AZ-400 Practice Question: Design and implement build and release pipelines
Your team uses Azure Pipelines to deploy a Docker container to Azure Kubernetes Service (AKS). The pipeline builds a Docker image, pushes it to Azure Container Registry (ACR), and then runs a deployment to AKS. You want to ensure that the deployment uses the exact image that was built in the same pipeline run. Which approach should you use?
⚠ Common exam trap
Candidates often choose the 'latest' tag (Option D) because it seems simpler, but they overlook that 'latest' is mutable and can cause deployment of a different image than the one built in the same pipeline run.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Generate a unique tag (e.g., Build.BuildId) and pass it to both the Docker build and Kubernetes manifest via variable substitution.
Using a unique tag like Build.BuildId ensures that the exact image built in the pipeline is referenced in the Kubernetes manifest. This prevents deployment from accidentally using a stale or overwritten image, as the tag is unique per run and passed consistently via variable substitution from the Docker build to the deployment YAML.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use two separate pipelines: one for build/push, one for deploy, and share the image tag via a variable group.
Why it's wrong here
Splitting build and deploy into separate pipelines breaks the atomicity of a release; the deploy pipeline may consume an image tag from a variable group that points to a different or older build than the one just produced, so there's no guarantee the tested artifact is exactly the one deployed. A single pipeline or a pipeline with pipeline resources ensures the exact image reference is passed directly from build to deployment.
- ✗
Use a single task for build and push, and rely on ACR's internal pull-through cache.
Why it's wrong here
While ACR's cache can reduce pull time, it is a content-based cache that stores layers by digest, not by tag; it does not ensure that the tag used in your Kubernetes manifest points to the freshly built image, and it can serve a stale or different image if the tag is reused. The cache only helps transfer efficiency, not reference integrity.
- ✓
Generate a unique tag (e.g., Build.BuildId) and pass it to both the Docker build and Kubernetes manifest via variable substitution.
Why this is correct
Using Build.BuildId (or another unique identifier) as the image tag makes each build's image reference immutable and traceable, and when you inject that same tag into the Kubernetes manifest during variable substitution, the deployment is guaranteed to pull the exact artifact produced by the current pipeline run. This eliminates tag-mutation races and provides clear auditability.
- ✗
Tag the image as 'latest' and reference it in the Kubernetes manifest.
Why it's wrong here
The 'latest' tag is mutable and can be overwritten by any subsequent build, so a Kubernetes manifest referencing 'latest' may pull a different image than the one built and tested in the current pipeline, breaking reproducibility and making rollbacks unreliable. Using a fixed, unique tag is required to ensure the deployed image exactly matches the verified build.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Azure Pipelines
Azure Pipelines is a cloud-based CI/CD service from Microsoft that automatically builds, tests, and deploys code to any platform or cloud.
Key term
Anthos
Anthos is a Google Cloud platform that lets you run applications consistently across different computing environments, like on-premises data centers and multiple public clouds.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.