Microsoft · AZ-400
Designing and Implementing Microsoft DevOps Solutions (AZ-400) Practice Test
Expert-level exam that measures your ability to design and implement processes, source control strategies, build and release pipelines, security and compliance plans, and instrumentation strategies for DevOps solutions.
Exam Details
Questions
622
Duration
150 minutes
Passing Score
700/1000
Difficulty
ExpertLast Updated
Jun 2026
Topics Covered
CI/CD PipelinesSource Control StrategyInfrastructure as CodeSecurity and ComplianceMonitoring and Instrumentation
AZ-400 Practice Exam
This AZ-400 practice exam prepares you for Designing and Implementing Microsoft DevOps Solutions, the exam behind the DevOps Engineer Expert certification. It is built around the way Microsoft weights the real exam, where designing and implementing build and release pipelines alone makes up 50 to 55 percent of your score, so the questions give you heavy, repeated exposure to CI/CD across Azure DevOps and GitHub.
Beyond pipelines, you will practice source control strategy, process and communication design, security and compliance planning, and instrumentation. Remember that passing AZ-400 only grants the Expert title once you also hold AZ-104 or AZ-204, so plan your certification path accordingly. The explanations connect each answer back to the tooling and tradeoffs you face when running production DevOps.
Use the free preview to benchmark yourself, then work through the full bank until you can consistently clear 700 out of 1000. The certification is valid for one year and renews free online, so treat this practice as the start of an ongoing DevOps learning routine.
Exam Domain Breakdown
Design and implement processes and communications13%
Design and implement a source control strategy13%
Design and implement build and release pipelines53%
Develop a security and compliance plan13%
Implement an instrumentation strategy8%
Exam Overview
The AZ-400 exam validates expert-level proficiency in designing and implementing DevOps solutions on Microsoft Azure, covering the full software delivery lifecycle from source control and CI/CD pipelines to security, compliance, and observability. The exam was last updated on July 26, 2024, and spans five major domains: processes and communications, source control strategy, build and release pipelines (the heaviest domain at 50–55%), security and compliance, and instrumentation. Candidates are assessed on both Azure DevOps and GitHub as delivery platforms, with a strong emphasis on YAML-based pipeline authoring, infrastructure as code using Bicep and Azure Resource Manager, and integration with Microsoft security tooling such as GitHub Advanced Security and Microsoft Defender for Cloud.
The certification leads to the Microsoft Certified: DevOps Engineer Expert credential, one of Microsoft's highest-tier role-based certifications. It reflects the breadth of skills required to bridge development and operations teams, automate software delivery pipelines, implement scalable IaC strategies, and embed security and monitoring throughout the development lifecycle. The exam content spans multiple Azure services including Azure Pipelines, Azure Repos, Azure Artifacts, Azure Boards, Azure Key Vault, Azure Monitor, Application Insights, and Azure App Configuration, making it one of the broadest Azure expert-level exams available.
Who Should Take This Exam
This exam is aimed at experienced developers and infrastructure administrators who operate at the intersection of software engineering and cloud operations. Ideal candidates hold hands-on experience with both Azure DevOps and GitHub, have already earned either the Azure Administrator Associate (AZ-104) or Azure Developer Associate (AZ-204) certification, and work—or aspire to work—on cross-functional teams alongside developers, site reliability engineers, Azure administrators, and security engineers.
Typical job roles that benefit from this certification include DevOps Engineer, Release Engineer, Platform Engineer, Cloud Infrastructure Engineer, and Site Reliability Engineer. Candidates should be comfortable designing branching strategies, authoring multi-stage YAML pipelines, managing secrets and service connections, configuring deployment patterns such as blue-green and canary releases, and integrating security scanning tools into pipelines. A background in scripting, cloud-native tooling, and agile delivery methodologies is strongly recommended.
Prerequisites
Microsoft does not impose formal prerequisites to register for the AZ-400 exam, but earning the resulting Microsoft Certified: DevOps Engineer Expert certification requires holding either the Microsoft Certified: Azure Administrator Associate (AZ-104) or Microsoft Certified: Azure Developer Associate (AZ-204) credential. These associate certifications ensure candidates have foundational competence in either Azure infrastructure management or Azure application development before attempting the expert-level exam.
Beyond formal certification requirements, candidates are strongly advised to have practical, hands-on experience implementing both Azure DevOps and GitHub solutions in production or near-production environments. Microsoft recommends proficiency in at least one of the two core disciplines (administration or development) along with experience designing CI/CD pipelines, managing Git repositories at scale, working with Azure Key Vault, and implementing Infrastructure as Code using Bicep or Azure Resource Manager templates. Familiarity with Kusto Query Language (KQL) for log analysis and with GitHub Advanced Security features is also beneficial given the breadth of the exam's security and instrumentation domains.
Exam Format
The AZ-400 exam is administered by Pearson VUE and can be taken via online proctoring or at an authorized testing center. The time limit is 150 minutes, and a passing score of 700 on a 1–1000 scale is required. The exam is available in ten languages: English, Japanese, Chinese (Simplified), Chinese (Traditional), Korean, German, French, Spanish, Portuguese (Brazil), and Italian; candidates taking a non-English version may request 30 additional minutes. Pricing varies by country and region.
The exam uses a variety of question formats typical of Microsoft expert-level exams, including multiple choice, multiple select, drag-and-drop, case studies, and lab-based or scenario-driven questions. Microsoft does not publish an exact question count, but the exam is structured around the five scored domains listed in the official study guide. A free Practice Assessment is available on Microsoft Learn (Assessment ID 56) that closely mirrors the style and difficulty of actual exam questions. The certification renews annually via a free online assessment on Microsoft Learn.
Skills Measured
- 1.Design and implement processes and communications (10–15%): Covers designing work-flow structures including GitHub Flow, implementing feedback cycles with GitHub issues and notifications, integrating tracking tools such as Azure Boards and GitHub Projects, configuring DevOps dashboards with metrics for cycle time, lead time, and time to recovery, documenting projects using wikis with Markdown and Mermaid syntax, automating release notes from Git history, and configuring integrations via webhooks and Microsoft Teams.
- 2.Design and implement a source control strategy (10–15%): Covers designing branching strategies (trunk-based, feature branch, release branch), implementing pull request workflows with branch policies and protections, configuring permissions and tags in repositories, managing large files with Git LFS and git-fat, scaling Git repositories using Scalar and cross-repository sharing, and recovering or removing specific data using Git commands.
- 3.Design and implement build and release pipelines (50–55%): The dominant domain, covering package management with Azure Artifacts and GitHub Packages, dependency versioning using SemVer and CalVer, designing comprehensive testing strategies (unit, integration, load) with code coverage, authoring multi-stage YAML pipelines with parallelism and reusable templates, selecting and managing GitHub Actions runners and Azure DevOps agents, designing deployment strategies (blue-green, canary, ring, feature flags, A/B testing), minimizing downtime with VIP swap and deployment slots, implementing Infrastructure as Code using Azure Resource Manager, Bicep, and Azure Automation State Configuration, deploying via Azure Deployment Environments, and maintaining pipeline health including migration from classic to YAML pipelines.
- 4.Develop a security and compliance plan (10–15%): Covers choosing between Service Principals and Managed Identities, managing GitHub Apps and personal access tokens, configuring Azure DevOps service connections and security groups, implementing secrets management with Azure Key Vault, preventing secret leakage in pipelines, configuring Microsoft Defender for Cloud DevOps Security, setting up GitHub Advanced Security for code, secret, and dependency scanning, integrating Dependabot alerts, and automating container image scanning with CodeQL.
- 5.Implement an instrumentation strategy (5–10%): Covers configuring Azure Monitor and Log Analytics for DevOps tooling integration, collecting telemetry via Application Insights, VM Insights, Container Insights, Storage Insights, and Network Insights, configuring GitHub insights and pipeline alerting, inspecting infrastructure performance (CPU, memory, disk, network), analyzing distributed traces in Application Insights, and writing basic Kusto Query Language (KQL) queries for log interrogation.
Study Tips
- Use the official AZ-400 Study Guide on Microsoft Learn (aka.ms/AZ400-StudyGuide) as your primary syllabus. It lists every measurable skill organized by domain and percentage weight—use it to identify gaps rather than studying everything equally, given that build and release pipelines alone represent 50–55% of the exam.
- Complete the free Microsoft Learn Practice Assessment (Assessment ID 56) early in your preparation to benchmark your readiness and again in the final week. The assessment mirrors the actual exam's difficulty and question style, making it one of the most accurate predictors of exam performance.
- Build YAML pipelines hands-on in a free Azure DevOps organization and a GitHub repository. The exam heavily tests multi-stage pipelines, reusable templates, variable groups, environments with approval gates, and self-hosted agent configuration—skills that are difficult to absorb without writing and running real pipeline code.
- Study the Microsoft Learn instructor-led course AZ-400T00 (Design and Implement Microsoft DevOps Solutions) or its self-paced modules. The course covers all five exam domains and includes labs for Azure Pipelines, GitHub Actions, Azure Key Vault integration, IaC with Bicep, and Application Insights—directly aligned to exam objectives.
- Focus specific attention on GitHub Advanced Security and Microsoft Defender for Cloud DevOps Security, as these security tooling integrations have been consistently present in recent exam updates. Practice configuring CodeQL analysis, Dependabot alerts, and secret scanning policies in both GitHub and Azure DevOps contexts.
- Watch the AZ-400 Exam Readiness Zone video series on Microsoft Learn, which covers all five exam domains with exam-oriented explanations. This is especially useful for the instrumentation domain (5–10%) and processes/communications domain (10–15%), which are often underprepared relative to their exam weight.
- Practice writing basic Kusto Query Language (KQL) queries in Azure Monitor Logs, as the instrumentation domain includes direct questions on log interrogation. Microsoft's KQL quick reference and the Log Analytics demo environment (available free in the Azure portal) are the best resources for this skill.
Career Benefits
Earning the Microsoft Certified: DevOps Engineer Expert via AZ-400 positions professionals for senior-level roles including DevOps Engineer, Platform Engineer, Site Reliability Engineer, and Cloud Automation Architect. In the United States, certified Azure DevOps engineers typically command annual salaries ranging from $100,000 to $160,000 depending on experience, geography, and industry vertical. The certification serves as a strong differentiator in organizations that have standardized on the Microsoft Azure and GitHub ecosystem, which includes a large share of enterprise environments undergoing cloud-native transformation.
The DevOps Engineer Expert is one of Microsoft's most comprehensive expert-level credentials and is frequently cited by hiring managers as evidence of end-to-end delivery competence rather than narrow tool expertise. Unlike associate-level certifications, AZ-400 demonstrates proficiency that spans security engineering, infrastructure automation, release management, and observability—making certified professionals valuable contributors to platform, infrastructure, and application teams alike. The certification must be renewed annually via a free online assessment on Microsoft Learn, ensuring certified individuals stay current with the platform's evolving capabilities.
Sample Questions
5 sample questions with answers and explanations. Start a practice session to test yourself across all 622 questions.
Preview — answers shown1. A branch policy on the main branch of an Azure Repo requires all pull requests to have a successful build before they can be merged. A specific user, the release manager, must be able to merge a hotfix urgently, even if the build fails. To grant this permission while adhering to the principle of least privilege, where should this override be configured?
AIn the Security settings for the entire repository, by granting the user the 'Bypass policies' permission.
BBy adding the user to the 'Project Administrators' group for the project.
CIn the Security settings for the main branch, by granting the user the 'Bypass policies on pull requests' permission.
DBy adding the user to the 'Build Administrators' group for the organization.
Explanation
The most precise and least-privileged way to grant this permission is in the Security settings for the specific branch (main). Within the branch's security configuration, you can find the 'Bypass policies on pull requests' permission. Granting 'Allow' for this permission to the release manager's user account will let them override the build policy, but only on that specific branch and only for pull requests. This is much more targeted than granting broad administrative or repository-wide permissions.
2. A release pipeline needs to generate release notes automatically. The notes must contain a list of all 'Feature' and 'Bug' work items associated with the release. Which three components are needed to build this automation?
A1. A service principal. 2. A dashboard widget. 3. A PowerShell script.
B1. An agent pool. 2. A variable group. 3. A deployment group.
C1. A work item query. 2. A service hook. 3. A release gate.
D1. A Personal Access Token (PAT). 2. A Work Item Query. 3. A PowerShell task in the pipeline.
Explanation
The three necessary components are: First, a Personal Access Token (PAT) with permissions to read work items. This will be used to securely authenticate to the Azure DevOps REST API. Second, a saved Work Item Query that is configured to find all 'Feature' and 'Bug' work items linked to the current build. Third, a PowerShell (or Bash) task in the release pipeline. This script will use the PAT to call the REST API, execute the saved query, parse the JSON results, and format them into a markdown file for the release notes.
3. A team needs to send a daily summary of application exceptions to a Microsoft Teams channel. The exceptions are automatically captured in Application Insights. Which two Azure services should be used together to create this automated reporting workflow with minimal code?
AAzure Logic Apps and Azure Application Insights
BAzure Functions and Azure DevOps
CAzure Data Factory and Microsoft Teams
DAzure Automation and Azure Event Hub
Explanation
The best combination is Azure Logic Apps and Azure Application Insights. You can create a Logic App with a 'Recurrence' trigger to run once a day. This Logic App can then use the 'Run Analytics query' action to query the exceptions table in Application Insights for the last 24 hours. Finally, it can use the built-in 'Post a message' connector for Microsoft Teams to format and send the summary. This entire workflow can be built in a low-code, visual designer.
4. A release pipeline for an Azure App Service has an approval process where a team lead must sign off before deploying to production. The company policy allows for an eight-hour approval window. However, the pipeline is currently configured with a two-hour timeout, causing deployments to fail if the approval is delayed. Where should a DevOps engineer adjust the settings to extend this approval timeout to the required eight hours?
AIn the Post-deployment conditions, by modifying the Timeout for approvals.
BIn the Agent Job, by modifying the job timeout.
CIn the Pre-deployment conditions, by modifying the Time between re-evaluation of gates.
DIn the Pre-deployment conditions, by modifying the Timeout for approvals.
Explanation
The correct place to change this setting is in the Pre-deployment conditions. The approval happens before the deployment to a stage begins. Within the pre-deployment conditions, there is a specific Timeout setting for manual approvals that dictates how long the pipeline will wait for a person to approve or reject the release before it automatically fails. This needs to be set to 8 hours. The Time between re-evaluation of gates is incorrect because it applies to automated checks (gates), not manual human approvals. Post-deployment conditions are incorrect because they apply after a stage has completed, not before. The agent job timeout is incorrect as it limits how long the agent can run tasks, not how long it waits for an approval.
5. A team needs to deploy an application using Helm to an RBAC-enabled Azure Kubernetes Service (AKS) cluster. The pipeline needs an identity to authenticate to the cluster. What is the correct sequence of actions to set this up securely?
A1. Create a service principal in Azure AD and grant it a role on the AKS cluster. 2. Create an ARM service connection in DevOps using the service principal. 3. Use the service connection in the Helm task.
B1. Create a service connection in DevOps using a developer's PAT. 2. Configure RBAC roles. 3. Run helm install.
C1. Run helm init. 2. Create a service principal. 3. Grant the service principal a role.
D1. Grant the 'Azure Kubernetes Service Cluster Admin' role to the 'Project Collection Build Service' identity. 2. Run helm install.
Explanation
The standard, secure procedure is: First, create a dedicated identity for the pipeline by creating a service principal in Azure AD. You then grant this service principal an appropriate role (like 'Azure Kubernetes Service Cluster User Role') on the AKS cluster resource in Azure. Second, you create an 'Azure Resource Manager' service connection in your Azure DevOps project, configuring it to use the service principal you just created. Finally, in your pipeline's Helm task, you select this service connection, which allows the pipeline to securely authenticate to the cluster and perform the deployment.
Frequently Asked Questions
What are the prerequisites for AZ-400?
To earn the DevOps Engineer Expert certification you must also hold either AZ-104 (Azure Administrator Associate) or AZ-204 (Azure Developer Associate). You can sit AZ-400 in any order, but the title is only granted once you hold a qualifying associate certification.
How much does the AZ-400 exam cost?
AZ-400 costs USD $165 in the United States, with the price varying by country or region.
What is the passing score for AZ-400?
You need 700 out of 1000. It is a scaled score, not a raw percentage.
Is AZ-400 hard?
It is an expert-level exam covering a broad DevOps toolchain across Azure DevOps and GitHub. The build and release pipelines domain alone is 50 to 55 percent of the exam, so deep CI/CD experience matters.
What does AZ-400 cover?
Designing and implementing processes and communications (10-15%), source control (10-15%), build and release pipelines (50-55%), security and compliance (10-15%), and instrumentation (5-10%).
Does the AZ-400 certification expire?
Yes. The DevOps Engineer Expert certification is valid for one year and is renewed free through an online, open-book assessment on Microsoft Learn within the six months before it expires.
How long should I study for AZ-400?
Candidates with hands-on Azure and DevOps experience commonly spend roughly 6 to 10 weeks. This is a community estimate, not an official Microsoft figure.
Is AZ-400 worth it?
For DevOps and cloud engineers in the Microsoft ecosystem it is a recognized expert credential validating CI/CD, infrastructure as code, DevSecOps, and source control across Azure DevOps and GitHub.
More Microsoft Practice Exams
Microsoft Dynamics 365 Supply Chain Management Functional Consultant Expert (MB-335)
MB-335 · 2039 questions
Microsoft Dynamics 365 Business Central Functional Consultant (MB-800)
MB-800 · 1899 questions
Microsoft Certified: Azure AI Engineer Associate (AI-102)
AI-102 · 1392 questions
Microsoft Certified: Windows Server Hybrid Administrator Associate (AZ-801)
AZ-801 · 1376 questions
Microsoft Dynamics 365 Finance Functional Consultant (MB-310)
MB-310 · 1299 questions
Microsoft 365 Certified: Fundamentals (MS-900)
MS-900 · 1201 questions
$17.99
One-time access to this exam
Full access to all 622 questions
Or $15/mo for all 253 exams
Detailed explanations
Free preview stays available