Free AZ-400 sample questions with answers
Here are five free AZ-400 sample questions, one from each skill area, with the answer and the reasoning behind it. Try each one before opening the answer. These are original scenario questions written against the official skills outline, not questions from the real exam.
Question 1. A team uses Azure Boards for planning and GitHub for code. Auditors want every production change traceable to a requirement, without developers keeping a spreadsheet. What should you configure?
- A. A wiki page listing each release and its features
- B. A webhook that posts every commit to a Teams channel
- C. The Azure Boards integration with the GitHub repository, and work item references in pull requests
- D. A scheduled pipeline that exports commits to a spreadsheet
Show answer
Answer: C
Connecting Azure Boards to the GitHub repository and referencing work items in commits and pull requests (for example AB#123) creates links between code changes and work items automatically. A wiki page or a spreadsheet needs manual upkeep and drifts. A webhook to Teams only posts messages and creates no traceability link.
Want more questions like this? Full AZ-400 practice tests →
Question 2. Developers sometimes push directly to the main branch of an Azure Repos repository and break the build. You need every change to main to be reviewed by at least two people and to pass the CI build first. What should you configure?
- A. A branch policy on main with two required reviewers and build validation
- B. A client-side pre-push hook distributed to all developers
- C. A scheduled pipeline that reverts commits that fail the build
- D. A release branch that developers must use instead of main
Show answer
Answer: A
A branch policy on main can require a minimum number of reviewers and a successful build validation before a pull request can complete, and it blocks direct pushes. A git hook on developer machines can be bypassed and is not enforced centrally. A scheduled revert is not prevention, and moving to a release branch does not stop anyone pushing to main.
Want more questions like this? Full AZ-400 practice tests →
Question 3. A multi-stage Azure Pipelines YAML file has stages Build, Test and Deploy. The Deploy stage must run only when the Test stage succeeds and only for the main branch. Which Deploy stage definition meets the requirement?
- A. dependsOn: Build, with condition: always()
- B. No dependsOn, with condition: eq(variables[‘Build.SourceBranch’], ‘refs/heads/main’)
- C. dependsOn: Build, with condition: succeeded()
- D. dependsOn: Test, with condition: and(succeeded(), eq(variables[‘Build.SourceBranch’], ‘refs/heads/main’))
Show answer
Answer: D
dependsOn: Test makes Deploy wait for Test, and a condition combining succeeded() with a check that Build.SourceBranch equals refs/heads/main limits it to main. Option B has only the branch check; a custom condition replaces the implicit success check, so Deploy could run after a failed Test. Option C waits only for Build and has no branch check. Option A uses always(), which runs the stage even after failures.
Want more questions like this? Full AZ-400 practice tests →
Question 4. A GitHub Actions workflow deploys to Azure with a service principal secret stored in a repository secret. Security wants to remove long-lived credentials entirely. What should you do?
- A. Create a new service principal secret with a one-month expiry
- B. Configure a federated credential on the app registration and use OpenID Connect in the workflow
- C. Store a personal access token in the repository secrets
- D. Move the secret into Key Vault and read it with the same service principal
Show answer
Answer: B
Workload identity federation lets GitHub Actions authenticate to Microsoft Entra ID through OpenID Connect with a short-lived token, so no secret exists to leak or rotate. A new service principal secret with a shorter expiry is still a secret. A personal access token is a GitHub credential and does not authenticate to Azure. Storing the secret in Key Vault still requires a credential to read the vault.
Want more questions like this? Full AZ-400 practice tests →
Question 5. Users report that a web app is slow only for requests that call a downstream API. You need to see where time is spent across the services involved in a single request. Which capability should you use?
- A. VM insights performance charts
- B. Application Insights distributed tracing with the application map
- C. A CPU percentage metric alert on the host
- D. Azure Pipelines run analytics
Show answer
Answer: B
Application Insights distributed tracing correlates the telemetry of services involved in one operation and shows a timeline of dependency calls. VM insights shows machine-level performance, not request flow. A CPU alert tells you something is busy, not which call is slow. Pipeline run analytics concerns builds and releases, not production requests.
Want more questions like this? Full AZ-400 practice tests →
Keep going
The free 20-question practice test covers all five domains in the proportions of the exam. If you got a question wrong, the matching guide explains the topic: processes and communications, source control, build and release pipelines, security and compliance and instrumentation.