Free AZ-400 Practice Test Questions and Answers (2026)

View Mode
Q: 1

DRAG DROP You use an Azure pipeline to build a .NET app that has NuGet dependencies. You need to ensure that the pipeline caches required NuGet packages. How should you configure thepipeline? To answer, drag the appropriate values to the correct targets. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Microsoft AZ 400 question

Drag & Drop
16 comments in the community discussion
6
$(Build.SourcesDirectory)/**/packages.lock.json' for Bucket 1, $(Agent.OS) in Bucket 2, and $(NUGET_PACKAGES) for Bucket 3. This matches how Azure Pipelines cache NuGet packages with proper keys and restore. Pretty sure this is the standard setup unless the question asks for agent-specific keys.
3
This looks like one from my exam last year, on the official lab, keys line up with bucket order: lock file pattern, OS, then NUGET_PACKAGES.
Q: 2

HOTSPOT Your company uses Git as a source code control system for a complex app named App1. You plan to add a new functionality to App1. You need to design a branching model for the new functionality. Which branch lifetime and branch time should you use in the branching model? To answer, select the appropriate options in the answer area. NOTE:Each correct selection is worth one point. Microsoft AZ 400 question

Your Answer
16 comments in the community discussion
6
Is anyone using long-lived branches for this kind of work anymore, or is it always short-lived feature branches now? Just trying to see if there's a situation where that's not the best approach.
5
Short-lived feature branch here. Main reason is you only need the branch until the new functionality is done, then merge back to main. Long-lived branches are mostly for major ongoing streams or releases, which isn't the case. Sometimes people pick release branch by mistake but that's not for features. Pretty sure t
Q: 3

HOTSPOT Your company is building a new web application. You plan to collect feedback from pilot users on the features being delivered. All the pilot users have a corporate computer that has Google Chrome and the Microsoft Test & Feedback extension installed. Thepilot users will test the application by using Chrome. You need to identify which access levels are required to ensure that developers can request and gather feedback from the pilot users. The solution must use the principle of least privilege. Which access levels m Azure DevOps should you identify? To answer, select the appropriate options in the answer area NOTE: Each correct selection is worth one point. Microsoft AZ 400 question

Your Answer
23 comments in the community discussion
3
Basic for both. Saw this trap on a similar question where Stakeholder looks ok for pilot users, but with the Chrome extension and full feedback workflow, they also need Basic. I think that's right here but open to discussion.
2
Extension in Connected mode flips it, so both need Basic access.
Q: 4

DRAG DROP You need to replace the existing DevOps tools to support the planned changes. What should you use? To answer, drag the appropriate tools to the correct targets. Each tool may be usedonce, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE:Each correct selection is worth one point. Microsoft AZ 400 question

Drag & Drop
18 comments in the community discussion
6
Trello: Azure Boards, Bamboo: Azure Pipelines, BitBucket: GitHub repositories. This matches how the tools line up by function. I think that's what they're looking for but not 100% locked in, open to another view.
5
Yeah, same here: Trello goes to Azure Boards, Bamboo to Azure Pipelines, BitBucket to GitHub repositories.
Q: 5
You have a project in Azure DevOps named Project1. Project1 contains a build pipeline named Pipe1 that builds an application namedAppl. You have an agent pool named Pool1 that contains a Windows Server 2019-based self-hosted agent. Pipe1 uses Pool1. You plan to implement another project named Project2. Project2 will have a build pipeline named Pipe2 that builds an application namedApp2. App1 and App2 have conflicting dependencies. You need to minimize the possibility that the two build pipelines will conflict with each other. The solution must minimize infrastructure costs. What should you do?
Options
22 comments in the community discussion
6
Option A. not C. Adding another agent would cost more, trap option if you aren't careful.
2
A. Container jobs isolate dependencies on one agent, so no extra infra needed. Pretty sure that's the cheapest fix here.
Q: 6

DRAG DROP You have a GitHub organization. You ate creating a GitHub Actions workflow. You need to perform authenticated AP1 requests by using a GitHub app name App1. Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Microsoft AZ 400 question

Drag & Drop
31 comments in the community discussion
6
I remember a similar scenario from labs on a practice test, sequence is: Register App1 and store app ID, generate private key as secret, install App1 in org, then generate installation access token. That hits each setup stage for GitHub Apps with Actions. I think that's right here but let me know if anyone saw it di
6
Register App1 and store the app ID, generate a private key as secret, install App1 in org, generate installation access token.
Q: 7

DRAG DROP Your company plans to deploy an application to the following endpoints: • Ten virtual machines hosted in Azure. • Ten virtual machines hosted in an on-premises data center environment All the virtual machines have the- Azure Pipelines agent. You need to implement a release strategy for deploying the application to the endpoints. What should you recommend using to deploy the application to the endpoints? To answer, drag the appropriate components to the correct endpoint. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or soon to view content NOTE: Each correct selection n worth one point. Microsoft AZ 400 question

Drag & Drop
20 comments in the community discussion
8
Makes sense to use deployment groups for both the Azure and on-prem VMs here since all have the Pipeline agent. Management group/resource group don’t work across hybrid, and deployment group fits this setup. Pretty sure this is what Microsoft wants.
6
Ten Azure VMs: deployment group, On-prem VMs: deployment group. Resource group is tempting but only makes sense for Azure resources.
Q: 8

DRAG DROP You have a project in Azure DevOps named Project1 that has a release pipeline in Azure Pipeline named ReleaseP1. you need toensure that when a new release is generated for ReleaseP1, a new release note document is created. The release notes must contain new features and bug fixes. Which three actions should you perform in sequence? To answer, move the appropriate actions from the Most of actions to the answer area and arrange them r the correct order. NOTE: More than one order of answer choices is correct You will receive credit for any of the correct orders you select Microsoft AZ 400 question

Drag & Drop
33 comments in the community discussion
6
Actually, mapping should be: Create a query to pull features/bugs, then create the PAT for auth, then use a PowerShell task to write to markdown. Widget isn't needed if the requirement is generating a file. Anyone think otherwise?
6
Yeah, dashboard widget first (to fetch info), then create PAT so the script can access the data, and finish by adding a PowerShell task to actually build the markdown file. Pretty sure that covers the release note workflow here. If anyone thinks using the query step changes things let me know.
Q: 9

DRAG DROP You have a protect in Azure DevOps. You need to associate an automated testto a test case. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Microsoft AZ 400 question

Drag & Drop
19 comments in the community discussion
9
Create a test project → Check in the project to Azure DevOps → Add the automated test to a build pipeline.
6
Create a test project → Check in the project → Add the automated test to a build pipeline. Had something like this in a mock and this order matched their process, pretty sure that's it.
Q: 10

HOTSPOT You have an Azure subscription that contains an Azure key vault named Vault1. an Azure pipeline named Pipeline1, and an Azure SQL database named DB1. Pipeline1 is used to deploy an app that will authenticate to DB1 by using a password. You need to store the password in Vault1. The solution must ensure that the password can be accessed by Pipeline1. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Microsoft AZ 400 question

Your Answer
27 comments in the community discussion
6
Ugh, Azure loves to switch up between policies and RBAC in these questions. For this one, it's store as a secret and adjust access policies, since no RBAC requirement is mentioned. Seen similar on other practice sets.
6
Store as secret and update access policies, not RBAC. RBAC is a trap unless required specifically.
Q: 11
You use Azure SQL Database Intelligent Insights and Azure Application Insights foe monitoring. You need to write ad-hoc Queries against the monitoring data. Which Querylanguage should you use?
Options
8 comments in the community discussion
3
Option C Seen similar wording in practice exams, always points to Log Analytics for these monitoring queries.
Yep, C. That's the one for querying Azure monitoring data.
Q: 12
Your company hosts a web application in Azure. The company uses Azure Pipelines for the build and release management of the application. Stakeholders report that the past few releases have negatively affected system performance. You configure alerts in Azure Monitor. You need to ensure that new releases are only deployed to production if the releases meet defined performance baseline criteria in the staging environment first. What should you use to prevent the deployment of releases that fall to meet the performance baseline?
Options
3 comments in the community discussion
Pretty sure B here. A trigger in Azure Pipelines could help start the deployment process only when certain conditions are met, like after performance baselines are checked. Triggers are usually how you control when releases move forward. Not completely sure, but feels like that's what they're for in this scenario. Agre
Q: 13

HOTSPOT You have an Azure subscription that contains an Azure load testing instance named Test1 and an Azure App Service web app named App1. You implement a CI/CD pipeline named Pipeline1 that uses Test1. Pipeline1 uses the following alt- config-pipeline1.yam1 file. Microsoft AZ 400 question For each of the following statements, select Yes if thestatement is true, otherwise select No. Microsoft AZ 400 question

Your Answer
6 comments in the community discussion
5
Looks like the right pick is YES YES NO. The key is that the ramp-up is just 60 seconds, but the total duration is 180 seconds, so peak load runs for 120. If I missed anything let me know.
1
Yeah, it's YES YES NO here. Ramp-up is only 60 seconds, so peak lasts for 120 not just 60.
Q: 14

HOTSPOT Your company uses Team Foundation Server 2013 (TFS 2013). You plan to migrate to Azure DevOps. You need to recommend a migration strategy that meets the following requirements: Preserves the dates of Team Foundation Version Control changesets Preserves the changes dates of work items revisions Minimizes migration effort Migrates all TFS artifacts What should you recommend? To answer, select the appropriate options in the answerarea. NOTE:Each correct selection is worth one point. Microsoft AZ 400 question

Your Answer
4 comments in the community discussion
1
This looks like one from my exam last year. on a mock before. The right sequence is to upgrade TFS to the latest RTW version, then use the Database Import Service for migration. This method keeps all dates and history intact with minimal manual work.
Upgrade TFS to the latest RTW release on-prem first, then use Database Import Service for the migration.
Q: 15

HOTSPOT You have a virtual machine that runs Windows Server 2019 and is managed by using Desired State Configuration (DSC). You have the following DSC configuration. Microsoft AZ 400 question You have the following Local Configuration Manager (LCM) configuration. Microsoft AZ 400 question For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Microsoft AZ 400 question

Your Answer
5 comments in the community discussion
4
No for statement 1, No for statement 2, Yes for statement 3
Hmm, I think statement 2 is actually Yes. In ApplyAndMonitor mode, it should keep watching and apply if there are changes. Not totally sure about statement 1 though, might have mixed up the direction of the copy.
Q: 16

DRAG DROP You have a GitHub organization named org1 and an Azure tenant named Tenant1. You need to enable single sign-on (SSO) in Azure Active Directory (Azure AD) for the users in org1. Which URIs should you use for the SAML configuration in Azure AD? To answer, drag the appropriate URIs to the correct settings. Each URImay be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE:Each correct selection is worth one point. Microsoft AZ 400 question

Drag & Drop
3 comments in the community discussion
8
Hmm, you actually need https://github.com/orgs/org1 for both Entity ID and Sign on URL, then https://github.com/orgs/org1/saml/consume for Reply URL. If they swapped the SAML consumer with the org root, it would break SSO so this is pretty strict matching.
1
Identifier: https://github.com/orgs/org1, Reply URL: https://login.microsoftonline.com/tenant1, Sign on URL: https://github.com/orgs/org1. Pretty sure the login.microsoftonline one is needed here.
Q: 17

SIMULATION Task 7 You need to prepare a network security group (NSG) named az400 38443478 nsgl to host an Azure DevOps pipeline agent. The solution must allow only the required outbound port for Azure DevOps and deny all other inbound and outbound access to the Internet

Your Answer
8 comments in the community discussion
3
Allow outbound TCP 443 to AzureDevOps service tag, everything else denied. This matches what I saw in a practice exam and aligns with least privilege for pipeline agents. Pretty sure that's the most secure config, unless AzureDevOps tag isn't available.
2
Makes sense, outbound TCP 443 to AzureDevOps tag is best if available, otherwise use Internet. Inbound deny usually default. Agree?
Q: 18

You plan to create an image that will contain a .NET Core application. You have a Dockerfile file that contains the following code. (Line numbers are included for reference only.) Microsoft AZ 400 question You need to ensure that the image is as small as possible when the image is built. Which line should you modify in the file?

Options
5 comments in the community discussion
1
C imo
B. not C
Q: 19

HOTSPOT You use Azure Pipelines lo manage the build and deployment of apps. You are planning the release strategies for a new app. You need to choose strategies for the following scenarios: • Releases will be made available to users who are grouped by their tolerance for software faults. • Code will be deployed to enable functionality that will be available in later releases of the app. • When a new release occurs, the existing deployment will remain active to minimize recovery time if a return to the previous version is required. Microsoft AZ 400 question

Your Answer
5 comments in the community discussion
4
Progressive exposure, feature flags, blue/green.
Progressive rollout, feature toggles, and canary deployment. I think these fit here because canary is for minimizing rollback time right? Not totally sure about the last one, someone double-check me.
Q: 20

HOTSPOT You have an Azure subscription that contains multiple web apps. You need to enable Change Analysis for the web apps. How should you complete the script? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Microsoft AZ 400 question

Your Answer
5 comments in the community discussion
5
Register-AzResourceProvider for Microsoft.ChangeAnalysis, then Set-AzResource for tagging. That's the proper order in Azure context here.
3
Is Register-AzResourceProvider needed for Microsoft.ChangeAnalysis or just Set-AzResource with the right tag here?
Question 1 of 20

What's covered in this practice questions set

3: Design and implement build and release pipelines · 9 questions

📖 About this Domain

This domain focuses on automating your software delivery lifecycle using Azure Pipelines. You will learn to construct CI/CD workflows that build, test, and deploy applications. The core is designing and implementing robust build and release automation.

🎓 What You Will Learn

  • You will learn to design and implement a pipeline strategy using YAML and the classic UI editor.
  • You will learn to integrate source control systems like Azure Repos and GitHub to trigger automated builds.
  • You will learn to configure and manage build infrastructure, including Microsoft-hosted and self-hosted agents.
  • You will learn to implement advanced release strategies like canary and blue-green deployments using release pipelines and deployment groups.

🛠️ Skills You Will Build

  • You will build the skill to author complex, multi-stage CI/CD pipelines using YAML syntax.
  • You will build skills in managing build artifacts and implementing a package management strategy with Azure Artifacts.
  • You will build the ability to integrate security and quality validation into your pipelines using release gates and static code analysis tools.
  • You will build the skill to orchestrate complex deployments across multiple environments with approvals and automated checks.

💡 Top Tips to Prepare

  • Focus on hands-on labs creating both YAML and classic release pipelines in an Azure DevOps organization.
  • Master the YAML pipeline schema, including triggers, variables, stages, jobs, and steps.
  • Understand the technical implementation of deployment patterns like blue-green, canary, and rolling deployments within Azure Pipelines.
  • Differentiate between Microsoft-hosted and self-hosted agents, including their use cases, capabilities, and configuration.

4: Develop a security and compliance plan · 6 questions

📖 About this Domain

This domain covers the implementation of DevSecOps to embed security and compliance into the CI/CD pipeline. It focuses on managing sensitive information, automating security validation, and ensuring governance. The core objective is to shift security left in the development lifecycle.

🎓 What You Will Learn

  • You will learn to design and implement a strategy for managing secrets, keys, and certificates using Azure Key Vault.
  • You will learn to integrate open-source software security analysis using tools like WhiteSource Bolt or GitHub Dependabot.
  • You will learn to implement static application security testing (SAST) and dynamic application security testing (DAST) in the pipeline.
  • You will learn to configure pipelines to enforce security and compliance checks using release gates and Azure Policy.

🛠️ Skills You Will Build

  • You will build the skill to configure Azure Pipelines to securely access secrets from Azure Key Vault during runtime.
  • You will build the ability to integrate and automate security scanning tools for code and dependencies within a YAML pipeline.
  • You will build proficiency in configuring security and compliance validation as a quality gate in a release pipeline.
  • You will build the capability to design a holistic DevSecOps strategy that includes threat modeling and infrastructure compliance.

💡 Top Tips to Prepare

  • Gain hands-on experience by creating a pipeline that uses a variable group linked to Azure Key Vault to manage secrets.
  • Practice integrating a security scanner extension like SonarCloud or Mend Bolt from the Azure DevOps Marketplace into a build pipeline.
  • Review the Microsoft Learn modules on implementing security in DevOps and understand the role of Azure Security Center.
  • Understand the difference between SAST, DAST, and Software Composition Analysis (SCA) and where each fits in the pipeline.

1: Configure processes and communications · 4 questions

📖 About this Domain

This domain focuses on configuring project tracking and team communication within Azure DevOps. You will learn to manage work items using Azure Boards and integrate collaboration tools to streamline development workflows.

🎓 What You Will Learn

  • Configure Azure Boards to manage backlogs, sprints, and work items using Agile, Scrum, and CMMI process templates.
  • Create and configure dashboards and wikis to provide project visibility and centralized documentation.
  • Set up notifications and subscriptions to keep stakeholders informed about project events and pipeline status.
  • Integrate external communication tools like Microsoft Teams and Slack using service hooks for real-time updates.

🛠️ Skills You Will Build

  • Ability to customize process templates and configure team backlogs, boards, and sprints for effective work management.
  • Proficiency in creating shared team dashboards with configurable widgets for monitoring project health and progress.
  • Skill in configuring service hooks to automate communication between Azure DevOps and third-party services.
  • Competence in managing project wikis to foster a collaborative knowledge-sharing environment.

💡 Top Tips to Prepare

  • Practice creating and customizing work items, queries, and backlogs in an Azure DevOps organization.
  • Master the configuration of service hooks by connecting Azure DevOps to a Microsoft Teams or Slack channel.
  • Build complex dashboards using various widgets like query results, burndown charts, and pipeline overviews.
  • Understand the differences between the Agile, Scrum, and CMMI process templates and when to use each.

5: Implement an instrumentation strategy · 1 questions

📖 About this Domain

This domain covers designing and implementing feedback mechanisms for development teams. It focuses on configuring monitoring services and telemetry collection to analyze application performance, system health, and user behavior.

🎓 What You Will Learn

  • You will learn to configure monitoring and logging using Azure Monitor and Application Insights for comprehensive telemetry.
  • You will learn to analyze telemetry data to create dashboards and reports for stakeholder feedback.
  • You will learn to implement routing for crash report data from client-side applications using services like App Center.
  • You will learn to design and implement a logging strategy using structured logging and log aggregation techniques.

🛠️ Skills You Will Build

  • You will build the skill to instrument an application with the Application Insights SDK to capture custom events and metrics.
  • You will build the skill to query log data using Kusto Query Language (KQL) within a Log Analytics workspace.
  • You will build the skill to create and share dashboards in the Azure Portal to visualize application health and performance.
  • You will build the skill to configure alert rules in Azure Monitor based on specific metrics or log search queries.

💡 Top Tips to Prepare

  • Focus on the practical implementation of Application Insights, including its SDK, codeless attachment, and availability tests.
  • Master Kusto Query Language (KQL) as it is essential for analyzing logs and creating alerts in Azure Monitor.
  • Understand the differences and use cases for Azure Monitor metrics versus logs for effective alerting and monitoring strategies.
  • Practice configuring App Center diagnostics to handle crash reporting and analytics for client applications.

2: Design and implement source control

📖 About this Domain

This domain focuses on designing and implementing source control strategies using Git within Azure Repos. You will learn how to structure repositories and manage branching workflows to support enterprise DevOps practices.

🎓 What You Will Learn

  • Learn to develop a modern source control strategy, including selecting between centralized and distributed version control systems like Git.
  • Understand how to plan and implement branching strategies such as GitFlow, GitHub Flow, and release flow for your source code.
  • Discover how to configure and manage repositories in Azure Repos, including setting up branch policies and permissions.
  • Explore methods to integrate source control with external tools and manage large binary files using Git LFS.

🛠️ Skills You Will Build

  • You will build the skill to design a scalable Git branching model that enforces code quality through pull requests and branch policies.
  • You will be able to structure monorepos and multiple repositories to optimize build pipelines and manage dependencies.
  • You will gain proficiency in securing repositories by configuring branch policies, permissions, and requiring signed commits.
  • You will learn to handle large files in Git repositories efficiently by implementing and configuring Git LFS.

💡 Top Tips to Prepare

  • Master Git commands and concepts, especially branching, merging, and rebasing, through hands-on practice in a local environment and Azure Repos.
  • Focus on understanding the pros and cons of different branching strategies like GitFlow versus Trunk-Based Development for various project types.
  • Practice configuring branch policies in Azure Repos, including setting up required reviewers, build validation, and status checks.
  • Review Microsoft Learn modules on managing source control with Git and Azure Repos to understand best practices for repository structure and security.

Premium Access Includes

  • ✓Quiz Simulator
  • ✓Exam Mode
  • ✓Progress Tracking
  • ✓Question Saving
  • ✓Flash Cards
  • ✓Drag & Drops
  • ✓3 Months Access
  • ✓PDF Downloads
Get Premium Access
Scroll to Top

FLASH OFFER

Days
Hours
Minutes
Seconds

avail 10% DISCOUNT on YOUR PURCHASE

  • USE THE CODE GIVEN BELOW ON YOUR CHECKOUT
DISCOUNT10