AZ-400 Continuous Integration 5 — Questions and Answers
Question 1: Which tool integrated with Azure Pipelines performs static application security testing (SAST) by scanning source code for vulnerabilities?
- Azure Load Testing
- Microsoft Security DevOps (MSDO) / Defender for DevOps (Correct answer)
- Azure Monitor
- Azure Policy
Correct answer: Microsoft Security DevOps (MSDO) / Defender for DevOps
Microsoft Security DevOps (part of Defender for DevOps) runs SAST tools like Bandit, ESLint, and Credential Scanner within Azure Pipelines to surface code-level security issues.
Question 2: What is the effect of enabling 'batch' mode on an Azure Pipelines CI trigger?
- Runs multiple pipeline instances simultaneously for the same branch
- Waits for the current run to finish before starting a new run with all accumulated commits (Correct answer)
- Splits commits into batches and runs a separate pipeline for each batch
- Groups multiple branches into a single pipeline run
Correct answer: Waits for the current run to finish before starting a new run with all accumulated commits
With batch: true, if a run is in progress when new commits arrive, the pipeline queues one more run that includes all commits pushed since the current run started, rather than queuing one per commit.
Question 3: A .NET project uses a private NuGet feed hosted in Azure Artifacts. What task should be added to a CI pipeline to authenticate before restoring packages?
- NuGetCommand with 'push' command
- NuGetAuthenticate (Correct answer)
- DownloadSecureFile
- UseDotNet
Correct answer: NuGetAuthenticate
The NuGetAuthenticate task configures NuGet credential providers so that subsequent restore commands can access private Azure Artifacts feeds without manual credential setup.
Question 4: In Azure Pipelines YAML, what is the purpose of the 'resources.pipelines' block?
- Defines the agent resources available for pipeline execution
- Declares another pipeline whose artifacts or triggers this pipeline can consume (Correct answer)
- Lists the Azure resources provisioned for deployment
- Configures resource locks on Azure subscriptions
Correct answer: Declares another pipeline whose artifacts or triggers this pipeline can consume
The resources.pipelines block lets a pipeline reference artifacts from—and optionally trigger on completions of—another Azure Pipeline.
Question 5: What does 'flaky test' mean, and how should a CI pipeline handle it?
- A test that consistently fails due to a code bug; it should block the build
- A test that passes and fails non-deterministically; it should be quarantined and tracked separately (Correct answer)
- A test that runs too slowly and should be removed from the pipeline
- A test written in a deprecated framework that needs migration
Correct answer: A test that passes and fails non-deterministically; it should be quarantined and tracked separately
Flaky tests produce inconsistent results across identical runs due to timing, environment, or external dependencies, and should be quarantined to prevent false CI failures while being investigated.
Question 6: Which Azure Pipelines concept lets you define a reusable set of steps with input parameters, similar to a function in code?
- Job matrices
- Step templates with parameters (Correct answer)
- Variable groups
- Pipeline environments
Correct answer: Step templates with parameters
Step templates accept parameters and can be included in multiple pipelines, allowing teams to standardize common step sequences (like build-test-publish) with customizable inputs.
Question 7: A team wants the CI pipeline to fail fast if any linting errors are found, before running longer-running tests. How should the pipeline be structured?
- Run all steps in a single job sequentially with linting last
- Place linting in an earlier stage that the test stage depends on (Correct answer)
- Run linting and tests in parallel jobs within the same stage
- Use a post-build script to check lint results after tests complete
Correct answer: Place linting in an earlier stage that the test stage depends on
Placing linting in a separate earlier stage with the test stage listing it in dependsOn ensures tests only start if linting passes, saving compute time on failed linting.
AZ-400 Continuous Integration 5
Which tool integrated with Azure Pipelines performs static application security testing (SAST) by scanning source code for vulnerabilities?