AZ-400 Pipeline Variables and Templates 2 — Questions and Answers
Question 1: Which syntax do you use to reference a variable group linked to an Azure Key Vault in a YAML pipeline?
- $(variableName) (Correct answer)
- $[variables.variableName]
- ${{ variables.variableName }}
- env.variableName
Correct answer: $(variableName)
Variables from Key Vault-linked variable groups are accessed using the macro syntax $(variableName) at runtime.
Question 2: What is the purpose of the `extends` keyword in an Azure DevOps YAML pipeline?
- To import variable groups into a pipeline
- To inherit from a base template and enforce organizational standards (Correct answer)
- To extend the timeout of a pipeline stage
- To add additional agents to a job pool
Correct answer: To inherit from a base template and enforce organizational standards
The `extends` keyword allows a pipeline to inherit from a base template, enabling organizations to enforce mandatory steps and policies.
Question 3: A pipeline template parameter is defined as `type: boolean`. What happens if you pass the string 'true' instead of the boolean true?
- Azure DevOps automatically coerces the string to boolean true (Correct answer)
- The pipeline fails with a type validation error
- The parameter is ignored and uses its default value
- The string 'true' is treated as falsy
Correct answer: Azure DevOps automatically coerces the string to boolean true
Azure DevOps YAML performs automatic type coercion for boolean template parameters, so the string 'true' is treated as boolean true.
Question 4: Which variable scope takes the lowest precedence when the same variable is defined at multiple levels in Azure Pipelines?
- Job level
- Stage level
- Pipeline root level (Correct answer)
- Variable group
Correct answer: Pipeline root level
Variables defined at the pipeline root level have the lowest precedence and are overridden by stage, job, or step-level definitions.
Question 5: How do you pass a secret variable from a parent pipeline to a template file without exposing it as plaintext?
- Reference it directly using ${{ parameters.secret }}
- Map it as a parameter with type: string and pass the $(secretVar) macro
- Use the env: block in a step to map the secret to an environment variable (Correct answer)
- Secrets cannot be passed to templates
Correct answer: Use the env: block in a step to map the secret to an environment variable
Secrets should be passed to template steps via the `env:` mapping, which prevents the value from appearing in logs.
Question 6: What is the correct way to conditionally include a template step only when a parameter equals a specific value?
- Use `condition:` on the template include
- Use `${{ if eq(parameters.env, 'prod') }}:` wrapping the template include (Correct answer)
- Set `enabled: false` dynamically
- Use a runtime condition expression with variables
Correct answer: Use `${{ if eq(parameters.env, 'prod') }}:` wrapping the template include
Template expressions like `${{ if eq(parameters.env, 'prod') }}:` are evaluated at compile time and can conditionally include template steps.
Question 7: Which statement correctly describes the `output` variable type in Azure Pipelines?
- Output variables are defined using the `output:` keyword in the variables section
- A step can set an output variable using `##vso[task.setvariable variable=name;isOutput=true]value` (Correct answer)
- Output variables are automatically available in all subsequent stages without any mapping
- Output variables replace secret variables once published
Correct answer: A step can set an output variable using `##vso[task.setvariable variable=name;isOutput=true]value`
Steps set output variables using the logging command `##vso[task.setvariable variable=name;isOutput=true]value`, making them available to downstream jobs.
AZ-400 Pipeline Variables and Templates 2
Which syntax do you use to reference a variable group linked to an Azure Key Vault in a YAML pipeline?