Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by Microsoft
Exam Format
Registration
Validity
Skills this practice test covers
- Design a branching strategy and enforce pull request rules with branch policies and branch protections.
- Write multi-stage YAML pipelines in Azure Pipelines and GitHub Actions, with reusable templates.
- Plan blue-green, canary and ring deployments, and swap deployment slots to limit downtime.
- Keep secrets in Azure Key Vault, and design pipelines that do not leak them.
- Turn on code and dependency scanning with CodeQL and Dependabot alerts in GitHub and Azure DevOps.
- Collect telemetry with Application Insights and query it with basic Kusto Query Language (KQL).
Explore related topics
AZ-400 exam content
5 domains · 16 topics · 250 questions
Design and implement processes and communications43 questions
This domain covers how a team plans, tracks and reports its work. Candidates connect work items in GitHub and Azure Boards to code, build dashboards for flow metrics, and link tools through webhooks and Microsoft Teams.
Skills tested
- Structure the flow of work with GitHub Flow, and track it in GitHub projects or Azure Boards.
- Build a dashboard that shows cycle times, time to recovery and lead time.
- Document a project with wikis, Markdown and Mermaid process diagrams.
- Generate release notes and other documentation from Git history.
- Connect Azure Boards, GitHub and Microsoft Teams, and route events through webhooks.
Questions by topic
- Design and implement appropriate metrics and queries for DevOps16
- Configure collaboration and communication15
- Design and implement traceability and flow of work12
Design and implement a source control strategy30 questions
This domain is about Git for a whole team. Candidates choose a branching model, protect key branches with review rules, and keep large repositories fast. They also recover lost data with Git commands and remove data that must not stay in the history.
Skills tested
- Compare trunk-based, feature branch and release branch strategies for a given team.
- Set up pull request rules with branch policies in Azure Repos and branch protections in GitHub.
- Store large files with Git Large File Storage (LFS) or git-fat, and scale big repositories with Scalar.
- Recover lost commits with Git commands, and purge sensitive data from a repository.
- Organize a repository with tags, and set its permissions.
Questions by topic
- Design and implement branching strategies for the source code13
- Configure and manage repositories17
Design and implement build and release pipelines101 questions
The largest domain covers every step between a commit and a running release. Candidates choose between GitHub Actions and Azure Pipelines, write YAML pipelines, manage packages and tests, plan deployments that avoid downtime, and define infrastructure as code.
Skills tested
- Write multi-stage YAML pipelines with trigger rules, templates, variable groups and environment approvals.
- Plan the runner or agent infrastructure by cost, tools, licenses, connectivity and upkeep.
- Publish packages to Azure Artifacts or GitHub Packages, versioned with SemVer or CalVer.
- Combine feature flags, slot swaps and rolling deployments into a release with little downtime.
- Define environments with Bicep or ARM templates, and keep machines in their desired state.
Questions by topic
- Design and implement deployments15
- Design and implement pipelines23
- Design and implement a package management strategy17
- Design and implement infrastructure as code (IaC)20
- Maintain pipelines15
- Design and implement a testing strategy for pipelines11
Develop a security and compliance plan47 questions
This domain covers who and what may use the pipelines, and how secrets and code stay safe. Candidates pick identities for automation, set permissions in GitHub and Azure DevOps, protect secrets with Azure Key Vault, and automate code, dependency and container scanning.
Skills tested
- Choose between a service principal and a system-assigned or user-assigned managed identity.
- Authenticate automation with GitHub Apps, GITHUB_TOKEN, service connections or personal access tokens.
- Grant fitting access levels, such as stakeholder access in Azure DevOps or outside collaborator access in GitHub.
- Use secrets from Azure Key Vault and secure files without exposing them in logs.
- Run CodeQL analysis and Dependabot alerts, and send the scan results to Microsoft Defender for Cloud.
Questions by topic
- Design and implement a strategy for managing sensitive information in automation15
- Automate security and compliance scanning18
- Design and implement authentication and authorization methods14
Implement an instrumentation strategy29 questions
The smallest domain covers what happens after a release. Candidates collect telemetry with Azure Monitor, Log Analytics and Application Insights, raise alerts on pipeline events, and query the data with KQL.
Skills tested
- Collect telemetry with Application Insights, VM Insights and Container Insights.
- Raise alerts on events in GitHub Actions and Azure Pipelines.
- Follow a request across services with distributed tracing in Application Insights.
- Write basic KQL queries that show CPU, memory, disk and network use.
Questions by topic
- Configure monitoring for a DevOps environment15
- Analyze metrics from instrumentation14
Requirements
- Required for the certification: an active prerequisite associate certification, such as Azure Administrator Associate.
- Recommended: experience both administering and developing in Azure, with strong skills in at least one.
- Recommended: hands-on work with both GitHub and Azure DevOps.
- Recommended: experience with version control, Agile development, automated testing and continuous integration.
About the AZ-400 exam
Engineers who build delivery pipelines on Azure DevOps and GitHub take AZ-400 to earn Microsoft Certified: DevOps Engineer Expert. The exam follows a change from the work item and the branch to the build, the tests, the release, the security scans and the monitoring. Build and release pipelines form the largest domain by far. Microsoft grants the certification only to candidates who also hold an active prerequisite associate certification, such as Azure Administrator Associate.
The PlanetCert practice test gives pipelines the most questions, as the exam does. Each explanation says why one option fits the scenario better than the others, for example a canary release instead of blue-green, or a managed identity instead of a stored secret. Study Mode suits the security domain, where GitHub and Azure DevOps use different names for similar controls. Brainy AI Assistant can explain why a YAML pipeline fails, or read a Kusto Query Language (KQL) query line by line.
How to earn the certification
- Earns
- Microsoft Certified: DevOps Engineer ExpertExpert
The certification is valid for one year and renews through a free online assessment on Microsoft Learn.
- Before
- AZ-104 Azure Administrator
Passing it earns Azure Administrator Associate, which meets the prerequisite for DevOps Engineer Expert.
- AZ-900 Azure Fundamentals
Optional. It covers the Azure basics that the associate exams build on.
- AZ-104 Azure Administrator
- After
- AZ-305 Designing Microsoft Azure Infrastructure Solutions
The exam for Azure Solutions Architect Expert. DevOps engineers who move into solution design often take it next.
- AZ-305 Designing Microsoft Azure Infrastructure Solutions
How to prepare for AZ-400
- 1
Mirror one project on both platforms
Put a small app in a GitHub repository and in an Azure DevOps project. Build the same flow in each: tracked work items, a protected main branch and a reviewed pull request.
- 2
Write the pipeline in YAML first
Pipelines are the largest domain. Write a multi-stage YAML pipeline in Azure Pipelines with a trigger, a template, a variable group and an approval, then rebuild it as a GitHub Actions workflow.
- 3
Ship one change three ways
Release one change with a slot swap, one behind a feature flag in Azure App Configuration and one as a canary. Roll each one back and note what the rollback needed.
- 4
Remove every stored secret
Move pipeline secrets into Azure Key Vault, or replace them with a managed identity. Then turn on CodeQL and Dependabot alerts and work through the first findings.
- 5
Save the timed runs for the end
Work through the AZ-400 practice test by domain in Study Mode, then take full runs in Timed Mode. After each run, ask Brainy AI Assistant which detail in a missed scenario pointed to the right answer.
Start a timed AZ-400run
Microsoft Learning Partners teach the instructor-led course AZ-400T00: Designing and Implementing Microsoft DevOps Solutions. Microsoft Learn also offers free self-paced learning paths for the exam.
Who AZ-400 is for
- DevOps engineers who build and run delivery pipelines on Azure DevOps or GitHub.
- Azure administrators and developers with an associate certification who now own their team's releases.
- Release, platform and site reliability engineers who script deployments, alerts and dashboards.
Typical job titles: DevOps engineer · Site reliability engineer · Release engineer · Platform engineer · Build engineer · Cloud engineer
AZ-400 glossary
20 terms from the exam objectives and the vendor's official material, each defined in a sentence.
- Application Insights
- The Azure Monitor feature that collects requests, failures, performance data and traces from a running application.
- Azure Artifacts
- The Azure DevOps service that hosts package feeds, such as NuGet and npm feeds, for a team's own and upstream packages.
- Azure Boards
- The Azure DevOps service for planning and tracking work items, such as user stories, bugs and tasks, on boards and backlogs.
- Azure Deployment Environments
- An Azure service that lets developers create preconfigured environments on demand from templates that the platform team approves.
- Azure Key Vault
- The Azure service that stores secrets, keys and certificates and controls who may read them.
- Bicep
- A declarative language for defining Azure resources that compiles to Azure Resource Manager (ARM) templates.
- Blue-green
- A deployment pattern with two identical environments, where traffic moves from the old one to the new one in a single switch.
- Branch policies
- Azure Repos rules that protect a branch, for example by requiring a pull request, reviewers or a successful build before a merge.
- Canary
- A deployment pattern that gives a new version to a small group of users first and widens the release only while it stays healthy.
- CodeQL
- GitHub's code analysis engine, which runs queries against source code to find security weaknesses.
- Deployment slots
- Separate live environments of an Azure App Service app. Swapping a staging slot into production releases a version with little downtime.
- Feature flags
- Switches that turn a feature on or off while the application runs, without a new deployment.
- Git Large File Storage (LFS)
- A Git extension that keeps large files outside the repository and stores small pointer files in their place.
- GitHub Flow
- A branching workflow in which each change is made on a short-lived branch and merged into the main branch through a pull request.
- GITHUB_TOKEN
- A token that GitHub creates for each workflow run, so that jobs can call the GitHub API with limited permissions.
- Kusto Query Language (KQL)
- The query language of Azure Monitor and Log Analytics, used to filter and summarize log and metric data.
- Managed Identity
- An identity that Azure creates and manages for a resource, so that code can reach other services without a stored secret.
- Scalar
- A tool that sets up Git for very large repositories, so that common commands stay fast.
- Semantic versioning (SemVer)
- A version format of major, minor and patch numbers, where each part signals a breaking change, a new feature or a fix.
- Trunk-based development
- A branching strategy in which developers merge small changes into one main branch often, instead of keeping long-lived branches.