cert
cert-1
cert-2

Pass Microsoft AZ-400 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
AZ-400 Exam - Verified By Experts
AZ-400 Premium Bundle
$29.98

AZ-400 Premium Bundle

$79.99
$109.97
  • Premium File 398 Questions & Answers. Last update: Oct 30, 2026
  • Training Course 27 Video Lectures
  • Study Guide 784 Pages
 
$109.97
$79.99
accept 56 downloads in last 7 days
block-screenshots
Purchase Microsoft AZ-400 Exam Training Products Individually
Microsoft AZ-400 Premium File
Premium File 398 Q&A
$76.99$69.99
Microsoft AZ-400 Video Training Course
Training Course 27 Lectures
$21.99 $19.99
Microsoft AZ-400 PDF Study Guide
Study Guide 784 Pages
$21.99 $19.99
Microsoft AZ-400 Practice Test 3

Question 20

An Azure DevOps engineering team evaluates this condition: Several production defects were fixed, but QA cannot determine which automated test gaps allowed them to escape. Which DevOps principle BEST explains the underlying weakness?

  1. Shared delivery dependencies must be visible across team backlogs with responsible ownership.
  2. Traceability requires explicit relationships among work items, source revisions, builds and deployments.
  3. Short-lived branches and reviewed pull requests reduce integration drift and make changes traceable.
  4. Defect traceability should connect incidents to code, test coverage and prevention work.

Explanation

Correct Answer

D:

Defect traceability should connect incidents to code, test coverage and prevention work. This principle identifies the risk or delivery weakness in the case. Relevant evidence: Inspect production incident links, bug work items, affected commits and test case mappings. An appropriate controlled response is: Relate production bugs to failing or missing tests and preventive backlog work.

Incorrect Answers

A:

Shared delivery dependencies must be visible across team backlogs with responsible ownership. This would address a different situation, such as: A platform dependency blocks three application teams, but each Azure Boards team tracks a separate unrelated task. In the present case, the most directly relevant principle is: Defect traceability should connect incidents to code, test coverage and prevention work. The crucial distinction is: Defect traceability should connect incidents to code, test coverage and prevention work.

B:

Traceability requires explicit relationships among work items, source revisions, builds and deployments. This would address a different situation, such as: Azure Boards shows completed user stories, but there is no way to identify the commits and deployments delivering each story. In the present case, the most directly relevant principle is: Defect traceability should connect incidents to code, test coverage and prevention work. The crucial distinction is: Defect traceability should connect incidents to code, test coverage and prevention work.

C:

Short-lived branches and reviewed pull requests reduce integration drift and make changes traceable. This would address a different situation, such as: An engineering organization uses long-lived feature branches, and its hotfixes regularly miss previously merged changes. In the present case, the most directly relevant principle is: Defect traceability should connect incidents to code, test coverage and prevention work. The crucial distinction is: Defect traceability should connect incidents to code, test coverage and prevention work.

Question 21

An Azure DevOps engineering team evaluates this condition: A critical production fix is committed to an old release branch and never reaches the mainline, so the bug returns next month. Which DevOps principle BEST explains the underlying weakness?

  1. Maintenance branching should match support windows and preserve immutable release history.
  2. Branch conventions and immutable release references should uniquely identify deployable versions.
  3. Hotfix processes must propagate tested corrections to every maintained affected line.
  4. Branch policies should enforce an independent review and required checks for protected code.

Explanation

Correct Answer

C:

Hotfix processes must propagate tested corrections to every maintained affected line. This principle identifies the risk or delivery weakness in the case. Relevant evidence: Compare release branch commits, mainline history and subsequent deployment tags. An appropriate controlled response is: Require reviewed back-merges or cherry-picks of hotfixes into active branches.

Incorrect Answers

A:

Maintenance branching should match support windows and preserve immutable release history. This would address a different situation, such as: Old supported product versions receive urgent fixes but the team deletes prior release references after every mainline update. In the present case, the most directly relevant principle is: Hotfix processes must propagate tested corrections to every maintained affected line. The crucial distinction is: Hotfix processes must propagate tested corrections to every maintained affected line.

B:

Branch conventions and immutable release references should uniquely identify deployable versions. This would address a different situation, such as: Teams use dozens of release branches with ambiguous names, and automation often deploys the wrong branch. In the present case, the most directly relevant principle is: Hotfix processes must propagate tested corrections to every maintained affected line. The crucial distinction is: Hotfix processes must propagate tested corrections to every maintained affected line.

D:

Branch policies should enforce an independent review and required checks for protected code. This would address a different situation, such as: A repository's default branch allows authors to approve their own high-risk changes without independent review. In the present case, the most directly relevant principle is: Hotfix processes must propagate tested corrections to every maintained affected line. The crucial distinction is: Hotfix processes must propagate tested corrections to every maintained affected line.

Question 22

An Azure DevOps engineering team evaluates this condition: A pipeline reports repeated deployment failures but no team receives notifications because the original owner left the company. Which DevOps principle BEST explains the underlying weakness?

  1. Cache keys must include dependency inputs so old artifacts cannot silently corrupt builds.
  2. Pipeline cost optimization should remove redundant executions without weakening required checks.
  3. Capacity changes should be justified by measured critical-path improvements and cost.
  4. Pipeline operational health needs assigned responders and maintained notification routing.

Explanation

Correct Answer

D:

Pipeline operational health needs assigned responders and maintained notification routing. This principle identifies the risk or delivery weakness in the case. Relevant evidence: Review alert subscriptions, team ownership, failure history and escalation paths. An appropriate controlled response is: Assign accountable pipeline owners and route critical failures to current responders.

Incorrect Answers

A:

Cache keys must include dependency inputs so old artifacts cannot silently corrupt builds. This would address a different situation, such as: A pipeline caches packages under one global key even after lockfile changes, causing inconsistent builds. In the present case, the most directly relevant principle is: Pipeline operational health needs assigned responders and maintained notification routing. The crucial distinction is: Pipeline operational health needs assigned responders and maintained notification routing.

B:

Pipeline cost optimization should remove redundant executions without weakening required checks. This would address a different situation, such as: Hundreds of nightly builds run when source code is unchanged, consuming expensive hosted parallel minutes. In the present case, the most directly relevant principle is: Pipeline operational health needs assigned responders and maintained notification routing. The crucial distinction is: Pipeline operational health needs assigned responders and maintained notification routing.

C:

Capacity changes should be justified by measured critical-path improvements and cost. This would address a different situation, such as: A pipeline team wants 50 more hosted agent slots even though bottlenecks are serial manual approvals and limited integration environments. In the present case, the most directly relevant principle is: Pipeline operational health needs assigned responders and maintained notification routing. The crucial distinction is: Pipeline operational health needs assigned responders and maintained notification routing.

Question 23

After implementing the change, the team verifies: An engineering organization uses long-lived feature branches, and its hotfixes regularly miss previously merged changes. Which result would BEST demonstrate that the issue is corrected?

  1. The shared platform dependency appears before downstream releases in an integrated plan.
  2. A hotfix reaches the protected mainline through review with all intended prior changes intact.
  3. A sample release note lists the actual included fixes without unrelated pending changes.
  4. A sampled escaped defect traces to an added regression test and successful validation.

Explanation

Correct Answer

B:

A hotfix reaches the protected mainline through review with all intended prior changes intact. This measures the actual expected outcome, rather than trusting only a configuration flag. Implemented action: Adopt protected mainline GitHub Flow with small reviewed changes and linked work items. Short-lived branches and reviewed pull requests reduce integration drift and make changes traceable.

Incorrect Answers

A:

The shared platform dependency appears before downstream releases in an integrated plan. This would address a different situation, such as: A platform dependency blocks three application teams, but each Azure Boards team tracks a separate unrelated task. In the present case, the most directly relevant verification is: A hotfix reaches the protected mainline through review with all intended prior changes intact. The crucial distinction is: Short-lived branches and reviewed pull requests reduce integration drift and make changes traceable.

C:

A sample release note lists the actual included fixes without unrelated pending changes. This would address a different situation, such as: Release notes are composed from memory and routinely omit merged security improvements. In the present case, the most directly relevant verification is: A hotfix reaches the protected mainline through review with all intended prior changes intact. The crucial distinction is: Short-lived branches and reviewed pull requests reduce integration drift and make changes traceable.

D:

A sampled escaped defect traces to an added regression test and successful validation. This would address a different situation, such as: Several production defects were fixed, but QA cannot determine which automated test gaps allowed them to escape. In the present case, the most directly relevant verification is: A hotfix reaches the protected mainline through review with all intended prior changes intact. The crucial distinction is: Short-lived branches and reviewed pull requests reduce integration drift and make changes traceable.

Question 24

An Azure DevOps engineering team evaluates this condition: A protected mainline accepts pull requests before a required unit test suite finishes, causing broken packages. Which DevOps principle BEST explains the underlying weakness?

  1. Consumer contract tests should detect interface-breaking changes before coordinated release.
  2. Code-scanning feedback should be available on proposed changes before merge.
  3. Integration tests must exercise representative dependent services and configuration.
  4. Unit test gates should complete successfully against the proposed change before merge.

Explanation

Correct Answer

D:

Unit test gates should complete successfully against the proposed change before merge. This principle identifies the risk or delivery weakness in the case. Relevant evidence: Review PR check policies, test job dependencies and build result timing. An appropriate controlled response is: Require verified unit test checks as part of protected pull request policy.

Incorrect Answers

A:

Consumer contract tests should detect interface-breaking changes before coordinated release. This would address a different situation, such as: A microservice changes a JSON field name while a downstream consumer still relies on the old name. In the present case, the most directly relevant principle is: Unit test gates should complete successfully against the proposed change before merge. The crucial distinction is: Unit test gates should complete successfully against the proposed change before merge.

B:

Code-scanning feedback should be available on proposed changes before merge. This would address a different situation, such as: A GitHub repository scans vulnerabilities once a month but merges vulnerable code daily. In the present case, the most directly relevant principle is: Unit test gates should complete successfully against the proposed change before merge. The crucial distinction is: Unit test gates should complete successfully against the proposed change before merge.

C:

Integration tests must exercise representative dependent services and configuration. This would address a different situation, such as: Service unit tests pass but integration fails because Azure SQL connectivity differs between staging and production. In the present case, the most directly relevant principle is: Unit test gates should complete successfully against the proposed change before merge. The crucial distinction is: Unit test gates should complete successfully against the proposed change before merge.

Question 25

A Microsoft DevOps team is addressing: Six teams manually create nearly identical VNets with inconsistent NSG defaults and missing diagnostics. Which TWO complementary actions should be taken? Select TWO answers.

  1. Compare YAML and Bicep modules, probes, managed identity choices and review history.
  2. Inspect existing VNet templates, module interfaces, policy results and configuration drift.
  3. Publish a versioned Bicep networking module with secure defaults and reviewed parameters.
  4. Use a safe scoped deployment strategy with reviewed change previews and deletion protections.
  5. Inspect environment provisioning logs, resource tags, TTL and cleanup policies.

Explanation

Correct Answers

B:

Inspect existing VNet templates, module interfaces, policy results and configuration drift. This supplies the diagnosis/evidence needed for the scenario. Its complementary step is: Publish a versioned Bicep networking module with secure defaults and reviewed parameters. Together they address: IaC modules should centralize approved reusable infrastructure patterns.

C:

Publish a versioned Bicep networking module with secure defaults and reviewed parameters. This supplies the controlled implementation needed for the scenario. Its complementary step is: Inspect existing VNet templates, module interfaces, policy results and configuration drift. Together they address: IaC modules should centralize approved reusable infrastructure patterns.

Incorrect Answers

A:

Compare YAML and Bicep modules, probes, managed identity choices and review history. This concerns a different DevOps situation: Each team's pipeline provisions Azure Container Apps independently, with inconsistent health probes and identity. This case instead requires both a targeted investigation (Inspect existing VNet templates, module interfaces, policy results and configuration drift.) and a controlled change (Publish a versioned Bicep networking module with secure defaults and reviewed parameters.).

D:

Use a safe scoped deployment strategy with reviewed change previews and deletion protections. This concerns a different DevOps situation: A deployment pipeline uses complete mode unintentionally and deletes resources omitted from an updated ARM template. This case instead requires both a targeted investigation (Inspect existing VNet templates, module interfaces, policy results and configuration drift.) and a controlled change (Publish a versioned Bicep networking module with secure defaults and reviewed parameters.).

E:

Inspect environment provisioning logs, resource tags, TTL and cleanup policies. This concerns a different DevOps situation: Engineers create temporary load-test environments manually but never remove costly public IP addresses. This case instead requires both a targeted investigation (Inspect existing VNet templates, module interfaces, policy results and configuration drift.) and a controlled change (Publish a versioned Bicep networking module with secure defaults and reviewed parameters.).

Question 26

An Azure DevOps engineering team evaluates this condition: A central deployment pipeline cannot restore a package from another Azure DevOps project although the feed works locally. Which DevOps principle BEST explains the underlying weakness?

  1. Cross-project feeds require authorized build-service identities and scope settings.
  2. Private package access requires scoped workflow identity and authorized repository permissions.
  3. Release images should be identified by immutable digests or protected version tags.
  4. Reproducible builds require controlled package versions and lockfile inputs.

Explanation

Correct Answer

A:

Cross-project feeds require authorized build-service identities and scope settings. This principle identifies the risk or delivery weakness in the case. Relevant evidence: Inspect feed/project scope, pipeline identity, role assignment and error logs. An appropriate controlled response is: Grant the consuming build service read access at the appropriate feed scope.

Incorrect Answers

B:

Private package access requires scoped workflow identity and authorized repository permissions. This would address a different situation, such as: A GitHub Actions workflow receives 403 when installing a private package owned by another organization repository. In the present case, the most directly relevant principle is: Cross-project feeds require authorized build-service identities and scope settings. The crucial distinction is: Cross-project feeds require authorized build-service identities and scope settings.

C:

Release images should be identified by immutable digests or protected version tags. This would address a different situation, such as: A team overwrites the same image tag in Azure Container Registry for every build and loses reproducible deployment history. In the present case, the most directly relevant principle is: Cross-project feeds require authorized build-service identities and scope settings. The crucial distinction is: Cross-project feeds require authorized build-service identities and scope settings.

D:

Reproducible builds require controlled package versions and lockfile inputs. This would address a different situation, such as: The same Git commit restores different NuGet package versions one week apart and intermittently fails tests. In the present case, the most directly relevant principle is: Cross-project feeds require authorized build-service identities and scope settings. The crucial distinction is: Cross-project feeds require authorized build-service identities and scope settings.

Question 27

The DevOps team must resolve this situation: A deployment job fails but the failure is not associated with the GitHub issue that requested the release. Which engineering action is MOST appropriate?

  1. Use a structured GitHub Issues intake process with ownership, labels and linked fixes.
  2. Relate production bugs to failing or missing tests and preventive backlog work.
  3. Update related GitHub Issues from protected workflow events with release status and error context.
  4. Adopt protected mainline GitHub Flow with small reviewed changes and linked work items.

Explanation

Correct Answer

C:

Update related GitHub Issues from protected workflow events with release status and error context. This action addresses the specific failure or requirement and preserves delivery controls. Validation criterion: A failed sample release leaves the linked issue open and alerts its responsible team. Closed-loop delivery needs automated status updates connected to the requesting work.

Incorrect Answers

A:

Use a structured GitHub Issues intake process with ownership, labels and linked fixes. This would address a different situation, such as: Customer-reported bugs arrive in chat messages and are never consistently recorded for the development team. In the present case, the most directly relevant engineering action is: Update related GitHub Issues from protected workflow events with release status and error context. The crucial distinction is: Closed-loop delivery needs automated status updates connected to the requesting work.

B:

Relate production bugs to failing or missing tests and preventive backlog work. This would address a different situation, such as: Several production defects were fixed, but QA cannot determine which automated test gaps allowed them to escape. In the present case, the most directly relevant engineering action is: Update related GitHub Issues from protected workflow events with release status and error context. The crucial distinction is: Closed-loop delivery needs automated status updates connected to the requesting work.

D:

Adopt protected mainline GitHub Flow with small reviewed changes and linked work items. This would address a different situation, such as: An engineering organization uses long-lived feature branches, and its hotfixes regularly miss previously merged changes. In the present case, the most directly relevant engineering action is: Update related GitHub Issues from protected workflow events with release status and error context. The crucial distinction is: Closed-loop delivery needs automated status updates connected to the requesting work.

Question 28

The DevOps team must resolve this situation: A reusable GitHub Actions workflow grants write permissions to every job although most only compile and test. Which engineering action is MOST appropriate?

  1. Configure trusted GitHub OIDC federation and least-privilege Azure roles for the deployment.
  2. Include explicit succeeded dependencies in the custom promotion condition.
  3. Define explicit stage dependencies and artifact handoffs in the YAML pipeline.
  4. Restrict default GITHUB_TOKEN permissions and grant write scopes only to required jobs.

Explanation

Correct Answer

D:

Restrict default GITHUB_TOKEN permissions and grant write scopes only to required jobs. This action addresses the specific failure or requirement and preserves delivery controls. Validation criterion: A test-only job cannot mutate repository releases while publish job remains authorized. Job-level token permissions should match each workflow task's minimum needs.

Incorrect Answers

A:

Configure trusted GitHub OIDC federation and least-privilege Azure roles for the deployment. This would address a different situation, such as: A GitHub Actions release stores a long-lived Azure service principal password in repository secrets for every deployment. In the present case, the most directly relevant engineering action is: Restrict default GITHUB_TOKEN permissions and grant write scopes only to required jobs. The crucial distinction is: Job-level token permissions should match each workflow task's minimum needs.

B:

Include explicit succeeded dependencies in the custom promotion condition. This would address a different situation, such as: A post-deployment verification job runs even when staging tests fail because its condition overrides the default dependency check. In the present case, the most directly relevant engineering action is: Restrict default GITHUB_TOKEN permissions and grant write scopes only to required jobs. The crucial distinction is: Job-level token permissions should match each workflow task's minimum needs.

C:

Define explicit stage dependencies and artifact handoffs in the YAML pipeline. This would address a different situation, such as: A deployment stage starts before the packaging stage publishes an artifact because stages are configured independently. In the present case, the most directly relevant engineering action is: Restrict default GITHUB_TOKEN permissions and grant write scopes only to required jobs. The crucial distinction is: Job-level token permissions should match each workflow task's minimum needs.

Question 29

After implementing the change, the team verifies: Azure Boards reports near-zero cycle time because teams move stories to Active only when coding is almost finished. Which result would BEST demonstrate that the issue is corrected?

  1. Sample completed stories show realistic cycle times that match actual engineering work.
  2. A test job delayed by runner scarcity shows queue time rather than slow compilation.
  3. A deliberately overdue critical issue remains visible until independently resolved.
  4. The report states response coverage and captures previously omitted contributor feedback.

Explanation

Correct Answer

A:

Sample completed stories show realistic cycle times that match actual engineering work. This measures the actual expected outcome, rather than trusting only a configuration flag. Implemented action: Define and enforce meaningful Active and Done transitions in the team's process. Flow metrics depend on consistent state-transition definitions and truthful process data.

Incorrect Answers

B:

A test job delayed by runner scarcity shows queue time rather than slow compilation. This would address a different situation, such as: A pipeline takes 50 minutes, but dashboard owners cannot distinguish runner queue delays from actual build execution. In the present case, the most directly relevant verification is: Sample completed stories show realistic cycle times that match actual engineering work. The crucial distinction is: Flow metrics depend on consistent state-transition definitions and truthful process data.

C:

A deliberately overdue critical issue remains visible until independently resolved. This would address a different situation, such as: A security scorecard shows the total number of alerts but cannot identify overdue critical fixes. In the present case, the most directly relevant verification is: Sample completed stories show realistic cycle times that match actual engineering work. The crucial distinction is: Flow metrics depend on consistent state-transition definitions and truthful process data.

D:

The report states response coverage and captures previously omitted contributor feedback. This would address a different situation, such as: A team reports excellent developer experience based only on responses from its three most active maintainers. In the present case, the most directly relevant verification is: Sample completed stories show realistic cycle times that match actual engineering work. The crucial distinction is: Flow metrics depend on consistent state-transition definitions and truthful process data.

Question 30

An Azure DevOps engineering team evaluates this condition: Two user interface variants are shown, but the team changes both pricing logic and checkout latency simultaneously and cannot attribute outcomes. Which DevOps principle BEST explains the underlying weakness?

  1. Rolling update policies should preserve minimum ready capacity during replacement.
  2. Rolling replacement should account for connection draining and readiness transitions.
  3. Slot deployment must isolate environment-specific connection and trigger settings.
  4. A/B evaluations require stable cohorts and measurable objective-specific differences.

Explanation

Correct Answer

D:

A/B evaluations require stable cohorts and measurable objective-specific differences. This principle identifies the risk or delivery weakness in the case. Relevant evidence: Inspect targeting rules, conversion events, experiment durations and uncontrolled changes. An appropriate controlled response is: Isolate the tested change and instrument comparable outcome metrics across randomized cohorts.

Incorrect Answers

A:

Rolling update policies should preserve minimum ready capacity during replacement. This would address a different situation, such as: An AKS update removes every API pod simultaneously because maxUnavailable equals the full replica count. In the present case, the most directly relevant principle is: A/B evaluations require stable cohorts and measurable objective-specific differences. The crucial distinction is: A/B evaluations require stable cohorts and measurable objective-specific differences.

B:

Rolling replacement should account for connection draining and readiness transitions. This would address a different situation, such as: A deployment removes an application instance while it has open customer sessions, causing dropped purchases. In the present case, the most directly relevant principle is: A/B evaluations require stable cohorts and measurable objective-specific differences. The crucial distinction is: A/B evaluations require stable cohorts and measurable objective-specific differences.

C:

Slot deployment must isolate environment-specific connection and trigger settings. This would address a different situation, such as: An Azure Functions staging slot unexpectedly processes production queue messages before its swap because a trigger configuration was not isolated. In the present case, the most directly relevant principle is: A/B evaluations require stable cohorts and measurable objective-specific differences. The crucial distinction is: A/B evaluations require stable cohorts and measurable objective-specific differences.

Designing and Implementing Microsoft DevOps Solutions (AZ-400) Practice Tests