AZ-400 exam questions on packages and testing ask two things: which version of a package can be used by whom, and how thoroughly was the code checked before deployment. The two topics share one pipeline goal — guaranteeing automatically that build artifacts are trustworthy. Azure Artifacts and GitHub Packages own the supply side; the test pyramid and Quality Gate own the assurance side.
Azure Artifacts — Feed, Views, and Upstream Sources
Imagine a library where books are scattered across dozens of shelves with no catalogue. Finding anything takes forever. Azure Artifacts is your team's package library: one place to host NuGet, npm, Maven, Python, and Universal Packages, organized with three core concepts.
A is the container for packages, scoped to an organization or a project. Separating public packages from internal-only packages requires two separate feeds — per-package access scopes inside a single feed are not possible.
track package maturity: , , and . CI publishes to ; QA validation promotes to ; final approval promotes to . Movement between views is done by , not re-publishing. Sharing only the URL with external consumers means they see only stable versions.
proxy packages from public registries (npmjs.com, NuGet.org, Maven Central) through the internal feed. Saving an upstream package into the feed requires at least the role; a can only download already-cached packages.
GitHub Packages is the registry native to GitHub, authenticated with or a PAT. Azure Artifacts pairs naturally with Azure Pipelines; GitHub Packages pairs natively with GitHub Actions.
SemVer — What the Version Number Communicates
Think of a prescription with only the drug name and no dosage. A version number is a message that tells consumers what kind of change happened. SemVer standardizes that message with MAJOR.MINOR.PATCH.
: bug fix only, no API change. Existing consumer code works unchanged. (e.g., 3.5.2 → 3.5.3) : new feature, existing API preserved. PATCH resets to 0. Deprecating also counts as MINOR. (e.g., 2.5.3 → 2.6.0) : breaking change, backward compatibility removed. MINOR and PATCH both reset to 0. (e.g., 3.4.9 → 4.0.0)
The exam frequently contrasts deprecating vs. removing. Marking an endpoint as deprecated but leaving it in place does not affect consumers — that is MINOR. Actually removing it or changing a parameter signature becomes MAJOR. Azure Artifacts is immutable: a published version cannot be republished, so every fix needs a new version number.
The Test Pyramid — Right Test at the Right Stage
Picture a car assembly line. Catching a faulty part early costs almost nothing. Finding the same defect after painting and packing means disassembling the whole car. The test pyramid applies this logic to pipelines: the further right a defect travels, the more expensive it is to fix.
form the base. They run in milliseconds, isolating a single function from all external dependencies using mocks or stubs. In .NET use ; results are files. The task requires to parse them. In PowerShell, is the standard; is a static analysis tool, not a test framework.
validate real interactions with databases, external APIs, and payment gateways. They run 10–100x slower than unit tests and belong after the build stage but before deployment.
exercise full user scenarios in a real browser. controls Chromium, Firefox, and WebKit through one API and includes built-in auto-wait. offers the widest legacy browser support. runs only on Chromium and does not support WebKit — eliminated for any cross-browser requirement.
via Azure Load Testing (built on JMeter) measures response time, throughput, and error rate. Load testing validates behavior within expected peak traffic; stress testing deliberately exceeds capacity to observe system degradation.
For , OWASP ZAP offers two modes. runs Spider + Passive Scan only, safe for production. adds AJAX Spider and Active Scan with real attack payloads — staging only, never production.
!The test pyramid
Quality Gate — Automating the Deploy Decision
A warehouse that relies on a single human inspector for every outgoing shipment creates a bottleneck at scale. An automated inspection line that passes only compliant packages is more reliable. Quality Gate and Release Gate apply that principle to deployments.
and analyze code quality, code smells, security vulnerabilities (SAST), and coverage against configurable thresholds. For Maven-based Java use ; for Gradle use . Code coverage tools are language-specific: Java uses , .NET/Cuses , JavaScript/Node.js uses .
run automated condition checks before and after deployment stages in Azure Pipelines:
: runs an Azure Boards query; blocks deployment while active bugs exceed a threshold. : queries Azure Monitor metrics or logs with KQL; blocks if error rate or response time fails the baseline. : general-purpose gate for any external system check.
check conditions before a stage starts. check state after a stage completes. Gate (automated condition-based) vs. Manual approval (human clicks Approve) is a regular exam distinction.
Runner Selection — Self-Hosted vs Microsoft-Hosted
Think of a company shuttle versus a taxi. The shuttle runs a fixed route but can enter the private campus. A taxi goes anywhere but cannot enter the secured facility. Runner choice follows the same trade-off.
Microsoft-hosted runners give a clean virtual environment for every job with no maintenance overhead. They cannot reach private-network resources, so integration or load tests requiring internal systems need a different approach.
Self-hosted runners run on team-managed machines with full private-network access. For NuGet feeds from Azure Artifacts, install the on the agent machine — Microsoft's official recommendation for seamless credential handling.
Exam Key Takeaways
'Manage package maturity without re-publishing' -- Release views ( / / ) + promote 'Proxy external public registries through internal feed' -- upstream source 'Minimum role to save upstream packages' -- Collaborator 'Minimum role to publish packages directly' -- Contributor 'Mark as deprecated, not removed' -- SemVer MINOR 'Remove endpoint or change signature' -- SemVer MAJOR 'WebKit support + auto-wait' -- Playwright 'No WebKit, eliminated for cross-browser' -- Cypress 'Passive scan only, safe for production' -- OWASP ZAP Baseline Scan 'Active scan included, staging only' -- OWASP ZAP Full Scan 'Automatic check before next stage starts' -- Pre-deployment gate 'Automatic check after deployment completes' -- Post-deployment gate
Azure Artifacts = version-controlled package supply chain, test pyramid = layered quality assurance, Quality Gate = automated deploy decision.