AZ400-Q: isolate approved package consumption
Developers need internal packages and approved open-source dependencies. Security wants one controlled place to cache/approve external packages and separate prerelease internal builds from released packages. Which design best fits?
- A) Let every build download any package directly from the internet.
- B) Use a package feed with upstream sources for approved externals and views/promoted versions to separate prerelease from release consumption. ✓
- C) Commit every package binary to the application repository.
- D) Store package archives as pipeline variables.
Answer: B. A feed and upstream strategy controls source, caching, access, and promotion. Views or equivalent promotion boundaries help consumers select the intended package maturity.
Why not the others: Direct internet restore loses central policy. Committing binaries bloats source control. Variables are not package management.
Related
azure-artifacts-feeds · upstream-and-versioning · dependency-management