AZ-400 Dependency Management 4 — Questions and Answers
Question 1: You want to automatically update outdated npm dependencies and open pull requests for each update. Which tool integrates natively with Azure DevOps for this?
- Dependabot (via GitHub integration)
- npm-check-updates run as a pipeline cron job
- Renovate Bot configured with an Azure DevOps provider (Correct answer)
- WhiteSource auto-remediation
Correct answer: Renovate Bot configured with an Azure DevOps provider
Renovate Bot supports Azure DevOps natively as a platform, scanning repos for outdated dependencies and automatically opening PRs with version bumps.
Question 2: Which Azure Artifacts concept allows you to mark a specific package version as the approved production version, protecting it from retention policy deletion?
- Pinning
- Promoting to a view (e.g., @Release) (Correct answer)
- Tagging the package
- Setting the version as 'stable' in the feed settings
Correct answer: Promoting to a view (e.g., @Release)
Promoting a package version to a view (such as @Prerelease or @Release) marks it as approved for that stage and protects it from automatic deletion by retention policies.
Question 3: Your pipeline publishes a Maven package to Azure Artifacts. Which authentication method does Microsoft recommend for Maven pipelines in Azure DevOps?
- Hardcoding credentials in pom.xml
- Using a PAT stored in a pipeline secret variable referenced in settings.xml
- The MavenAuthenticate task with a service connection (Correct answer)
- OAuth2 device flow interactively during the pipeline run
Correct answer: The MavenAuthenticate task with a service connection
The MavenAuthenticate pipeline task injects credentials from a service connection into Maven's settings.xml at runtime, which is Microsoft's recommended approach.
Question 4: A vulnerability is found in a transitive dependency (a dependency of a dependency). Which approach is best for mitigating it in an npm project without waiting for the direct dependency to update?
- Update the direct dependency and hope it resolves the transitive one
- Remove the direct dependency entirely
- Use the 'overrides' field in package.json to force a specific version of the transitive dependency (Correct answer)
- Pin the vulnerable transitive package in .npmrc
Correct answer: Use the 'overrides' field in package.json to force a specific version of the transitive dependency
The 'overrides' field in package.json (npm v8.3+) forces a specific version of a transitive dependency across the entire dependency tree, patching the vulnerability immediately.
Question 5: In Azure Artifacts, what is the purpose of a 'project-scoped' feed versus an 'organization-scoped' feed?
- Project-scoped feeds are faster; organization-scoped feeds have more storage
- Project-scoped feeds are visible only within the project; organization-scoped feeds are accessible to all projects in the organization (Correct answer)
- Organization-scoped feeds support more package types
- Project-scoped feeds cannot have upstream sources
Correct answer: Project-scoped feeds are visible only within the project; organization-scoped feeds are accessible to all projects in the organization
Project-scoped feeds are associated with a specific Azure DevOps project and inherit its permissions, while organization-scoped feeds are accessible to all projects in the organization.
Question 6: You need to publish a pre-release NuGet package from a feature branch pipeline. Which versioning suffix convention indicates a pre-release package per SemVer?
- 2.0.0.beta
- 2.0.0-beta.1 (Correct answer)
- 2.0.0_RC1
- 2.0.0+beta
Correct answer: 2.0.0-beta.1
SemVer pre-release versions use a hyphen suffix (e.g., 2.0.0-beta.1), which NuGet and Azure Artifacts recognize as a pre-release version lower in precedence than 2.0.0.
Question 7: When configuring Dependabot for an Azure DevOps repository, where must the dependabot.yml configuration file be placed?
- /dependabot.yml at the repo root
- /.azure/dependabot.yml
- /.github/dependabot.yml (Correct answer)
- /pipelines/dependabot.yml
Correct answer: /.github/dependabot.yml
Even when using Dependabot with Azure DevOps (via a compatibility layer or GitHub Actions bridge), the configuration file must be placed at /.github/dependabot.yml.
AZ-400 Dependency Management 4
You want to automatically update outdated npm dependencies and open pull requests for each update.
Which tool integrates natively with Azure DevOps for this?