AZ-400 Continuous Delivery 4 — Questions and Answers
Question 1: Your organization requires that only signed container images can be deployed to production AKS clusters. Which Azure service enforces this policy?
- Azure Security Center compliance policies
- Azure Policy with image integrity add-on
- Azure Container Registry content trust (Correct answer)
- Microsoft Defender for Containers
Correct answer: Azure Container Registry content trust
ACR content trust uses Docker Notary to sign images, and AKS can be configured to reject unsigned images at admission.
Question 2: A YAML pipeline stage depends on two other stages completing successfully. How should this dependency be declared?
- List both stage names under 'needs'
- List both stage names under 'dependsOn' (Correct answer)
- Use 'condition: always()' on the dependent stage
- Set 'runAfter' to both stage names
Correct answer: List both stage names under 'dependsOn'
The 'dependsOn' keyword in a stage definition accepts a list of stage names that must complete before this stage runs.
Question 3: Which feature of Azure Pipelines environments enables you to restrict which branches can deploy to a protected environment like production?
- Artifact filters
- Branch control check (Correct answer)
- Stage conditions
- Approval gates
Correct answer: Branch control check
The branch control check on an environment allows deployments only from pipelines running on specified branches (e.g., 'main').
Question 4: When using Azure Pipelines with GitHub repositories, which trigger type initiates a CD pipeline run when a pull request is merged to main?
- CI trigger on the main branch (Correct answer)
- PR trigger
- Scheduled trigger
- Resource trigger
Correct answer: CI trigger on the main branch
A CI trigger set on the 'main' branch fires when commits are pushed to main, which is the result of a merged pull request.
Question 5: A release pipeline must deploy a database schema migration before deploying the application. How should this sequencing be enforced?
- Use parallel jobs
- Place the database migration in a prior stage with 'dependsOn' on the app stage (Correct answer)
- Use a post-deployment gate on the DB stage
- Configure a scheduled trigger on the app stage
Correct answer: Place the database migration in a prior stage with 'dependsOn' on the app stage
Placing the migration in a separate earlier stage and declaring 'dependsOn' ensures the migration completes before the application stage starts.
Question 6: Which Azure DevOps concept tracks deployment records, approvals, and health checks for a group of resources such as a Kubernetes namespace?
- Release pipeline
- Environment (Correct answer)
- Service connection
- Agent pool
Correct answer: Environment
An Azure DevOps environment represents a deployment target (like a K8s namespace or VM group) and records all deployments, approvals, and checks against it.
Question 7: A team stores Terraform state in Azure Blob Storage. During CD, the pipeline must acquire a state lock to prevent concurrent deployments. What is the correct approach?
- Use a pipeline concurrency lock on the stage
- Rely on Azure Blob Storage lease-based locking built into the azurerm backend (Correct answer)
- Use a mutex variable in the pipeline
- Deploy a separate lock service on AKS
Correct answer: Rely on Azure Blob Storage lease-based locking built into the azurerm backend
The Terraform azurerm backend natively uses Azure Blob Storage leases for state locking, preventing concurrent Terraform operations.
AZ-400 Continuous Delivery 4
Your organization requires that only signed container images can be deployed to production AKS clusters.
Which Azure service enforces this policy?