AZ-400 Dependency Management 4

Question 1

You want to automatically update outdated npm dependencies and open pull requests for each update. Which tool integrates natively with Azure DevOps for this?

Accepted Answer

Renovate Bot configured with an Azure DevOps provider

Answer

Renovate Bot supports Azure DevOps natively as a platform, scanning repos for outdated dependencies and automatically opening PRs with version bumps.

Question 2

Which Azure Artifacts concept allows you to mark a specific package version as the approved production version, protecting it from retention policy deletion?

Accepted Answer

Promoting to a view (e.g., @Release)

Answer

Promoting a package version to a view (such as @Prerelease or @Release) marks it as approved for that stage and protects it from automatic deletion by retention policies.

Question 3

Your pipeline publishes a Maven package to Azure Artifacts. Which authentication method does Microsoft recommend for Maven pipelines in Azure DevOps?

Accepted Answer

The MavenAuthenticate task with a service connection

Answer

The MavenAuthenticate pipeline task injects credentials from a service connection into Maven's settings.xml at runtime, which is Microsoft's recommended approach.

Question 4

A vulnerability is found in a transitive dependency (a dependency of a dependency). Which approach is best for mitigating it in an npm project without waiting for the direct dependency to update?

Accepted Answer

Use the 'overrides' field in package.json to force a specific version of the transitive dependency

Answer

The 'overrides' field in package.json (npm v8.3+) forces a specific version of a transitive dependency across the entire dependency tree, patching the vulnerability immediately.

Question 5

In Azure Artifacts, what is the purpose of a 'project-scoped' feed versus an 'organization-scoped' feed?

Accepted Answer

Project-scoped feeds are visible only within the project; organization-scoped feeds are accessible to all projects in the organization

Answer

Project-scoped feeds are associated with a specific Azure DevOps project and inherit its permissions, while organization-scoped feeds are accessible to all projects in the organization.

AZ-400 Practice Test

AZ-400 Practice Test

AZ-400 Dependency Management 4