AZ-400 Release Management 5 — Questions and Answers
Question 1: Which Azure DevOps service connection type should be used to deploy resources to an Azure subscription using a service principal?
- Generic service connection
- Azure Resource Manager service connection (Correct answer)
- SSH service connection
- Kubernetes service connection
Correct answer: Azure Resource Manager service connection
The Azure Resource Manager service connection authenticates via a service principal (or managed identity) to authorize pipeline tasks to deploy Azure resources.
Question 2: A pipeline deploys to 50 on-premises servers in a deployment group. The team wants only 10 servers updated at a time. Which deployment group job setting controls this?
- Max parallel targets (Correct answer)
- Rolling deployment batch size
- Concurrency limit on the agent pool
- Deployment group health percentage
Correct answer: Max parallel targets
The 'Maximum number of targets in parallel' setting on a deployment group job controls how many machines are updated simultaneously in each deployment batch.
Question 3: In a release pipeline, what does setting the 'Deployment queue settings' to 'Deploy latest and cancel the others' accomplish?
- Cancels all pending releases and only keeps the oldest queued one
- Deploys only the most recent pending release and cancels any others waiting in queue (Correct answer)
- Forces sequential deployment of all queued releases
- Notifies approvers that older releases have been superseded
Correct answer: Deploys only the most recent pending release and cancels any others waiting in queue
This setting ensures that when multiple releases are queued, only the latest version deploys while all other queued deployments are cancelled, reducing unnecessary deployments.
Question 4: Which tool integrated into Azure Pipelines release gates uses work item queries to ensure all linked bugs are closed before a production deployment?
- Azure Monitor gate
- Query Azure DevOps Work Items gate (Correct answer)
- Invoke REST API gate pointing to Azure Boards
- Security Compliance gate
Correct answer: Query Azure DevOps Work Items gate
The 'Query Work Items' gate runs an Azure Boards query and fails the gate if the returned work item count doesn't meet the specified threshold (e.g., zero open critical bugs).
Question 5: A DevOps engineer is using Helm charts to deploy to AKS from a release pipeline. Which task should they use to upgrade an existing Helm release?
- Kubectl Apply task
- Helm Deploy task with 'upgrade' command (Correct answer)
- Azure App Service Deploy task
- Docker Compose task
Correct answer: Helm Deploy task with 'upgrade' command
The Helm Deploy task with the 'upgrade' command (helm upgrade) updates an existing Helm release in the AKS cluster using the specified chart and values.
Question 6: What is the purpose of the 'protected' flag on an Azure Pipelines YAML environment?
- It encrypts all variables in the environment automatically
- It requires pipeline resources like service connections in that environment to pass approval checks
- It prevents the environment from being deleted by non-admins (Correct answer)
- It restricts the environment to only run on private agents
Correct answer: It prevents the environment from being deleted by non-admins
Marking an environment as protected restricts deletion and modification to users with the Administrator role, preventing accidental removal of critical environments.
Question 7: A team practicing trunk-based development wants every merge to 'main' to automatically deploy to staging but require approval before production. Which release pipeline configuration achieves this?
- CD trigger on artifact filtered to 'main' branch, with auto-deploy to staging and pre-deployment approval on production stage (Correct answer)
- Scheduled trigger for staging and manual trigger for production
- Branch policy requiring PR approvals before any deployment
- Separate pipelines for staging and production with no linkage
Correct answer: CD trigger on artifact filtered to 'main' branch, with auto-deploy to staging and pre-deployment approval on production stage
A continuous deployment trigger filtered to the 'main' branch auto-deploys to staging, while a pre-deployment approval gate on the production stage requires manual sign-off.
AZ-400 Release Management 5
Which Azure DevOps service connection type should be used to deploy resources to an Azure subscription using a service principal?