Microsoft AZ-400 · DevOps Engineer Expert · Updated 2026
Free AZ-400 DevOps Engineer Practice Exam (2026)
Full-length AZ-400 mock exams with a realistic number of questions and the real exam time. Source control, pipelines, security, instrumentation and team process scenarios, answers explained, and your score by domain.
1. Choose a set
2. Choose a mode
50 questions · 1 hour 40 min · same as the real exam
You have an unfinished attempt on this set.
Questions 1–10Page 1 of 5
🏆
Question 1Build & Release Pipelines
Fabrikam's platform team must ensure that every YAML pipeline in the organization runs mandatory security scanning steps. Pipeline authors must not be able to remove or skip those steps. Which approach should you use?
Correct answer: C. Pipelines that extend a central template
An extends template controls the overall pipeline structure, and authors can only fill the parameters the template allows, so required steps cannot be removed. Step templates are inserted by the author, who can simply leave them out.
An extends template controls the overall pipeline structure, and authors can only fill the parameters the template allows, so required steps cannot be removed. Step templates are inserted by the author, who can simply leave them out.
Question 2Source Control
Wingtip Toys deploys its web app to production many times a day. Developers report frequent painful merge conflicts from long-running branches. Unfinished features must stay hidden from users. Which branching strategy should you recommend?
Correct answer: B. Trunk-based development with feature flags
Trunk-based development keeps branches short-lived and merges to main often, which reduces merge conflicts and supports many daily deployments. Feature flags hide unfinished work. GitFlow adds long-lived branches and more merges, which works against frequent releases.
Trunk-based development keeps branches short-lived and merges to main often, which reduces merge conflicts and supports many daily deployments. Feature flags hide unfinished work. GitFlow adds long-lived branches and more merges, which works against frequent releases.
Question 3Security & Compliance
Fabrikam's Azure Resource Manager service connections use service principal secrets that expire every 90 days and break pipelines. Security wants no secrets stored in Azure DevOps. What should you use for the service connections?
Correct answer: D. Workload identity federation
Workload identity federation lets Azure DevOps exchange a short-lived token with Microsoft Entra ID, so no secret is stored or rotated. A certificate is still a credential that must be stored and renewed.
Workload identity federation lets Azure DevOps exchange a short-lived token with Microsoft Entra ID, so no secret is stored or rotated. A certificate is still a credential that must be stored and renewed.
Question 4Build & Release Pipelines
Litware deploys with a multi-stage YAML pipeline. Before the production stage runs, a member of the operations group must approve the deployment. The approval must apply to any pipeline that deploys to production. What should you configure?
Correct answer: A. An Approvals check on the production environment
Approvals in YAML pipelines are checks on protected resources such as environments, so any pipeline that targets the production environment waits for approval. Pre-deployment approvals exist only in classic release pipelines.
Approvals in YAML pipelines are checks on protected resources such as environments, so any pipeline that targets the production environment waits for approval. Pre-deployment approvals exist only in classic release pipelines.
Question 5Instrumentation
Fabrikam's public website must be checked every five minutes from several Azure regions. The team wants an alert when the site does not return HTTP 200 or the TLS certificate is close to expiry. What should you create in Application Insights?
Correct answer: B. A standard availability test
A standard availability test calls the URL from several regions on a schedule, checks the status code and can validate TLS certificate expiry. Smart detection looks for anomalies in existing telemetry and does not probe the site.
A standard availability test calls the URL from several regions on a schedule, checks the status code and can validate TLS certificate expiry. Smart detection looks for anomalies in existing telemetry and does not probe the site.
Question 6Processes & Communications
Contoso uses Azure Boards for a Kanban team. The team lead wants a dashboard widget that shows how long work items take from the moment work starts until they are closed. Time spent waiting in the backlog must be excluded. Which widget should you add?
Correct answer: A. Cycle Time widget
The Cycle Time widget measures the time from when an item first enters an In Progress state until it is completed, so backlog waiting time is excluded. The Lead Time widget starts counting when the item is created, so it includes the backlog wait.
The Cycle Time widget measures the time from when an item first enters an In Progress state until it is completed, so backlog waiting time is excluded. The Lead Time widget starts counting when the item is created, so it includes the backlog wait.
Question 7Build & Release Pipelines
Adatum's build compiles code that must connect to an on-premises license server that is not reachable from the internet. The build also needs a licensed third-party compiler that cannot be installed at runtime. Which agent type should you use?
Correct answer: D. Self-hosted agent on the corporate network
A self-hosted agent on the corporate network can reach the on-premises license server and keep the licensed compiler installed. Microsoft-hosted agents start from a fresh image each run and have no access to the private network.
A self-hosted agent on the corporate network can reach the on-premises license server and keep the licensed compiler installed. Microsoft-hosted agents start from a fresh image each run and have no access to the private network.
Question 8Source Control
Contoso uses Azure Repos. Pull requests that target main must not be completed unless a CI pipeline compiles the merged code and all unit tests pass. You need to enforce this for every pull request. What should you configure on the main branch?
Correct answer: A. A build validation branch policy
A build validation policy queues the pipeline for each pull request and blocks completion until the build succeeds. A branch lock makes the branch read-only, which stops all merges instead of gating them on a passing build.
A build validation policy queues the pipeline for each pull request and blocks completion until the build succeeds. A branch lock makes the branch read-only, which stops all merges instead of gating them on a passing build.
Question 9Build & Release Pipelines
Northwind runs self-hosted Azure Pipelines agents on Azure VMs in a virtual network. Build demand is high during work hours and near zero at night. You need agents that scale in and out automatically while still reaching resources in the virtual network. What should you use?
Correct answer: C. An Azure Virtual Machine Scale Set agent pool
A scale set agent pool lets Azure Pipelines grow and shrink a VM scale set that you deploy into your virtual network. Microsoft-hosted agents scale for you but cannot join your virtual network.
A scale set agent pool lets Azure Pipelines grow and shrink a VM scale set that you deploy into your virtual network. Microsoft-hosted agents scale for you but cannot join your virtual network.
Question 10Security & Compliance
Litware keeps API keys in Azure Key Vault. Several YAML pipelines in one project need these keys as secret variables. The keys must stay in Key Vault, and you want to manage the link in one place. What should you create?
Correct answer: A. A variable group linked to the key vault
A variable group linked to Key Vault maps selected secrets as variables, and pipelines read the current values at run time. Secret variables in each pipeline copy the values into Azure DevOps and must be updated in many places.
A variable group linked to Key Vault maps selected secrets as variables, and pipelines read the current values at run time. Secret variables in each pipeline copy the values into Azure DevOps and must be updated in many places.
Question 11Build & Release Pipelines
Tailspin Toys builds a Node.js library with GitHub Actions. Tests must run on Node.js 18, 20 and 22, each on both Ubuntu and Windows. You want one job definition that creates all combinations. What should you use?
Correct answer: D. A matrix strategy in the job
A matrix strategy expands one job definition into a job for every combination of the listed values, here six jobs. Separate workflow files would duplicate the same job logic and are harder to maintain.
A matrix strategy expands one job definition into a job for every combination of the listed values, here six jobs. Separate workflow files would duplicate the same job logic and are harder to maintain.
Question 12Instrumentation
Litware runs ten microservices instrumented with Application Insights. When latency rises, engineers need a visual view of how services call each other and which dependency is failing. What should they use?
Correct answer: B. Application Map
Application Map uses distributed tracing data to draw components and their dependencies, with failure rates and latency on each call. Metrics Explorer charts numbers but does not show how the services connect.
Application Map uses distributed tracing data to draw components and their dependencies, with failure rates and latency on each call. Metrics Explorer charts numbers but does not show how the services connect.
Question 13Processes & Communications
Fabrikam hosts code in GitHub and tracks work in Azure Boards. The Azure Boards app for GitHub is already connected to the repository. Developers must link each commit to its Azure Boards work item from the commit message. What should developers include in the message?
Correct answer: C. AB#1234 in the message
With the Azure Boards app connected, the AB#ID syntax in a commit message creates a link to the Azure Boards work item. A plain #ID mention references a GitHub issue or pull request in the repository, not an Azure Boards work item.
With the Azure Boards app connected, the AB#ID syntax in a commit message creates a link to the Azure Boards work item. A plain #ID mention references a GitHub issue or pull request in the repository, not an Azure Boards work item.
Question 14Build & Release Pipelines
Wingtip Toys' Azure Pipelines build spends four minutes restoring npm packages on every run. The packages only change when package-lock.json changes. You need to cut the restore time on Microsoft-hosted agents. What should you add?
Correct answer: B. A Cache task keyed on package-lock.json
The Cache task saves the npm cache and restores it on later runs when the key, built from package-lock.json, matches. Publishing node_modules as a pipeline artifact shares files within one run, not across separate runs.
The Cache task saves the npm cache and restores it on later runs when the key, built from package-lock.json, matches. Publishing node_modules as a pipeline artifact shares files within one run, not across separate runs.
Question 15Source Control
Fabrikam stores code in GitHub. Any change to files under the /database folder must be approved by members of the dba-team before it merges to main. Other folders must not need dba-team approval. What should you implement?
Correct answer: D. CODEOWNERS with required code owner review
A CODEOWNERS entry maps /database to dba-team, and requiring code owner review makes their approval mandatory only when those files change. Listing the team as required reviewers on every pull request would also force approval on unrelated folders.
A CODEOWNERS entry maps /database to dba-team, and requiring code owner review makes their approval mandatory only when those files change. Listing the team as required reviewers on every pull request would also force approval on unrelated folders.
Question 16Build & Release Pipelines
Contoso developers install npm packages from an Azure Artifacts feed. They also need public packages from npmjs.com. Packages they use must stay available even if a package is removed from the public registry. What should you configure?
Correct answer: B. An upstream source to npmjs on the feed
An upstream source lets the feed fetch packages from npmjs and keep a saved copy, so they stay available if the public version is removed. Pointing .npmrc straight at npmjs.com bypasses the feed and keeps no copy.
An upstream source lets the feed fetch packages from npmjs and keep a saved copy, so they stay available if the public version is removed. Pointing .npmrc straight at npmjs.com bypasses the feed and keeps no copy.
Question 17Security & Compliance
Adatum stores code in GitHub with GitHub Advanced Security enabled. Developers sometimes commit cloud access keys by mistake. You need to stop supported secrets from reaching the repository at all. What should you enable?
Correct answer: C. Secret scanning push protection
Push protection blocks a push that contains a supported secret before it lands in the repository. Secret scanning alerts only report secrets after they are already committed.
Push protection blocks a push that contains a supported secret before it lands in the repository. Secret scanning alerts only report secrets after they are already committed.
Question 18Build & Release Pipelines
Fabrikam publishes NuGet packages to an Azure Artifacts feed on every build. Consumer teams must only see package versions that passed integration testing. You want to avoid managing a second feed. What should you use?
Correct answer: A. Feed views with promotion to @Release
Feed views let you promote tested versions to a view such as @Release, and consumers connect to that view to see only promoted versions. Retention policies delete old versions but do not hide untested ones from consumers.
Feed views let you promote tested versions to a view such as @Release, and consumers connect to that view to see only promoted versions. Retention policies delete old versions but do not hide untested ones from consumers.
Question 19Instrumentation
Adatum engineers query Application Insights logs. They need the number of failed requests in each 5-minute interval to chart a trend. Which query should they use?
Correct answer: D. requests | where success == false | summarize count() by bin(timestamp, 5m)
Filtering on success == false and then summarizing count() by bin(timestamp, 5m) groups failures into 5-minute buckets for a chart. Grouping by resultCode gives totals per code, not a trend over time.
Filtering on success == false and then summarizing count() by bin(timestamp, 5m) groups failures into 5-minute buckets for a chart. Grouping by resultCode gives totals per code, not a trend over time.
Question 20Source Control
Litware's game studio stores large Photoshop and 3D model files in a Git repository. Clones are slow and the repository size grows quickly with each version of these binary files. Developers must keep using normal Git commands. What should you use?
Correct answer: A. Git LFS for the binary file types
Git LFS stores large binary files outside the normal Git object store and downloads only the versions needed, which keeps clones fast. A .gitignore entry stops the files from being versioned at all, which fails the need to track them.
Git LFS stores large binary files outside the normal Git object store and downloads only the versions needed, which keeps clones fast. A .gitignore entry stops the files from being versioned at all, which fails the need to track them.
Question 21Build & Release Pipelines
Litware runs a web app on Azure App Service in the Standard tier. New releases must be warmed up before they get production traffic, and rollback must take seconds. You need a blue-green approach with minimal infrastructure. What should you do?
Correct answer: C. Deploy to a staging slot and swap it with production
Deploying to a staging slot lets the app warm up, and a swap moves it to production with no downtime. Swapping back is a fast rollback. Redeploying an older package on failure takes much longer and causes downtime.
Deploying to a staging slot lets the app warm up, and a swap moves it to production with no downtime. Swapping back is a fast rollback. Redeploying an older package on failure takes much longer and causes downtime.
Question 22Processes & Communications
Litware keeps product documentation as Markdown files in an Azure Repos Git repository next to the code. Each release branch must show the documentation that matches that release. You want readers to browse the docs in the Azure DevOps wiki with the least effort. What should you do?
Correct answer: D. Publish the repository folder as a code wiki
Publishing code as a wiki renders Markdown from a repository folder and lets you add a wiki version for each branch, so every release branch shows its own docs. A project wiki is a separate repository, so the copied files would drift from the code on each branch.
Publishing code as a wiki renders Markdown from a repository folder and lets you add a wiki version for each branch, so every release branch shows its own docs. A project wiki is a separate repository, so the copied files would drift from the code on each branch.
Question 23Build & Release Pipelines
Adatum wants to release a new checkout feature to 5 percent of users and to the beta testers group. The team must change the audience without redeploying the app. Which solution should you use?
Correct answer: D. An App Configuration feature flag with targeting
An App Configuration feature flag with the targeting filter can enable a feature for named groups and a percentage of users, and you change it at runtime. Slot traffic routing splits requests by percentage but cannot target a named group.
An App Configuration feature flag with the targeting filter can enable a feature for named groups and a percentage of users, and you change it at runtime. Slot traffic routing splits requests by percentage but cannot target a named group.
Question 24Security & Compliance
Northwind's GitHub repositories use many npm dependencies. When a vulnerability is published for a dependency, the team wants a pull request that upgrades it to a fixed version, created automatically. What should you enable?
Correct answer: B. Dependabot security updates
Dependabot security updates open pull requests that bump a vulnerable dependency to a patched version. Dependabot alerts only notify you and do not create the upgrade pull request.
Dependabot security updates open pull requests that bump a vulnerable dependency to a patched version. Dependabot alerts only notify you and do not create the upgrade pull request.
Question 25Instrumentation
Northwind has several Azure Monitor alert rules. When any of them fires, the on-call engineer must get an SMS and an incident must be opened through a webhook. You want to define these notifications once and reuse them. What should you create?
Correct answer: C. An action group
An action group defines notifications and actions such as SMS and webhooks, and many alert rules can reuse it. An alert processing rule changes how fired alerts are handled, such as suppressing them, but it does not define the actions.
An action group defines notifications and actions such as SMS and webhooks, and many alert rules can reuse it. An alert processing rule changes how fired alerts are handled, such as suppressing them, but it does not define the actions.
Question 26Build & Release Pipelines
Northwind deploys a containerized service to Azure Kubernetes Service with a YAML deployment job. New versions must first receive 10 percent of the pods, then 25 percent, before full rollout. Which deployment strategy should you specify?
Correct answer: D. canary
The canary strategy for Kubernetes deployment jobs uses increments such as 10 and 25 to roll a new version out gradually. The rolling strategy replaces instances in batches but does not split a percentage of traffic to a baseline.
The canary strategy for Kubernetes deployment jobs uses increments such as 10 and 25 to roll a new version out gradually. The rolling strategy replaces instances in batches but does not split a percentage of traffic to a baseline.
Question 27Source Control
Adatum has a very large monorepo with millions of files. Git status and fetch are slow on developer machines. You want Git to configure partial clone, sparse checkout and background maintenance automatically with one command. What should developers use?
Correct answer: C. Scalar
Scalar ships with Git and sets up partial clone, sparse checkout, the commit graph and scheduled background maintenance for large repositories. Git LFS only helps with large binary files, not with the number of files in a repository.
Scalar ships with Git and sets up partial clone, sparse checkout, the commit graph and scheduled background maintenance for large repositories. Git LFS only helps with large binary files, not with the number of files in a repository.
Question 28Build & Release Pipelines
Tailspin Toys deploys only to Azure. The team wants infrastructure as code with a clean syntax, no state file to manage, and support for new Azure resource types on day one. Which tool should you recommend?
Correct answer: B. Bicep
Bicep is a native Azure language that compiles to ARM, needs no state file and supports new resource types immediately. Terraform requires a state file that the team must store and protect.
Bicep is a native Azure language that compiles to ARM, needs no state file and supports new resource types immediately. Terraform requires a state file that the team must store and protect.
Question 29Processes & Communications
Tailspin Toys runs an internal ticketing system that exposes an HTTPS endpoint. Each time a bug work item is updated in Azure Boards, the ticketing system must receive the change details automatically. You need to minimize custom code. What should you configure?
Correct answer: C. A service hook subscription with the Web Hooks consumer
A service hook subscription for the work item updated event can post JSON payloads to any HTTPS endpoint with the Web Hooks consumer. A scheduled pipeline calling the REST API needs custom code and only finds changes when it runs.
A service hook subscription for the work item updated event can post JSON payloads to any HTTPS endpoint with the Web Hooks consumer. A scheduled pipeline calling the REST API needs custom code and only finds changes when it runs.
Question 30Build & Release Pipelines
Wingtip Toys has five engineers who run Terraform from Azure Pipelines against the same Azure subscription. State must be shared, and two runs must never change the state at the same time. What should you configure?
Correct answer: A. An azurerm backend in Azure Blob Storage
The azurerm backend stores state in a blob and uses a blob lease to lock it during a run, which prevents concurrent changes. A state file committed to the repository has no locking and can expose secrets.
The azurerm backend stores state in a blob and uses a blob lease to lock it during a run, which prevents concurrent changes. A state file committed to the repository has no locking and can expose secrets.
Question 31Source Control
A developer at Northwind pushed a commit to the shared main branch that broke the build. Other developers have already pulled main and built on top of it. You must undo the change without rewriting shared history. Which command should the developer use?
Correct answer: B. git revert
git revert creates a new commit that reverses the bad change, so history stays intact for everyone who already pulled. git reset --hard rewrites history and would need a force push, which breaks other developers' clones.
git revert creates a new commit that reverses the bad change, so history stays intact for everyone who already pulled. git reset --hard rewrites history and would need a force push, which breaks other developers' clones.
Question 32Security & Compliance
Tailspin Toys stores a C# application in Azure Repos. GitHub Advanced Security for Azure DevOps is enabled. Security needs to find issues such as SQL injection in the source code during every pipeline run, with results shown in the repository. Which solution should you use?
Correct answer: A. Code scanning with CodeQL
Code scanning uses CodeQL to analyze source code for flaws such as SQL injection and shows alerts in Azure Repos. Dependency scanning finds known vulnerable packages, not flaws in your own code.
Code scanning uses CodeQL to analyze source code for flaws such as SQL injection and shows alerts in Azure Repos. Dependency scanning finds known vulnerable packages, not flaws in your own code.
Question 33Build & Release Pipelines
Contoso developers need to create short-lived sandbox environments for feature testing on their own. Each environment must come from approved IaC templates and land in subscriptions that the platform team controls. Which service should you use?
Correct answer: C. Azure Deployment Environments
Azure Deployment Environments lets developers self-serve environments from a catalog of approved IaC templates, deployed to subscriptions set by the platform team. DevTest Labs formulas create preconfigured VMs, not full environments from a governed IaC catalog.
Azure Deployment Environments lets developers self-serve environments from a catalog of approved IaC templates, deployed to subscriptions set by the platform team. DevTest Labs formulas create preconfigured VMs, not full environments from a governed IaC catalog.
Question 34Instrumentation
Tailspin Toys runs workloads on Azure Kubernetes Service. Operators need CPU and memory use for nodes, pods and containers, plus container logs, with minimal setup. What should you enable?
Correct answer: D. Container insights
Container insights collects node, pod and container performance data and container logs from AKS. VM insights focuses on virtual machine guest performance, not Kubernetes objects.
Container insights collects node, pod and container performance data and container logs from AKS. VM insights focuses on virtual machine guest performance, not Kubernetes objects.
Question 35Build & Release Pipelines
Fabrikam keeps its Azure SQL Database schema in a SQL database project in Visual Studio. Each release must update the target database schema to match the project, and the pipeline must work out the needed changes. What should the pipeline deploy?
Correct answer: D. A DACPAC from the database project
A SQL database project builds a DACPAC, and the deployment task compares it with the target database and applies the needed schema changes. A BACPAC holds schema and data for import or export, not incremental schema updates.
A SQL database project builds a DACPAC, and the deployment task compares it with the target database and applies the needed schema changes. A BACPAC holds schema and data for import or export, not incremental schema updates.
Question 36Source Control
Tailspin Toys found that a database password was committed to an Azure Repos repository months ago. It appears in many commits on several branches. The password has already been rotated. You must remove it from the entire Git history. What should you do?
Correct answer: A. Rewrite the history with git filter-repo
git filter-repo rewrites every commit to strip the secret, and then the cleaned history is force-pushed. Deleting the file in a new commit only removes it from the latest snapshot, so the password stays in older commits.
git filter-repo rewrites every commit to strip the secret, and then the cleaned history is force-pushed. Deleting the file in a new commit only removes it from the latest snapshot, so the password stays in older commits.
Question 37Build & Release Pipelines
Litware has a CI pipeline that builds an artifact and a separate YAML deployment pipeline. The deployment pipeline must start automatically each time the CI pipeline completes successfully on main. What should you configure in the deployment pipeline?
Correct answer: B. A pipeline resource with a trigger
A pipeline resource with a trigger starts the deployment pipeline when the referenced CI pipeline completes, and can filter on branch. A CI trigger fires on code pushes, not on another pipeline finishing.
A pipeline resource with a trigger starts the deployment pipeline when the referenced CI pipeline completes, and can filter on branch. A CI trigger fires on code pushes, not on another pipeline finishing.
Question 38Processes & Communications
Northwind Traders wants to find where work piles up across the columns of its Kanban board. The team needs to see how many items sat in each column over the last 30 days, so it can spot a growing queue. Which dashboard widget should you use?
Correct answer: D. Cumulative Flow Diagram widget
The Cumulative Flow Diagram shows the count of items in each board column over time, and a widening band reveals a bottleneck. A Query Tile shows only a single current count, so it cannot show how queues changed over the period.
The Cumulative Flow Diagram shows the count of items in each board column over time, and a widening band reveals a bottleneck. A Query Tile shows only a single current count, so it cannot show how queues changed over the period.
Question 39Security & Compliance
Wingtip Toys has code in both GitHub and Azure DevOps. The security team wants one view of DevOps security findings across both platforms, next to its cloud security posture in Azure. What should you configure?
Correct answer: C. Defender for Cloud DevOps security connectors
Defender for Cloud DevOps security connects GitHub and Azure DevOps organizations and shows their security findings beside your cloud posture. Azure Policy evaluates Azure resources, not code repositories.
Defender for Cloud DevOps security connects GitHub and Azure DevOps organizations and shows their security findings beside your cloud posture. Azure Policy evaluates Azure resources, not code repositories.
Question 40Build & Release Pipelines
Adatum's .NET build produces a Cobertura coverage report. The team wants the coverage results shown on the Code Coverage tab of each pipeline run summary. Which task should you add after the tests run?
Correct answer: B. Publish Code Coverage Results
The Publish Code Coverage Results task reads Cobertura or JaCoCo files and shows them on the Code Coverage tab of the run. Publish Test Results shows test outcomes, not coverage.
The Publish Code Coverage Results task reads Cobertura or JaCoCo files and shows them on the Code Coverage tab of the run. Publish Test Results shows test outcomes, not coverage.
Question 41Instrumentation
Wingtip Toys has 80 Azure VMs. Operators want ready-made performance charts for CPU, memory, disk and network across the fleet, with a way to spot the busiest machines. You need minimal setup. What should you enable?
Correct answer: C. VM insights
VM insights collects guest performance data with the Azure Monitor agent and gives ready-made charts across many VMs. Azure Advisor gives recommendations but does not chart live performance trends.
VM insights collects guest performance data with the Azure Monitor agent and gives ready-made charts across many VMs. Azure Advisor gives recommendations but does not chart live performance trends.
Question 42Build & Release Pipelines
Northwind builds container images in Azure Pipelines on agents that do not have Docker installed. Images must be built and pushed to Azure Container Registry with the least agent setup. What should the pipeline run?
Correct answer: A. az acr build against the registry
az acr build sends the build context to an ACR Task, which builds the image in Azure and pushes it to the registry, so the agent needs no Docker daemon. docker build needs Docker on the agent.
az acr build sends the build context to an ACR Task, which builds the image in Azure and pushes it to the registry, so the agent needs no Docker daemon. docker build needs Docker on the agent.
Question 43Source Control
Wingtip Toys has 300 GitHub repositories in one organization. Security wants the same protections on the default branch of every repository, including future ones, managed from one place. You need to minimize administrative effort. What should you use?
Correct answer: B. An organization ruleset targeting default branches
An organization ruleset applies branch rules to many repositories at once, including new ones that match its targeting. Per-repository branch protection rules would need to be created and maintained 300 times.
An organization ruleset applies branch rules to many repositories at once, including new ones that match its targeting. Per-repository branch protection rules would need to be created and maintained 300 times.
Question 44Build & Release Pipelines
Tailspin Toys has 40 GitHub repositories that all need the same build, test and deploy jobs, including job-level settings such as environments and runners. Changes must be made in one place. What should you create?
Correct answer: A. A reusable workflow
A reusable workflow is triggered with workflow_call and can define complete jobs, including runners and environments, that other repositories call. A composite action bundles steps only, so it cannot define jobs or environments.
A reusable workflow is triggered with workflow_call and can define complete jobs, including runners and environments, that other repositories call. A composite action bundles steps only, so it cannot define jobs or environments.
Question 45Processes & Communications
Adatum has 12 GitHub repositories in one organization. The program manager needs a single planning view of issues from all repositories, with a custom Priority field and two-week iterations. You need to use native GitHub features only. What should you create?
Correct answer: C. An organization-level GitHub project
An organization-level GitHub project can include issues from many repositories and supports custom fields and an iteration field. Milestones belong to one repository, so they cannot give a single view across all 12 repositories.
An organization-level GitHub project can include issues from many repositories and supports custom fields and an iteration field. Milestones belong to one repository, so they cannot give a single view across all 12 repositories.
Question 46Security & Compliance
Contoso has an Azure Resource Manager service connection with Owner rights on the production subscription. Only the production release pipeline may use it. Other pipelines in the project must be blocked. What should you configure?
Correct answer: B. Pipeline permissions on the service connection
Pipeline permissions on a service connection list which pipelines may use it, so you allow only the production pipeline. An Approvals check pauses for a person to approve but does not stop other pipelines from requesting the connection.
Pipeline permissions on a service connection list which pipelines may use it, so you allow only the production pipeline. An Approvals check pauses for a person to approve but does not stop other pipelines from requesting the connection.
Question 47Build & Release Pipelines
Wingtip Toys wants every release pipeline run to load test its API with an existing JMeter script. The pipeline must fail if the average response time exceeds 500 ms. You want a managed service with minimal setup. What should you use?
Correct answer: D. Azure Load Testing with fail criteria
Azure Load Testing runs JMeter scripts at scale from a pipeline task and can fail the run when fail criteria such as average response time are breached. Availability tests check uptime from a few locations, not behavior under load.
Azure Load Testing runs JMeter scripts at scale from a pipeline task and can fail the run when fail criteria such as average response time are breached. Availability tests check uptime from a few locations, not behavior under load.
Question 48Instrumentation
Contoso's release managers report that the main CI pipeline in Azure Pipelines fails often. They want to see its pass rate over the last 14 days and which tasks fail most. You want to use built-in features. What should they use?
Correct answer: A. The pipeline Analytics tab pass rate report
The Analytics tab on a pipeline shows the pass rate report with trends and the top failing tasks. The Test Results Trend widget shows test outcomes, not failures in other pipeline tasks.
The Analytics tab on a pipeline shows the pass rate report with trends and the top failing tasks. The Test Results Trend widget shows test outcomes, not failures in other pipeline tasks.
Question 49Source Control
Contoso wants the main branch history in Azure Repos to stay linear, with exactly one commit for each completed pull request. Developers should still commit freely on their feature branches. What should you configure?
Correct answer: B. A merge type policy that allows only squash merge
Limiting the merge type to squash merge combines all feature branch commits into a single commit on main for each pull request. A minimum reviewers policy controls approvals but does not change how commits land on main.
Limiting the merge type to squash merge combines all feature branch commits into a single commit on main for each pull request. A minimum reviewers policy controls approvals but does not change how commits land on main.
Question 50Build & Release Pipelines
Contoso has a YAML pipeline with three stages: Build, DeployWest and DeployEast. The two deploy stages must run in parallel after Build succeeds. What should you configure?
Correct answer: D. Set dependsOn: Build on both deploy stages
Setting dependsOn: Build on both deploy stages makes each wait only for Build, so they run at the same time once Build succeeds. A condition of always() would run them even when Build fails.
Setting dependsOn: Build on both deploy stages makes each wait only for Build, so they run at the same time once Build succeeds. A condition of always() would run them even when Build fails.
The real AZ-400 exam at a glance
50questions
1h 40mtime limit
MCQmultiple choice
75%+aim for here
Score 75% or more on two different sets before you book the real exam. Need a plan for your weak topics? See how we help you pass, or get a full refund.
More free Microsoft Azure & Power BI practice tests
AZ-900 Practice Test50 questions · Azure FundamentalsAZ-104 Practice Test50 questions · Azure AdministratorAZ-305 Practice Test50 questions · Azure Solutions ArchitectPL-300 Practice Test50 questions · Power BI Data Analyst
See all 36 free practice tests →
Original practice questions written by CertOcean in the style of the AZ-400 exam. They are not real exam questions. AZ-400 and Microsoft are trademarks of their owners. Real exam format: usually 40-60 questions · 100 minutes · passing score 700 on a 1-1000 scale · the real exam can include case studies.