AZ-400 Dependency Management 5 — Questions and Answers
Question 1: Your build pipeline restores NuGet packages but you want to ensure the resolved versions exactly match the checked-in packages.lock.json. Which dotnet CLI flag enforces this?
- --no-dependencies
- --locked-mode (Correct answer)
- --force-evaluate
- --use-lock-file
Correct answer: --locked-mode
'dotnet restore --locked-mode' fails the restore if the lock file is out of date or if the resolved packages don't match the lock file, ensuring reproducible builds.
Question 2: A package published to Azure Artifacts is found to be malicious. What is the fastest way to prevent it from being installed by any team member?
- Delete the feed and recreate it
- Unlist the package version
- Delete the specific package version from the feed (Correct answer)
- Set the feed to read-only
Correct answer: Delete the specific package version from the feed
Deleting the specific package version from the Azure Artifacts feed immediately prevents any new installs of that version while leaving all other packages unaffected.
Question 3: Which Go module command downloads all dependencies listed in go.mod and updates go.sum with their cryptographic hashes?
- go get ./...
- go mod download (Correct answer)
- go mod tidy
- go mod vendor
Correct answer: go mod download
'go mod download' downloads all modules in go.mod to the local cache and verifies/updates go.sum with their expected cryptographic checksums.
Question 4: Your organization wants to use Azure Artifacts as a universal package registry for binaries that are not language-specific (e.g., compiled CLI tools). Which package type should you use?
- NuGet
- npm
- Universal Packages (Correct answer)
- Maven
Correct answer: Universal Packages
Azure Artifacts Universal Packages support any file type and size, making them ideal for distributing compiled binaries, scripts, or other non-language-specific artifacts.
Question 5: A security policy requires that all packages in Azure Artifacts feeds must originate from approved upstream sources only. Which setting enforces this at the feed level?
- Disable anonymous access to the feed
- Set 'upstream sources' to include only approved registries and block direct publish from unapproved sources (Correct answer)
- Enable feed-level two-factor authentication
- Set retention policy to 1 day for unverified packages
Correct answer: Set 'upstream sources' to include only approved registries and block direct publish from unapproved sources
Configuring upstream sources to include only approved registries and restricting direct publish permissions ensures all packages flow through vetted sources.
Question 6: In an Azure DevOps pipeline, you want to fail the build if any direct NuGet dependency has a known HIGH or CRITICAL vulnerability. Which integration achieves this most directly?
- Azure Policy assigned to the subscription
- OWASP Dependency-Check task with a CVSS threshold configured to fail on HIGH/CRITICAL (Correct answer)
- Azure Defender for servers enabled on the build agent
- NuGet audit with '--audit-level high' flag in the restore command
Correct answer: OWASP Dependency-Check task with a CVSS threshold configured to fail on HIGH/CRITICAL
The OWASP Dependency-Check Azure DevOps task scans NuGet packages and can be configured with a CVSS score threshold to fail the pipeline when HIGH or CRITICAL vulnerabilities are found.
Question 7: Your team uses Azure Artifacts with multiple feeds across different projects. To reduce duplication, you want packages from Feed A to be available in Feed B without republishing. What should you configure?
- Mirror Feed A to Feed B using a nightly pipeline
- Add Feed A as an upstream source in Feed B (Correct answer)
- Use a shared NuGet.Config pointing to both feeds in sequence
- Merge both feeds into a single organization-scoped feed
Correct answer: Add Feed A as an upstream source in Feed B
Adding Feed A as an upstream source in Feed B allows Feed B consumers to transparently access and cache packages from Feed A without manual republishing.
AZ-400 Dependency Management 5
Your build pipeline restores NuGet packages but you want to ensure the resolved versions exactly match the checked-in packages.lock.json.
Which dotnet CLI flag enforces this?