AZ-400 Practice Question: Design and implement build and release pipelines
Your build pipeline runs on a self-hosted agent pool. You need to ensure that only authorized pipelines can use these agents. Which security measure should you implement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set permissions on the agent pool
Agent pool permissions allow restricting which pipelines can use the agents, ensuring only authorized pipelines can access the self-hosted agents. Option B (agent tokens) is for registering agents, not for authorizing pipelines. Option C (variable groups) is for storing variables and secrets, not for agent access control. Option D (agent queues) is a legacy concept that does not provide granular pipeline-level permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set permissions on the agent pool
Why this is correct
Set permissions on the agent pool to control which pipelines can queue jobs on that pool. In Azure Pipelines, agent pool security roles (Reader, User, Administrator) govern authorization at the pool level, so you can restrict a pipeline or project from using specific self-hosted agents by modifying these permissions.
- ✗
Use agent tokens
Why it's wrong here
Agent tokens (such as PATs or registration tokens) are used only to authenticate and register a self-hosted agent with Azure DevOps; they do not authorize pipelines to use the pool. Even if a pipeline references a token, it does not grant or deny pipeline-level access, which is determined by pool permissions, not token possession.
- ✗
Use variable groups
Why it's wrong here
Variable groups are library resources that store variables and secrets for reuse across pipelines; they are not involved in agent or pool authorization. Linking a variable group to a pipeline only controls access to those variables, never whether the pipeline can run on a particular agent pool.
- ✗
Configure agent queues
Why it's wrong here
Agent queues are a deprecated legacy concept in Azure Pipelines, superseded by agent pools. Configuring queues only manages queuing behavior and does not enforce any security restrictions on which pipelines can execute on the underlying agents, so it cannot limit pipeline access.
Go deeper
Related to this question
Learn chapter
Source Control Strategy Design
Key term
Agent
An agent is a software component that runs on a local machine to perform automated tasks, collect data, or execute commands as part of a larger system like CI/CD or monitoring.
Key term
Variables
A variable is a named storage location in a computer program that holds a value which can change during execution.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.