AZ-400 Pipeline Variables and Templates 4 — Questions and Answers
Question 1: An organization wants to mandate that all pipelines include a security scanning job. Which Azure DevOps feature best enforces this?
- Branch policies
- Required pipeline templates via the `extends` keyword and protected template resources (Correct answer)
- Variable group permissions
- Service connection approvals
Correct answer: Required pipeline templates via the `extends` keyword and protected template resources
Required templates configured with `extends` and protected as a resource force every consuming pipeline to include the mandated jobs.
Question 2: What is the correct way to iterate over an `object` parameter (a list) inside a YAML template using `each`?
- ${{ for item in parameters.list }}
- ${{ each item in parameters.list }}: (Correct answer)
- {% for item in parameters.list %}
- loop: ${{ parameters.list }}
Correct answer: ${{ each item in parameters.list }}:
The `${{ each item in parameters.list }}:` template expression iterates over an object parameter list to generate repeated YAML blocks.
Question 3: A YAML pipeline sets a variable with `isReadonly: true`. What is the effect?
- The variable cannot be overridden at queue time by users (Correct answer)
- The variable is automatically marked as secret
- The variable is shared read-only across all pipelines in the project
- The variable value is cached for 24 hours
Correct answer: The variable cannot be overridden at queue time by users
Setting `isReadonly: true` on a variable prevents users from overriding its value when manually triggering a pipeline run.
Question 4: Which approach correctly maps an output variable from job A to job B within the same stage?
- In job B's variables section: `$[dependencies.JobA.outputs['stepA.myVar']]` (Correct answer)
- In job B's variables section: `$[stageDependencies.Stage1.JobA.outputs['stepA.myVar']]`
- In job B's variables section: `$(JobA.stepA.myVar)`
- In job B's variables section: `${{ dependencies.JobA.myVar }}`
Correct answer: In job B's variables section: `$[dependencies.JobA.outputs['stepA.myVar']]`
Within the same stage, cross-job output variables are referenced using `$[dependencies.JobName.outputs['stepName.varName']]`.
Question 5: What happens when you link a variable group to a pipeline but the Azure Key Vault secret has been deleted?
- The pipeline skips the secret and uses an empty string
- The pipeline run fails when it attempts to fetch the deleted secret (Correct answer)
- The pipeline uses the last cached value from the previous successful run
- The variable group is automatically unlinked
Correct answer: The pipeline run fails when it attempts to fetch the deleted secret
If a Key Vault secret is deleted, the pipeline fails at runtime when Azure DevOps attempts to retrieve the missing secret value.
Question 6: Which keyword in a YAML template file defines the expected inputs that callers must or may provide?
- variables:
- inputs:
- parameters: (Correct answer)
- args:
Correct answer: parameters:
The `parameters:` section at the top of a YAML template file declares the typed inputs that consuming pipelines can or must pass.
Question 7: A pipeline variable contains a JSON string. How can a Bash step safely extract a specific field from it?
- Use the built-in Azure Pipelines json() function in a condition expression
- Echo the variable into `jq` within the Bash step: `echo '$(jsonVar)' | jq -r '.field'` (Correct answer)
- Use the parseJson() expression in the variables section
- Reference it with ${{ fromJSON(variables.jsonVar).field }}
Correct answer: Echo the variable into `jq` within the Bash step: `echo '$(jsonVar)' | jq -r '.field'`
Within a Bash step, you can echo the macro-expanded variable value and pipe it through `jq` to extract individual JSON fields.
AZ-400 Pipeline Variables and Templates 4
An organization wants to mandate that all pipelines include a security scanning job.
Which Azure DevOps feature best enforces this?