AZ400-Q: choose runner infrastructure
A pipeline must build a service that downloads packages from a registry available only on a private network. The team also needs a preinstalled proprietary compiler. They want the least operational effort consistent with those constraints. What should they use?
- A) A GitHub-hosted runner, because every hosted runner can access a private network.
- B) A Microsoft-hosted Azure Pipelines agent with an inbound firewall rule to the registry.
- C) A self-hosted runner/agent in the private network with the required compiler, restricted to the needed pool and repositories. ✓
- D) A developer workstation triggered manually for each build.
Answer: C. A self-hosted runner or agent can be placed where it has private connectivity and can contain the required toolchain. Restrict its pool and permissions, patch it, and isolate workloads because it becomes part of the delivery security boundary.
Why not the others: Hosted runners do not automatically reach a private endpoint. Opening inbound access does not change a hosted agent’s network location and is an unsafe response. A workstation is not repeatable CI infrastructure.