AZ-400: Azure DevOps Engineer Expert Practice Exam

What the AZ-400 exam covers

• Configure Processes and Communications127 questions
• Design and Implement Source Control139 questions
• Design and Implement Build and Release Pipelines146 questions
• Develop a Security and Compliance Plan133 questions
• Implement an Instrumentation Strategy120 questions

Free AZ-400 sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 665.

1. Question 1Configure Processes and Communications

   Your organization uses Azure Boards and needs to enforce that every pull request is linked to a work item before it can be completed. Which setting should you configure?

   • ACreate a custom pipeline gate that checks for work item links
   • BEnable branch policies requiring linked work items on the target branchCorrect
   • CConfigure a service hook to block PRs without work items
   • DSet up a compliance policy in Azure Policy for the DevOps organization
   ✓ Correct answer: B

   Branch policies in Azure DevOps provide a native mechanism to enforce governance rules at the source control level. By configuring a branch policy that requires work item links, Azure DevOps automatically blocks pull request completion until all linked work items are attached, ensuring traceability and maintaining project discipline without requiring custom code or external tools.

   Why the other options are wrong

   • ACreate a custom pipeline gate that checks for work item links is incorrect because while gates can add validation, branch policies are the purpose-built Azure DevOps feature for enforcing work item requirements on pull requests.
   • CConfigure a service hook to block PRs without work items is incorrect because service hooks trigger external notifications or webhooks, not enforcement mechanisms that prevent pull request completion.
   • DSet up a compliance policy in Azure Policy for the DevOps organization is incorrect because Azure Policy governs Azure infrastructure resources, not Azure DevOps pull request requirements.
2. Question 2Configure Processes and CommunicationsSelect all that apply

   Your DevOps team is implementing a feedback loop from production back to the development process. They need to ensure that production incidents automatically create bug work items in Azure DevOps, and that these bugs are prioritized in the team's current sprint backlog. Which TWO configurations should you implement?

   • AConfigure Azure Monitor action groups to call the Azure DevOps REST API via a Logic App, creating bug work items with incident details when critical alerts fireCorrect
   • BConfigure email notifications from Azure Monitor and ask developers to create bugs from email content
   • CSet up Azure Boards rules to automatically assign newly created bugs from alerts to the current sprint iteration path based on priorityCorrect
   • DAssign a team member to manually check Azure Monitor alerts daily and create work items
   ✓ Correct answer: A, C

   Implementing a production-to-development feedback loop requires two automations. First, when Azure Monitor fires a critical alert, an action group triggers a Logic App that calls the Azure DevOps REST API to create a bug work item. The Logic App maps incident metadata (alert name, severity, affected resource) into the bug work item fields, creating a complete incident record in the development backlog. Second, Azure Boards rules automatically assign incoming bugs to the current sprint if they meet criteria (e.g., priority is Critical), ensuring urgent production issues are visible and prioritized in the current work cycle. This automated pipeline ensures production incidents surface immediately to the development team without manual handoffs.

   Why the other options are wrong

   • BConfigure email notifications from Azure Monitor and ask developers to create bugs from email content is incorrect because manual work item creation from emails is error-prone, introduces delays, and loses incident metadata that could be captured programmatically.
   • DAssign a team member to manually check Azure Monitor alerts daily and create work items is incorrect because this is labor-intensive, introduces delays, and relies on manual transcription of incident information.
3. Question 3Design and Implement Source Control

   What is a Git submodule used for?

   • ACI/CD pipelines
   • BCode reviews
   • CBranching strategies
   • DIncluding external repositories within a repositoryCorrect
   ✓ Correct answer: D

   A submodule lets one Git repository embed another repository at a specific commit inside a subdirectory, while keeping the two repositories' histories separate. This is how teams pull in a shared library or third-party component as a pinned dependency without copying its source. The parent repository records the exact submodule commit so checkouts are reproducible. The mechanism is purely about composing repositories, not about pipelines, reviews, or branching.

   Why the other options are wrong

   • ACI/CD pipelines automate build, test, and deployment; they are unrelated to how Git embeds one repository inside another.
   • BCode reviews are a collaboration workflow (typically via pull requests) and have nothing to do with the submodule mechanism.
   • CBranching strategies describe how teams organize work across branches, which is a separate concept from referencing an external repository.
4. Question 4Design and Implement Build and Release Pipelines

   In Azure Pipelines, you can use template expressions and parameters to create reusable pipeline templates that accept inputs such as build configuration, target environment, and service connection names.

   • ATrueCorrect
   • BFalse
   ✓ Correct answer: A

   This statement is true. YAML pipeline templates accept parameters that enable dynamic configuration without duplicating template code. Template authors define parameters for inputs like build configuration (Debug/Release), target environment (dev/staging/prod), and service connection names. Pipeline authors then pass different values for these parameters when using the template, automatically customizing template behavior without modifying the template itself. This architecture supports complex multi-tenant scenarios where a single template serves multiple teams with different configurations. Parameters support type validation, default values, and conditional logic based on parameter values, providing a powerful composition model for building sophisticated pipeline automation.

   Why the other options are wrong

   • BFalse is incorrect. The statement is true. This statement is true. YAML pipeline templates accept parameters that enable dynamic configuration without duplicating template code. Template authors define parameters for inputs like build configuration (Debug/Release), target environment (dev/staging/prod), and service connection names.
5. Question 5Develop a Security and Compliance PlanSelect all that apply

   Your organization needs to implement SAST (Static Application Security Testing) and DAST (Dynamic Application Security Testing). Which TWO statements are correct about when to use each?

   • ASAST requires a running application to perform its analysis
   • BSAST analyzes source code without executing it and should be run during the build stageCorrect
   • CDAST analyzes compiled binaries without executing the application
   • DDAST tests the running application by simulating attacks and should be run against a deployed environmentCorrect
   ✓ Correct answer: B, D

   SAST (Static Application Security Testing) and DAST (Dynamic Application Security Testing) serve different purposes in the testing lifecycle. SAST analyzes the application without running it, making it ideal for the build stage where it can quickly identify code-level vulnerabilities like hardcoded secrets, SQL injection flaws, or unsafe dependencies. DAST, by contrast, requires a running application and tests it from an attacker's perspective by simulating real-world attacks, network issues, and runtime behavior, making it best suited for testing against a deployed environment.

   Why the other options are wrong

   • ASAST requires a running application to perform its analysis is incorrect because SAST is static analysis that does not execute the application.
   • CDAST analyzes compiled binaries without executing the application is incorrect because DAST requires a running application to perform its dynamic testing.
6. Question 6Develop a Security and Compliance Plan

   Your company uses Azure Pipelines with self-hosted agents running on Azure VMs. The security team discovered that build agents retain source code, build artifacts, and cached credentials between pipeline runs. This violates the company's data classification policy. What should you implement?

   • AAdd a cleanup script as the last step in every pipeline to delete the working directory
   • BReplace self-hosted agents with Azure VM Scale Set agents configured with ephemeral OS disks that are reimaged after each pipeline runCorrect
   • CConfigure antivirus software on the build agents to scan after each build
   • DRestrict physical access to the servers hosting the build agents
   ✓ Correct answer: B

   The problem is residual data persisting between runs on long-lived agents, so the durable fix is to make each run start from a clean machine. Azure VM Scale Set agents with ephemeral OS disks are reimaged after each job, guaranteeing that source code, artifacts, and cached credentials from a previous run are gone. This provides clean, disposable build environments at scale without manual cleanup steps that could be missed. It directly enforces the data classification policy.

   Why the other options are wrong

   • AA cleanup script as the last step can be skipped if a run fails before it executes and may miss caches outside the working directory, so it does not reliably guarantee a clean state.
   • CAntivirus scanning detects malware but does not remove the retained source code, artifacts, and credentials that violate the data classification policy.
   • DRestricting physical access addresses a different threat and does nothing about data persisting on the agent between pipeline runs.
7. Question 7Implement an Instrumentation Strategy

   Which Azure Monitor feature allows you to create custom dashboards?

   • AExcel export
   • BAzure Dashboards with pinned metricsCorrect
   • CEmail reports
   • DPower BI only
   ✓ Correct answer: B

   Azure Dashboards is the native Azure Monitor feature that allows you to create custom visualizations by pinning metrics, graphs, and tiles from various Azure resources and services into a personalized view. These dashboards can display data from multiple resources, provide shared team visibility, and be customized for specific roles or monitoring needs. Dashboards persist in Azure and can be managed through the portal or Azure Resource Manager templates.

   Why the other options are wrong

   • AExcel export is incorrect because exporting to Excel is a manual, one-time operation, not creating dynamic custom dashboards.
   • CEmail reports is incorrect because email reports are static and not interactive dashboards.
   • DPower BI only is incorrect because Power BI is an optional advanced analytics tool, not the primary Azure Monitor dashboard feature.
8. Question 8Configure Processes and CommunicationsSelect all that apply

   Wide World Importers wants its board columns to mirror the team's real workflow by adding an in-review state between Active and Resolved for User Stories, and it wants to cap the number of items allowed in that new column so the team stops overloading reviewers. Which TWO configurations should the administrator apply? (Choose two.)

   • AAdd a custom workflow state to the User Story work item typeCorrect
   • BSet a work in progress (WIP) limit on the board columnCorrect
   • CCreate a shared query grouped by state
   • DAdd a new area path for the review team
   • EEnable the cumulative flow diagram widget
   ✓ Correct answer: A, B

   Adding a custom workflow state to the User Story type through the inherited process introduces the in-review stage between Active and Resolved and surfaces it as a board column. Setting a work in progress limit on that Kanban column enforces a maximum number of items, preventing reviewer overload. Both directly implement the requested workflow and cap.

   Why the other options are wrong

   • CA shared query only lists items; it neither changes the workflow nor limits a column.
   • DArea paths group work by team or component and have no effect on states or column limits.
   • EThe cumulative flow diagram visualizes flow over time but does not add a state or enforce a limit.
9. Question 9Develop a Security and Compliance PlanSelect all that apply

   An administrator at Fabrikam Inc is planning to use SonarQube code analysis. Which two of the following are requirements or features of this solution? (Choose two.)

   • AAccess control for pipelinesCorrect
   • BOWASP dependency check
   • CAudit loggingCorrect
   • DCodeQL analysis
   • EAnalysis code SonarQube
   ✓ Correct answer: A, C

   SonarQube code analysis integrates into Azure DevOps pipelines where access control ensures only authorized users can modify analysis configurations and view sensitive code quality metrics. Audit logging records all SonarQube analysis executions, result changes, and policy decisions, providing compliance evidence and enabling root cause analysis of code quality issues. These controls establish governance over the analysis process and maintain an auditable record of all quality gate decisions.

   Why the other options are wrong

   • BOWASP dependency check is incorrect because this is a separate complementary tool for dependency analysis, not a core SonarQube requirement.
   • DCodeQL analysis is incorrect because CodeQL is GitHub's analysis engine, distinct from SonarQube.
   • Eanalysis code SonarQube is incorrect because this is a malformed option that doesn't represent a valid feature.
10. Question 10Configure Processes and Communications

    While customizing an inherited process, you want a field that the team relies on for queries and rules but that should not clutter the work item form for end users. Which configuration achieves this?

    • AKeep the field defined in the process but remove it from the form layout (do not add it to any page or group)Correct
    • BDelete the field from the process entirely
    • CMark the field as read-only on every work item type
    • DCreate the field as a personal column option in each user's query view
    ✓ Correct answer: A

    A custom field that exists in the process is available for queries, charts, and rules even if it is not placed on any layout page or group, so users do not see it on the form. This is the standard way to maintain a 'behind the scenes' field that automation or reporting uses without burdening the editing experience. Removing it from the layout does not delete its data or query availability.

    Why the other options are wrong

    • BDeleting the field removes it from queries and rules as well, so it can no longer be used at all.
    • CMarking a field read-only still displays it on the form, so it continues to clutter the UI and does not hide it.
    • DPersonal column options control which columns appear in a query result grid; they do not define a reusable process field or hide it from the form.

Related Microsoft resources

• AZ-400 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• SC-200 practice examRelated
• AZ-140 practice examRelated
• AZ-900 practice examRelated

AZ-400 practice exam FAQ