AZ-400 Question 151
Single answerYou are configuring a YAML-based pipeline in Azure DevOps to deploy to a 'Production' environment. A new requirement is that any deployment to Production must be manually approved by the security lead within 24 hours, and further deployments should be blocked until the existing deployment completes. Which approach should you implement to meet these requirements?
- A
Include a Manual Intervention task in the production stage of your YAML pipeline to request approval from the security lead.
- B
Configure a deployment job in the YAML referencing the 'Production' environment and add a manual approval check in the environment's settings, assigning the security lead and setting a 24-hour timeout.
- C
Use classic release pipelines with pre-deployment approvals for the Production environment to require security lead sign-off.
- D
Create a separate stage dedicated to approvals only, triggered before the Production stage, to manage the security lead approval manually.
Show answer and explanation
Correct answer: B
Explanation
To implement checks and approvals with YAML-based environments in Azure DevOps, you define a deployment job that references your environment and then configure approval checks in the environment� settings. This approach allows you to require manual sign-offs (e.g., from a security lead) and set timeouts or concurrency limits. Refer to Microsoft� Azure DevOps documentation on managing environments (https://learn.microsoft.com/azure/devops/pipelines/process/environment-approvals?view=azure-devops) for detailed guidance.
- A. Incorrect.
Option 1 is incorrect. While a Manual Intervention task can be used in older or classic pipelines, it� not the recommended approach for YAML-based environment checks. The requirement specifically mentions using YAML-based environments with manual approvals and concurrency locks.
- B. Correct.
Option 2 is correct. In a YAML-based pipeline, referencing the Production environment in a deployment job and then configuring a manual approval check from the environment� settings (including the security lead� identity and a 24-hour timeout) satisfies both approval and concurrency requirements.
- C. Incorrect.
Option 3 is incorrect because it refers to a classic release pipeline approach, not a YAML-based environment check. Classic release approvals don�t apply to YAML-based pipelines in the same manner.
- D. Incorrect.
Option 4 is incorrect. Merely creating a separate stage for manual approvals does not leverage environment checks, nor does it enforce the concurrency lock that prevents a new deployment from starting while the current one is pending.