AZ-400 Dependency Management 2 — Questions and Answers
Question 1: Your team wants to prevent developers from publishing packages with known critical CVEs to Azure Artifacts. Which feature should you enable?
- Upstream sources
- Artifact policies with vulnerability scanning (Correct answer)
- Feed permissions set to read-only
- Retention policies
Correct answer: Artifact policies with vulnerability scanning
Artifact policies with vulnerability scanning (via Microsoft Defender for DevOps or integrated tools) can block publishing of packages containing critical CVEs.
Question 2: A developer runs 'npm audit' in their pipeline and it reports high-severity vulnerabilities. Which Azure DevOps pipeline task provides built-in npm audit integration?
- WhiteSource Bolt
- npm task with 'custom' command set to 'audit' (Correct answer)
- Azure Security Center task
- Dependency Check task
Correct answer: npm task with 'custom' command set to 'audit'
The built-in npm pipeline task supports running 'npm audit' by setting the command to 'custom' and specifying 'audit' as the custom command.
Question 3: You want NuGet packages published to Azure Artifacts to be automatically deleted after 30 days unless promoted to the 'Release' view. Which feature handles this?
- Feed permissions
- Upstream source caching
- Retention policies (Correct answer)
- Package deprecation
Correct answer: Retention policies
Retention policies in Azure Artifacts automatically delete older package versions based on age or version count, with promotions to views protecting packages from deletion.
Question 4: Which Maven scopes are NOT included in the final packaged artifact by default, making them safe for test-only dependencies?
- compile and runtime
- test and provided (Correct answer)
- system and import
- compile and provided
Correct answer: test and provided
Maven 'test' scope dependencies are only on the test classpath and 'provided' scope is expected from the runtime environment, so neither is packaged in the final artifact.
Question 5: Your organization uses Azure Artifacts with upstream sources. A developer requests a package version that exists in the upstream but not locally. What happens?
- The build fails with a 404 error
- The package is fetched from upstream, cached locally, and returned (Correct answer)
- The developer must manually promote the package first
- Azure Artifacts redirects the client directly to the upstream URL
Correct answer: The package is fetched from upstream, cached locally, and returned
Azure Artifacts upstream sources fetch the requested package from the upstream source, save a cached copy in your feed, and return it to the client transparently.
Question 6: A pipeline consuming a private npm package from Azure Artifacts fails with '401 Unauthorized'. The pipeline uses a service connection. What is the most likely fix?
- Add the feed URL to .npmrc and authenticate using the pipeline's service connection credential (Correct answer)
- Switch to a personal access token in the pipeline YAML
- Make the feed public
- Install the package before the pipeline triggers
Correct answer: Add the feed URL to .npmrc and authenticate using the pipeline's service connection credential
You must configure .npmrc with the Azure Artifacts feed URL and use the npm Authenticate task to inject credentials from the service connection.
Question 7: When configuring an Azure Artifacts feed to use npmjs.com as an upstream source, what is the default behavior when a package exists in both the feed and upstream?
- The upstream version always takes precedence
- The locally stored (feed) version is returned without contacting upstream (Correct answer)
- Azure Artifacts merges both versions
- The pipeline chooses based on semver ordering
Correct answer: The locally stored (feed) version is returned without contacting upstream
Azure Artifacts always serves the locally stored copy first; the upstream is only contacted if the package or version is not yet cached in the feed.
AZ-400 Dependency Management 2
Your team wants to prevent developers from publishing packages with known critical CVEs to Azure Artifacts.
Which feature should you enable?