AZ-400 sample questions with answers
The other 223 questions are in the practice tool, with answers revealed as you go.
Start 20 questionsConfigure processes and communications
- A remote engineering group spread across several countries wants people to hand off questions about specific tasks without scheduling calls. Which feature in Azure DevOps supports that handoff best?
- A product manager wants to see how long work takes from the moment a request is created until it is completed, and how long active development takes once it has started, using built-in reporting. Where should they look?
- A developer wants a commit and its pull request to appear automatically in the Development section of the related Azure Boards work item, without anyone copying links. What is the standard approach?
Design and implement a source control strategy
- A team practicing continuous integration wants every developer to integrate into the shared line at least daily, while still releasing unfinished functionality without exposing it to customers. Which arrangement fits?
- A company keeps its web frontend, API and background worker in one repository. A change to the frontend should not trigger expensive builds of the worker. Which setup addresses this?
- A software house wants developers to catch leaked secrets and formatting errors before a commit ever leaves their laptop, and it wants the server to reject anything that bypasses that step. Which pairing is strongest?
- A developer is midway through an edit when an urgent request arrives. The branch must be clean for the switch, but the partial edits need to stay recoverable. Which action is correct?
- A feature branch has twenty small commits, several of them fixups. The team wants the target branch to receive a single clean change when the pull request completes. Which option achieves this?
- A company wants to contribute a bug fix to a public open-source project hosted on another platform, while keeping its own working copy under the company's account. What is the standard workflow?
- A five-person startup with little Git experience wants a branching model that is quick to learn, still requires peer review of changes, and fits a continuous deployment pipeline. Which model should it choose?
- A company's monorepo has a very large history and thousands of branches, which makes clones and routine fetches slow on developer Windows machines. Which Microsoft-developed tooling improves this without splitting the repository?
Design and implement build and release pipelines
- A library must be tested on Windows, Ubuntu and macOS against three runtime versions each. The team wants one pipeline definition that expands to all nine combinations. What should they use?
- An engineering group wants its npm restores to keep working during public registry slowdowns, and wants each third-party package fetched from the public registry only once. Which Azure Artifacts feature achieves this?
- A deployment stage fails when it tries to create an App Service, and the log says the caller lacks authorization on the resource group. The YAML parses and the agent is healthy. What is the likely root cause?
- An operations team needs a nightly check that a fleet of Windows web servers still matches its desired configuration, using the PowerShell DSC engine. Which implementation should the pipeline or automation use?
- A small team's release manager, who does not work in source control, needs to set up a simple deployment. The team has no requirement to version that pipeline definition alongside the code. Which authoring approach is appropriate?
- A platform group wants the settings for a web app hosted in Azure App Service, such as app settings and connection strings, captured as code so every environment is built the same way. What is the best way to do this?
- A release pipeline should automatically revert to the last known good version when post-deployment health checks fail. Which design achieves this?
- An integration test in your pipeline fails about one run in five, yet a rerun almost always passes. Which response follows recommended practice for keeping the pipeline trustworthy?
- Integration tests need a real SQL Server engine in CI. Each run must start from the same schema and seed data, and no run may affect a later one. Which approach meets this?
- Your release must reach the secondary region only after the primary region has stayed healthy for five minutes. Which workflow layout enforces that order?
- A Kubernetes-hosted service ships a release that adds a column the new code reads. Which sequencing avoids a window where new code runs against a schema that lacks the column?
- A retail company needs its public service and its release pipeline to survive a major incident in one Azure region. Which architecture meets this goal?
- A build pipeline takes 14 minutes, mostly restoring packages and running unit tests one project after another. Which change shortens the run without reducing test coverage?
- A company runs a classic release pipeline with three stages, manual approvals and shared variable groups. Which migration plan carries the least production risk?
Develop a security and compliance plan
- A governance team wants the policy to block creation or update of App Service resources whenever HTTPS-only is not enabled. Which Azure Policy effect should the definition use?
- A logistics company wants every resource that supports diagnostic logs to send them to one central Log Analytics workspace. Existing resources that lack the setting, and any new ones, must be corrected without manual steps. Which Azure Policy effect should be used?
- A payments company runs self-hosted pipeline agents that must reach an Azure Key Vault and a private storage account without crossing the public internet. The security team also wants the agent subnet's inbound and outbound flows tightly restricted. What is the best design?
- A healthcare software vendor must keep pipeline run history and published build outputs for seven years to satisfy an audit rule. The platform team wants that enforced consistently for every pipeline in one Azure DevOps project. Where should the retention rule live?
- A logistics firm runs a deployment job on a self-hosted agent VM, authenticating with a service principal whose client secret expires every few months. Lapses have caused outages when nobody noticed the expiry. The Azure team wants to eliminate the recurring manual secret handling. What change addresses the root problem best?
- A platform team must guarantee that pods on an AKS cluster can only run container images pulled from the organization's approved registries. Which control enforces this at deployment time?
- A team wants its CI pipeline to stop a build when someone commits an API key or a connection string into the repository. Which kind of tool should it add?
- A company connects Azure DevOps pipelines to its Azure subscriptions and wants the safest way to authenticate those service connections. Which option is preferred?
- A compliance program requires that every storage account in a subscription use customer-managed keys for encryption at rest, rather than the default Microsoft-managed keys. Which policy effect blocks non-compliant accounts from being created?
- A public web application must only be reached over HTTPS, and browsers should refuse plain HTTP even if a user types it. Which combination provides this?
Implement an instrumentation strategy
- A payments team has agreed that 99.9 percent of requests must succeed each month, and wants to know when it is spending its error budget too fast. Which tooling provides the signals it needs?
- An operations team wants an alert within minutes when a web app starts throwing unhandled exceptions after a release. Which approach gives automatic detection and notification?
- An operations lead wants one screen that shows VM CPU, AKS node health, a log query result and failed request counts, all visible without switching portals. Which option delivers this?
- A commerce startup wants its dashboards to show counts of checkouts completed and accounts created, not just server response times. Which Application Insights capability should the developers use?
- A platform team wants alerts that reach on-call engineers with the failing resource name, the metric value, and a link to the response playbook. Which design achieves this?
- When a disk-usage alert fires for a production VM, the team wants temporary files cleared automatically without waiting for an engineer to log in. Which setup handles this?
- After a three-hour outage caused by a misconfigured database firewall rule, leadership asks how the team should run the post-incident review. What approach best prevents recurrence?
- An insurance claims flow passes through an API gateway, a quoting service and a payments service, and each emits its own telemetry. Support wants a single timeline showing every hop for one customer request. What capability supplies that?