AZ-400 - Design and Implement Build and Release Pipelines (53% of the exam) - Section 3.1

Design and implement a package management strategy using Azure Artifacts and GitHub Packages, including feeds, views, and upstream sources.

Design a package management strategy using Azure Artifacts feeds and GitHub Packages, and understand how feed views separate pre-release from promoted packages. Configure upstream sources so pipelines can resolve public packages through a single, governable proxy rather than hitting external registries directly.

Azure ArtifactsGitHub Packagespackage feedsfeed viewsupstream sources

Practice question for this objective

Free sampleDesign and Implement Build and Release Pipelinesmedium

A platform team publishes an internal npm package to an "Azure Artifacts" feed. Many consuming teams should pull only versions that have passed validation and been blessed for general use, while the platform team keeps publishing in-progress builds to the same feed. Which feed mechanism lets consumers subscribe to only the blessed versions without a separate feed?

  • AApply a retention policy that deletes any package version below a quality threshold, so only validated versions survive in the feed and consumers therefore receive only the blessed ones.
  • BGive each consuming team a personal access token scoped to read only the validated packages, so the token itself filters the feed down to the blessed versions for those consumers.
  • CPromote validated versions into the feed's @Release view and have consumers connect to the feed @Release endpoint, so they resolve only versions promoted into that view. Correct
  • DPublish each validated version a second time to a separate release feed and have consumers point at that feed, so only blessed versions ever reach the consuming teams.
Use feed views to expose a validated, promoted subset of a single Azure Artifacts feed to downstream consumers. A feed in Azure Artifacts has views such as @Local, @Prerelease, and @Release. Every published version lands in @Local, and promoting a version into @Release makes it visible through that view's endpoint. Consumers who connect to the @Release view resolve only promoted versions, which separates blessed from in-progress builds without duplicating the feed.

Why A is wrong: Retention policies prune versions by age or count, not by validation state, and deleting in-progress builds would break the platform team's own workflow, so this does not separate blessed from unblessed versions.

Why B is wrong: A token controls authentication and feed-level permission, not which versions are visible, so it cannot present consumers with a blessed-only subset and would still expose in-progress builds.

Why C is correct: Feed views expose a filtered slice of a single feed; promoting blessed versions into @Release and pointing consumers at that view endpoint gives them only validated versions while the platform team keeps publishing to @Local.

Why D is wrong: A separate feed does isolate blessed versions, but it forces duplicate publishing and re-resolution of the same artifact, which the requirement explicitly rules out by asking to avoid a second feed.

See more AZ-400 practice questions, answers explained.

Exam traps in Design and Implement Build and Release Pipelines

Answers that look right on this material and are not. Each one is a distractor from a different question in the AZ-400 bank for this domain.

  • Add the public NuGet gallery as a separate service connection and point each build's restore step at that connection instead of at the Azure Artifacts feed, so restores skip the feed entirely.

    Why it is wrong: Pointing restores straight at the public gallery is tempting because it keeps the existing source, but it leaves the build directly dependent on gallery uptime and saves no copy locally, so neither requirement is met.

  • Push the bundles into the feed as NuGet packages by wrapping each image in a .nupkg so it inherits the feed's versioning and views

    Why it is wrong: Wrapping large binaries in NuGet packages abuses a format built for .NET assemblies, adds packaging overhead, and runs into NuGet size constraints, so it is a poor fit even though the feed would accept it.

  • Create the feed scoped to the publishing project and add every consuming project's build identity as a feed reader, so each project's pipeline is granted access individually.

    Why it is wrong: A project-scoped feed can be shared by granting each consumer reader access, but doing so for every project is the per-consumer permission work the requirement is trying to avoid.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.