AZ-400 last-minute revision

Exam day

• Microsoft doesn’t publish a fixed question count or duration for AZ-400, so plan on a mix of formats (multiple choice, drag and drop, yes/no case-study sets, and some YAML-reading questions) and check the time shown at the start. Some sections can’t be revisited once you move on, so answer each before leaving it.
• Passing score is 700 out of 1,000. There is no penalty for guessing.
• Domain weights (skills measured from July 27, 2026): processes and communications 10-15%, source control 10-15%, build and release pipelines 50-55%, security and compliance 10-15%, instrumentation 5-10%.
• The certification renews annually through a free online assessment.

How to read an AZ-400 question

Read the last sentence first, then look for the constraint:

Elimination tricks

• Task groups and classic release pipelines are only right in classic scenarios; new designs use YAML templates and multi-stage pipelines.
• A personal access token tied to a person is rarely the best answer for automation.
• Secrets in YAML, repository files or plain pipeline variables on fork builds are wrong.
• Answers that disable a control “temporarily” (bypass policies, grant admin) are usually wrong.

Core syntax to have fresh

Azure Pipelines

• Hierarchy: pipeline > stages > jobs > steps. Stages sequential, jobs parallel by default; dependsOn changes it.
• Job types: agent, container, server, deployment (targets an environment; strategies runOnce, rolling, canary).
• Variable syntax: $(x) macro (runtime), ${{ }} template (compile time), $[ ] runtime expression.
• Templates: template: for step/job/stage/variable, extends: to enforce structure. Task groups are classic only.
• Trigger keys: trigger, pr (GitHub and Bitbucket only), schedules (UTC cron), resources.pipelines, resources.webhooks.
• Output between jobs: isOutput=true then dependencies.<job>.outputs['step.var'].

GitHub Actions

• on: (push, pull_request, schedule, workflow_dispatch, workflow_call, workflow_run, repository_dispatch).
• needs: orders jobs. permissions: limits GITHUB_TOKEN. concurrency: prevents overlap. environment: brings protection rules.
• OIDC login needs permissions: id-token: write.
• Reusable workflow = whole job set (workflow_call). Composite action = steps inside a job.
• Code scanning upload needs security-events: write.

Deployment strategies

Identity and secrets

Scanning

Metrics and monitoring

KQL: where, project, extend, summarize ... by bin(timestamp, 5m), top 10 by x desc, render timechart, ago(1d), join, let. sort by is descending by default; == is case-sensitive; has is faster than contains.

Numbers worth knowing