Microsoft · AZ-400
Designing and Implementing Microsoft DevOps Solutions (AZ-400) Practice Tests
Expert-level exam that measures your ability to design and implement processes, source control strategies, build and release pipelines, security and compliance plans, and instrumentation strategies for DevOps solutions.
Exam Details
Practice Questions
622
≈ 12 practice exams
Duration
150 minutes
Passing Score
700/1000
Difficulty
ExpertLast Updated
Jun 2026
Topics Covered
CI/CD PipelinesSource Control StrategyInfrastructure as CodeSecurity and ComplianceMonitoring and Instrumentation
AZ-400 Practice Exam
This AZ-400 practice exam prepares you for Designing and Implementing Microsoft DevOps Solutions, the exam behind the DevOps Engineer Expert certification. It is built around the way Microsoft weights the real exam, where designing and implementing build and release pipelines alone makes up 50 to 55 percent of your score, so the questions give you heavy, repeated exposure to CI/CD across Azure DevOps and GitHub.
Beyond pipelines, you will practice source control strategy, process and communication design, security and compliance planning, and instrumentation. Remember that passing AZ-400 only grants the Expert title once you also hold AZ-104 or AZ-204, so plan your certification path accordingly. The explanations connect each answer back to the tooling and tradeoffs you face when running production DevOps.
Use the free preview to benchmark yourself, then work through the full bank until you can consistently clear 700 out of 1000. The certification is valid for one year and renews free online, so treat this practice as the start of an ongoing DevOps learning routine.
Exam Domain Breakdown
Design and implement processes and communications13%
Design and implement a source control strategy13%
Design and implement build and release pipelines53%
Develop a security and compliance plan13%
Implement an instrumentation strategy8%
Exam Overview
The AZ-400 exam validates expert-level proficiency in designing and implementing DevOps solutions on Microsoft Azure, covering the full software delivery lifecycle from source control and CI/CD pipelines to security, compliance, and observability. The exam was last updated on July 26, 2024, and spans five major domains: processes and communications, source control strategy, build and release pipelines (the heaviest domain at 50–55%), security and compliance, and instrumentation. Candidates are assessed on both Azure DevOps and GitHub as delivery platforms, with a strong emphasis on YAML-based pipeline authoring, infrastructure as code using Bicep and Azure Resource Manager, and integration with Microsoft security tooling such as GitHub Advanced Security and Microsoft Defender for Cloud.
The certification leads to the Microsoft Certified: DevOps Engineer Expert credential, one of Microsoft's highest-tier role-based certifications. It reflects the breadth of skills required to bridge development and operations teams, automate software delivery pipelines, implement scalable IaC strategies, and embed security and monitoring throughout the development lifecycle. The exam content spans multiple Azure services including Azure Pipelines, Azure Repos, Azure Artifacts, Azure Boards, Azure Key Vault, Azure Monitor, Application Insights, and Azure App Configuration, making it one of the broadest Azure expert-level exams available.
Who Should Take This Exam
This exam is aimed at experienced developers and infrastructure administrators who operate at the intersection of software engineering and cloud operations. Ideal candidates hold hands-on experience with both Azure DevOps and GitHub, have already earned either the Azure Administrator Associate (AZ-104) or Azure Developer Associate (AZ-204) certification, and work—or aspire to work—on cross-functional teams alongside developers, site reliability engineers, Azure administrators, and security engineers.
Typical job roles that benefit from this certification include DevOps Engineer, Release Engineer, Platform Engineer, Cloud Infrastructure Engineer, and Site Reliability Engineer. Candidates should be comfortable designing branching strategies, authoring multi-stage YAML pipelines, managing secrets and service connections, configuring deployment patterns such as blue-green and canary releases, and integrating security scanning tools into pipelines. A background in scripting, cloud-native tooling, and agile delivery methodologies is strongly recommended.
Prerequisites
Microsoft does not impose formal prerequisites to register for the AZ-400 exam, but earning the resulting Microsoft Certified: DevOps Engineer Expert certification requires holding either the Microsoft Certified: Azure Administrator Associate (AZ-104) or Microsoft Certified: Azure Developer Associate (AZ-204) credential. These associate certifications ensure candidates have foundational competence in either Azure infrastructure management or Azure application development before attempting the expert-level exam.
Beyond formal certification requirements, candidates are strongly advised to have practical, hands-on experience implementing both Azure DevOps and GitHub solutions in production or near-production environments. Microsoft recommends proficiency in at least one of the two core disciplines (administration or development) along with experience designing CI/CD pipelines, managing Git repositories at scale, working with Azure Key Vault, and implementing Infrastructure as Code using Bicep or Azure Resource Manager templates. Familiarity with Kusto Query Language (KQL) for log analysis and with GitHub Advanced Security features is also beneficial given the breadth of the exam's security and instrumentation domains.
Exam Format
The AZ-400 exam is administered by Pearson VUE and can be taken via online proctoring or at an authorized testing center. The time limit is 150 minutes, and a passing score of 700 on a 1–1000 scale is required. The exam is available in ten languages: English, Japanese, Chinese (Simplified), Chinese (Traditional), Korean, German, French, Spanish, Portuguese (Brazil), and Italian; candidates taking a non-English version may request 30 additional minutes. Pricing varies by country and region.
The exam uses a variety of question formats typical of Microsoft expert-level exams, including multiple choice, multiple select, drag-and-drop, case studies, and lab-based or scenario-driven questions. Microsoft does not publish an exact question count, but the exam is structured around the five scored domains listed in the official study guide. A free Practice Assessment is available on Microsoft Learn (Assessment ID 56) that closely mirrors the style and difficulty of actual exam questions. The certification renews annually via a free online assessment on Microsoft Learn.
Skills Measured
- 1.Design and implement processes and communications (10–15%): Covers designing work-flow structures including GitHub Flow, implementing feedback cycles with GitHub issues and notifications, integrating tracking tools such as Azure Boards and GitHub Projects, configuring DevOps dashboards with metrics for cycle time, lead time, and time to recovery, documenting projects using wikis with Markdown and Mermaid syntax, automating release notes from Git history, and configuring integrations via webhooks and Microsoft Teams.
- 2.Design and implement a source control strategy (10–15%): Covers designing branching strategies (trunk-based, feature branch, release branch), implementing pull request workflows with branch policies and protections, configuring permissions and tags in repositories, managing large files with Git LFS and git-fat, scaling Git repositories using Scalar and cross-repository sharing, and recovering or removing specific data using Git commands.
- 3.Design and implement build and release pipelines (50–55%): The dominant domain, covering package management with Azure Artifacts and GitHub Packages, dependency versioning using SemVer and CalVer, designing comprehensive testing strategies (unit, integration, load) with code coverage, authoring multi-stage YAML pipelines with parallelism and reusable templates, selecting and managing GitHub Actions runners and Azure DevOps agents, designing deployment strategies (blue-green, canary, ring, feature flags, A/B testing), minimizing downtime with VIP swap and deployment slots, implementing Infrastructure as Code using Azure Resource Manager, Bicep, and Azure Automation State Configuration, deploying via Azure Deployment Environments, and maintaining pipeline health including migration from classic to YAML pipelines.
- 4.Develop a security and compliance plan (10–15%): Covers choosing between Service Principals and Managed Identities, managing GitHub Apps and personal access tokens, configuring Azure DevOps service connections and security groups, implementing secrets management with Azure Key Vault, preventing secret leakage in pipelines, configuring Microsoft Defender for Cloud DevOps Security, setting up GitHub Advanced Security for code, secret, and dependency scanning, integrating Dependabot alerts, and automating container image scanning with CodeQL.
- 5.Implement an instrumentation strategy (5–10%): Covers configuring Azure Monitor and Log Analytics for DevOps tooling integration, collecting telemetry via Application Insights, VM Insights, Container Insights, Storage Insights, and Network Insights, configuring GitHub insights and pipeline alerting, inspecting infrastructure performance (CPU, memory, disk, network), analyzing distributed traces in Application Insights, and writing basic Kusto Query Language (KQL) queries for log interrogation.
Study Tips
- Use the official AZ-400 Study Guide on Microsoft Learn (aka.ms/AZ400-StudyGuide) as your primary syllabus. It lists every measurable skill organized by domain and percentage weight—use it to identify gaps rather than studying everything equally, given that build and release pipelines alone represent 50–55% of the exam.
- Complete the free Microsoft Learn Practice Assessment (Assessment ID 56) early in your preparation to benchmark your readiness and again in the final week. The assessment mirrors the actual exam's difficulty and question style, making it one of the most accurate predictors of exam performance.
- Build YAML pipelines hands-on in a free Azure DevOps organization and a GitHub repository. The exam heavily tests multi-stage pipelines, reusable templates, variable groups, environments with approval gates, and self-hosted agent configuration—skills that are difficult to absorb without writing and running real pipeline code.
- Study the Microsoft Learn instructor-led course AZ-400T00 (Design and Implement Microsoft DevOps Solutions) or its self-paced modules. The course covers all five exam domains and includes labs for Azure Pipelines, GitHub Actions, Azure Key Vault integration, IaC with Bicep, and Application Insights—directly aligned to exam objectives.
- Focus specific attention on GitHub Advanced Security and Microsoft Defender for Cloud DevOps Security, as these security tooling integrations have been consistently present in recent exam updates. Practice configuring CodeQL analysis, Dependabot alerts, and secret scanning policies in both GitHub and Azure DevOps contexts.
- Watch the AZ-400 Exam Readiness Zone video series on Microsoft Learn, which covers all five exam domains with exam-oriented explanations. This is especially useful for the instrumentation domain (5–10%) and processes/communications domain (10–15%), which are often underprepared relative to their exam weight.
- Practice writing basic Kusto Query Language (KQL) queries in Azure Monitor Logs, as the instrumentation domain includes direct questions on log interrogation. Microsoft's KQL quick reference and the Log Analytics demo environment (available free in the Azure portal) are the best resources for this skill.
Career Benefits
Earning the Microsoft Certified: DevOps Engineer Expert via AZ-400 positions professionals for senior-level roles including DevOps Engineer, Platform Engineer, Site Reliability Engineer, and Cloud Automation Architect. In the United States, certified Azure DevOps engineers typically command annual salaries ranging from $100,000 to $160,000 depending on experience, geography, and industry vertical. The certification serves as a strong differentiator in organizations that have standardized on the Microsoft Azure and GitHub ecosystem, which includes a large share of enterprise environments undergoing cloud-native transformation.
The DevOps Engineer Expert is one of Microsoft's most comprehensive expert-level credentials and is frequently cited by hiring managers as evidence of end-to-end delivery competence rather than narrow tool expertise. Unlike associate-level certifications, AZ-400 demonstrates proficiency that spans security engineering, infrastructure automation, release management, and observability—making certified professionals valuable contributors to platform, infrastructure, and application teams alike. The certification must be renewed annually via a free online assessment on Microsoft Learn, ensuring certified individuals stay current with the platform's evolving capabilities.
Sample Questions
5 sample questions with answers and explanations. The full bank has 622 questions, enough for 12 full-length practice exams.
Preview — answers shown1. The central platform team at Nexus Innovations develops and distributes several shared packages using a single feed in Azure Artifacts. They need a mechanism to publish new builds from their CI pipeline for validation and testing. These new builds must not be visible or available to regular consumers, who should only have access to packages that have been officially promoted to a 'release' quality level. How can they achieve this separation of package visibility within the same feed?
AUse feed views
BImplement retention policies
CCreate a separate feed for each quality level
DUse upstream sources
Explanation
Using feed views is the correct solution for this scenario. Azure Artifacts allows you to promote packages through different views, such as @local, @prerelease, and @release. New packages are published to the @local view by default. The platform team can then test them and, once validated, promote them to the @release view. Consumers of the packages can then connect their developer tools directly to the @release view, ensuring they only ever see and restore the stable, approved packages, while the development packages remain hidden from them. Upstream sources are for proxying packages from other feeds. Retention policies are for automatically deleting old package versions, not controlling visibility. Creating separate feeds is a valid strategy but the question asks how to solve it within a single feed.
2. A company wants to provide developers with a simple and secure way to authenticate with Git from the command line to their Azure Repos. The solution should avoid repeated password prompts. What is the recommended tool for this?
AUsing the Git Credential Manager.
BUsing alternate credentials.
CStoring a PAT in a plain text file.
DUsing a managed identity.
Explanation
The Git Credential Manager (GCM) is the modern, recommended solution. It integrates with the operating system's credential store to securely handle authentication for Git. When a developer first connects to Azure Repos, it facilitates an interactive sign-in with their Azure AD account. After that, it securely caches the token and automatically provides it to Git for future commands, providing a seamless and secure experience without repeated password entry. Alternate credentials are a legacy and less secure option. Managed identities are for services, not developer workstations.
3. A DevOps team wants to automatically link work items to their YAML pipeline runs. When a run completes, they want the linked User Story to show the run's status. Where in the pipeline's UI settings would they typically enable or configure this automatic work item linking?
AIn the pipeline's Triggers tab
BIn the pipeline's Settings from the 'More actions' menu
CIn the repository's branch policy settings
DIn the project's Agent Pool settings
Explanation
This configuration is typically found in the pipeline's settings menu in the web UI. Even for a YAML pipeline, some metadata and integration settings are managed through the user interface. By editing the pipeline and selecting 'Settings' from the 'More actions' (three dots) menu, you can find options to control integrations, including whether to automatically link work items that are mentioned in commit messages.
4. A DevOps team at Fabrikam is creating a new pipeline for a .NET Core application. The pipeline needs a stage to build the code, a stage to run unit tests, and a final stage to perform a static code analysis using SonarQube. What is the correct sequence of tasks within the pipeline to achieve this?
A1. Prepare Analysis Configuration 2. Visual Studio Build 3. Visual Studio Test 4. Run Code Analysis
B1. Visual Studio Build 2. Visual Studio Test 3. Run Code Analysis 4. Prepare Analysis Configuration
C1. Run Code Analysis 2. Visual Studio Build 3. Prepare Analysis Configuration 4. Visual Studio Test
D1. Visual Studio Test 2. Prepare Analysis Configuration 3. Run Code Analysis 4. Visual Studio Build
Explanation
The correct sequence for integrating SonarQube is critical. First, you must run the 'Prepare Analysis Configuration' task. This task configures the SonarScanner and must run before the build. Second, you run the 'Visual Studio Build' task to compile the code. The SonarScanner integrates with the build process to collect information. Third, you run the 'Visual Studio Test' task to execute unit tests and generate code coverage reports. Finally, you run the 'Run Code Analysis' task. This task collects all the build and test coverage information and sends it to the SonarQube server for processing.
5. An architect is evaluating their team's trunk-based development strategy. To ensure the main branch remains stable and of high quality, which two of the following are the most important things to check for in their process?
Multiple correct answersAAnalyze the pull request workflow to ensure it includes automated build and test validation.
BReview the commit history to assess if changes are being integrated frequently in small batches.
CCount the number of active branches at any given time.
DEnsure developers are creating branches that live for several weeks or months.
Explanation
The two most important things to check are the PR workflow and the commit history. First, analyzing the pull request workflow to ensure it includes automated quality gates (like successful builds and tests) is critical to prevent broken code from being merged. Second, reviewing the commit history to see if changes are being integrated frequently and in small, manageable batches is a key indicator of a healthy trunk-based development process. Large, infrequent merges increase risk and make debugging difficult. Long-lived branches are the opposite of what is desired in trunk-based development.
Frequently Asked Questions
What are the prerequisites for AZ-400?
To earn the DevOps Engineer Expert certification you must also hold either AZ-104 (Azure Administrator Associate) or AZ-204 (Azure Developer Associate). You can sit AZ-400 in any order, but the title is only granted once you hold a qualifying associate certification.
How much does the AZ-400 exam cost?
AZ-400 costs USD $165 in the United States, with the price varying by country or region.
What is the passing score for AZ-400?
You need 700 out of 1000. It is a scaled score, not a raw percentage.
Is AZ-400 hard?
It is an expert-level exam covering a broad DevOps toolchain across Azure DevOps and GitHub. The build and release pipelines domain alone is 50 to 55 percent of the exam, so deep CI/CD experience matters.
What does AZ-400 cover?
Designing and implementing processes and communications (10-15%), source control (10-15%), build and release pipelines (50-55%), security and compliance (10-15%), and instrumentation (5-10%).
Does the AZ-400 certification expire?
Yes. The DevOps Engineer Expert certification is valid for one year and is renewed free through an online, open-book assessment on Microsoft Learn within the six months before it expires.
How long should I study for AZ-400?
Candidates with hands-on Azure and DevOps experience commonly spend roughly 6 to 10 weeks. This is a community estimate, not an official Microsoft figure.
Is AZ-400 worth it?
For DevOps and cloud engineers in the Microsoft ecosystem it is a recognized expert credential validating CI/CD, infrastructure as code, DevSecOps, and source control across Azure DevOps and GitHub.
More Microsoft Practice Exams
Microsoft Certified: Cybersecurity Architect Expert (SC-100)
SC-100 · 880 questions
Microsoft Certified: Cybersecurity Business Professional (SC-730)
SC-730 · 575 questions
Microsoft Certified: AI Agent Builder Associate (AB-620)
AB-620 · 595 questions
Microsoft Dynamics 365 Business Central Developer (MB-820)
MB-820 · 838 questions
Microsoft Dynamics 365 Business Central Functional Consultant (MB-800)
MB-800 · 1899 questions
Microsoft Dynamics 365 Customer Experience Analyst (MB-280)
MB-280 · 957 questions
$17.99
One-time access to this exam
622 questions (12 practice exams' worth)
Unlimited timed exam simulations
Yours forever — no subscription
Detailed explanations
Free preview stays available