AZ-400 Question 130
Select 2You are a DevOps lead for a financial services company that processes high-volume transactions in a secure on-premises environment. You must design a self-hosted agent infrastructure for your Azure DevOps pipelines (or GitHub Actions) to handle specialized build and deployment tasks. Your solution should be cost-effective, meet strict internal network security requirements, simplify maintenance, and ensure proper licensing. Which two actions should you take to design this self-hosted agent infrastructure?
- A
Use on-premises self-hosted agents on virtual machines that auto-scale to handle peak build loads, then deallocate when not in use.
- B
Run all builds on Microsoft-hosted agents, relying on pay-as-you-go concurrency for reduced cost and simpler licensing.
- C
Purchase individual Windows Server licenses for each agent VM without considering license reuse or shared licensing models.
- D
Leverage ephemeral container-based builds where each pipeline job runs on a freshly provisioned container, reducing patching and maintenance overhead.
- E
Eliminate all outbound network connectivity from the self-hosted agents to maximize isolation from external services.
Show answer and explanation
Correct answers: A, D
Explanation
Designing a cost-effective, secure, and maintainable self-hosted agent infrastructure involves proper scaling strategies, licensing considerations, and ensuring the environment is aligned with security policies. Many organizations leverage automated VM or container orchestration on-premises to handle fluctuating demand, maintain compliance within a firewall, and reduce maintenance overhead. For more details, refer to the official Azure DevOps Agent documentation (https://learn.microsoft.com/azure/devops/pipelines/agents/agents) or GitHub Actions runner documentation (https://docs.github.com/actions/hosting-your-own-runners) for best practices around scaling, licensing, connectivity, and security.
- A. Correct.
Correct. Using on-premises self-hosted agents allows you to operate behind the corporate firewall and control costs by automatically scaling resources up or down, so you only pay for the infrastructure you need. This design meets security requirements (staying within the network boundary) and can be cost-effective, especially at higher concurrency levels.
- B. Incorrect.
Incorrect. Although Microsoft-hosted agents are convenient, they are not suitable for strict on-premises environments requiring no outbound build or deployment configuration. They also might become more expensive if you have continuous high-volume needs. The scenario specifically requires an on-premises setup.
- C. Incorrect.
Incorrect. Purchasing individual licenses for each VM can lead to unnecessary costs and complexity when alternate license models (such as shared licensing under Software Assurance) could be more cost-effective. Proper licensing strategies can often reduce overhead significantly.
- D. Correct.
Correct. Using ephemeral container-based builds simplifies maintainability because each job starts with a clean environment. This approach reduces patching requirements and addresses image consistency issues, ultimately lowering the operational burden.
- E. Incorrect.
Incorrect. Completely blocking outbound traffic from self-hosted agents is typically impractical because agents must communicate with Azure DevOps or GitHub to receive job instructions and report results. Securing and restricting traffic to necessary domains or endpoints is a best practice, rather than fully eliminating connectivity.