AZ-400 Practice Question: Design and implement build and release pipelines
Your release pipeline uses a 'Run Azure CLI' task to execute a script. The script authenticates using a service principal. However, the deployment fails with 'insufficient privileges to complete the operation'. What is the most likely cause?
⚠ Common exam trap
It's easy for candidates to confuse authentication failures (invalid credentials, expired secrets) with authorization failures (insufficient RBAC permissions), leading them to incorrectly select options related to credential issues when the error message explicitly states 'insufficient privileges'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The service principal lacks the necessary RBAC role on the target resource.
The error 'insufficient privileges to complete the operation' indicates that the service principal successfully authenticated but lacks the required Azure RBAC role on the target resource. Even with a valid secret and a logged-in Azure CLI session, the service principal must have an assigned role (e.g., Contributor, Owner, or a custom role) that grants the specific permissions needed for the deployment operation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Azure CLI task is not logged in.
Why it's wrong here
The Azure CLI task in Azure DevOps automatically authenticates using the service principal or managed identity configured for the task, so a lack of an explicit login is not the cause. The error is an authorization failure (e.g., 403 Forbidden), not an authentication failure (e.g., 401 Unauthorized), indicating the identity was recognized but denied access.
- ✗
The service principal secret has expired.
Why it's wrong here
An expired service principal secret would cause an authentication failure when the Azure CLI task tries to obtain a token, resulting in errors like 'AADSTS7000222' or 'Invalid client secret'. Since the error is an authorization error (the identity was authenticated but not permitted), the secret's validity is not the issue.
- ✓
The service principal lacks the necessary RBAC role on the target resource.
Why this is correct
The service principal is authenticated but does not have the required Azure RBAC role (e.g., Contributor, Reader, or a custom role) on the target resource or resource group. Azure CLI commands that attempt to perform an action without the necessary role assignment will return an authorization error, so assigning the appropriate RBAC role resolves the issue.
- ✗
The service principal does not have a secret.
Why it's wrong here
A service principal without a secret would prevent the Azure CLI task from authenticating at all, leading to a credential or 'interactive browser' error, not an authorization error. The presence of a secret is required for the task to get a token, but the error message indicates the token was obtained yet lacked permissions on the resource.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Pipeline
A pipeline is an automated series of steps that takes code from development to production, ensuring quality and speed.
Key term
Service principal
A service principal is an identity created for an application or automated tool to access cloud resources securely without using a human user account.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.