AZ-400 Practice Question: Design and implement build and release pipelines
Your team is using GitHub Actions for CI/CD. The workflow builds a container image and pushes it to Azure Container Registry (ACR). However, the workflow fails with an authentication error when pushing to ACR. What is the most likely cause?
⚠ Common exam trap
Many exam-takers assume Docker authentication is handled automatically by the Docker client or that ACR allows anonymous pushes, when in fact Azure requires explicit Azure AD authentication via the 'azure/login' action before any registry write operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The workflow does not include an 'azure/login' step to authenticate with Azure.
GitHub Actions workflows that push container images to Azure Container Registry (ACR) must first authenticate with Azure. Without an 'azure/login' step (using Azure CLI or Azure PowerShell actions), the workflow lacks the necessary OAuth2 tokens or service principal credentials to authorize the 'docker push' command against the ACR endpoint. The authentication error occurs because the Docker client cannot obtain a valid ACR access token without prior Azure authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The repository name in the workflow is incorrect.
Why it's wrong here
An incorrect repository name would make the push target a nonexistent ACR repository, producing an error such as 'repository not found' or a manifest invalid response. This is distinct from the authentication failure the workflow is experiencing, because Azure login and credentials would still succeed; only the final push destination would be invalid.
- ✗
The Dockerfile is missing a required LABEL instruction.
Why it's wrong here
Dockerfile LABEL instructions are optional metadata and are not required by Azure Container Registry for image push operations. The push process only requires a successfully built image and valid registry credentials, so omitting a LABEL cannot cause the workflow to fail at the authentication or push step.
- ✗
The ACR allows anonymous pull access.
Why it's wrong here
Enabling anonymous pull on an ACR allows unauthenticated clients to pull images, but it has no effect on push operations, which always require authentication and an RBAC role like AcrPush. Since the failure is in pushing, anonymous pull settings would not resolve or cause the missing-credential error.
- ✓
The workflow does not include an 'azure/login' step to authenticate with Azure.
Why this is correct
The azure/login action establishes Azure credentials for the job, and a subsequent docker login step (or azure/docker-login) uses those credentials to authenticate with the ACR. Without the azure/login step, the workflow has no authenticated context for Azure, so the Docker push receives an unauthorized or authentication-required response, exactly matching the reported failure.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
GitHub
GitHub is a cloud-based platform for storing, tracking, and collaborating on code using Git version control.
Key term
Service principal
A service principal is an identity created for an application or automated tool to access cloud resources securely without using a human user account.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.