dc dotCreds
Designing and Implementing Microsoft DevOps Solutions

AZ-400 Practice Test

Start today’s free 10-question AZ-400 set with source-backed explanations, local progress, and a fresh rotation every morning.

10 Free Daily Questions Source-backed Explanations 200 Verified Questions

Questions updated at Aug 12, 2026, 3:38 PM CDT

Go Pro - One Time Unlock

Unlock the full AZ-400 bank

200 verified questions Exam Mode Practice Mode Detailed explanations Weak-area review No subscription - one-time unlock

Get the complete source-backed bank with Interview Questions, the full Study Guide, full Course Notes, detailed explanations, weak-area review, and exam-style practice.

Interview Questions Full Study Guide Full Course Notes Exam Mode Practice Mode Guided Course Detailed explanations Weak-area review No subscription
$4.99 One-time payment
See bundle and PDF options

We will confirm your site email in one quick checkout step.

Why DotCreds?

Practice with explanations that teach.

Source links for every answer Every wrong answer explained Guided Course included Practice and Exam Mode Weak-area tracking Same verified bank across web practice

What you get with free practice

10 Free Questions Daily Fresh set every day from the live bank
Detailed Explanations Learn with clear source-backed answers
Track Your Progress Daily history and performance insights
Upgrade Anytime Unlock the full bank when you are ready
Today's 10 AZ-400 questions

Use this AZ-400 practice test to review Designing and Implementing Microsoft DevOps Solutions. Questions rotate daily and each answer links back to the source used to write it.

Today’s Set
10 questions
Rotates at 10:00 AM local time
Progress
0/10
Answered on this page
Accuracy
0%
Loading countdown…

200 verified questions are in the live bank. Free daily questions are selected from a rotating sample set. Unlock Pro to access the full question bank.

Preparing today’s free questions... Ordering the final locked-bank set before showing the practice cards.
Question 1 of 10
Objective Design and implement traceability and flow of work Design and implement processes and communications

A release dashboard shows a linked work item and commit, but no build, test, or deployment links. The team says the release is fully traceable and tested. Which assessment is accurate?

Concept tested:
Question 2 of 10
Objective Manage sensitive information in automation Develop a security and compliance plan

A pipeline downloads a secure provisioning profile, copies it to a persistent folder, and passes its password on the command line while relying on log masking. What should change?

Concept tested:
Question 3 of 10
Objective Configure and manage repositories Design and implement a source control strategy

A team tags commit v2.0 and claims the tag prevents force pushes to main and prevents package 2.0 from being overwritten. What is correct?

Concept tested:
Question 4 of 10
Objective Analyze metrics from instrumentation Implement an instrumentation strategy

Average latency remains 300 ms, but the 99th percentile rises to six seconds. Distributed traces show one storage dependency consuming five seconds for slow requests. What should the team conclude?

Concept tested:
Question 5 of 10
Objective Design and implement pipelines Design and implement build and release pipelines

Production deployments currently run as ordinary jobs, and auditors cannot see environment-specific deployment history. The deployment steps themselves are correct. What should change?

Concept tested:
Question 6 of 10
Objective Configure collaboration and communication Design and implement processes and communications

A release webhook sometimes delivers twice, and generated notes list experimental commits that were not approved work. Which change is needed?

Concept tested:
Question 7 of 10
Objective Design and implement branching strategies for source code Design and implement a source control strategy

A pull request passes build validation, merges to main, and then fails because the merge commit combines changes not present in the tested head. What pipeline practice addresses this gap?

Concept tested:
Question 8 of 10
Objective Configure monitoring for a DevOps environment Implement an instrumentation strategy

Application Insights shows separate traces for an API and worker that communicate through a queue. The team also needs request, dependency, exception, and performance evidence. Which fix is complete?

Concept tested:
Question 9 of 10
Objective Automate security and compliance scanning Develop a security and compliance plan

A release gate scans source code but not container layers, dependencies, secrets, or licenses. A critical OS package ships in the image. Which redesign is complete?

Concept tested:
Question 10 of 10
Objective Design runner and agent infrastructure Design and implement build and release pipelines

A self-hosted agent has production network access and cached credentials. It also executes pull requests from public forks to save cost. What should the team change?

Concept tested:
Locked preview

You are viewing today’s free 10. Unlock 190 more questions.

Unlock full bank
Daily sample Rotating practice Free daily questions are selected from a rotating sample set.
Pro bank Full access Unlock Pro to access the full question bank, Exam Mode, Practice Mode, and random tests.
AZ-400 Pro $4.99 one-time

Best if you only need this one certification.

50 Exam Practice Test $1.99 one-time

A 50-question AZ-400 PDF for short review sessions. Questions come first, then the answer review and explanations later in the file.

Azure Cloud Bundle $9.99 one-time

Unlock all 5 active Azure Cloud Bundle practice banks in one permanent purchase.

What’s includedAZ-900, AZ-104, AZ-305, AZ-700, AZ-400
All Access $6.99/month

Unlock every active practice exam, bundle and path experience, Pro course and study content, and included downloads.

What’s includedEvery current and future active practice exam, All active bundle and career-path practice content, Pro course lessons, study content, and supported paid downloads

Choose an unlock option to continue. We will confirm your site email in one quick checkout step.

Secure checkout powered by Stripe. Source-backed questions. Not brain dumps. Checkout stays on this page and unlocks the same Pro builder on this practice page.

Purchase options

Unlock the full AZ-400 bank.

Get the full bank, Exam Mode, Practice Mode, question sets, random tests, readiness tracking, saved box scores, and review tools for this exam.

The PDF versions keep questions first and move the answer review, explanations, and distractor notes to the back of the file.

200 verified exam-style questions Every choice explained Exam Mode and Practice Mode Question sets and random tests Readiness score and trends Previous test box scores

You've answered 0/10 questions in today's set.

Locked: 190 more questions in the full bank.

Locked: exam simulation mode, practice mode, readiness tracking, and saved review history.

Checkout stays on this page, so you can keep practicing, unlock the full bank, and start Exam Mode or Practice Mode when you are ready.

Cheat Sheets

7-day score keeper

Answer questions today and this will become a rolling 7-day scorecard.

Local history
Optional progress sync

Keep today’s practice moving

Guest progress saves automatically on this device. Add an email later when you want a magic link that keeps your daily AZ-400 practice in sync across browsers.

Guest progress saves on this device automatically

Guest progress is available without an account.

Source-backed answer review

The free daily AZ-400 set includes crawlable question text, answer choices, correct answer labels, objective mapping, and source links. Only the first SEO card includes answer explanations and any extra learning features. Pro-only bank questions stay locked; this section mirrors only the 10 free daily questions already shown on this page.

Question 1 A release dashboard shows a linked work item and commit, but no build, test, or deployment links. The team says the release is fully traceable and tested. Which assessment is accurate?

Answer choices

  1. A. The work-item link proves every pipeline stage passed, for the team’s delivery requirements, as the primary approach to the stated delivery requirements.
  2. B. The link provides requirement-to-source traceability, but end-to-end evidence still needs build, test, and release records with independent statuses
  3. C. A release tag alone supplies all missing evidence, for the team’s delivery requirements, as the primary approach to the stated security, delivery, and governance requirements.
  4. D. Traceability is unnecessary when the source commit is known, for the stated workflow and governance requirements, for the stated delivery requirement.

Correct answer

The link provides requirement-to-source traceability, but end-to-end evidence still needs build, test, and release records with independent statuses

Source-to-work association is one useful link, not proof of delivery outcomes. End-to-end traceability connects the lifecycle while preserving build, test, and release results as distinct evidence.

Wrong-answer review

  • A. The work-item link proves every pipeline stage passed, for the team’s delivery requirements, as the primary approach to the stated delivery requirements.: No test or pipeline outcome is contained in the work-item association.
  • C. A release tag alone supplies all missing evidence, for the team’s delivery requirements, as the primary approach to the stated security, delivery, and governance requirements.: A tag identifies source state and does not contain build or test results.
  • D. Traceability is unnecessary when the source commit is known, for the stated workflow and governance requirements, for the stated delivery requirement.: Knowing source is insufficient for audit, diagnosis, and delivery verification.

Extra learning features

Why this matters

Failure to independently verify build, test, and release stages creates significant risk. Without documented evidence of each stage's success, it's impossible to diagnose issues, understand the root cause of failures, or confidently deploy updates. This directly impacts operational stability and service availability.

Objective/domain: Design and implement processes and communications

Source: Link GitHub commits and pull requests to Azure Boards work items

Question 2 A pipeline downloads a secure provisioning profile, copies it to a persistent folder, and passes its password on the command line while relying on log masking. What should change?

Answer choices

  1. A. Keep the persistent copy because secure-file protection follows it, as the primary response to the stated security and delivery constraints.
  2. B. Print the password in encoded form, for the stated implementation, across the complete workflow.
  3. C. Commit the profile so masking is unnecessary, as the primary response to the stated security and delivery constraints.
  4. D. Authorize the secure file narrowly, use and delete the local copy within the job, and avoid command-line or logged secret exposure

Correct answer

Authorize the secure file narrowly, use and delete the local copy within the job, and avoid command-line or logged secret exposure

Objective/domain: Develop a security and compliance plan

Source: Use Azure Key Vault secrets in Azure Pipelines

Question 3 A team tags commit v2.0 and claims the tag prevents force pushes to main and prevents package 2.0 from being overwritten. What is correct?

Answer choices

  1. A. The tag enforces both controls once pushed, as the primary response to the stated security and delivery constraints.
  2. B. A tag identifies a commit; branch policy and package-registry immutability must be configured separately
  3. C. The tag converts all large files to Git LFS pointers, as the primary response to the stated security and delivery constraints.
  4. D. The tag grants repository administration to its creator, for the stated implementation, within this workflow.

Correct answer

A tag identifies a commit; branch policy and package-registry immutability must be configured separately

Objective/domain: Design and implement a source control strategy

Source: Manage large files with Git LFS

Question 4 Average latency remains 300 ms, but the 99th percentile rises to six seconds. Distributed traces show one storage dependency consuming five seconds for slow requests. What should the team conclude?

Answer choices

  1. A. The average proves users are unaffected, as the proposed approach to the stated operational requirement.
  2. B. Top-level duration is enough and dependency spans add no value, as the proposed design for the stated workflow.
  3. C. Scale CPU because every latency problem is compute, as the proposed approach to the stated operational requirement.
  4. D. Tail users are affected, and the dependency span localizes the dominant delay for targeted investigation

Correct answer

Tail users are affected, and the dependency span localizes the dominant delay for targeted investigation

Objective/domain: Implement an instrumentation strategy

Source: Application Insights overview

Question 5 Production deployments currently run as ordinary jobs, and auditors cannot see environment-specific deployment history. The deployment steps themselves are correct. What should change?

Answer choices

  1. A. Use a deployment job that targets the production environment, within this workflow.
  2. B. Add a schedule trigger to the ordinary job, as the proposed approach to the stated operational requirement.
  3. C. Move deployment credentials into template parameters, across the complete workflow.
  4. D. Run two ordinary jobs in parallel, as the proposed approach to the stated operational requirement.

Correct answer

Use a deployment job that targets the production environment, within this workflow.

Objective/domain: Design and implement build and release pipelines

Source: YAML schema reference for Azure Pipelines

Question 6 A release webhook sometimes delivers twice, and generated notes list experimental commits that were not approved work. Which change is needed?

Answer choices

  1. A. Accept every duplicate and edit incidents later, for the team’s delivery requirements.
  2. B. Authenticate and deduplicate webhook deliveries, and generate release notes from governed work and version evidence
  3. C. Disable responses so delivery remains pending, for the team’s delivery requirements.
  4. D. Use unrelated chat history as the release source, for the stated workflow and governance requirements.

Correct answer

Authenticate and deduplicate webhook deliveries, and generate release notes from governed work and version evidence

Objective/domain: Design and implement processes and communications

Source: Service hooks overview

Question 7 A pull request passes build validation, merges to main, and then fails because the merge commit combines changes not present in the tested head. What pipeline practice addresses this gap?

Answer choices

  1. A. Remove pre-merge validation because it cannot test everything, as the primary response to the stated security and delivery constraints.
  2. B. Keep build validation and also run the pipeline on the resulting main branch state
  3. C. Use long-lived branches so merge commits never occur, as the primary response to the stated security and delivery constraints.
  4. D. Grant policy bypass to avoid the failed post-merge run, for the stated implementation.

Correct answer

Keep build validation and also run the pipeline on the resulting main branch state

Objective/domain: Design and implement a source control strategy

Source: Branch policies in Azure Repos

Question 8 Application Insights shows separate traces for an API and worker that communicate through a queue. The team also needs request, dependency, exception, and performance evidence. Which fix is complete?

Answer choices

  1. A. Instrument both components and propagate correlation context through the queue so Application Insights can join their telemetry
  2. B. Monitor only queue length, as the primary response to the stated security and delivery constraints, for the stated delivery requirement.
  3. C. Assign the same static operation ID to every request, for the stated implementation, as the primary approach to the stated delivery requirements.
  4. D. Use deployment history as distributed tracing, as the primary response to the stated security and delivery constraints, for this workflow.

Correct answer

Instrument both components and propagate correlation context through the queue so Application Insights can join their telemetry

Objective/domain: Implement an instrumentation strategy

Source: Application Insights overview

Question 9 A release gate scans source code but not container layers, dependencies, secrets, or licenses. A critical OS package ships in the image. Which redesign is complete?

Answer choices

  1. A. Run the same source scan repeatedly, as the proposed approach to the stated operational requirement.
  2. B. Use a release tag as container analysis, as the proposed design for the stated workflow.
  3. C. Scan only after production deployment, as the proposed approach to the stated operational requirement.
  4. D. Add pre-promotion image scanning and complementary code, dependency, secret, and license controls with severity policy and approved exceptions

Correct answer

Add pre-promotion image scanning and complementary code, dependency, secret, and license controls with severity policy and approved exceptions

Objective/domain: Develop a security and compliance plan

Source: Configure GitHub Advanced Security for Azure DevOps features

Question 10 A self-hosted agent has production network access and cached credentials. It also executes pull requests from public forks to save cost. What should the team change?

Answer choices

  1. A. Keep sharing because pull-request code cannot access the agent, for the stated workflow and governance requirements.
  2. B. Add more cached credentials so fork builds succeed, for the team’s delivery requirements, within this workflow.
  3. C. Isolate untrusted fork jobs on fresh or restricted agents and reserve the privileged self-hosted pool for trusted workloads with owned maintenance
  4. D. Use a demand named trusted to sandbox the process automatically, for the team’s delivery requirements.

Correct answer

Isolate untrusted fork jobs on fresh or restricted agents and reserve the privileged self-hosted pool for trusted workloads with owned maintenance

Objective/domain: Design and implement build and release pipelines

Source: Azure Pipelines agents

Where to go after the daily web set

How are AZ-400 questions generated?

dotCreds builds AZ-400 practice questions from public exam objectives and Microsoft Learn and exam-objective references. The questions are written for realistic study practice, not copied from exam dumps.

How are explanations sourced?

Each question includes an explanation and, when available, a source link back to the provider documentation or reference used to validate the answer. That keeps the practice tied to study material you can actually review.

What score do I get?

The page tracks today's answered count and accuracy for the 10-question daily set, then saves a 7-day score history on this device so you can see your recent practice trend.

Why use this site?

The site is the fastest way to start AZ-400 practice without installing anything. It is built for daily recall, quick weak-topic discovery, and source-backed explanations you can review immediately.