Practice Exam AZ-400: DevOps Engineer Expert

Question bank: 100 · timed mock exam: 100 min

Official exam page on the vendor's site (opens in a new tab) Official exam guide (opens in a new tab) Official prep course (opens in a new tab)

Compare: AZ-400 vs Terraform Associate

  • Design and implement build and release pipelines 56 questions
  • Design and implement processes and communications 12 questions
  • Design and implement a source control strategy 12 questions
  • Develop a security and compliance plan 12 questions
  • Implement an instrumentation strategy 8 questions
Study mode (free) Exam mode (subscribers)

Free: 25 questions in study mode, all domains, no account.

Subscription: the 100 questions of this certification, the timed exam mode, and all other certifications too.

Subscribe · €9.99 / month

Secure card payment (Stripe) · No commitment · Cancel online

How to prepare for DevOps Engineer Expert (AZ-400) with InfraPrep

The 100 questions cover 5 domains: Design and implement build and release pipelines, Design and implement processes and communications, Design and implement a source control strategy, Develop a security and compliance plan, Implement an instrumentation strategy. 25 of them are free, without an account.

Study mode

Answer at your pace: each answer is corrected straight away, with an explanation and the link to the documentation it relies on.

Exam mode

A timed exam of 100 minutes, with a question map to flag and come back to questions before you submit.

Results by domain

Your score is broken down by domain, so you know what to review first.

Original questions

Every question is written from the public documentation, never copied from the exam. You can contest an answer from study mode.

10 free sample questions

Question 1 Design and implement processes and communications

A team uses GitHub for source control and wants GitHub commits, pull requests, and branches to link automatically to work items in Azure Boards. Before any linking can happen, what must the team do first?

  1. Enable branch policies on the GitHub repository
  2. Connect the Azure Boards project to the GitHub repository
  3. Create a service connection of type GitHub in Azure Pipelines
  4. Install the Azure Boards app in GitHub and accept the updated permissions for pull request insights
Show the answer and the explanation

Correct answer: B

The documentation explains how to link work items to GitHub commits, pull requests, branches, and builds only after the Azure Boards project has been connected to the GitHub repository.

Source: official documentation

Question 2 Design and implement a source control strategy

A pull request's target branch has two active policies: "Automatically included reviewers", which allows requestors to approve their own changes, and "Require a minimum number of reviewers", which does not allow requestors to approve their own changes. The requestor approves their own pull request, and no one else has voted yet. What happens?

  1. The automatically included reviewers policy overrides the minimum-reviewers policy, so the PR completes
  2. The pull request cannot be completed, because the minimum-reviewers policy is not satisfied by the requestor's own approval
  3. The pull request can be completed, because at least one approval was recorded
  4. Both policies are automatically disabled once the requestor votes on their own pull request
Show the answer and the explanation

Correct answer: B

In this exact scenario the requestor's approval satisfies the automatically included reviewers policy but not the require a minimum number of reviewers policy, so the pull request still cannot be completed.

Source: official documentation

Question 3 Design and implement build and release pipelines

A team wants consumers of its Azure Artifacts feed to only ever install package versions that have already passed validation and met the team's quality bar, while unvalidated newer versions stay invisible to those consumers. Which feature achieves this?

  1. Share the @release feed view, which only contains packages that passed validation
  2. Publish new package versions directly to the @release view
  3. Create a separate upstream source just for validated packages
  4. Rename the @local view to @release
Show the answer and the explanation

Correct answer: A

Using the @release view lets a team share only packages that have passed validation and met its quality bar, so consumers of that view only see production-ready versions.

Source: official documentation

Question 4 Develop a security and compliance plan

A team wants a single authorization system that covers both managing an Azure Key Vault (its access policies and configuration) and accessing the secrets stored inside it. Which option meets both needs at once?

  1. A client certificate stored in the vault
  2. Key Vault access policy
  3. Azure RBAC
  4. A shared access signature (SAS) token
Show the answer and the explanation

Correct answer: C

Azure RBAC can be used both for management of the vaults and to access data stored in a vault, while Key Vault access policy can only be used when attempting to access data stored in a vault.

Source: official documentation

Question 5 Implement an instrumentation strategy

A team wants to configure end-to-end telemetry collection for a web application (requests, dependencies, exceptions, performance data) as part of their instrumentation strategy. Which Azure Monitor feature is described as an application performance monitoring (APM) feature for this purpose?

  1. Azure Monitor Application Insights
  2. Azure Monitor workbooks
  3. Diagnostic settings
  4. Azure Monitor Logs
Show the answer and the explanation

Correct answer: A

Azure Monitor Application Insights is an application performance monitoring (APM) feature of Azure Monitor, built for exactly this kind of application telemetry collection.

Source: official documentation

Question 6 Design and implement processes and communications

A team wants a dashboard widget that measures only the elapsed time from when a work item first enters an in-progress state until it reaches a completed state, to spot process bottlenecks after work has already started. Which widget matches this need?

  1. Cumulative flow diagram
  2. Sprint burndown widget
  3. Lead time widget
  4. Cycle time widget
Show the answer and the explanation

Correct answer: D

Cycle time is defined as the elapsed time from when a work item first enters an in progress state until it reaches a completed state, which is exactly the bottleneck measurement the team wants.

Source: official documentation

Question 7 Design and implement a source control strategy

Using the Azure DevOps CLI, you need to create a branch policy on the main branch that requires at least 2 approvals for pull requests to complete, while still letting pull request creators approve their own pull requests. Which command matches the documented example for this requirement?

  1. az repos policy work-item-linking create --branch main --repository-id --blocking true --enabled true
  2. az repos policy comment-required create --branch main --repository-id --blocking true --enabled true
  3. az repos policy approver-count create --branch main --repository-id --minimum-approver-count 2 --creator-vote-counts true --blocking true --enabled true --allow-downvotes true --reset-on-source-push false
  4. az repos policy approver-count create --branch main --repository-id --minimum-approver-count 2 --creator-vote-counts false --blocking true --enabled true --allow-downvotes true --reset-on-source-push false
Show the answer and the explanation

Correct answer: C

The documented example sets the minimum number of required approvals to 2 for pull requests in the main branch of the fabrikam repository, and the policy also allows pull request creators to approve their own pull requests, which matches creator-vote-counts true.

Source: official documentation

Question 8 Design and implement build and release pipelines

A team wants a package versioning scheme that signals, through the numeric parts of the version itself, whether a change is a breaking change, a new feature, or a bug fix. Which scheme does the documentation describe as widely adopted for this purpose?

  1. Semantic versioning (SemVer)
  2. Calendar versioning (CalVer)
  3. Feed view versioning
  4. Build number versioning
Show the answer and the explanation

Correct answer: A

The documentation states that most teams use semantic versioning to convey the nature and risk of a change, and that SemVer is widely adopted and effective for signaling that information.

Source: official documentation

Question 9 Develop a security and compliance plan

A security team wants pipelines to authenticate to Azure DevOps resources without storing any personal access token or long-lived secret. Which authentication approach for the service connection meets this goal?

  1. A personal access token (PAT) stored as a pipeline secret variable
  2. A client secret rotated manually every 90 days
  3. Basic authentication with a shared service account password
  4. Microsoft Entra workload identity federation
Show the answer and the explanation

Correct answer: D

Workload identity federation eliminates the need for secrets and secret management, and Azure DevOps can connect to resources using Microsoft Entra workload identity federation instead of personal access tokens or session tokens.

Source: official documentation

Question 10 Implement an instrumentation strategy

An application is split into several microservices, each instrumented with Application Insights. The team wants a single view that follows one transaction as it flows through all of these components, correlating the server-side telemetry end to end. Which capability provides this?

  1. The end-to-end transaction diagnostic experience
  2. The failures view, filtered by exception type
  3. The application dashboard's health summary
  4. Live metrics, refreshed continuously
Show the answer and the explanation

Correct answer: A

The end-to-end transaction diagnostic experience correlates server-side telemetry from across all Application Insights-monitored components into a single view, which is exactly the cross-service trace the team wants.

Source: official documentation

Frequently asked questions

Are there free questions, and do I need an account?

Yes. 25 questions of this certification are free in study mode, across all its domains, without a subscription and without registration. The account is created when you subscribe, at checkout.

How does the subscription work, and can I cancel?

One monthly subscription covers all certifications and the timed practice exams. There is no minimum period. You cancel online, at any time, with the "Cancel your contract" function in My account; cancellation takes effect at the end of the month already paid, and no further payment is taken.

Where do the questions come from?

Every question is original, written from the vendor's public documentation. Each answer comes with an explanation and a link to the documentation page it relies on. InfraPrep is not affiliated with the vendors, and certification names belong to their owners.

In which language are the questions?

The questions are written in English, also on the French version of the site.

Is the catalog updated?

Yes, the catalog changes over time: new certifications and new questions are added.