AZ-400 Pipeline decorator Practice Question
Your team uses Azure Pipelines for CI/CD. You need to enforce that all builds produce a signed artifact. Which approach should you use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a Pipeline decorator to inject the signing task into every build pipeline.
Pipeline decorators allow injecting tasks (like signing) into every pipeline globally without modifying individual pipeline definitions. Option A is wrong because YAML templates require each pipeline to explicitly extend them; they do not enforce automatic inclusion. Option B is wrong because branch policies control pull request merge conditions, not build steps. Option C is wrong because manual approval gates are used in release pipelines to control promotion, not to enforce signing during build.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a YAML template that includes the signing task and require all pipelines to extend it.
Why it's wrong here
YAML templates allow reuse of task sequences, and a pipeline may explicitly reference a template that includes the signing task, but there is no built-in mechanism to force every pipeline to reference that template. Individual repositories can adopt conventions, but absent governance, any pipeline author can bypass the template and omit the signing job. This is an opt-in pattern, not an enforced injection, so it cannot guarantee that all build pipelines perform signing.
- ✗
Set a branch policy requiring a signed build status.
Why it's wrong here
A branch policy that requires a signed build status only evaluates a named status check reported by a build during pull request validation. It does not modify or extend the pipeline definition to include a signing task; the pipeline must already be configured to perform signing and publish the corresponding status. Therefore, this approach enforces a prerequisite on the PR merge, not automatic injection of the signing step into every build pipeline.
- ✗
Configure a manual approval gate on the build pipeline.
Why it's wrong here
Manual approval gates are environment-based checkpoints in multi-stage YAML pipelines or classic release pipelines, used to pause execution until human authorization is granted. They control the flow of deployment/stage promotion, but they have no capability to insert additional compilation or signing tasks into a build definition. The signing task still has to be explicitly present in the pipeline, so an approval gate cannot enforce its inclusion.
- ✓
Use a Pipeline decorator to inject the signing task into every build pipeline.
Why this is correct
Pipeline decorators are extension-based components that automatically inject a set of tasks into every pipeline (or a filtered subset) at either the start or end of a job, at the organization level. Because the decorator runs outside the individual pipeline definition, it cannot be bypassed by pipeline authors and does not require changes to existing YAML or classic builds. This provides the required guarantee that the signing task is applied to every build pipeline.
Visual reference
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Pipeline
A pipeline is an automated series of steps that takes code from development to production, ensuring quality and speed.
Key term
Azure Pipelines
Azure Pipelines is a cloud-based CI/CD service from Microsoft that automatically builds, tests, and deploys code to any platform or cloud.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.