Validates DevOps strategy design and implementation skills. Covers CI/CD, IaC, monitoring, and the full DevOps lifecycle.
Work Traceability & Flow Design, GitHub Issues & Azure Boards Integration, DevOps Metrics, DORA & MTTR, Dashboards & KQL Queries, Collaboration: Wiki, Mermaid, Microsoft Teams Integration, Release Notes & Webhooks
Branching Strategies (Trunk-based, GitHub Flow), PR Workflow & Branch Policy, Branch Protection Rule & CODEOWNERS, Git LFS, Scalar, Shallow/Partial Clone, Repository Permissions & Sensitive Data Removal (BFG)
GitHub Actions & Azure Pipelines (YAML), Runners, Agents, Environments, Approvals, Package Management (Azure Artifacts, GitHub Packages, SemVer), Quality Gates & Test Strategy (Unit, Integration, Load), Blue-Green, Canary, Ring, Feature Flags, Slot Swap, IaC: ARM, Bicep, Terraform, DSC
Service Principal, Managed Identity, GitHub App, PAT, Service Connections, Permission Delegation, Azure Key Vault, OIDC, Workload Identity Federation, GitHub Advanced Security (CodeQL, Dependabot), Defender for Cloud DevOps, SAST, SCA, Container Scanning
Azure Monitor & Log Analytics, Application Insights & Distributed Tracing, Container/VM/Network Insights, GitHub Insights & Pipeline Alerts, KQL Queries & Performance Analysis
Try real exam-style questions from the free sample set. Each answer comes with a full explanation.
An e-commerce company operates a CI/CD pipeline for its web application using Azure Pipelines.
The QA team plans to perform end-to-end automated testing of the web UI across various browser environments (Chromium, Firefox, WebKit) as a pre-release stage. The tests must run as part of the pipeline and provide native support for the latest browser engines along with reliable auto-wait functionality.
Which web UI testing framework BEST meets these requirements?
Answer: B. Playwright
An e-commerce company needs native support for all three browser engines — Chromium, Firefox, and WebKit — along with auto-wait functionality. Playwright, developed by Microsoft, is an end-to-end testing framework that controls three browser engines (Chromium, Firefox, WebKit) through a single API and directly packages each engine's binary to provide native-level support. It also natively provides a built-in auto-wait mechanism that automatically waits until elements are clickable or visible.
Playwright provides language bindings for JavaScript/TypeScript, Python, Java, and .NET, and can be executed directly in Azure Pipelines YAML pipelines with the npx playwright test command. It also includes built-in features such as parallel execution, video recording, and network interception.
In the exam, Selenium and Playwright are easily confused. If native WebKit support or built-in auto-wait is a condition, choose Playwright; if broad legacy support for various languages and browsers is required, choose Selenium. Cypress does not support WebKit, so it is eliminated in this scenario.
A global financial company's security team wants to strengthen access control to Azure DevOps. All developers must be able to access the Azure DevOps Organization only through the company-designated office network or company VPN, and access from any other location must be blocked.
Which feature is MOST appropriate to enforce this network-based access restriction while minimizing changes to existing user accounts and environments?
Answer: B. Microsoft Entra Conditional Access
Microsoft Entra Conditional Access can set policies that allow or block access to Azure DevOps and other Entra ID-integrated apps based on network location (IP ranges or trusted locations). It applies consistent network-based access control across the entire organization without modifying existing user accounts or Azure DevOps project configurations, making it the best fit for this scenario.
Conditional Access policies use Named Locations to register the corporate office's public IP ranges or VPN gateway IPs as trusted locations, and automatically block requests originating from outside those locations. These policies are evaluated during the token issuance phase at login, operating independently of internal Azure DevOps settings.
In the exam, it is easy to confuse Project Security with Conditional Access. Project Security controls permissions (read/write) for specific projects within DevOps and does not support network-location-based blocking. For network location-based access restrictions, always choose Microsoft Entra Conditional Access.
A global financial services company is building a CI/CD pipeline using Azure Pipelines to deploy to a production SQL Database.
The pipeline requires a database connection string and an external payment gateway API key during execution. The security team requires that this sensitive information must NOT be stored in plain text in pipeline YAML files or variable groups, and must be protected in a centrally managed, auditable way.
Which Key Vault object type should be used to store this sensitive information in Azure Key Vault while minimizing operational overhead?
Answer: C. Key Vault Secret
In Azure Key Vault, Key Vault Secret is the dedicated object type for storing arbitrary string-valued sensitive information such as database connection strings and API keys. Azure Pipelines can link variable groups to Key Vault so that secrets are referenced as pipeline variables, satisfying both the plain-text-free storage and the centralized audit logging requirements simultaneously.
Key Vault offers three object types with distinct roles: Secret stores arbitrary string values like connection strings, API keys, and passwords; Key manages cryptographic keys (RSA, EC) used for encryption and signing; Certificate stores X.509 certificates. Managed HSM is a dedicated high-availability HSM cluster for FIPS 140-2 Level 3 security needs and is not intended for general secret storage.
On the exam, whenever you need to store a connection string, API key, or password, always choose Secret. Choose Key for cryptographic operations (signing/encryption), and Certificate for TLS/SSL certificate management.
A global e-commerce company's operations team is managing a production web application hosted on Azure App Service. During monthly scheduled deployments, brief downtime occurs, and when issues are discovered after a new version is deployed, rolling back to the previous version takes considerable time.
Which Azure App Service feature is MOST appropriate to minimize downtime and reduce rollback time in case of issues?
Answer: C. Deployment slots - Slot swap
Azure App Service deployment slots allow you to deploy a new version to a staging slot separate from the production slot, then perform a slot swap with near-zero downtime once the app is warmed up. The slot swap switches routing at the DNS level almost instantly, and if issues arise, swapping back restores the previous version within seconds.
Deployment slots are supported on Standard, Premium, and Isolated App Service plans, and each slot has its own hostname and app settings. Slot-sticky settings remain bound to their respective slots during a swap, so production connection strings and configurations are never exposed to staging.
On the exam, when you see Azure App Service zero-downtime deployment and fast rollback scenarios, choose Deployment slots - Slot swap. Azure Traffic Manager is for multi-region routing, and Azure Load Balancer operates at the network layer for load balancing — neither addresses App Service deployment strategy.
A SaaS company publishes public NuGet packages and enforces a versioning policy following Semantic Versioning.
A minor bug has been discovered in a recently released package that does not affect existing API behavior, and the fix needs to be deployed. The current version is 3.5.2.
What is the MOST appropriate version number to apply for this bug fix release?
Answer: B. 3.5.3
In Semantic Versioning (SemVer), the version number consists of three components: MAJOR.MINOR.PATCH. In this scenario, the bug fix is a backward-compatible fix that does not affect existing API behavior, so only the PATCH version should be incremented by 1. Incrementing PATCH from the current version 3.5.2 gives 3.5.3.
According to SemVer rules: MAJOR is incremented for incompatible API changes, MINOR for backward-compatible new functionality, and PATCH for backward-compatible bug fixes only. Version 3.6.0 applies when new features are added, 4.0.0 when there are breaking changes. Version 3.5.2 is the same as the current version and cannot be used as a new release.
On the exam, for 'bug fixes with no impact on existing API,' always increment only PATCH (the third number). For 'new feature additions,' increment MINOR; for 'breaking changes,' increment MAJOR.
The Designing and Implementing Microsoft DevOps Solutions (AZ-400) exam consists of 50 questions with a 100-minute time limit.
The passing score for the AZ-400 exam is 700 out of 1000.
The AZ-400 sample set (20 questions with full explanations) is free. The full bank of 370+ questions is available with a CloudMasterIT subscription.
The AZ-400 certification is valid for 1 years after passing. Recertification is required after that.