Free AZ-400 practice test: 20 questions
Twenty questions across the five AZ-400 skill areas, weighted roughly as the real exam is: three on processes and communications, three on source control, ten on build and release pipelines, three on security and compliance and one on instrumentation. These are original scenario questions. Find the constraint in each scenario before you look at the options.
Design and implement processes and communications
Question 1. A team wants to see on a dashboard how many days bugs wait between being reported and being resolved. Which Azure DevOps feature is the best fit?
- A. A wiki page updated manually every week
- B. A dashboard widget based on a work item query or analytics view
- C. A webhook to a Teams channel
- D. A release gate on the production environment
Show answer
Answer: B
A dashboard widget backed by a query or analytics view, such as a lead time or cycle time widget, shows how long work items take between states. A wiki page is static text, a webhook sends events to another system, and a release gate controls deployments rather than reporting on bugs.
Want more questions like this? Full AZ-400 practice tests →
Question 2. Your team posts GitHub pull request activity to a Microsoft Teams channel and wants a call to a custom internal system whenever a pull request is opened. What should you configure?
- A. A wiki page with a link to the system
- B. A dashboard widget for pull requests
- C. A branch policy requiring one reviewer
- D. A webhook for the pull request event
Show answer
Answer: D
A webhook sends an HTTP POST with the event payload to a URL you specify, so it fits a custom system. A wiki, a dashboard widget and a branch policy do not call external systems when an event occurs.
Want more questions like this? Full AZ-400 practice tests →
Question 3. Release notes for every version must be generated automatically from the Git history, with no one writing them by hand. What is the best approach?
- A. A pipeline step that builds the changelog from commit messages or pull request titles
- B. A manually edited Markdown file per release
- C. A screenshot of the commit graph attached to each release
- D. A quarterly access review
Show answer
Answer: A
Generating the changelog in the pipeline from commit messages or pull request titles, for example using conventional commit messages, automates release notes from Git history. Writing them by hand contradicts the requirement. A screenshot of the commit graph is not release notes, and an access review concerns permissions.
Want more questions like this? Full AZ-400 practice tests →
Design and implement a source control strategy
Question 4. A product supports versions 3.x and 4.x at the same time and must ship security fixes to both lines. Which branching approach fits?
- A. Trunk-based development with one main branch only
- B. One long-lived feature branch for all fixes
- C. A release branch for each supported version
- D. A fork per developer
Show answer
Answer: C
Release branches let you maintain several shipped versions in parallel and apply fixes to each. Trunk-based development with a single line does not support patching two older versions. A single feature branch and a fork per developer do not address maintaining two supported releases.
Want more questions like this? Full AZ-400 practice tests →
Question 5. In a GitHub repository, no one should be able to merge to main unless a specific team has reviewed changes under the /infra folder. What should you configure?
- A. A required status check only
- B. A CODEOWNERS entry for /infra and branch protection requiring code owner review
- C. Git LFS tracking for /infra
- D. A tag on the /infra folder
Show answer
Answer: B
A CODEOWNERS file assigns the owning team to the /infra path, and a branch protection rule requiring code owner review enforces it. Required status checks alone do not require human reviewers. Git LFS is for large files, and a tag marks a commit without enforcing review.
Want more questions like this? Full AZ-400 practice tests →
Question 6. A developer deleted a branch with unmerged commits by mistake and has not run garbage collection. Which command helps find the lost commits?
- A. git revert
- B. git cherry-pick
- C. git tag
- D. git reflog
Show answer
Answer: D
git reflog lists where HEAD and branch tips have pointed, so the last commit of the deleted branch can be found and a new branch created from it. git revert undoes a commit, git cherry-pick copies a commit that you already know, and git tag lists tags and does not track lost commits.
Want more questions like this? Full AZ-400 practice tests →
Design and implement build and release pipelines
Question 7. An Azure Pipelines pipeline should run for pushes to main but not when only files under the docs folder change. What should you configure?
- A. A pull request trigger on main
- B. Disable continuous integration for the pipeline
- C. A CI trigger for main with a path exclude for docs
- D. A nightly schedule
Show answer
Answer: C
A trigger with branch include main and a path exclude for docs does exactly that. A pull request trigger runs on PRs, not pushes. Disabling CI for the whole pipeline stops all builds, and a schedule runs regardless of changes.
Want more questions like this? Full AZ-400 practice tests →
Question 8. A build produces an npm package that internal teams consume. You want teams to receive only packages that passed integration tests, without rebuilding them. What should you use?
- A. An Azure Artifacts feed with views and promotion of tested packages
- B. A new feed for every build
- C. A Git tag on the repository
- D. A variable group per package
Show answer
Answer: A
Azure Artifacts feed views let you promote a package to a Release view after tests pass, and consumers subscribe to that view. Publishing to a new feed every time creates sprawl, tagging a repo does not control package visibility, and a variable group stores values only.
Want more questions like this? Full AZ-400 practice tests →
Question 9. A library follows semantic versioning. A change removes a public method that consumers use. Which part of the version should increase?
- A. PATCH
- B. MAJOR
- C. MINOR
- D. The build date
Show answer
Answer: B
Removing a public method is a breaking change, which increments the MAJOR number in semantic versioning. MINOR is for backward-compatible features, and PATCH is for backward-compatible fixes. The build date is not part of SemVer.
Want more questions like this? Full AZ-400 practice tests →
Question 10. Your builds need access to a database inside a private virtual network that Microsoft-hosted agents cannot reach. You want minimal maintenance of the build machines. Which option fits best?
- A. Microsoft-hosted agents with the firewall opened to the internet
- B. Build on developers’ laptops
- C. Microsoft-hosted agents without changes
- D. Scale set agents in the virtual network
Show answer
Answer: D
Virtual Machine Scale Set agents run in your own network and scale automatically with demand, reducing maintenance compared with hand-managed VMs. Microsoft-hosted agents cannot reach the private network. Opening the database to the internet weakens security, and developer laptops are unmanaged and unreliable.
Want more questions like this? Full AZ-400 practice tests →
Question 11. In a GitHub Actions workflow, the deploy job must start only after the build and test jobs succeed and only on the main branch. Which definition is correct?
- A. No needs, with if: always()
- B. needs: build only, with no condition
- C. needs: [build, test] and if: github.ref == ‘refs/heads/main’
- D. on: pull_request with no needs
Show answer
Answer: C
needs makes the job wait for the listed jobs, and an if condition on github.ref restricts it to main. Without needs, jobs run in parallel. Listing only build ignores test, and on: pull_request does not restrict deployment to main pushes.
Want more questions like this? Full AZ-400 practice tests →
Question 12. A company wants to release a new version to 5 percent of users, observe error rates, and then widen the rollout gradually. Which deployment strategy is this?
- A. Canary
- B. Blue-green
- C. Big-bang release
- D. Recreate
Show answer
Answer: A
Sending a small share of traffic to the new version and increasing it as metrics stay healthy is a canary deployment. Blue-green switches all traffic between two environments at once, a big-bang release replaces everything, and a recreate deployment stops the old version before starting the new.
Want more questions like this? Full AZ-400 practice tests →
Question 13. You need to turn a feature on for selected users at run time without redeploying the application. What should you use?
- A. A deployment slot swap
- B. A feature flag in Azure App Configuration
- C. A longer artifact retention period
- D. A larger agent pool
Show answer
Answer: B
Feature flags managed in Azure App Configuration Feature Manager let you enable a feature for chosen users or percentages without a deployment. A new deployment slot swap changes the whole version. A longer retention period and a larger agent pool do not control feature exposure.
Want more questions like this? Full AZ-400 practice tests →
Question 14. Infrastructure for each pull request must be created on demand from an approved template, used by the developer for testing and then removed. Which Azure service fits best?
- A. Azure Artifacts
- B. A Recovery Services vault
- C. A Bicep file pasted into the wiki
- D. Azure Deployment Environments
Show answer
Answer: D
Azure Deployment Environments lets developers self-deploy project environments from approved infrastructure templates with governance. Azure Artifacts stores packages, a Recovery Services vault stores backups, and a static Bicep file in a wiki gives no managed self-service.
Want more questions like this? Full AZ-400 practice tests →
Question 15. A team still uses classic release pipelines configured in the portal. They want pipeline definitions reviewed in pull requests and versioned with the code. What should they do?
- A. Add more stages in the portal editor
- B. Export screenshots of the release definition
- C. Migrate the pipelines to YAML stored in the repository
- D. Buy more parallel jobs
Show answer
Answer: C
Migrating to YAML pipelines stores the definition in the repository, so changes are reviewed and versioned with the code. Adding more portal stages keeps the definition outside source control, and exporting screenshots does not provide review. Increasing parallel jobs is unrelated.
Want more questions like this? Full AZ-400 practice tests →
Question 16. Pipelines run slowly because every run downloads the same dependencies. Which change reduces duration without reducing test coverage?
- A. Enable dependency caching in the pipeline
- B. Remove the integration tests
- C. Disable builds on pull requests
- D. Run the pipeline only on Fridays
Show answer
Answer: A
Caching dependencies between runs avoids repeated downloads and keeps all tests. Removing tests reduces coverage, disabling the build on pull requests removes validation, and running only on Fridays defeats continuous integration.
Want more questions like this? Full AZ-400 practice tests →
Develop a security and compliance plan
Question 17. A VM-hosted self-hosted agent in Azure must read secrets from Key Vault without any stored credential. Which identity should you use?
- A. A service principal with a client secret
- B. A managed identity assigned to the VM
- C. A personal access token
- D. A user account password in a script
Show answer
Answer: B
A managed identity on the VM authenticates to Key Vault without a stored credential once it is granted access. A service principal with a secret and a PAT are stored credentials. An account password in a script is both stored and insecure.
Want more questions like this? Full AZ-400 practice tests →
Question 18. Security wants pull requests blocked from introducing dependencies with known vulnerabilities in a GitHub repository. What should you enable?
- A. Secret scanning
- B. A CODEOWNERS file
- C. Git LFS
- D. Dependency review
Show answer
Answer: D
Dependency review in GitHub checks the dependency changes in a pull request against known vulnerabilities and can fail the check. Secret scanning finds credentials, CODEOWNERS assigns reviewers, and Git LFS manages large files.
Want more questions like this? Full AZ-400 practice tests →
Question 19. A pipeline needs a signing certificate file during deployment. The file must not be stored in the repository and only authorised pipelines should download it. What should you use?
- A. A secure file in Azure Pipelines
- B. A file committed to a private repository
- C. A blob in a public container
- D. An email attachment
Show answer
Answer: A
Secure files in Azure Pipelines store a file encrypted outside the repository and make it available only to authorised pipelines at run time. Committing the file to the repository exposes it, a public blob exposes it to everyone, and an email attachment is not controlled.
Want more questions like this? Full AZ-400 practice tests →
Implement an instrumentation strategy
Question 20. You want an alert when more than 5 percent of requests to your web app fail in a 10-minute window, based on Application Insights data. What should you create?
- A. A wiki page of known failures
- B. A branch policy on main
- C. An alert rule on failed requests with an action group
- D. A release note describing the failure rate
Show answer
Answer: C
A metric or log alert rule on the failed requests data in Application Insights, connected to an action group, triggers on the threshold. A wiki page and a branch policy do not monitor production, and a release note records changes, not run-time failures.
Want more questions like this? Full AZ-400 practice tests →
Review
Score yourself by domain, not just overall. The matching guides are processes and communications, source control, build and release pipelines, security and compliance and instrumentation.