Microsoft · AZ-400
Designing and Implementing Microsoft DevOps Solutions (AZ-400) Practice Tests
Expert-level exam that measures your ability to design and implement processes, source control strategies, build and release pipelines, security and compliance plans, and instrumentation strategies for DevOps solutions.
Exam Details
Practice Questions
622
≈ 12 practice exams
Duration
150 minutes
Passing Score
700/1000
Difficulty
ExpertLast Updated
Jun 2026
Topics Covered
CI/CD PipelinesSource Control StrategyInfrastructure as CodeSecurity and ComplianceMonitoring and Instrumentation
AZ-400 Practice Exam
This AZ-400 practice exam prepares you for Designing and Implementing Microsoft DevOps Solutions, the exam behind the DevOps Engineer Expert certification. It is built around the way Microsoft weights the real exam, where designing and implementing build and release pipelines alone makes up 50 to 55 percent of your score, so the questions give you heavy, repeated exposure to CI/CD across Azure DevOps and GitHub.
Beyond pipelines, you will practice source control strategy, process and communication design, security and compliance planning, and instrumentation. Remember that passing AZ-400 only grants the Expert title once you also hold AZ-104 or AZ-204, so plan your certification path accordingly. The explanations connect each answer back to the tooling and tradeoffs you face when running production DevOps.
Use the free preview to benchmark yourself, then work through the full bank until you can consistently clear 700 out of 1000. The certification is valid for one year and renews free online, so treat this practice as the start of an ongoing DevOps learning routine.
Exam Domain Breakdown
Design and implement processes and communications13%
Design and implement a source control strategy13%
Design and implement build and release pipelines53%
Develop a security and compliance plan13%
Implement an instrumentation strategy8%
Exam Overview
The AZ-400 exam validates expert-level proficiency in designing and implementing DevOps solutions on Microsoft Azure, covering the full software delivery lifecycle from source control and CI/CD pipelines to security, compliance, and observability. The exam was last updated on July 26, 2024, and spans five major domains: processes and communications, source control strategy, build and release pipelines (the heaviest domain at 50–55%), security and compliance, and instrumentation. Candidates are assessed on both Azure DevOps and GitHub as delivery platforms, with a strong emphasis on YAML-based pipeline authoring, infrastructure as code using Bicep and Azure Resource Manager, and integration with Microsoft security tooling such as GitHub Advanced Security and Microsoft Defender for Cloud.
The certification leads to the Microsoft Certified: DevOps Engineer Expert credential, one of Microsoft's highest-tier role-based certifications. It reflects the breadth of skills required to bridge development and operations teams, automate software delivery pipelines, implement scalable IaC strategies, and embed security and monitoring throughout the development lifecycle. The exam content spans multiple Azure services including Azure Pipelines, Azure Repos, Azure Artifacts, Azure Boards, Azure Key Vault, Azure Monitor, Application Insights, and Azure App Configuration, making it one of the broadest Azure expert-level exams available.
Who Should Take This Exam
This exam is aimed at experienced developers and infrastructure administrators who operate at the intersection of software engineering and cloud operations. Ideal candidates hold hands-on experience with both Azure DevOps and GitHub, have already earned either the Azure Administrator Associate (AZ-104) or Azure Developer Associate (AZ-204) certification, and work—or aspire to work—on cross-functional teams alongside developers, site reliability engineers, Azure administrators, and security engineers.
Typical job roles that benefit from this certification include DevOps Engineer, Release Engineer, Platform Engineer, Cloud Infrastructure Engineer, and Site Reliability Engineer. Candidates should be comfortable designing branching strategies, authoring multi-stage YAML pipelines, managing secrets and service connections, configuring deployment patterns such as blue-green and canary releases, and integrating security scanning tools into pipelines. A background in scripting, cloud-native tooling, and agile delivery methodologies is strongly recommended.
Prerequisites
Microsoft does not impose formal prerequisites to register for the AZ-400 exam, but earning the resulting Microsoft Certified: DevOps Engineer Expert certification requires holding either the Microsoft Certified: Azure Administrator Associate (AZ-104) or Microsoft Certified: Azure Developer Associate (AZ-204) credential. These associate certifications ensure candidates have foundational competence in either Azure infrastructure management or Azure application development before attempting the expert-level exam.
Beyond formal certification requirements, candidates are strongly advised to have practical, hands-on experience implementing both Azure DevOps and GitHub solutions in production or near-production environments. Microsoft recommends proficiency in at least one of the two core disciplines (administration or development) along with experience designing CI/CD pipelines, managing Git repositories at scale, working with Azure Key Vault, and implementing Infrastructure as Code using Bicep or Azure Resource Manager templates. Familiarity with Kusto Query Language (KQL) for log analysis and with GitHub Advanced Security features is also beneficial given the breadth of the exam's security and instrumentation domains.
Exam Format
The AZ-400 exam is administered by Pearson VUE and can be taken via online proctoring or at an authorized testing center. The time limit is 150 minutes, and a passing score of 700 on a 1–1000 scale is required. The exam is available in ten languages: English, Japanese, Chinese (Simplified), Chinese (Traditional), Korean, German, French, Spanish, Portuguese (Brazil), and Italian; candidates taking a non-English version may request 30 additional minutes. Pricing varies by country and region.
The exam uses a variety of question formats typical of Microsoft expert-level exams, including multiple choice, multiple select, drag-and-drop, case studies, and lab-based or scenario-driven questions. Microsoft does not publish an exact question count, but the exam is structured around the five scored domains listed in the official study guide. A free Practice Assessment is available on Microsoft Learn (Assessment ID 56) that closely mirrors the style and difficulty of actual exam questions. The certification renews annually via a free online assessment on Microsoft Learn.
Skills Measured
- 1.Design and implement processes and communications (10–15%): Covers designing work-flow structures including GitHub Flow, implementing feedback cycles with GitHub issues and notifications, integrating tracking tools such as Azure Boards and GitHub Projects, configuring DevOps dashboards with metrics for cycle time, lead time, and time to recovery, documenting projects using wikis with Markdown and Mermaid syntax, automating release notes from Git history, and configuring integrations via webhooks and Microsoft Teams.
- 2.Design and implement a source control strategy (10–15%): Covers designing branching strategies (trunk-based, feature branch, release branch), implementing pull request workflows with branch policies and protections, configuring permissions and tags in repositories, managing large files with Git LFS and git-fat, scaling Git repositories using Scalar and cross-repository sharing, and recovering or removing specific data using Git commands.
- 3.Design and implement build and release pipelines (50–55%): The dominant domain, covering package management with Azure Artifacts and GitHub Packages, dependency versioning using SemVer and CalVer, designing comprehensive testing strategies (unit, integration, load) with code coverage, authoring multi-stage YAML pipelines with parallelism and reusable templates, selecting and managing GitHub Actions runners and Azure DevOps agents, designing deployment strategies (blue-green, canary, ring, feature flags, A/B testing), minimizing downtime with VIP swap and deployment slots, implementing Infrastructure as Code using Azure Resource Manager, Bicep, and Azure Automation State Configuration, deploying via Azure Deployment Environments, and maintaining pipeline health including migration from classic to YAML pipelines.
- 4.Develop a security and compliance plan (10–15%): Covers choosing between Service Principals and Managed Identities, managing GitHub Apps and personal access tokens, configuring Azure DevOps service connections and security groups, implementing secrets management with Azure Key Vault, preventing secret leakage in pipelines, configuring Microsoft Defender for Cloud DevOps Security, setting up GitHub Advanced Security for code, secret, and dependency scanning, integrating Dependabot alerts, and automating container image scanning with CodeQL.
- 5.Implement an instrumentation strategy (5–10%): Covers configuring Azure Monitor and Log Analytics for DevOps tooling integration, collecting telemetry via Application Insights, VM Insights, Container Insights, Storage Insights, and Network Insights, configuring GitHub insights and pipeline alerting, inspecting infrastructure performance (CPU, memory, disk, network), analyzing distributed traces in Application Insights, and writing basic Kusto Query Language (KQL) queries for log interrogation.
Study Tips
- Use the official AZ-400 Study Guide on Microsoft Learn (aka.ms/AZ400-StudyGuide) as your primary syllabus. It lists every measurable skill organized by domain and percentage weight—use it to identify gaps rather than studying everything equally, given that build and release pipelines alone represent 50–55% of the exam.
- Complete the free Microsoft Learn Practice Assessment (Assessment ID 56) early in your preparation to benchmark your readiness and again in the final week. The assessment mirrors the actual exam's difficulty and question style, making it one of the most accurate predictors of exam performance.
- Build YAML pipelines hands-on in a free Azure DevOps organization and a GitHub repository. The exam heavily tests multi-stage pipelines, reusable templates, variable groups, environments with approval gates, and self-hosted agent configuration—skills that are difficult to absorb without writing and running real pipeline code.
- Study the Microsoft Learn instructor-led course AZ-400T00 (Design and Implement Microsoft DevOps Solutions) or its self-paced modules. The course covers all five exam domains and includes labs for Azure Pipelines, GitHub Actions, Azure Key Vault integration, IaC with Bicep, and Application Insights—directly aligned to exam objectives.
- Focus specific attention on GitHub Advanced Security and Microsoft Defender for Cloud DevOps Security, as these security tooling integrations have been consistently present in recent exam updates. Practice configuring CodeQL analysis, Dependabot alerts, and secret scanning policies in both GitHub and Azure DevOps contexts.
- Watch the AZ-400 Exam Readiness Zone video series on Microsoft Learn, which covers all five exam domains with exam-oriented explanations. This is especially useful for the instrumentation domain (5–10%) and processes/communications domain (10–15%), which are often underprepared relative to their exam weight.
- Practice writing basic Kusto Query Language (KQL) queries in Azure Monitor Logs, as the instrumentation domain includes direct questions on log interrogation. Microsoft's KQL quick reference and the Log Analytics demo environment (available free in the Azure portal) are the best resources for this skill.
Career Benefits
Earning the Microsoft Certified: DevOps Engineer Expert via AZ-400 positions professionals for senior-level roles including DevOps Engineer, Platform Engineer, Site Reliability Engineer, and Cloud Automation Architect. In the United States, certified Azure DevOps engineers typically command annual salaries ranging from $100,000 to $160,000 depending on experience, geography, and industry vertical. The certification serves as a strong differentiator in organizations that have standardized on the Microsoft Azure and GitHub ecosystem, which includes a large share of enterprise environments undergoing cloud-native transformation.
The DevOps Engineer Expert is one of Microsoft's most comprehensive expert-level credentials and is frequently cited by hiring managers as evidence of end-to-end delivery competence rather than narrow tool expertise. Unlike associate-level certifications, AZ-400 demonstrates proficiency that spans security engineering, infrastructure automation, release management, and observability—making certified professionals valuable contributors to platform, infrastructure, and application teams alike. The certification must be renewed annually via a free online assessment on Microsoft Learn, ensuring certified individuals stay current with the platform's evolving capabilities.
Sample Questions
5 sample questions with answers and explanations. The full bank has 622 questions, enough for 12 full-length practice exams.
Preview — answers shown1. A financial institution has a compliance requirement that all commits to their main branch must be digitally signed to verify the author's identity. Which Git feature should they implement to enforce this?
AA branch policy requiring a successful build.
BUsing SSH keys for authentication instead of PATs.
CA branch policy requiring GPG or SSH signature verification on commits.
DA pre-commit hook on the developers' machines.
Explanation
To enforce signed commits on the server side, you must configure a branch policy. Both GitHub and Azure DevOps have branch policy options that can be set to require that all commits being merged have a valid GPG or SSH signature. This ensures that the provenance of every commit can be verified, meeting the compliance requirement. A client-side pre-commit hook is not sufficient as it can be easily bypassed by a developer.
2. A lead developer suspects that the team's low productivity is due to a large amount of accumulated technical debt. They need a quantifiable metric that can help them prove this and track improvement over time. Which of the following is the most effective metric for measuring the impact of technical debt?
AThe number of active bugs in the backlog.
BThe percentage of overall development time spent on rework versus new features.
CThe percentage of unit tests that pass in a build.
DThe number of lines of code in the application.
Explanation
The percentage of time spent on rework is a powerful and direct measure of the impact of technical debt. Rework includes time spent fixing bugs caused by a fragile codebase, refactoring complex code just to make a simple change, or dealing with a convoluted deployment process. A high percentage of time spent on rework directly correlates with high technical debt and clearly demonstrates that the debt is hindering the team's ability to deliver new value (features). Tracking this metric over time can show the positive impact of refactoring efforts.
3. A team needs to configure a build agent for a project that requires a specific, licensed version of a third-party testing tool. The license agreement prohibits installation on shared or public infrastructure. Which type of agent should they use for their Azure Pipeline?
AA self-hosted agent installed on a dedicated, company-owned server
BA container job on a Microsoft-hosted agent
CA Microsoft-hosted agent running Windows
DA Microsoft-hosted agent running Ubuntu
Explanation
A self-hosted agent is the only correct choice. Microsoft-hosted agents are shared, public infrastructure and cannot have custom licensed software installed on them. By setting up a self-hosted agent on a dedicated server that the company owns, they can legally install the licensed testing tool and have full control over the agent's environment, ensuring it meets the software's requirements and the company's compliance needs.
4. A team needs to test a minor UI change on a single instance of their web application, which runs on a Virtual Machine Scale Set (VMSS). The app is stateful, so creating a separate test environment is not ideal. What is the most direct method to update just one instance within the VMSS for this test?
AUpdate the installation script in its source location, then manually connect to a specific instance and re-run the Custom Script Extension on it.
BUpdate the Custom Script Extension for the VMSS and then reimage all instances.
CCreate a new VMSS with the updated code and use a load balancer to split traffic.
DChange the VMSS upgrade policy to 'Manual' and then apply the update.
Explanation
The most direct and least disruptive method is to target a single instance. First, you update the installation or configuration script in its source location (e.g., a file in Azure Blob Storage). Then, you identify a specific instance within the VMSS and use Azure CLI or PowerShell to manually re-run the Custom Script Extension command against that instance only. This forces that one VM to pull the new script and re-apply its configuration, updating the application in isolation without affecting the rest of the scale set.
5. An administrator assigns a new Azure Policy to the top-level Tenant Root Group. The policy has an effect of 'Deny' and is triggered if the resource type is 'Microsoft.Storage/storageAccounts' and the supportsHttpsTrafficOnly property is false. What is the impact of this policy?
AIt prevents all non-HTTPS traffic to existing storage accounts.
BIt prevents the creation of any new storage account that allows non-HTTPS traffic.
CIt automatically enables the 'Secure transfer required' setting on all existing storage accounts.
DIt encrypts all data at rest for new storage accounts.
Explanation
A policy with a 'Deny' effect acts as a guardrail during resource creation or update. This specific policy will be evaluated by Azure Resource Manager whenever someone tries to create a new storage account. If the creation request specifies that supportsHttpsTrafficOnly is false, the policy condition will be met, and the 'Deny' effect will block the creation of the resource entirely. It does not affect existing resources, nor does it automatically modify (Append) resources. Note: The supportsHttpsTrafficOnly property corresponds to the 'Secure transfer required' setting in the portal.
Frequently Asked Questions
What are the prerequisites for AZ-400?
To earn the DevOps Engineer Expert certification you must also hold either AZ-104 (Azure Administrator Associate) or AZ-204 (Azure Developer Associate). You can sit AZ-400 in any order, but the title is only granted once you hold a qualifying associate certification.
How much does the AZ-400 exam cost?
AZ-400 costs USD $165 in the United States, with the price varying by country or region.
What is the passing score for AZ-400?
You need 700 out of 1000. It is a scaled score, not a raw percentage.
Is AZ-400 hard?
It is an expert-level exam covering a broad DevOps toolchain across Azure DevOps and GitHub. The build and release pipelines domain alone is 50 to 55 percent of the exam, so deep CI/CD experience matters.
What does AZ-400 cover?
Designing and implementing processes and communications (10-15%), source control (10-15%), build and release pipelines (50-55%), security and compliance (10-15%), and instrumentation (5-10%).
Does the AZ-400 certification expire?
Yes. The DevOps Engineer Expert certification is valid for one year and is renewed free through an online, open-book assessment on Microsoft Learn within the six months before it expires.
How long should I study for AZ-400?
Candidates with hands-on Azure and DevOps experience commonly spend roughly 6 to 10 weeks. This is a community estimate, not an official Microsoft figure.
Is AZ-400 worth it?
For DevOps and cloud engineers in the Microsoft ecosystem it is a recognized expert credential validating CI/CD, infrastructure as code, DevSecOps, and source control across Azure DevOps and GitHub.
More Microsoft Practice Exams
Microsoft Certified: Cybersecurity Architect Expert (SC-100)
SC-100 · 880 questions
Microsoft Certified: Cybersecurity Business Professional (SC-730)
SC-730 · 575 questions
Microsoft Certified: AI Agent Builder Associate (AB-620)
AB-620 · 595 questions
Microsoft Dynamics 365 Business Central Developer (MB-820)
MB-820 · 838 questions
Microsoft Dynamics 365 Business Central Functional Consultant (MB-800)
MB-800 · 1899 questions
Microsoft Dynamics 365 Customer Experience Analyst (MB-280)
MB-280 · 957 questions
$17.99
One-time access to this exam
622 questions (12 practice exams' worth)
Unlimited timed exam simulations
Yours forever — no subscription
Detailed explanations
Free preview stays available