AZ-400 Question 153
Select 2You are configuring an Azure DevOps pipeline that deploys to two YAML-based environments: 'Staging' and 'Production.' The Staging environment requires an automated code scan to pass before deployment, and the Production environment requires an approval from the security team. You need to ensure that the code scan runs automatically whenever you deploy to Staging, and that a security team member must manually approve any deployment to Production. Which two actions should you take to meet these requirements?
- A
A. Configure an environment check in the Staging environment settings that references the automated code scan process.
- B
B. Include a manualValidation job in the YAML pipeline itself to replace the need for environment approvals in Production.
- C
C. In the YAML pipeline, add a deployment job targeting the Production environment and configure approval directly within that job.
- D
D. Configure an environment approval check for the Production environment that prompts a security team member to approve or reject the deployment.
- E
E. Enable the default agentless job option on all environments to run checks without additional configuration.
Show answer and explanation
Correct answers: A, D
Explanation
In Azure DevOps, YAML-based pipelines reference environments by name. However, environment checks and approvals (automatic checks, manual approvals, gates, etc.) are configured in the environment� settings rather than directly in the YAML file. To meet real-world requirements�such as an automated scan in Staging and a manual approval in Production�you must define the necessary checks in each environment� settings. Refer to Microsoft� official Azure DevOps documentation on 'Approvals and checks' for step-by-step instructions on how to set these up.
- A. Correct.
Option A is correct. When using YAML-based environments, you can configure an environment check in the environment� settings in Azure DevOps. This automated check could be your code scan or any other process that must pass before deployment proceeds.
- B. Incorrect.
Option B is incorrect. A manualValidation job in YAML only allows for a pause and manual validation within the pipeline itself. It does not replace the built-in environment approvals. If you need to enforce formal approvals in Azure DevOps, you must configure environment-level checks.
- C. Incorrect.
Option C is incorrect. While you do reference the Production environment in the YAML pipeline using a deployment job, approvals are not defined directly in the YAML file. They are configured in the environment settings in Azure DevOps. This ensures that the pipeline cannot bypass mandatory approvals.
- D. Correct.
Option D is correct. You need to add an approval check in the Production environment so that a security team member can manually approve or reject a deployment. This is configured in the environment� settings rather than in the pipeline itself.
- E. Incorrect.
Option E is incorrect. Enabling the agentless job option does not automatically set up environment checks or approvals. You still need to explicitly configure checks or approvals within the environment settings.