AZ-400 Question 146
Select 2Your team needs to run a specialized code-scanning task on an on-premises environment that hosts a proprietary security tool unavailable on the public cloud. The remaining build and test tasks can be run on Microsoft-hosted agents. You want to design a hybrid Azure DevOps pipeline where only the scanning step runs on a self-hosted agent, while all other steps continue to run on a Microsoft-hosted agent. Which two actions should you take to achieve these requirements?
- A
Deploy the on-premises security tool as a container in an Azure Container Instance and point your pipeline to that container
- B
Install and configure a self-hosted agent in the on-premises environment and register it in Azure DevOps
- C
Configure separate jobs in the pipeline: one job targeting the self-hosted agent for scanning and another targeting the Microsoft-hosted agent for the remaining tasks
- D
Use a configuration option in a single job that automatically switches between self-hosted and Microsoft-hosted agents
Show answer and explanation
Correct answers: B, C
Explanation
For complex scenarios involving both on-premises and cloud-based tasks, Azure DevOps supports hybrid pipelines. You can install and configure a self-hosted agent behind your firewall to run tasks that need access to on-premises resources or specialized tools. Then, you can utilize Microsoft-hosted agents for other tasks. By creating multiple jobs in a single pipeline (one for the on-premises scanning and others for standard builds), you ensure the pipeline is efficient and secure. For more details, see Microsoft official documentation on self-hosted agents and comingling self-hosted and Microsoft-hosted agents in pipelines: https://docs.microsoft.com/azure/devops/pipelines/agents/agents.
- A. Incorrect.
Option 1: INCORRECT. Deploying the security tool as a container in the cloud would defeat the purpose of on-premises scanning. If the tool is only available on-prem, it cannot simply be containerized in Azure without additional work and licensing agreements. This action does not fulfill the requirement of running the specialized tool exactly in the on-premises environment.
- B. Correct.
Option 2: CORRECT. Setting up a self-hosted agent allows Azure DevOps to run pipeline tasks directly in your on-premises environment. By registering the self-hosted agent, you ensure the build can securely trigger the on-premises scanning task where the proprietary tool is installed.
- C. Correct.
Option 3: CORRECT. Splitting the pipeline into multiple jobs is a best practice for hybrid scenarios. One job can run on your new self-hosted agent to execute the scanning step, while other jobs (such as build or test) can leverage cloud-based Microsoft-hosted agents. This ensures clear isolation and efficient use of resources.
- D. Incorrect.
Option 4: INCORRECT. A single job cannot dynamically switch between different agents. To alternate between self-hosted and Microsoft-hosted agents, you need multiple jobs or stages, each pointing to the correct pool of agents.