AZ-400 Practice Question: Design and implement build and release pipelines
Your team is using Azure Pipelines to deploy a web application to Azure App Service. The application uses a configuration file (appsettings.json) that contains environment-specific settings. You need to manage these settings across development, staging, and production environments without exposing secrets in the source code. The pipeline should automatically replace the settings during deployment. What should you configure?
⚠ Common exam trap
AZ-400 often tests the confusion between build-time and release-time configuration, and candidates may choose options that involve code changes or are specific to older technologies like Web.config.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the 'File Transform' task in the release pipeline to replace tokens in the configuration file with variables defined in pipeline variable groups.
The File Transform task in Azure Pipelines can perform token replacement in configuration files like appsettings.json using variables defined in pipeline variable groups. This allows environment-specific settings to be injected during deployment without hardcoding secrets in source control. Variable groups can be linked to Azure Key Vault for secure secret management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use the 'File Transform' task in the release pipeline to replace tokens in the configuration file with variables defined in pipeline variable groups.
Why this is correct
The File Transform task is the correct choice because it directly performs token replacement in configuration files like appsettings.json, using variable values from pipeline variable groups. It supports both standard and secret variables, so connection strings and API keys can be injected at release time without exposing them in the repository.
- ✗
Create separate build configurations for each environment and use the 'Transform Web.config' task.
Why it's wrong here
The Transform Web.config task is specifically designed for .NET Framework web.config files, not for appsettings.json used by .NET Core/ASP.NET Core applications. Additionally, creating separate build configurations per environment is a compile-time strategy that mixes build and release concerns, whereas runtime configuration should be handled during deployment.
- ✗
Use the 'Azure App Service Deploy' task with the 'Use Web Deploy' option and configure parameterization.
Why it's wrong here
The Azure App Service Deploy task's 'Use Web Deploy' option and parameterization feature rely on Web Deploy's parameters.xml and are intended for web.config or other deploy-time parameters of .NET applications; it does not provide a generic mechanism to transform JSON files like appsettings.json. This task focuses on deployment, not on post-build configuration file tokenization.
- ✗
Set environment variables in the Azure App Service and read them in the application code.
Why it's wrong here
Setting environment variables in the Azure App Service and reading them in code is a valid deployment configuration approach, but it requires modifying the application code to read those variables, which changes the solution design. The question specifically asks about transforming the configuration file within the pipeline, so this option does not meet the requirement of file transformation.
Go deeper
Related to this question
Learn chapter
Source Control Strategy Design
Key term
Azure Key Vault
Azure Key Vault is a cloud service for securely storing and managing sensitive information like passwords, encryption keys, and certificates.
Key term
Task
A Task in Azure DevOps is a predefined, reusable step that performs a specific action during a build or release pipeline, like compiling code or running tests.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 696 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.