Microsoft Certification
59 practice questions with correct answers and detailed explanations. Use this guide to review concepts before taking the practice exam.
The Microsoft Designing and Implementing Microsoft DevOps Solutions (AZ-400) certification validates professional expertise in Microsoft technologies. This study guide covers all 59 practice questions from our AZ-400 practice test, complete with correct answers and explanations to help you understand each concept thoroughly.
Review each question and explanation below, then test yourself with the full interactive practice exam to measure your readiness.
Your organization uses Azure Repos for version control. You need to implement a strategy to prevent direct commits to the main branch. Which approach should you use?
Branch policies in Azure Repos enforce code review requirements and build validation before merging to main, preventing direct commits effectively.
You are designing a multi-stage release pipeline using Azure Pipelines. What is the primary purpose of using deployment gates?
Deployment gates control the flow of releases by pausing deployments at specified points to allow for manual approvals, automated checks, or other validations before progression.
Your team is implementing Infrastructure as Code using Azure Resource Manager templates. A developer accidentally commits a template containing a hardcoded storage account key. What should be your immediate remediation step?
Immediately rotating the compromised credential is the critical first step to prevent unauthorized access, followed by auditing to determine if the key was misused.
You need to implement a container registry scanning solution in your CI/CD pipeline. Which Azure service should be integrated to scan container images for vulnerabilities automatically?
Azure Defender for Registries provides automated vulnerability scanning of container images stored in Azure Container Registry during build and deployment processes.
Your organization wants to measure deployment frequency and lead time for changes as part of DORA metrics. Which two metrics are these classified as?
DORA metrics include deployment frequency and lead time as velocity/efficiency measures that indicate how fast teams can deliver changes to production.
You are configuring a self-hosted Azure Pipelines agent behind a corporate firewall. The agent cannot reach Azure Services. What is the most likely configuration issue?
Self-hosted agents behind firewalls require outbound network access to Azure services; firewall rules blocking required endpoints will prevent agent connectivity to Azure.
Your team implements a blue-green deployment strategy for a critical application. What is the primary advantage of this approach?
Blue-green deployments maintain two identical production environments, allowing rapid traffic switching for instant rollbacks if issues occur in the new version.
You need to ensure that sensitive configuration values are not exposed in your Git repository. Which approach is recommended?
Azure Key Vault provides secure, centralized storage for secrets with access control and audit logging, preventing sensitive values from being stored in repositories.
Your organization is adopting GitOps practices using Azure DevOps. How should infrastructure and application configurations be managed in this approach?
GitOps treats Git repositories as the single source of truth, using continuous reconciliation operators to automatically synchronize the live environment with Git state.
You are implementing a security scanning step in your CI/CD pipeline using Microsoft Security DevOps. Which types of security vulnerabilities can this tool detect?
Microsoft Security DevOps scans source code, dependencies, and infrastructure configurations for security vulnerabilities and compliance issues across the development pipeline.
Your team uses Azure Artifacts to host NuGet packages. You need to implement feed permissions so only authorized teams can publish packages. What should you configure?
Azure Artifacts feeds support granular permission models where different teams can have separate feeds with specific contributor permissions for package publishing.
You need to implement test automation for UI testing in your CI/CD pipeline. Which approach provides the best integration with Azure Pipelines?
Selenium integrated with Azure Pipelines multi-job strategy enables automated, parallel UI testing with results reported back to the pipeline for quality gates.
Your organization must maintain compliance with data residency regulations. How should you configure Azure Pipelines agents to ensure builds occur in a specific geographic region?
Self-hosted agents deployed in a specific region and assigned to a dedicated agent pool ensure builds execute within the required geographic location for compliance.
You are designing a release pipeline for a microservices architecture. Which deployment pattern should you use to minimize blast radius if a service update fails?
Progressive microservice deployments with health checks and automated rollback limit failure impact by allowing individual service rollback while others remain operational.
Your team implements a build pipeline that generates multiple artifacts. You need to selectively copy specific artifacts to different release stages. Which Azure Pipelines task should you use?
The Download Build Artifacts task allows selective artifact retrieval based on patterns and stage requirements, enabling efficient artifact management across pipeline stages.
You need to implement a feedback loop from production monitoring back to your development team. Which practice aligns with DevOps principles?
Implementing feedback loops from production monitoring creates actionable insights for developers, enabling continuous improvement aligned with DevOps principles.
Your organization uses Azure DevOps with multiple projects. You need to share variable groups across projects for consistency. What is the recommended approach?
Organization-level variable groups in Azure DevOps allow sharing and consistent management of variables across multiple projects with controlled permissions.
You implement a policy requiring all pull requests to have code reviews from at least two reviewers. A senior developer claims this slows down the release process. How should you respond?
Code review policies create quality gates that catch defects early, reducing downstream costs and improving long-term velocity, even if individual reviews take time.
You need to automate the creation of work items based on test failures in your CI/CD pipeline. Which approach is recommended?
The Create Work Item task in Azure Pipelines automates work item generation from test failures, ensuring issues are tracked and prioritized appropriately.
Your organization implements Infrastructure as Code using Terraform. You need to validate Terraform configurations before deployment. Which tool should be integrated into your pipeline?
Terraform validate and tflint tools provide automated syntax checking, linting, and best practice validation for Infrastructure as Code before deployment.
You are designing a notification strategy for pipeline failures. Which approach provides the best balance between alerting teams and avoiding notification fatigue?
Targeted notifications for critical stages and failures with appropriate recipient groups reduce notification fatigue while ensuring important issues receive timely attention.
Your team needs to implement canary deployments for a web application. Which Azure service combination best supports this pattern?
Application Insights provides metrics collection while Traffic Manager can route traffic gradually to the canary version, enabling safe validation before full rollout.
You need to implement secret rotation for credentials used in your CI/CD pipeline. What is the recommended approach using Azure Key Vault?
Key Vault rotation policies combined with dynamic secret references in pipelines enable automatic credential rotation without manual intervention or pipeline downtime.
Your organization uses GitHub for version control but Azure DevOps for work item tracking. How should you integrate these systems for a cohesive DevOps workflow?
Azure Pipelines supports GitHub repositories with built-in connectors, and Azure DevOps extensions enable linking between GitHub commits and Azure DevOps work items.
You need to implement a policy that prevents merge of pull requests with insufficient code coverage. How should you configure this in Azure Repos?
Branch policies combined with build validation can enforce code coverage thresholds from test results, preventing merges that don't meet coverage requirements.
Your organization uses Azure Repos and wants to implement a branching strategy that supports continuous delivery with minimal merge conflicts. Which branching strategy is most suitable for a team practicing trunk-based development?
Trunk-based development with short-lived feature branches is ideal for continuous delivery, minimizing merge conflicts through frequent integration. Long-lived branches like in Git Flow introduce complexity that contradicts trunk-based principles.
You are implementing a CI/CD pipeline in Azure Pipelines. Your team requires that all pull requests must have at least two code reviews before merging. Where should you configure this policy?
Pull request policies including code review requirements are configured in Azure Repos branch protection rules and pull request policies, not in pipeline definitions. This ensures the policy is enforced at the repository level regardless of the CI/CD tool.
Your organization is implementing Infrastructure as Code using Azure Resource Manager templates. Which approach best ensures version control and auditability of infrastructure changes?
Storing ARM templates in Azure Repos provides version control, commit history, and enables automated deployments through CI/CD pipelines, ensuring auditability and traceability of infrastructure changes. This is a core DevOps practice.
You need to implement security scanning in your Azure Pipelines CI/CD workflow to detect vulnerabilities in open-source dependencies before deployment. Which Azure service should you integrate?
WhiteSource Bolt or Microsoft Dependency Check are purpose-built tools for scanning dependencies and identifying vulnerabilities in open-source packages within CI/CD pipelines. They can be integrated as pipeline tasks for automated security validation.
Your team is designing a release pipeline strategy where different environments (Dev, Staging, Production) require different approval workflows. What is the recommended approach using Azure Pipelines?
A single pipeline with multiple stages allows you to define environment-specific approval gates and pre-deployment conditions using stage dependencies and approval gates in YAML or release pipelines. This provides flexibility while maintaining a single source of truth.
You are implementing containerized applications in Azure Kubernetes Service (AKS). Which approach best integrates container image scanning for vulnerabilities into your DevOps workflow?
Integrating vulnerability scanning via ACR tasks or pipeline tasks like Trivy before images are pushed to the registry ensures security issues are caught early in the development cycle, enabling shift-left security practices.
Your organization wants to monitor deployment frequency and lead time for changes as key DevOps metrics. Which Azure service provides built-in dashboards for these DORA metrics?
Azure DevOps Analytics and Insights provide built-in views for DORA metrics including deployment frequency, lead time for changes, and failure rate, accessible directly within the Azure DevOps portal.
You need to implement a strategy for managing secrets (API keys, connection strings) in Azure Pipelines without exposing them in logs or YAML files. What is the most secure approach?
Using Azure Key Vault with managed identities provides defense-in-depth security, ensuring secrets are never stored in code or pipeline definitions and access is auditable. Secrets are fetched securely at runtime using the pipeline's managed identity.
Your team is using Azure Repos Git and wants to implement a policy that automatically rejects push attempts that contain secrets or API keys. Which solution should you implement?
Azure DevOps Credential Scanner (CredScan) can be integrated into build pipelines to detect secrets in committed code and configured to block pushes or builds when secrets are found, providing automated enforcement across the team.
You are designing a multi-stage deployment pipeline where the Production stage should only deploy if the Staging stage has been running without critical incidents for at least 24 hours. How would you implement this requirement?
Pre-deployment gates in Azure Pipelines can query Azure Monitor or other services to check for critical incidents, allowing you to conditionally approve deployments based on health metrics and incident data from the previous stage.
Your organization uses GitHub for source control but wants to integrate with Azure Pipelines for CI/CD. What is required to establish this integration?
Azure Pipelines supports GitHub as a source control system through a GitHub service connection that requires authorization via a personal access token, enabling CI/CD workflows for GitHub-hosted repositories.
You need to implement automated testing for your application in the build pipeline. Your team wants to ensure that test failures block the build and prevent deployment. How should you configure this?
Setting 'continueOnError: false' on test tasks ensures that any test failures will cause the build to fail and prevent downstream stages from executing, enforcing quality gates in the pipeline.
Your organization is implementing Infrastructure as Code with Terraform and wants to store state files securely in Azure. Which Azure service is recommended for storing Terraform state with encryption and concurrent access control?
Azure Blob Storage with RBAC and encryption at rest provides secure storage for Terraform state files, preventing unauthorized access and ensuring data is encrypted. This is the recommended approach for production Terraform state management.
You are implementing a blue-green deployment strategy in Azure App Service to enable zero-downtime deployments. What is the first step in setting up this strategy?
App Service Deployment Slots provide a built-in mechanism for blue-green deployments in Azure App Service, allowing you to deploy and validate in a staging slot before swapping with production, ensuring zero downtime.
Your team wants to implement automated rollback functionality in your deployment pipeline. If a deployment to production fails health checks, the previous version should be automatically restored. Which Azure service feature enables this?
App Service Deployment Slots can be configured to automatically swap back to the previous version if post-deployment health checks fail, providing automated rollback without manual intervention.
You are configuring source control security for your Azure Repos project. You want to prevent users from deleting branches without approval. Where should you configure this policy?
Branch deletion permissions and protections are configured in Azure Repos under branch policies and repository permissions, which control who can delete branches and whether approval is required.
Your organization uses Azure DevOps for project management and wants to link work items to code commits and pull requests for traceability. What naming convention should be used in commit messages?
Azure DevOps automatically links work items to commits and pull requests when the commit message includes '#' followed by the work item ID, enabling traceability without additional tools or manual processes.
You need to implement Continuous Monitoring (CM) for your deployed applications. Which combination of Azure services provides comprehensive application and infrastructure monitoring?
Azure Monitor provides infrastructure and system metrics while Application Insights offers deep application-level tracing, performance monitoring, and custom telemetry, together providing comprehensive CM coverage.
Your team is implementing GitOps for managing Kubernetes deployments in AKS. Which tool integrates with Azure Repos and AKS to automatically sync desired state from Git to the cluster?
Flux and ArgoCD are GitOps operators that can be deployed in AKS and continuously sync the cluster state with the desired state defined in a Git repository, enabling declarative infrastructure management.
You are implementing a policy where all code changes must pass static code analysis and meet quality gates before merging to main branch. Which Azure service component enforces this?
Branch policies can be configured to require successful completion of status checks (including SonarQube or other code analysis tools) before pull requests can be merged, enforcing quality gates at the repository level.
Your organization wants to implement automated database schema migrations as part of the deployment pipeline. Which approach is recommended for version controlling schema changes?
Version control tools like Flyway or Liquibase enable declarative database migrations that are treated like code, allowing them to be tested, reviewed, and deployed automatically as part of the CI/CD pipeline.
You need to configure Azure Pipelines to use a self-hosted agent pool that is only accessible from a specific corporate network. How should you set this up while maintaining security?
Self-hosted agents can be configured to communicate outbound to Azure DevOps through a proxy or firewall, allowing them to be network-restricted while maintaining secure connectivity to the DevOps service.
Your team wants to implement feature flags in your application to enable canary deployments where new features are rolled out to a percentage of users. Which Azure service integrates with your application code for feature flag management?
Azure App Configuration with Feature Manager provides a centralized store for feature flags that can be toggled at runtime, allowing applications to reference flags dynamically and enabling canary deployments without redeployment.
You are designing a compliance solution where all deployed resources must be tagged with cost center and environment information. How should you enforce this in your infrastructure deployments?
Azure Policy can enforce tagging requirements on resources, automatically blocking non-compliant deployments or auto-remediating them, ensuring all resources meet organizational tagging standards for compliance and cost management.
Your organization uses Azure Pipelines to build and deploy applications. You need to implement a strategy to manage secrets and sensitive data across multiple pipeline stages. Which approach provides the best security while maintaining ease of access?
Azure Key Vault integration with pipeline variable groups provides secure, centralized secret management with encryption at rest and in transit. This is the recommended Microsoft practice for handling sensitive data in CI/CD pipelines.
You are implementing infrastructure as code using Terraform in Azure DevOps. The Terraform state file contains sensitive information and must be protected. Where should you store the Terraform state file to meet security requirements?
Azure Storage with encryption and access controlled through Key Vault is the secure, scalable solution for Terraform state management. This prevents unauthorized access and ensures the sensitive state data is properly protected.
Your team is setting up a multi-stage deployment pipeline with approval gates. You need to ensure that deployments to production require manual approval from specific team members. Which feature in Azure Pipelines should you configure?
Release pipeline checks and approvals allow you to configure manual approval gates for specific stages, ensuring only authorized users can approve deployments to production environments.
You need to analyze code quality and security vulnerabilities in a containerized application before deployment. Which combination of tools should be integrated into your Azure Pipeline?
SonarQube analyzes code quality and technical debt, while Trivy scans container images for vulnerabilities. Integrating both into the pipeline enables shift-left security practices and early issue detection.
Your organization is adopting a trunk-based development strategy with Azure Repos. To support continuous integration while maintaining code quality, which branching strategy should you implement?
Trunk-based development uses a main branch with short-lived feature branches and frequent integrations. Feature flags decouple deployment from feature release, supporting continuous integration while managing risk.
You are implementing Azure DevOps with on-premises application servers. The organization requires that build artifacts be stored locally for compliance reasons. Which artifact storage solution meets this requirement?
Self-hosted artifact feeds or local NuGet feeds allow artifact storage on-premises, meeting compliance and data residency requirements while maintaining artifact management capabilities.
Your pipeline deploys microservices to a Kubernetes cluster. You need to implement a deployment strategy that allows gradual rollout while monitoring metrics and automatically rolling back on failure. Which deployment pattern should you use?
Canary deployments gradually roll out to a subset of users, enabling metric-based validation and automated rollback decisions. This minimizes blast radius and reduces risk in production environments.
You need to implement automated testing across multiple environments (dev, staging, production) with different data sets. How should you parameterize your test pipeline to handle environment-specific configurations?
Pipeline variables, variable groups, and template parameters provide flexible, secure configuration management across environments without code duplication or manual intervention.
Your organization monitors application performance in production using Azure Application Insights. You want to automatically trigger a rollback of a recent deployment if error rates exceed a threshold. Which Azure service should orchestrate this automated response?
Azure DevOps Release Pipelines support monitoring gates that can evaluate metrics from Application Insights and trigger automatic rollback or halt deployment progression based on defined thresholds.
You are designing a CI/CD solution where developers work across geographically distributed locations. You need to optimize pipeline execution time and reduce latency for artifact downloads. Which strategy should you implement?
Distributed agents in multiple regions combined with CDN for artifact delivery minimize latency and build times for geographically distributed teams while improving overall throughput.
You've reviewed all 59 questions. Take the interactive practice exam to simulate the real test environment.
▶ Start Practice Exam — Free