AZ-400 Practice Question: Design and implement build and release pipelines
Your team uses GitHub Actions to deploy a microservices application to a Kubernetes cluster. The workflow builds Docker images and pushes them to a container registry, then updates the Kubernetes deployment. The deployment often fails due to image pull errors, specifically 'ErrImagePull' and 'ImagePullBackOff'. You investigate and find that the image tag in the Kubernetes manifest is the commit SHA. The workflow uses the 'azure/k8s-deploy@v1' action. You suspect that the image is not being pulled because the registry credentials are not properly configured. You have stored the registry credentials as secrets. What is the most likely cause and solution?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The action does not automatically create imagePullSecrets; you need to add a step to create the secret in the cluster and reference it in the deployment.
The 'azure/k8s-deploy@v1' action deploys to Kubernetes but does not automatically create imagePullSecrets for private container registries. Even if the registry credentials are stored as secrets in GitHub, they are not automatically applied to the cluster. You must explicitly create a Kubernetes secret of type docker-registry and add an imagePullSecrets entry to the deployment manifest. Option A is wrong because using 'latest' tag is not a best practice and does not address authentication. Option B is wrong because the image name is likely correct; the issue is pulling due to lack of credentials. Option C is wrong because the action does support private registries when credentials are properly configured.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The commit SHA tag is not valid; use 'latest' tag instead.
Why it's wrong here
A Git commit SHA is a valid, immutable image tag that uniquely identifies a build; 'latest' is mutable and not required. The authentication error occurs because the private registry requires credentials, not because the tag format is invalid. The error message would be an authentication failure, not a tag-not-found error.
- ✗
The image name is incorrect; verify the registry URL.
Why it's wrong here
If the image name or registry URL were incorrect, the client would fail during the resolution phase with a 'not found' style error. The observed error is an authentication error during the pull phase, indicating the image exists but the cluster lacks credentials to access the private registry. Therefore, the problem is not the image name but the missing imagePullSecret.
- ✗
The 'azure/k8s-deploy' action does not support private registries; use a different action.
Why it's wrong here
The 'azure/k8s-deploy' action does support private registry images as long as the cluster has the required imagePullSecret; it simply does not generate that secret automatically. The action applies manifests but cannot configure Kubernetes authentication for a private registry. The correct fix is to create and reference the secret, not to swap actions.
- ✓
The action does not automatically create imagePullSecrets; you need to add a step to create the secret in the cluster and reference it in the deployment.
Why this is correct
The 'azure/k8s-deploy' action only applies Kubernetes manifests, treating them as static YAML; it does not create or inject imagePullSecrets into the cluster. When pulling images from a private registry like ACR, Kubernetes requires a docker-registry secret (type kubernetes.io/dockerconfigjson) containing credentials, and your deployment spec must explicitly reference that secret under `imagePullSecrets`. Because the action simply runs `kubectl apply`, it cannot authenticate the kubelet on the cluster's behalf, so you must add a prior step to create the secret (e.g., using `kubectl create secret docker-registry`) and ensure it is referenced in the deployment manifest.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
find
The find command in Unix/Linux is a powerful utility for searching files and directories based on a wide range of criteria such as name, size, type, permissions, and modification time.
Key term
GitHub
GitHub is a cloud-based platform for storing, tracking, and collaborating on code using Git version control.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.