AZ-400 Practice Question: Design and implement build and release pipelines
You have a multi-stage YAML pipeline that deploys to Azure App Service. The deployment to the production stage should only proceed if a manual approval is granted. How should you configure this?
⚠ Common exam trap
Many candidates confuse deployment gates (automated health checks) with manual approvals, or mistakenly think branch policies or pipeline decorators can enforce stage-level sign-off, when only environment-level approval checks provide the required manual approval workflow.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add an approval check on the production environment
Azure Pipelines supports approval checks on environments, which allow you to require manual approval before a deployment proceeds to a specific stage. By adding an approval check on the production environment, the pipeline will pause at that stage until an authorized user grants approval, meeting the requirement for manual sign-off before production deployment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use deployment gates with Azure Monitor metrics
Why it's wrong here
Deployment gates with Azure Monitor metrics are automated checks that evaluate health signals, such as metric thresholds or query results, before or after a deployment stage. They are not designed for manual sign-off; they run without human intervention, so they cannot satisfy a requirement for explicit human approval.
- ✗
Configure branch policies on the main branch
Why it's wrong here
Branch policies on the main branch govern source control operations like pull request reviews and merge validation, not deployment-time approvals. They operate at the repository level and do not intercept or block the execution of pipeline stages or environments, so they are ineffective for enforcing a production deployment sign-off.
- ✗
Add a pipeline decorator to require sign-off
Why it's wrong here
Pipeline decorators automatically inject additional steps into pipeline definitions, but they cannot prompt for interactive user approval or block a stage pending human authorization. Decorators are for adding tasks or logging logic, not for creating environment-level approval checkpoints that require a user to explicitly approve or reject a deployment.
- ✓
Add an approval check on the production environment
Why this is correct
Adding an approval check on the production environment in Azure Pipelines creates a manual gate that halts the deployment before it runs, requiring an authorized user to explicitly approve or reject the release. This is the proper native mechanism for enforcing human sign-off on a production deployment in a multi-stage YAML pipeline.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Check
A Check in Azure DevOps is a gating mechanism that evaluates predefined conditions before allowing a pipeline deployment to proceed to a specific environment.
Key term
Pipeline
A pipeline is an automated series of steps that takes code from development to production, ensuring quality and speed.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.