AZ-400 Dependency Management 3 — Questions and Answers
Question 1: You need to share a common library across multiple Azure DevOps projects without duplicating source code. What is the recommended Azure Artifacts approach?
- Copy the source into each project's repo
- Publish the library as a versioned package to a shared Azure Artifacts feed (Correct answer)
- Use a Git submodule pointing to the library repo
- Store the DLL in Azure Blob Storage and download it in each pipeline
Correct answer: Publish the library as a versioned package to a shared Azure Artifacts feed
Publishing the library as a versioned package to a shared Azure Artifacts feed is the recommended approach for reuse, versioning, and dependency management across projects.
Question 2: Which pip command generates a requirements.txt file that pins every installed package to its exact current version?
- pip install --freeze
- pip freeze > requirements.txt (Correct answer)
- pip export > requirements.txt
- pip list --pinned > requirements.txt
Correct answer: pip freeze > requirements.txt
'pip freeze' outputs all installed packages and their exact versions in requirements.txt format, enabling reproducible installs.
Question 3: Your team wants to enforce that all NuGet packages used in a solution come from the corporate Azure Artifacts feed only, blocking direct access to nuget.org. How do you enforce this?
- Remove nuget.org from developer machines' NuGet.Config
- Configure the feed with upstream sources disabled and distribute a NuGet.Config that points only to the corporate feed (Correct answer)
- Set a pipeline variable NUGET_PACKAGES to the corporate feed URL
- Use a conditional step in the pipeline to fail if nuget.org is referenced
Correct answer: Configure the feed with upstream sources disabled and distribute a NuGet.Config that points only to the corporate feed
Distributing a NuGet.Config that lists only the corporate feed and disabling upstream sources ensures all package resolution goes through the controlled feed.
Question 4: In Gradle, which configuration is used for dependencies required only at compile time and NOT needed at runtime?
- runtimeOnly
- compileOnly (Correct answer)
- implementation
- testImplementation
Correct answer: compileOnly
'compileOnly' in Gradle marks dependencies that are needed to compile the code but should not be included in the runtime classpath or packaged artifact.
Question 5: Your organization wants to track open-source license compliance for all NuGet packages. Which Azure DevOps marketplace extension is most commonly used for this?
- OWASP Dependency-Check
- WhiteSource (Mend) Bolt (Correct answer)
- SonarQube
- Black Duck
Correct answer: WhiteSource (Mend) Bolt
WhiteSource Bolt (now Mend Bolt) is a free Azure DevOps extension that scans NuGet, npm, and other packages for open-source license compliance and vulnerabilities.
Question 6: When using semantic versioning in Azure Artifacts, what does a version change from 2.3.1 to 2.4.0 indicate?
- A breaking API change was introduced
- A backward-compatible new feature was added (Correct answer)
- Only a bug fix was applied
- The package was recompiled with a newer SDK
Correct answer: A backward-compatible new feature was added
In semantic versioning (MAJOR.MINOR.PATCH), incrementing the MINOR version (2.3.x → 2.4.0) indicates new backward-compatible functionality was added.
Question 7: A pipeline uses 'dotnet restore' but packages are repeatedly downloaded from the internet on every run despite no changes. How do you add caching to fix this?
- Use the 'Cache' pipeline task with the NuGet packages directory and a key based on the packages.lock.json hash (Correct answer)
- Set NUGET_PACKAGES environment variable to a persistent path
- Add a 'Download' task before dotnet restore
- Configure Azure Artifacts retention policy to 365 days
Correct answer: Use the 'Cache' pipeline task with the NuGet packages directory and a key based on the packages.lock.json hash
The Cache pipeline task stores and restores the NuGet packages directory using a cache key derived from the lock file hash, skipping downloads when dependencies haven't changed.
AZ-400 Dependency Management 3
You need to share a common library across multiple Azure DevOps projects without duplicating source code.
What is the recommended Azure Artifacts approach?