AZ-400 Question 100
Single answerYou are a DevOps engineer for an organization that develops custom libraries and consumes several open-source packages. The team wants to store internal NuGet packages in a private Azure Artifacts feed, yet still allow developers and build pipelines to automatically access packages from the public NuGet Gallery without manually updating references. Additionally, they want to ensure only verified package versions are promoted to production. Which approach should you recommend?
- A
Create a single Azure Artifacts feed, configure the NuGet Gallery as an upstream source, and use views (e.g., Pre-release, Release) to promote verified packages to production
- B
Use separate Azure Artifacts feeds for each environment and manually copy packages from the public NuGet Gallery into each feed whenever updates are needed
- C
Configure all pipelines to directly reference the public NuGet Gallery URL for open-source packages, then lock package versions in each pipeline� YAML definition
- D
Maintain a local file share to store downloaded public packages and script nightly jobs to copy them into your private feed for production use
Show answer and explanation
Correct answer: A
Explanation
In Azure Artifacts, you can configure upstream sources to seamlessly include packages from external feeds such as NuGet Gallery, npmjs.com, or other registries. Views (such as Pre-release, Release) help you manage the lifecycle of these packages by limiting which versions are exposed downstream, thereby ensuring that only vetted packages make it into production. Refer to Microsoft� official documentation on 'Use upstream sources in Azure Artifacts' and 'Manage package lifecycle with views' for detailed guidance.
- A. Correct.
Correct. By creating a single feed and adding the public NuGet Gallery as an upstream source, you only need to manage references centrally. Views allow you to filter which package versions are available in production, ensuring only verified or approved packages are promoted.
- B. Incorrect.
Incorrect. While separate feeds might give you isolation, manually copying packages introduces additional overhead and risk of version inconsistencies. This approach doesn�t effectively manage updates from an external repository automatically.
- C. Incorrect.
Incorrect. Directly referencing external feeds in every pipeline can work, but you lose centralized control over package versions. Promoting specific package versions becomes more cumbersome because each pipeline� YAML must be updated individually.
- D. Incorrect.
Incorrect. Relying on a file share and scripts to download and copy packages to production is error-prone, difficult to maintain, and lacks systematic version control. Automated upstream sources and Azure Artifacts views are more reliable and efficient.