described timeout occurs at the stage of connecting to the AKS API server, which is independent of container registry connectivity.
- ✓
The build agent's IP address is not allowed by the AKS cluster's network policies.
Why this is correct
If the build agent's public IP address is not included in the AKS cluster's authorized IP ranges (a feature of the API server access profile), the API server will silently drop packets, causing the pipeline to hang until the connection times out. This matches the symptom precisely, making it the correct cause among the given options.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
YAML pipeline
A YAML pipeline is a text-based file written in YAML format that defines an automated series of steps for building, testing, and deploying software in a continuous integration and continuous delivery (CI/CD) system.
Key term
Stage
A stage is a discrete phase in a software development or deployment pipeline where code is built, tested, integrated, or released in a controlled environment.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.