cert
cert-1
cert-2

Pass Microsoft AZ-400 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
AZ-400 Exam - Verified By Experts
AZ-400 Premium Bundle
$29.98

AZ-400 Premium Bundle

$79.99
$109.97
  • Premium File 398 Questions & Answers. Last update: Oct 30, 2026
  • Training Course 27 Video Lectures
  • Study Guide 784 Pages
 
$109.97
$79.99
accept 56 downloads in last 7 days
block-screenshots
Purchase Microsoft AZ-400 Exam Training Products Individually
Microsoft AZ-400 Premium File
Premium File 398 Q&A
$76.99$69.99
Microsoft AZ-400 Video Training Course
Training Course 27 Lectures
$21.99 $19.99
Microsoft AZ-400 PDF Study Guide
Study Guide 784 Pages
$21.99 $19.99
Microsoft AZ-400 Practice Test 63

Question 620

Before changing the pipeline or service, engineers find: Pipeline duration grows because a flaky test is retried eight times but the dashboard still shows every build as green. Which evidence should the engineer inspect FIRST?

  1. Inspect retry counts, per-test historical failure rates, queue and execution time.
  2. Review queue latency, pool capacity, concurrent jobs and utilization.
  3. Inspect agent image announcement, demands, SDK versions and task compatibility.
  4. Inspect output variables, task logs, masking controls and newly added debug flags.

Explanation

Correct Answer

A:

Inspect retry counts, per-test historical failure rates, queue and execution time. This directly checks the uncertain behavior or control before changing production. Pipeline health should surface flaky failures and retry overhead separately from success. The resulting targeted action is: Track flaky test metrics and assign root-cause fixes rather than unconditional retries.

Incorrect Answers

B:

Review queue latency, pool capacity, concurrent jobs and utilization. This would address a different situation, such as: A pipeline runs quickly on an agent but waits 70 minutes in queue due to a limited self-hosted pool. In the present case, the most directly relevant evidence is: Inspect retry counts, per-test historical failure rates, queue and execution time. The crucial distinction is: Pipeline health should surface flaky failures and retry overhead separately from success.

C:

Inspect agent image announcement, demands, SDK versions and task compatibility. This would address a different situation, such as: Builds fail after an Azure Pipelines hosted image update because a legacy runtime was implicitly available before. In the present case, the most directly relevant evidence is: Inspect retry counts, per-test historical failure rates, queue and execution time. The crucial distinction is: Pipeline health should surface flaky failures and retry overhead separately from success.

D:

Inspect output variables, task logs, masking controls and newly added debug flags. This would address a different situation, such as: Verbose diagnostic logging starts printing deployment tokens after a new task version update. In the present case, the most directly relevant evidence is: Inspect retry counts, per-test historical failure rates, queue and execution time. The crucial distinction is: Pipeline health should surface flaky failures and retry overhead separately from success.

Question 621

The DevOps team must resolve this situation: A deployment stage starts before the packaging stage publishes an artifact because stages are configured independently. Which engineering action is MOST appropriate?

  1. Define explicit stage dependencies and artifact handoffs in the YAML pipeline.
  2. Move common steps into approved reusable templates with pinned or governed references.
  3. Configure appropriate exclusive locks or deployment concurrency controls per environment.
  4. Configure trusted GitHub OIDC federation and least-privilege Azure roles for the deployment.

Explanation

Correct Answer

A:

Define explicit stage dependencies and artifact handoffs in the YAML pipeline. This action addresses the specific failure or requirement and preserves delivery controls. Validation criterion: A failed package stage prevents promotion and no missing-artifact deployment begins. YAML stage dependencies should express the actual required job order.

Incorrect Answers

B:

Move common steps into approved reusable templates with pinned or governed references. This would address a different situation, such as: Teams each copy a deployment YAML template and security fixes reach only some repositories. In the present case, the most directly relevant engineering action is: Define explicit stage dependencies and artifact handoffs in the YAML pipeline. The crucial distinction is: YAML stage dependencies should express the actual required job order.

C:

Configure appropriate exclusive locks or deployment concurrency controls per environment. This would address a different situation, such as: Two production deployments target the same App Service slot simultaneously and the earlier one overwrites the newer release. In the present case, the most directly relevant engineering action is: Define explicit stage dependencies and artifact handoffs in the YAML pipeline. The crucial distinction is: YAML stage dependencies should express the actual required job order.

D:

Configure trusted GitHub OIDC federation and least-privilege Azure roles for the deployment. This would address a different situation, such as: A GitHub Actions release stores a long-lived Azure service principal password in repository secrets for every deployment. In the present case, the most directly relevant engineering action is: Define explicit stage dependencies and artifact handoffs in the YAML pipeline. The crucial distinction is: YAML stage dependencies should express the actual required job order.

Question 622

The DevOps team must resolve this situation: Azure Boards shows completed user stories, but there is no way to identify the commits and deployments delivering each story. Which engineering action is MOST appropriate?

  1. Relate production bugs to failing or missing tests and preventive backlog work.
  2. Configure work-item linking and automatic build/deployment associations in Azure Boards.
  3. Link dependent work items across teams and use delivery plans to visualize blockers.
  4. Use a structured GitHub Issues intake process with ownership, labels and linked fixes.

Explanation

Correct Answer

B:

Configure work-item linking and automatic build/deployment associations in Azure Boards. This action addresses the specific failure or requirement and preserves delivery controls. Validation criterion: A sample released story traces to its pull request, verified build and target deployment. Traceability requires explicit relationships among work items, source revisions, builds and deployments.

Incorrect Answers

A:

Relate production bugs to failing or missing tests and preventive backlog work. This would address a different situation, such as: Several production defects were fixed, but QA cannot determine which automated test gaps allowed them to escape. In the present case, the most directly relevant engineering action is: Configure work-item linking and automatic build/deployment associations in Azure Boards. The crucial distinction is: Traceability requires explicit relationships among work items, source revisions, builds and deployments.

C:

Link dependent work items across teams and use delivery plans to visualize blockers. This would address a different situation, such as: A platform dependency blocks three application teams, but each Azure Boards team tracks a separate unrelated task. In the present case, the most directly relevant engineering action is: Configure work-item linking and automatic build/deployment associations in Azure Boards. The crucial distinction is: Traceability requires explicit relationships among work items, source revisions, builds and deployments.

D:

Use a structured GitHub Issues intake process with ownership, labels and linked fixes. This would address a different situation, such as: Customer-reported bugs arrive in chat messages and are never consistently recorded for the development team. In the present case, the most directly relevant engineering action is: Configure work-item linking and automatic build/deployment associations in Azure Boards. The crucial distinction is: Traceability requires explicit relationships among work items, source revisions, builds and deployments.

Question 623

After implementing the change, the team verifies: An Azure Pipelines task group exposes a deployment secret as a plain variable and prints it during release. Which result would BEST demonstrate that the issue is corrected?

  1. A deliberately Linux-only failure is detected before package publication.
  2. A representative task runs without emitting sensitive values in logs.
  3. An untrusted development pipeline cannot read production variable values.
  4. A simulated pair of releases leaves the later approved version running.

Explanation

Correct Answer

B:

A representative task runs without emitting sensitive values in logs. This measures the actual expected outcome, rather than trusting only a configuration flag. Implemented action: Use protected secret variables or Key Vault integration and suppress credential output. Reusable pipeline elements must preserve secret scoping and masking.

Incorrect Answers

A:

A deliberately Linux-only failure is detected before package publication. This would address a different situation, such as: A cross-platform CLI is built only on Windows and fails later when customers run it on Linux. In the present case, the most directly relevant verification is: A representative task runs without emitting sensitive values in logs. The crucial distinction is: Reusable pipeline elements must preserve secret scoping and masking.

C:

An untrusted development pipeline cannot read production variable values. This would address a different situation, such as: A shared variable group contains production connection strings, and every development pipeline can read them. In the present case, the most directly relevant verification is: A representative task runs without emitting sensitive values in logs. The crucial distinction is: Reusable pipeline elements must preserve secret scoping and masking.

D:

A simulated pair of releases leaves the later approved version running. This would address a different situation, such as: Two production deployments target the same App Service slot simultaneously and the earlier one overwrites the newer release. In the present case, the most directly relevant verification is: A representative task runs without emitting sensitive values in logs. The crucial distinction is: Reusable pipeline elements must preserve secret scoping and masking.

Question 624

The DevOps team must resolve this situation: A pipeline starts integration tests before deploying the dependent database migration, causing intermittent failures. Which engineering action is MOST appropriate?

  1. Implement repeatable baseline comparison gates for resource consumption and latency.
  2. Make integration testing depend on successful migration and test environment readiness.
  3. Use a dedicated test subscription or resource group with restricted identity permissions.
  4. Test expand-and-contract schema changes against concurrent old and new application instances.

Explanation

Correct Answer

B:

Make integration testing depend on successful migration and test environment readiness. This action addresses the specific failure or requirement and preserves delivery controls. Validation criterion: An intentionally failed migration prevents downstream integration tests from running. Test stages must declare prerequisite environment and schema dependencies explicitly.

Incorrect Answers

A:

Implement repeatable baseline comparison gates for resource consumption and latency. This would address a different situation, such as: An API's new release increases CPU costs by 60%, but the load test reports green because no baseline exists. In the present case, the most directly relevant engineering action is: Make integration testing depend on successful migration and test environment readiness. The crucial distinction is: Test stages must declare prerequisite environment and schema dependencies explicitly.

C:

Use a dedicated test subscription or resource group with restricted identity permissions. This would address a different situation, such as: A test pipeline reuses a production storage account and occasionally deletes customer fixtures. In the present case, the most directly relevant engineering action is: Make integration testing depend on successful migration and test environment readiness. The crucial distinction is: Test stages must declare prerequisite environment and schema dependencies explicitly.

D:

Test expand-and-contract schema changes against concurrent old and new application instances. This would address a different situation, such as: A release adds a non-null column while old and new application versions temporarily operate together. In the present case, the most directly relevant engineering action is: Make integration testing depend on successful migration and test environment readiness. The crucial distinction is: Test stages must declare prerequisite environment and schema dependencies explicitly.

Question 625

Before changing the pipeline or service, engineers find: A developer accidentally removes an important local commit during an interactive rebase, but it is still reachable from Git reflog. Which evidence should the engineer inspect FIRST?

  1. Inspect tag protection rules, release digests and commit-signature requirements.
  2. Inspect project access groups, repository ACLs, token grants and vendor responsibilities.
  3. Inspect file types, object sizes, clone profiles and LFS availability.
  4. Inspect reflog entries, commit IDs, branch history and garbage collection status.

Explanation

Correct Answer

D:

Inspect reflog entries, commit IDs, branch history and garbage collection status. This directly checks the uncertain behavior or control before changing production. Git reflog can help recover recent local reference movements before garbage collection. The resulting targeted action is: Recover the intended commit using the recorded reflog SHA and a safe new branch.

Incorrect Answers

A:

Inspect tag protection rules, release digests and commit-signature requirements. This would address a different situation, such as: A release build uses a mutable tag name that engineers can retarget to a different unreviewed commit. In the present case, the most directly relevant evidence is: Inspect reflog entries, commit IDs, branch history and garbage collection status. The crucial distinction is: Git reflog can help recover recent local reference movements before garbage collection.

B:

Inspect project access groups, repository ACLs, token grants and vendor responsibilities. This would address a different situation, such as: A QA vendor needs read-only test access but has been granted repository administration rights. In the present case, the most directly relevant evidence is: Inspect reflog entries, commit IDs, branch history and garbage collection status. The crucial distinction is: Git reflog can help recover recent local reference movements before garbage collection.

C:

Inspect file types, object sizes, clone profiles and LFS availability. This would address a different situation, such as: Designers repeatedly commit multi-gigabyte video assets as normal Git blobs and cloning takes hours. In the present case, the most directly relevant evidence is: Inspect reflog entries, commit IDs, branch history and garbage collection status. The crucial distinction is: Git reflog can help recover recent local reference movements before garbage collection.

Question 626

After implementing the change, the team verifies: An API passes functional tests for one user but violates latency objectives under 1,000 concurrent clients. Which result would BEST demonstrate that the issue is corrected?

  1. A test release exceeding the approved regression allowance fails the gate.
  2. The authorization module appears in coverage results and reduced testing is detected.
  3. A release is blocked when representative p95 latency exceeds its objective.
  4. Both app versions write correctly during transition and a rollback stays feasible.

Explanation

Correct Answer

C:

A release is blocked when representative p95 latency exceeds its objective. This measures the actual expected outcome, rather than trusting only a configuration flag. Implemented action: Add an Azure Load Testing stage with approved throughput and latency pass criteria. Load tests should measure realistic concurrency against explicit performance thresholds.

Incorrect Answers

A:

A test release exceeding the approved regression allowance fails the gate. This would address a different situation, such as: An API's new release increases CPU costs by 60%, but the load test reports green because no baseline exists. In the present case, the most directly relevant verification is: A release is blocked when representative p95 latency exceeds its objective. The crucial distinction is: Load tests should measure realistic concurrency against explicit performance thresholds.

B:

The authorization module appears in coverage results and reduced testing is detected. This would address a different situation, such as: A team's claimed 90% code coverage includes only generated code and excludes its core authorization module. In the present case, the most directly relevant verification is: A release is blocked when representative p95 latency exceeds its objective. The crucial distinction is: Load tests should measure realistic concurrency against explicit performance thresholds.

D:

Both app versions write correctly during transition and a rollback stays feasible. This would address a different situation, such as: A release adds a non-null column while old and new application versions temporarily operate together. In the present case, the most directly relevant verification is: A release is blocked when representative p95 latency exceeds its objective. The crucial distinction is: Load tests should measure realistic concurrency against explicit performance thresholds.

Question 627

A Microsoft DevOps team is addressing: An Azure DevOps pipeline uses a GitHub repository but cannot run pull-request validation because its repository connection is misconfigured. Which TWO complementary actions should be taken? Select TWO answers.

  1. Configure appropriate exclusive locks or deployment concurrency controls per environment.
  2. Configure approved GitHub connection permissions and required PR build validation.
  3. Compare duplicated YAML, referenced template versions, access rules and review practices.
  4. Review stage condition expressions, dependency status and test results.
  5. Inspect GitHub App installation, service connection, YAML PR settings and branch policy.

Explanation

Correct Answers

B:

Configure approved GitHub connection permissions and required PR build validation. This supplies the controlled implementation needed for the scenario. Its complementary step is: Inspect GitHub App installation, service connection, YAML PR settings and branch policy. Together they address: Azure Pipelines GitHub integration requires scoped access and appropriate PR triggers.

E:

Inspect GitHub App installation, service connection, YAML PR settings and branch policy. This supplies the diagnosis/evidence needed for the scenario. Its complementary step is: Configure approved GitHub connection permissions and required PR build validation. Together they address: Azure Pipelines GitHub integration requires scoped access and appropriate PR triggers.

Incorrect Answers

A:

Configure appropriate exclusive locks or deployment concurrency controls per environment. This concerns a different DevOps situation: Two production deployments target the same App Service slot simultaneously and the earlier one overwrites the newer release. This case instead requires both a targeted investigation (Inspect GitHub App installation, service connection, YAML PR settings and branch policy.) and a controlled change (Configure approved GitHub connection permissions and required PR build validation.).

C:

Compare duplicated YAML, referenced template versions, access rules and review practices. This concerns a different DevOps situation: Teams each copy a deployment YAML template and security fixes reach only some repositories. This case instead requires both a targeted investigation (Inspect GitHub App installation, service connection, YAML PR settings and branch policy.) and a controlled change (Configure approved GitHub connection permissions and required PR build validation.).

D:

Review stage condition expressions, dependency status and test results. This concerns a different DevOps situation: A post-deployment verification job runs even when staging tests fail because its condition overrides the default dependency check. This case instead requires both a targeted investigation (Inspect GitHub App installation, service connection, YAML PR settings and branch policy.) and a controlled change (Configure approved GitHub connection permissions and required PR build validation.).

Question 628

Before changing the pipeline or service, engineers find: A test pipeline reuses a production storage account and occasionally deletes customer fixtures. Which evidence should the engineer inspect FIRST?

  1. Inspect service connections, resource IDs, variables and test cleanup scripts.
  2. Review coverage collection filters, included assemblies and security-sensitive modules.
  3. Inspect global.json, agent image capabilities, use-dotnet steps and restore failures.
  4. Inspect browser-test steps, authentication dependencies and failure traces.

Explanation

Correct Answer

A:

Inspect service connections, resource IDs, variables and test cleanup scripts. This directly checks the uncertain behavior or control before changing production. Test execution should be isolated from production identities and destructive resources. The resulting targeted action is: Use a dedicated test subscription or resource group with restricted identity permissions.

Incorrect Answers

B:

Review coverage collection filters, included assemblies and security-sensitive modules. This would address a different situation, such as: A team's claimed 90% code coverage includes only generated code and excludes its core authorization module. In the present case, the most directly relevant evidence is: Inspect service connections, resource IDs, variables and test cleanup scripts. The crucial distinction is: Test execution should be isolated from production identities and destructive resources.

C:

Inspect global.json, agent image capabilities, use-dotnet steps and restore failures. This would address a different situation, such as: An Azure Pipeline fails only on hosted agents because tests require an uninstalled legacy.NET SDK. In the present case, the most directly relevant evidence is: Inspect service connections, resource IDs, variables and test cleanup scripts. The crucial distinction is: Test execution should be isolated from production identities and destructive resources.

D:

Inspect browser-test steps, authentication dependencies and failure traces. This would address a different situation, such as: A payment workflow completes an HTTP health check but fails after users submit the checkout form. In the present case, the most directly relevant evidence is: Inspect service connections, resource IDs, variables and test cleanup scripts. The crucial distinction is: Test execution should be isolated from production identities and destructive resources.

Question 629

The DevOps team must resolve this situation: Payment processing files require security review, but code owner review is only advisory. Which engineering action is MOST appropriate?

  1. Require independent pull request reviews and passing automated checks on main.
  2. Apply equivalent required reviews and test gates to all protected release branches.
  3. Enforce code owner approval for sensitive path changes in protected branches.
  4. Use fork-and-pull-request contributions with least-privilege branch access.

Explanation

Correct Answer

C:

Enforce code owner approval for sensitive path changes in protected branches. This action addresses the specific failure or requirement and preserves delivery controls. Validation criterion: A change to the protected payment directory cannot merge without authorized approval. Sensitive paths should have enforced review by designated accountable owners.

Incorrect Answers

A:

Require independent pull request reviews and passing automated checks on main. This would address a different situation, such as: A repository's default branch allows authors to approve their own high-risk changes without independent review. In the present case, the most directly relevant engineering action is: Enforce code owner approval for sensitive path changes in protected branches. The crucial distinction is: Sensitive paths should have enforced review by designated accountable owners.

B:

Apply equivalent required reviews and test gates to all protected release branches. This would address a different situation, such as: A company protects main but permits unrestricted direct commits to an unprotected release branch deployed to production. In the present case, the most directly relevant engineering action is: Enforce code owner approval for sensitive path changes in protected branches. The crucial distinction is: Sensitive paths should have enforced review by designated accountable owners.

D:

Use fork-and-pull-request contributions with least-privilege branch access. This would address a different situation, such as: External contributors can directly edit protected organization branches rather than submitting reviewed fork-based changes. In the present case, the most directly relevant engineering action is: Enforce code owner approval for sensitive path changes in protected branches. The crucial distinction is: Sensitive paths should have enforced review by designated accountable owners.

Question 630

The DevOps team must resolve this situation: A deployment removes an application instance while it has open customer sessions, causing dropped purchases. Which engineering action is MOST appropriate?

  1. Set appropriate maxUnavailable/maxSurge and validate readiness during rollout.
  2. Implement staged deployment rings with explicit gates and pause criteria.
  3. Configure graceful shutdown and appropriate draining before removing active targets.
  4. Isolate the tested change and instrument comparable outcome metrics across randomized cohorts.

Explanation

Correct Answer

C:

Configure graceful shutdown and appropriate draining before removing active targets. This action addresses the specific failure or requirement and preserves delivery controls. Validation criterion: An in-flight checkout completes during a controlled target replacement. Rolling replacement should account for connection draining and readiness transitions.

Incorrect Answers

A:

Set appropriate maxUnavailable/maxSurge and validate readiness during rollout. This would address a different situation, such as: An AKS update removes every API pod simultaneously because maxUnavailable equals the full replica count. In the present case, the most directly relevant engineering action is: Configure graceful shutdown and appropriate draining before removing active targets. The crucial distinction is: Rolling replacement should account for connection draining and readiness transitions.

B:

Implement staged deployment rings with explicit gates and pause criteria. This would address a different situation, such as: A desktop client update is rolled out to every employee globally at the same moment, causing a widespread outage. In the present case, the most directly relevant engineering action is: Configure graceful shutdown and appropriate draining before removing active targets. The crucial distinction is: Rolling replacement should account for connection draining and readiness transitions.

D:

Isolate the tested change and instrument comparable outcome metrics across randomized cohorts. This would address a different situation, such as: Two user interface variants are shown, but the team changes both pricing logic and checkout latency simultaneously and cannot attribute outcomes. In the present case, the most directly relevant engineering action is: Configure graceful shutdown and appropriate draining before removing active targets. The crucial distinction is: Rolling replacement should account for connection draining and readiness transitions.

Designing and Implementing Microsoft DevOps Solutions (AZ-400) Practice Tests