AZ-400 sample exam questions

15 exam-style questions for Microsoft AZ-400: DevOps Engineer, with answers and explanations. Take them as a timed practice exam first if you want a score out of 1000.

Take the free practice exam AZ-400 exam guide
  1. Question 1Single choiceTopic 1
    Your company makes use of Azure SQL Database Intelligent Insights and Azure Application Insights for monitoring purposes.
    You have been tasked with analyzing the monitoring using ad-hoc queries. You need to utilize the correct query language.
    Solution: You use the Contextual Query Language (CQL).
    Does the solution meet the goal?
    1. A
      Yes
    2. B
      No
    Show answer

    Correct answer: B

    Why

    Contextual Query Language is a standard for searching library and catalog systems and is not used by Application Insights or SQL Intelligent Insights. Ad-hoc analysis there uses Kusto Query Language, so this does not meet the goal.

  2. Question 2Multiple responseTopic 2
    Your company has multiple microservices-based apps that use the following tracing libraries:

    • OpenTelemetry
    • OpenCensus
    • OpenTracing
    • Honeycomb
    • Jaeger

    The company purchases an Azure subscription and implements Application Insights in Azure Monitor.

    You plan to centralize distributed tracing for the apps.

    You need to identify which libraries can integrate directly with Application Insights.

    Which two libraries should you identify? Each correct answer presents a complete solution.

    NOTE: Each correct solution is worth one point.
    1. A
      Honeycomb
    2. B
      OpenTracing
    3. C
      Jaeger
    4. D
      OpenTelemtry
    5. E
      OpenCensus
    Show answer

    Correct answer: D, E

    Why

    Application Insights integrates directly with OpenTelemetry (via the Azure Monitor exporter or distro) and OpenCensus exporters. Honeycomb, Jaeger and OpenTracing are not direct Application Insights integrations and would need conversion or a collector.

  3. Question 3Drag and dropTopic 2
    DRAG DROP

    You have a web app named App1 that uses Application Insights in Azure Monitor to store log data. App1 has users in multiple locations.

    You need to query App1 requests from London and Paris that return a 404 error. The solution must meet the following requirements:
    • Return the timestamp url, resultCode, and duration fields
    • Only show requests made during the last hour.

    How should you complete the query? To answer, drag the appropriate values to the correct targets. Each value may be used once, more than once, or not at all.

    Move each item to the matching row:

    • extend
    • project
    • select
    • timestamp >= ago(1hr)
    • timestamp -gt ago(1hr)
    • | where
    • | ... timestamp, url, resultCode, duration
    Show answer
    • | where timestamp >= ago(1hr)
    • | ... timestamp, url, resultCode, duration project
    Why

    KQL uses comparison operators such as >=, while -gt is PowerShell syntax, so timestamp >= ago(1hr) filters to the last hour. project returns only the listed columns; KQL has no select operator and extend would add columns rather than limit them.

  4. Question 4Multiple responseTopic 3
    You have an Azure subscription that contains multiple Azure services.
    You need to send an SMS alert when scheduled maintenance is planned for the Azure services.
    Which two actions should you perform? Each correct answer presents part of the solution.
    NOTE: Each correct selection is worth one point.
    1. A
      Enable Azure Security Center.
    2. B
      Create and configure an Azure Monitor alert rule.
    3. C
      Create an Azure Service Health alert.
    4. D
      Create and configure an action group.
    Show answer

    Correct answer: C, D

    Why

    A Service Health alert fires for planned maintenance on Azure services, and an action group supplies the SMS notification. A generic Monitor alert rule is not needed for service health events, and Security Center is unrelated.

  5. Question 5Single choiceTopic 4
    You have an Azure DevOps organization named Contoso that contains a project named Project1.
    You provision an Azure key vault named Keyvault1.
    You need to reference Keyvault1 secrets in a build pipeline of Project1.
    What should you do first?
    1. A
      Add a secure file to Project1.
    2. B
      Create an XAML build service.
    3. C
      Create a variable group in Project1.
    4. D
      Configure the security policy of Contoso.
    Show answer

    Correct answer: C

    Why

    A variable group in Project1 can be linked to Azure Key Vault, using an Azure service connection, so pipelines reference the vault secrets. Secure files hold files, not secrets, and XAML builds or org security policy do not provide this link.

  6. Question 6Drag and drop: orderTopic 4
    DRAG DROP

    You have an Azure Repos repository named Repo1 that is used for source control.

    You need to configure code scanning for Repo1.

    Which three tasks should the pipeline perform in sequence? To answer, move the appropriate tasks from the list of tasks to the answer area and arrange them in the correct order.

    Arrange 3 of these in the correct order:

    • Advanced Security Dependency Scanning
    • Advanced Security Initialize CodeQL
    • Advanced Security AutoBuild
    • Microsoft Purview Scan
    • Advanced Security Perform CodeQL Analysis
    Show answer
    1. Advanced Security Initialize CodeQL
    2. Advanced Security AutoBuild
    3. Advanced Security Perform CodeQL Analysis
    Why

    GitHub Advanced Security for Azure DevOps runs code scanning with CodeQL. The pipeline first initializes CodeQL, then builds the code with AutoBuild, and then runs the CodeQL analysis. Dependency scanning is a separate feature, and Purview scans data, not code.

  7. Question 7Single choiceTopic 5
    You have a public GitHub repository named Public1.

    A commit is made to Public1. The commit contains a pattern that matches a regular expression.

    Who is notified first when the commit is made?
    1. A
      the administrator of the GitHub organization
    2. B
      the committer
    3. C
      the owner of Public1
    4. D
      the secret scanning partner
    Show answer

    Correct answer: D

    Why

    With secret scanning on public repositories, a matching token is reported to the secret scanning partner (the service provider) first, so it can revoke the credential. Owners and committers are notified afterward, if at all.

  8. Question 8Drag and dropTopic 5
    DRAG DROP

    You have a large repository named Repo1 that contains a directory named directory1.

    You plan to modify files in directory1.

    You need to create a clone of Repo1. The solution must minimize the amount of transferred data.

    How should you complete the script? To answer, drag the appropriate values to the correct targets. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

    NOTE: Each correct selection is worth one point.

    Move each item to the matching row:

    • git clone
    • git fetch
    • git sparse-checkout
    • git worktree
    • scalar clone
    • scalar run
    • ___ https://dev.azure.com/organisation/_git/Repo1
    • ___ set directory1
    Show answer
    • ___ https://dev.azure.com/organisation/_git/Repo1 scalar clone
    • ___ set directory1 git sparse-checkout
    Why

    scalar clone makes a partial (blobless) clone with sparse checkout turned on, so only root files are downloaded at first. git sparse-checkout set directory1 then adds just that directory to the working tree, which keeps the amount of transferred data small.

  9. Question 9Single choiceTopic 6
    You manage a project by using Azure Board, and you manage the project code by using Azure Repos.

    You have a bug work item that has an ID of 123.

    You need to set the work item state to Resolved.

    What should you add to the commit message?
    1. A
      #123 completes
    2. B
      Resolves #AB-123
    3. C
      Verifies #123
    4. D
      Fixes #123
    Show answer

    Correct answer: D

    Why

    Azure Boards recognizes commit keywords such as Fixes, Fixed or Fix followed by #ID and moves the bug to the resolved state. Resolves with an AB- prefix and Verifies are not the right syntax, and #123 completes is not a keyword pattern.

  10. Question 10Single choiceTopic 7
    Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might
    meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
    After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
    Your company uses Azure DevOps to manage the build and release processes for applications.
    You use a Git repository for applications source control.
    You need to implement a pull request strategy that reduces the history volume in the master branch.
    Solution: You implement a pull request strategy that uses an explicit merge.
    Does this meet the goal?
    1. A
      Yes
    2. B
      No
    Show answer

    Correct answer: B

    Why

    An explicit (no-fast-forward) merge keeps all the topic branch commits and adds a merge commit, so it increases history volume. This does not meet the goal.

  11. Question 11Single choiceTopic 8
    Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might
    meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
    After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
    You have an approval process that contains a condition. The condition requires that releases be approved by a team leader before they are deployed.
    You have a policy stating that approvals must occur within eight hours.
    You discover that deployment fail if the approvals take longer than two hours.
    You need to ensure that the deployments only fail if the approvals take longer than eight hours.
    Solution: From Post-deployment conditions, you modify the Timeout setting for post-deployment approvals.
    Does this meet the goal?
    1. A
      Yes
    2. B
      No
    Show answer

    Correct answer: B

    Why

    The approval that gates deployment is the pre-deployment approval. Changing the timeout for post-deployment approvals does not affect the two hour failure, so this does not meet the goal.

  12. Question 12Drag and drop: orderTopic 8
    DRAG DROP

    You have a project in Azure DevOps named Project that has a release pipeline in Azure Pipeline named ReleaseP1.

    You need to ensure that when a new release is generated for ReleaseP1, a new release note document is created. The release notes must contain new features and bug fixes.

    Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

    NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select.

    Arrange 3 of these in the correct order:

    • Create a personal access token (PAT).
    • Create a service principal.
    • Create a PowerShell task in ReleaseP1 that writes the retrieved data to a markdown file.
    • Create a query that retrieves the feature and bug fix information.
    • Add a dashboard widget that retrieves the feature and bug fix information.
    Show answer
    1. Create a personal access token (PAT).
    2. Create a query that retrieves the feature and bug fix information.
    3. Create a PowerShell task in ReleaseP1 that writes the retrieved data to a markdown file.
    Why

    The PowerShell task calls the Azure DevOps REST API with a PAT to run a work item query that returns the features and bugs, then writes the results to a markdown release notes file. The PAT and the query can be created in either order.

  13. Question 13Single choiceTopic 9
    You have a project in Azure DevOps named Project1. Project1 contains a build pipeline named Pipe1 that builds an application named App1.

    You have an agent pool named Pool1 that contains a Windows Server 2022-based self-hosted agent. Pipe1 uses Pool1.

    You plan to implement another project named Project2. Project2 will have a build pipeline named Pipe2 that builds an application named App2.

    App1 and App2 have conflicting dependencies.

    You need to minimize the possibility that the two build pipelines will conflict with each other. The solution must minimize infrastructure costs.

    What should you do?
    1. A
      Add another self-hosted agent.
    2. B
      Add a Docker Compose task to the build pipelines.
    3. C
      Change the self-hosted agent to use Red Hat Enterprise Linux (RHEL) 9.
    4. D
      Create two container jobs.
    Show answer

    Correct answer: D

    Why

    Container jobs run each pipeline inside its own container image on the same agent, isolating conflicting dependencies without more infrastructure. Another agent costs more, and changing the OS or adding Docker Compose does not isolate the dependencies.

  14. Question 14Drag and dropTopic 9
    DRAG DROP

    You use Semantic Versioning (SemVer) as a dependency versioning strategy.

    You perform changes to code as shown in the following table.



    Which part of the version should you increment for each change? To answer, drag the appropriate parts to the correct changes. Each part may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

    NOTE: Each correct selection is worth one point.

    Move each item to the matching row:

    • Major
    • Minor
    • Patch
    • Change1:
    • Change2:
    • Change3:
    Show answer
    • Change1: Minor
    • Change2: Major
    • Change3: Patch
    Why

    New functionality with only minor impact on compatibility is a Minor bump. A significant incompatible change needs a Major bump. A change that adds no new functionality and has minor impact, such as a fix, is a Patch.

  15. Question 15Single choiceTopic 16
    You need to perform the GitHub code migration. The solution must support the planned changes for the DevOps environment.
    What should you use?
    1. A
      git clone
    2. B
      GitHub Importer
    3. C
      Import repository in Azure Repos
    4. D
      git-tfs
    Show answer

    Correct answer: B

    Why

    GitHub Importer is the built-in GitHub tool for importing a repository, including from TFVC, Subversion or Mercurial, and it preserves history. git clone and Azure Repos import do not migrate into GitHub, and git-tfs is a manual tool. Community votes are split, so verify against the case study.