AZ-400 Question 94
Select 2Your company uses Azure DevOps to manage multiple .NET projects. Each team builds and consumes NuGet packages stored in Azure Artifacts. You want to ensure that teams only publish fully tested packages to production, maintain consistent versioning across all feeds, and reduce the chance of pulling unverified packages directly from public sources. Which two actions should you include in your package management strategy to meet these requirements?
- A
Configure separate feeds or feed views for development, staging, and production, and promote packages only upon successful testing.
- B
Enable upstream sources for the production feed so that new versions from public feeds become immediately available to production builds.
- C
Implement package caching by downloading all external dependencies to a central file share and manually distributing them to developers.
- D
Use a single project feed for all packages to simplify management, ensuring each team can publish and consume directly from one source.
Show answer and explanation
Correct answers: A, C
Explanation
A robust package management strategy in Azure DevOps typically involves separating or promoting packages across multiple environments (e.g., development, staging, production) to ensure only tested versions are used in production. Azure Artifacts supports this via feed views, enabling you to promote packages gradually. Caching or mirroring external dependencies is often preferred in security-conscious environments to maintain control over which external packages are consumed. For more details, refer to the official Microsoft documentation on Azure Artifacts feeds, feed views, and upstream sources.
- A. Correct.
Option 1 is correct. Creating separate feeds or feed views (e.g., @Local, @PreRelease, @Release) in Azure Artifacts is a best practice. It allows you to promote packages through stages only after they've been tested and approved, ensuring that production builds consume high-quality, vetted packages.
- B. Incorrect.
Option 2 is incorrect. Using upstream sources directly in the production feed might allow unverified updates from public repositories into production. If your goal is to only use fully tested or approved versions, you typically want to limit direct access to public sources in the production feed.
- C. Correct.
Option 3 is correct. While you can use Azure Artifacts' upstream sources, some organizations prefer manually caching or mirroring external dependencies to reduce external dependencies and ensure all packages are verified. Setting up a central, controlled store (instead of automatically inheriting from public feeds) helps maintain package integrity and governance.
- D. Incorrect.
Option 4 is incorrect. Using a single feed for all packages doesn't provide fine-grained control over environments and makes it difficult to separate untested from production-ready packages. This would increase the risk of accidentally deploying unverified packages.