AZ-400: Designing and Implementing Microsoft DevOps Solutions — Questions and Answers

Question 1: Which statement BEST describes the relationship between Microsoft Azure DevOps Engineer certification requirements and industry evolution?

Requirements become less stringent over time
Requirements evolve periodically to reflect advances in knowledge, technology, and practice standards (Correct answer)
Certification requirements never change once established
Changes only occur when government mandates new requirements

Correct answer: Requirements evolve periodically to reflect advances in knowledge, technology, and practice standards

Certification requirements evolve to keep pace with advances in professional knowledge, technological developments, and changes in practice standards. This ensures that certified professionals remain current and competent in a changing professional landscape.

Question 2: Which Azure service should you use to store and manage secrets, keys, and certificates referenced in Azure Pipelines?

Azure Blob Storage
Azure Active Directory
Azure Security Center
Azure Key Vault (Correct answer)

Correct answer: Azure Key Vault

Azure Key Vault is the designated service for securely storing and managing secrets, keys, and certificates that can be referenced in Azure Pipelines using variable groups or task steps.

Question 3: In AZ-400 certification, what does redundancy in system design primarily provide?

Increased complexity
Fault tolerance and high availability (Correct answer)
Lower initial cost
Simplified maintenance

Correct answer: Fault tolerance and high availability

Redundancy provides fault tolerance by ensuring that if one component fails, backup components maintain system availability.

Question 4: Which statement BEST describes the relationship between Microsoft Azure DevOps Engineer certification requirements and industry evolution?

Changes only occur when government mandates new requirements
Requirements become less stringent over time
Requirements evolve periodically to reflect advances in knowledge, technology, and practice standards (Correct answer)
Certification requirements never change once established

Correct answer: Requirements evolve periodically to reflect advances in knowledge, technology, and practice standards

Question 5: A team is currently working on a repository for handling all of the source code in Azure repositories. Due to the large number of feature requests, it is difficult to keep track of the changes to the master branch. You must implement a technique that: - Allows for the consolidation of all commit histories - Merges all changes into a single commit You make the decision to use a git fetch request. Would this suffice as a solution?

Incorrect (Correct answer)
Correct

Correct answer: Incorrect

No, `git fetch` alone would not suffice. `git fetch` only downloads changes from the remote repository to your local repository without integrating them into your current branch. To consolidate all commit histories and merge changes into a single commit, you would typically use `git rebase -i` to squash multiple commits into one, or perform a squash merge during a pull request, which is a different operation than a simple fetch.

Question 6: A team needs to prevent deployments to production unless an Azure Monitor alert is in a healthy state. Which pipeline feature should they configure?

Azure Monitor release gate (Correct answer)
Retention policy
Branch protection rule
Pre-deployment approval

Correct answer: Azure Monitor release gate

The Azure Monitor release gate queries alert rules and blocks the deployment stage if any alerts are firing.

Question 7: What is the difference between a 'Runbook' gate and an 'Invoke Azure Function' gate in Azure Pipelines release pipeline?

Runbook gates require approval; Azure Function gates do not
Runbook gates execute Azure Automation runbooks; Azure Function gates invoke serverless HTTP-triggered functions (Correct answer)
Runbook gates run PowerShell directly on agents; Azure Function gates run in the cloud
There is no functional difference; both invoke scripts remotely

Correct answer: Runbook gates execute Azure Automation runbooks; Azure Function gates invoke serverless HTTP-triggered functions

The Runbook gate integrates with Azure Automation to run existing runbooks, while the Azure Function gate invokes an HTTP-triggered Azure Function for custom logic.

Question 8: A developer wants to run unit tests only when files in the 'src/' folder change. Which Azure Pipelines feature enables this?

Branch filters
Stage dependencies
Pipeline conditions
Path filters in trigger configuration (Correct answer)

Correct answer: Path filters in trigger configuration

Path filters in the trigger block (include/exclude paths) restrict pipeline execution to runs triggered by changes in specified directory paths.

Question 9: Which Azure Policy effect automatically deploys a resource or configuration to bring a non-compliant resource into compliance?

Deny
Append
DeployIfNotExists (Correct answer)
Audit

Correct answer: DeployIfNotExists

The DeployIfNotExists effect triggers a remediation deployment when a resource is found to be missing required configurations, automatically restoring compliance.

Question 10: What is the MOST effective way for new AZ-400 professionals to build competency in their field?

Combining formal education, mentored practice, and ongoing professional development (Correct answer)
Focusing solely on the most advanced topics
Studying certification materials exclusively
Learning entirely through trial and error

Correct answer: Combining formal education, mentored practice, and ongoing professional development

Building professional competency requires a multi-faceted approach: formal education provides foundational knowledge, mentored practice develops applied skills under guidance, and ongoing professional development ensures continuous growth and currency in the field.

Question 11: Which Microsoft security product integrates with Azure DevOps repositories to provide code scanning, secret scanning, and dependency review?

Microsoft Sentinel
Microsoft Defender for Cloud
GitHub Advanced Security (Correct answer)
Azure Security Center Classic

Correct answer: GitHub Advanced Security

GitHub Advanced Security (GHAS) provides code scanning (SAST), secret scanning, and dependency review and can be enabled on Azure DevOps repositories as well as GitHub.

Question 12: When implementing IaC in a CI/CD pipeline, what is the purpose of separating `terraform plan` and `terraform apply` into different pipeline stages?

It reduces the total time for Terraform operations by parallelizing work
It enables human review and approval of the planned changes before infrastructure is modified (Correct answer)
It allows Terraform to cache the provider plugins between stages
It prevents Terraform from needing write access to the state file during planning

Correct answer: It enables human review and approval of the planned changes before infrastructure is modified

Separating plan from apply allows teams to review exactly what infrastructure changes will occur and require approval gates before any modifications are made to production.

Question 13: A DevOps engineer wants to deploy an application to Azure App Service slots and then swap slots with zero downtime. Which task in Azure Pipelines performs the slot swap?

Azure CLI task with az webapp swap
Azure Web App task
Azure App Service Deploy
Azure App Service Manage (Correct answer)

Correct answer: Azure App Service Manage

The 'Azure App Service Manage' task includes a slot swap action that swaps staging and production slots with near-zero downtime.

Question 14: What is a sprint in Azure DevOps?

A time-boxed iteration for completing a set of work items (Correct answer)
A test plan
A type of build
A deployment stage

Correct answer: A time-boxed iteration for completing a set of work items

A sprint is a fixed-duration iteration during which the team commits to completing a specific set of work items.

Question 15: Your team uses Azure Artifacts with multiple feeds across different projects. To reduce duplication, you want packages from Feed A to be available in Feed B without republishing. What should you configure?

Merge both feeds into a single organization-scoped feed
Mirror Feed A to Feed B using a nightly pipeline
Add Feed A as an upstream source in Feed B (Correct answer)
Use a shared NuGet.Config pointing to both feeds in sequence

Correct answer: Add Feed A as an upstream source in Feed B

Adding Feed A as an upstream source in Feed B allows Feed B consumers to transparently access and cache packages from Feed A without manual republishing.

Question 16: In an Azure DevOps pipeline, you want to fail the build if any direct NuGet dependency has a known HIGH or CRITICAL vulnerability. Which integration achieves this most directly?

NuGet audit with '--audit-level high' flag in the restore command
OWASP Dependency-Check task with a CVSS threshold configured to fail on HIGH/CRITICAL (Correct answer)
Azure Defender for servers enabled on the build agent
Azure Policy assigned to the subscription

Correct answer: OWASP Dependency-Check task with a CVSS threshold configured to fail on HIGH/CRITICAL

The OWASP Dependency-Check Azure DevOps task scans NuGet packages and can be configured with a CVSS score threshold to fail the pipeline when HIGH or CRITICAL vulnerabilities are found.

Question 17: What is the role of a 'self-hosted agent' in Azure Pipelines compared to a Microsoft-hosted agent?

It runs on infrastructure you manage, allowing custom software and network access (Correct answer)
It automatically scales based on pipeline demand
It is free and has no job time limits
It runs faster due to dedicated Azure hardware

Correct answer: It runs on infrastructure you manage, allowing custom software and network access

Self-hosted agents run on your own VMs or containers, giving you control over installed tools, network connectivity, and persistent caches between runs.

Question 18: How does the AZ-400 body of knowledge relate to daily professional practice?

It provides the foundational framework that guides decision-making and standard practices (Correct answer)
It is relevant only for academic research
It is theoretical and has limited practical application
It only applies during certification exams

Correct answer: It provides the foundational framework that guides decision-making and standard practices

The body of knowledge provides the foundational framework of principles, standards, and best practices that professionals use to guide their daily decision-making, ensure consistent quality, and maintain alignment with industry standards.

Question 19: A pipeline deploys to production every time a commit is pushed to the main branch. The team wants a 30-minute soak period after staging before production deploys automatically. How is this implemented?

Configure a pre-deployment gate with a delay gate of 30 minutes (Correct answer)
Use a sleep task at the start of the production stage
Set a branch filter on the production artifact trigger
Add a scheduled trigger on the production stage

Correct answer: Configure a pre-deployment gate with a delay gate of 30 minutes

The 'Delay' release gate pauses the pipeline for a configurable duration before re-evaluating other gates and allowing the stage to proceed.

Question 20: What Azure DevOps feature supports Agile project management?

Repos only
Artifacts only
Azure Boards with work items and sprints (Correct answer)
Test Plans only

Correct answer: Azure Boards with work items and sprints

Azure Boards provides work item tracking, sprint planning, and Kanban boards for managing Agile projects within Azure DevOps.

Question 21: What is the recommended approach when a high-priority bug is discovered mid-sprint in a Scrum team using Azure Boards?

Immediately extend the sprint to accommodate the bug fix
Add the bug to the current sprint only after negotiating scope with the Product Owner (Correct answer)
Assign the bug to all developers simultaneously
Close the bug and open a new story for the next sprint

Correct answer: Add the bug to the current sprint only after negotiating scope with the Product Owner

In Scrum, unplanned work mid-sprint should be negotiated with the Product Owner, who may remove equivalent work to maintain sprint scope.

Question 22: What is the value of continuing education in monitoring and feedback for AZ-400 professionals?

It is only needed for recertification
It keeps professionals current with evolving standards and practices (Correct answer)
It is primarily a social activity
It replaces workplace experience

Correct answer: It keeps professionals current with evolving standards and practices

Continuing education ensures professionals stay current with the latest developments, standards, and best practices in their field.

Question 23: What Azure feature allows you to define governance rules that Azure resources must comply with, and can block non-compliant deployments?

Azure DevTest Labs
Azure Blueprints
Azure Policy (Correct answer)
Azure Monitor

Correct answer: Azure Policy

Azure Policy lets you create and assign policies that enforce organizational rules on resources; deployments that violate a Deny-effect policy are blocked automatically.

Question 24: How can you prevent a pipeline consumer from overriding a specific template parameter at queue time?

Set `allowOverride: false` on the variable group
Do not expose the value as a parameter; hardcode it inside the template (Correct answer)
Set the parameter as `secret: true`
Use the `readonly: true` attribute on the parameter

Correct answer: Do not expose the value as a parameter; hardcode it inside the template

Hardcoding values inside a template rather than exposing them as parameters prevents consumers from overriding those values.

Question 25: When configuring a multi-stage YAML pipeline, which keyword controls the condition under which a stage runs?

trigger
dependsOn
condition (Correct answer)
strategy

Correct answer: condition

The 'condition' keyword evaluates an expression at runtime to decide whether a stage or job should execute.

Question 26: Which Azure DevOps feature allows you to require a manual approval before a deployment proceeds to a production stage?

Artifact filter
Branch policy
Pre-deployment approval gate (Correct answer)
Service connection

Correct answer: Pre-deployment approval gate

Pre-deployment approvals in Azure Pipelines let you designate approvers who must sign off before a stage begins.

Question 27: Which deployment strategy in Azure Pipelines YAML should be used to deploy to a percentage of targets first, verify health, then roll out to the rest?

blueGreen
runOnce
rolling
canary (Correct answer)

Correct answer: canary

The 'canary' deployment strategy in YAML pipelines deploys to a defined percentage of targets first, allows health checks, then proceeds to the remaining targets.

Question 28: Which pip command generates a requirements.txt file that pins every installed package to its exact current version?

pip install --freeze
pip freeze > requirements.txt (Correct answer)
pip list --pinned > requirements.txt
pip export > requirements.txt

Correct answer: pip freeze > requirements.txt

'pip freeze' outputs all installed packages and their exact versions in requirements.txt format, enabling reproducible installs.

Question 29: Which practice in Agile and DevOps involves team members describing completed work and demonstrating it to stakeholders at the end of a sprint?

Sprint Retrospective
Backlog Refinement
Sprint Review (Correct answer)
Daily Standup

Correct answer: Sprint Review

The Sprint Review is a collaborative event where the team demonstrates completed work to stakeholders and gathers feedback to inform the backlog.

Question 30: What is the purpose of work item linking in Azure DevOps?

To assign permissions
To create builds
To delete work items
To establish relationships and traceability between work items (Correct answer)

Correct answer: To establish relationships and traceability between work items

Work item linking establishes relationships between items, enabling traceability from requirements through tasks to code changes and tests.

Question 31: What role does collaboration play in monitoring and feedback for AZ-400 professionals?

It reduces individual accountability
It slows down work unnecessarily
It is only needed in emergencies
It enhances outcomes through diverse perspectives and shared expertise (Correct answer)

Correct answer: It enhances outcomes through diverse perspectives and shared expertise

Collaboration leverages diverse perspectives and combined expertise to achieve better outcomes than any individual could alone.

AZ-400: Designing and Implementing Microsoft DevOps Solutions

The AZ-400 exam measures your ability to design and implement DevOps practices for version control, compliance, infrastructure as code, configuration management, build, release, and testing using Azure technologies. It is required for the Microsoft Certified: DevOps Engineer Expert certification.

Questions

35 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds