8 AZ-400 Practice Questions That Mirror the Real Exam
Here are 8 multiple-choice questions designed to match the difficulty and style of the AZ-400 (Microsoft DevOps Solutions) exam. They cover key domains including source control, CI/CD, infrastructure as code, and observability.
Question 1
Your team uses GitHub for source control. You need to enforce a policy where all code changes require a successful build and at least one approval before merging into the main branch. You also need to ensure that the build runs automatically when a pull request is created. Which two GitHub features should you configure? (Choose two.) Want to go further? 8 AI-102 Practice Questions That Mirror the Real Exam is a good next step.
For a quick assessment of your AZ-400 weak areas, use the free AZ-400 readiness check, which gives you a short set of practice questions and an explanation for each.
A. Branch protection rules
B. Repository webhooks
C. GitHub Actions workflow
D. Environment protection rules
Answer: A, C
Explanation: Branch protection rules enforce the requirement for pull request reviews and status checks (like a successful build) before merging. GitHub Actions is the service used to define the workflow that triggers the build automatically on pull_request events. Webhooks are for external notifications, and environment protection rules apply to deployment stages, not branch merging.
Question 2
You are designing a CI pipeline for a .NET application. You need to ensure that the build process runs on a Linux agent but the release process runs on a Windows agent. You are using Azure Pipelines. How should you configure the pipeline to achieve this separation?
A. Use a single pipeline with a multi-job strategy and run the build and release in different jobs.
B. Create two separate pipelines and manually trigger the release pipeline after the build completes.
C. Use a single pipeline with two stages, defining pool: vmImage: 'ubuntu-latest' for the build stage and pool: vmImage: 'windows-latest' for the release stage.
D. Use a self-hosted agent pool that contains both Linux and Windows agents, and let Azure Pipelines decide which agent to use.
Answer: C
Explanation: Azure Pipelines supports multi-stage YAML pipelines where each stage can have its own agent pool specification. Defining the pool at the stage level ensures the build runs on Linux and the release runs on Windows. A multi-job strategy is for parallel jobs, not sequential stage separation. Manual triggers and self-hosted pools with mixed OS types do not guarantee the OS-specific execution.
Question 3
You are implementing a container strategy for a microservices application. You need to manage the container images, enforce vulnerability scanning, and control access to images across multiple Azure regions. Which Azure service should you use?
A. Azure Container Instances (ACI)
B. Azure Container Registry (ACR)
C. Azure Kubernetes Service (AKS)
D. Azure Container Apps
Answer: B Looking for more detail? See 8 AWS CloudOps Engineer Practice Questions That Mirror the Real Exam.
Explanation: Azure Container Registry is the managed registry service that offers geo-replication for multi-region access, integrated vulnerability scanning (via Defender for Cloud), and role-based access control (RBAC) for image permissions. ACI and AKS are compute platforms that run containers, while Container Apps is a serverless container hosting service; none of these manage the images themselves.
Question 4
Your team is adopting Infrastructure as Code (IaC) using Terraform. You need to ensure that state files are stored centrally, support locking to prevent concurrent modifications, and are encrypted at rest. Which backend configuration should you use?
A. Local backend with a .gitignore file
B. Azure Storage account with container and blob leasing
C. Terraform Cloud's free tier with public state
D. AWS S3 bucket with versioning
Answer: B
Explanation: Azure Blob Storage supports native state file locking via blob leases and provides encryption at rest by default, making it a valid remote backend. A local backend lacks locking and central storage. Terraform Cloud free tier requires private state (public is insecure). S3 is valid but not an Azure-specific solution for an Azure-focused team.
Question 5
You are configuring a continuous deployment (CD) pipeline in Azure Pipelines. You need to deploy a web app to Azure App Service only if the build from the release branch succeeds. You also need to add a manual approval step before the production deployment. Which YAML approach should you use?
A. Use a single stage with a condition: eq(variables['Build.SourceBranch'], 'refs/heads/release') and add a manual validation task.
B. Use two stages: Build and Deploy. Add a condition on the Deploy stage to check the source branch, and add an environment with an approval check.
C. Use a build pipeline and a separate release pipeline, linking them with a pipeline resource.
D. Use a stage-level dependsOn condition and a preDeploy hook.
Answer: B
Explanation: Stage-level conditions allow you to gate the entire deploy stage based on the source branch. Environments in Azure Pipelines provide the mechanism for manual approval checks. Option A is incorrect because manual validation tasks are interactive and not ideal for production gates. Option C is a classic approach but doesn't leverage YAML stages. Option D is not a valid YAML construct.
Question 6
Your application uses Azure Application Insights for monitoring. You need to create a custom dashboard that shows the server response time, the number of failed requests, and the exception count over the last 24 hours. You want to write a single query to retrieve this data. Which Application Insights query language should you use?
A. SQL
B. Kusto Query Language (KQL)
C. PowerShell For more on this topic, see our guide on 8 AWS Developer Associate Practice Questions That Mirror the Real Exam.
D. Azure Resource Manager (ARM) templates
Answer: B
Explanation: Application Insights uses Kusto Query Language (KQL) for log and metric queries. It allows you to combine data from requests, exceptions, and performanceCounters tables in a single query using filters and aggregations. SQL is not supported. PowerShell is for automation, and ARM templates are for infrastructure deployment, not data querying.
Question 7
You are implementing a security review process in your CI pipeline. You need to analyze the source code for known vulnerable dependencies and secrets (like API keys) before the code is merged. Which two tools should you integrate into your GitHub Actions workflow?
A. GitHub Dependency Graph
B. GitHub CodeQL
C. GitHub Secret Scanning
D. GitHub Dependabot alerts
Answer: B, C
Explanation: CodeQL is GitHub's code scanning engine that can detect vulnerabilities in code and dependencies, and it can be run in CI. Secret Scanning actively scans for hardcoded secrets (e.g., passwords, tokens) in the repository. Dependency Graph and Dependabot alerts are passive, reporting features that show vulnerabilities but do not actively block the build or run in CI.
Question 8
Your team is using Azure DevOps. You need to implement a strategy to manage feature toggles for a new feature that will be rolled out gradually to 10% of users, then 50%, and finally 100%. You want to avoid a separate deployment for each percentage change. Which Azure DevOps feature should you use?
A. Azure App Configuration with feature flags
B. Azure DevOps Test Plans
C. Release gates in Azure Pipelines
D. Variable groups in Azure Pipelines
Answer: A
Explanation: Azure App Configuration provides managed feature flags with built-in percentage-based rollout (telemetry and filters). You can change the percentage dynamically without redeploying code. Test Plans is for manual testing. Release gates are for automated quality checks before deployment, and variable groups are for static configuration values, not dynamic runtime feature control.
These questions represent the analytical depth and breadth of the AZ-400 exam. Focus on understanding why a service is chosen over its alternatives, as the exam often tests your decision-making ability in complex scenarios rather than simple recall.
To structure that focus into a prep schedule that fits your time, use the free AZ-400 study plan and get a week-by-week plan weighted by the official topic areas.
Gauge your exam readiness with Designing and Implementing Microsoft DevOps Solutions (AZ-400) mock exam and pinpoint the topics that still need work.