AZ-400 Practice Question: Design and implement build and release pipelines
You have a pipeline that builds a Docker image and pushes it to Azure Container Registry. You need to ensure that only the latest successful build image is tagged as 'latest'. Which tagging strategy should you use?
⚠ Common exam trap
A common mix-up: candidates assume any tagging strategy that includes 'latest' is sufficient, overlooking the critical requirement that the tag must only be applied to successful builds, which is enforced by a conditional step.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a conditional step that runs only when the build succeeds to tag the image as 'latest'
It ensures the 'latest' tag is applied only after a successful build, preventing broken or incomplete images from being tagged as 'latest'. In Azure Pipelines, you can use a condition like `condition: succeeded()` on a script or Docker task that runs `docker tag` and `docker push` to update the 'latest' tag only when the preceding build steps succeed. This maintains a reliable 'latest' pointer to the most recent stable image.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use a conditional step that runs only when the build succeeds to tag the image as 'latest'
Why this is correct
This approach guarantees that the 'latest' tag is only moved after a fully successful build, using a condition such as `condition: succeeded()` to run a docker tag/push step. It ensures the image referenced by 'latest' is always a known-good artifact, avoiding the risk of tagging broken builds.
- ✗
Use the build ID as the tag and manually update 'latest'
Why it's wrong here
Using the build ID as the tag provides unique versioning, but manually updating the 'latest' tag is error-prone and relies on human intervention. This can lead to inconsistencies, missed updates, and accidental promotion of unverified builds, undermining the reliability of the 'latest' reference.
- ✗
Use the Git commit hash as the tag and push 'latest' separately
Why it's wrong here
While a Git commit hash provides traceability, pushing 'latest' in a separate step does not guarantee that the image originated from a successful build. The 'latest' tag could be pushed from a failed or intermediate pipeline, breaking the contract that 'latest' always points to a verified artifact.
- ✗
Always tag the image as 'latest' regardless of build status
Why it's wrong here
Unconditionally tagging every build as 'latest' means that a failed or incomplete build could overwrite the stable latest image. This violates the principle of promoting only validated artifacts, potentially shipping broken or untested code to consumers relying on the 'latest' tag.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Task
A Task in Azure DevOps is a predefined, reusable step that performs a specific action during a build or release pipeline, like compiling code or running tests.
Key term
Azure Pipelines
Azure Pipelines is a cloud-based CI/CD service from Microsoft that automatically builds, tests, and deploys code to any platform or cloud.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.