AZ-400 study guide: Free Azure certification exam question walkthrough

In this post, A Cloud Guru Azure Training Architects Matthew Ulasien and Mark Mikula provide exam tips and walk you through sample questions and answers in the style of the AZ-400 Microsoft DevOps Solutions exam.

Figuring out which Azure certification path is right for you? If you've made it beyond the Azure fundamentals and you have the Azure Developer Associate or Azure Administrator Associate cert under your belt, you may be ready to take on the expert-level Microsoft Certified: DevOps Engineer Expert certification and the AZ-400: Designing and Implementing Microsoft DevOps Solutions.

Get started with ACG and transform your career with courses and real hands-on labs in AWS, Microsoft Azure, Google Cloud, and beyond.

If you're preparing to study for the AZ-400 Designing and Implementing Microsoft DevOps Solutions exam (or just curious about what it entails), we’re here to help! Read on, or watch this session on YouTube.

To sweeten your study efforts, through the end of November, ACG's new AZ-400 course will be available for free. All you need is an ACG account — which is also free!

Not an ACG member yet? Create a free account (no credit card required) and get ready to ace the AZ-400 — and check out the rest of our rotating roster of free cloud courses — to Azure your success in the cloud.

Ready to prepare for the AZ-400? Read on!

• What skills are tested by the AZ-400?
• How long does it take to prepare for the AZ-400?
• How hard is the AZ-400
• How many questions are on the AZ-400?
• How to pass the AZ-400?
• Should I take the AZ-104 or the AZ-204 or both before the AZ-400?
• Should I take the AZ-500 before the AZ-400?
• What should I do after the AZ-400?
• How can I build up my developer skills to prepare for the AZ-400 and beyond?
• AZ-400 sample exam questions
• How to prepare for the AZ-400 for free

Here's what you'll be tested on in Microsoft's AZ-400:

If you have previous experience working with Azure, working with an Azure DevOps organization, working with Azure Pipelines, you may be able to prepare for the AZ-400 in 4–6 weeks. But generally, it depends on your previous level of experience working with Azure, DevOps processes, how well versed you are working with Git, or GitHub, or just the Git workflow, working with the CI/CD process, and so on. Even if you've had experience with DevOps, but not working specifically with Azure DevOps — specifically Azure Pipelines and the YAML format, there could be a little bit of a learning curve.

If you don't have experience with working with Azure, you should probably be starting with the AZ-104 exam or AZ-204 exams first.

If you have experience with Azure but are not experienced working with DevOps organizations, or you haven't really worked with a GitHub workflow that much, add at least another half a month of prep time — maybe about 2–3 months total. But these are very rough estimates and your mileage may vary!

With DevOps — whether you're working with Microsoft, Google, on-premises, or whatever — there's an assumed level of knowledge of both the developer side and the operations side, which also includes security. Very few people — outside maybe a very few unicorns — actually have deep knowledge in both at the same time.

DevOps is hard for most because there's probably at least one half of that equation that's just completely foreign to you. It's a hard topic to cover. You're not going to become an expert with this overnight. So don't feel bad if you're struggling with any of these questions. Just continue to work at it. The AZ-400 is a challenging exam, but given time and effort, you can do it!

You'll have 150 minutes to complete this exam. The total number of questions are between 40–60, depending on what Microsoft gives you.

This means you'll have approximately 2–3 minutes per question. (For this reason, I'd recommend you skip difficult questions and come back later. Note that there may be a couple of questions that cannot be revisited, but this will be indicated in these questions.)

Microsoft offers some great resources, including labs and courses with some really cool components. There's also the AZ-400 course at ACG, which goes through all the topics by domain. It's designed as a one-stop resource for all you need to know.

Most importantly you'll want to get hands-on with all the related tech around this exam, like Azure Pipelines.

Get the Azure Cloud Dictionary of Pain
Speaking cloud doesn’t have to be hard. We analyzed millions of responses to ID the top concepts that trip people up. Grab this cloud guide for succinct definitions of some of the most painful terms in Azure.

In a perfect world with infinite time and resources, both would set you up perfectly for the AZ-400. But in the real world, you'll be fine with just one. For the exams, take the one that is on the side you're most comfortable with and then double down on studying up on the side you're weaker on.

It's not required. The security concepts of the AZ-104 are sufficient for the AZ-400. Obviously, the AZ-500 (Microsoft Azure Security Technologies) will cover that too. But for the AZ-400? It may be a bit overkill.

Security is a big deal. It's a useful trait regardless of your background, and so the AZ-500 is a great thing to add to your resume at some point.

If you come from an administrator or an operations background like many of us, almost any job working with cloud engineering or the cloud in general is going to have some sort of a developer aspect to it. Especially in the next five to 10 years, this developer skillset is going to likely really separate who is really going to be able to climb up in their cloud careers. Those who are willing and able to bridge their own knowledge gaps from the operations to the development side — or vice versa — getting into DevOps is a good way to kick yourself out of the nest in a sense, and force you to start learning both those sides.

The sample exam questions below are a reasonable example of the types of questions you'll see on the exam, including some of the wordy and scenario-driven questions you can expect in the AZ-400. These questions come from our AZ-400 practice exam (available for free this month alongside our AZ-400 course).

SAMPLE QUESTION #1

When looking at questions, first consider the key things you need to focus on. In the case of this question that's:

• source control
• centralized
• on-premises virtual machine

So, with those three pieces of information, we can first rule out GitHub Teams. GitHub Teams is a team management function built into GitHub, but GitHub Teams itself is not a source control configuration so we can strike up that answer.

Next, we need a centralized source control method. By comparison, Git (or specifically Azure Repos Git) is by nature a decentralized source control method so Git is not centralized, so we can go ahead and throw that one out, which then leaves either subversion or Azure Repos using TFVC, which is short for team foundation version control. Now, both of those are centralized source control methods. However, Azure Repos using TFVC cannot run on an on-premises machine — rather it only is hosted or operated purely within Azure Repos inside of an Azure DevOps organization, not on-premises. So, Subversion, which is not quite commonly used but is a still existing centralized source control method can run on on-premises virtual machines — and anywhere else for that matter. Based on that info, that is our only correct answer.

Exam tip #1: Watch out for distractors! Microsoft loves to give you a wall of text that may lead you in the wrong direction. Take a look at those key features to ensure you're going in the right direction.

SAMPLE QUESTION #2

There is a lot of information in this question. The key pieces of info here are "deleting resource group" being the signal and "status as succeeded." So, we need to know essentially were we able to successfully delete the resource group. The other info is good to know but not ultimately relevant to the question.

With that in mind, the correct answer is a successful attempt to delete any resource group, or C.

Exam tip #2: Understand how services work and affect other services. With monitoring and site reliability engineering, there are many different pieces and you need to understand how everything of works together

SAMPLE EXAM QUESTION #3

Let's start with the key points we need to focus on:

• connection
• Azure Container Registry
• authentication resource

Based on the above, let's go ahead and throw out our incorrect answers. Our first incorrect answer is A, service account. Microsoft does not recommend utilizing a service account to create access.

A group membership role is more focused on permissions to a resource, but it's not an authentication resource itself.

And Microsoft states that an App Registration will not grant AKS access to the Azure Container Registry service.

With that mind, a Service Principal is our authentication method that will allow you to authenticate one Azure service securely over to the other. So based on that, answer C, Service Principal, is our correct answer.

And this goes back to that very same exam tip above: you're going to need to understand how other services interact with other ones. In this case, Azure Kubernetes Services to the Azure Container Registry, and Service Principal is definitely a managed identity. Definitely don't want service accounts because those have passwords, and service principals are managed identities, passwords are managed by Azure Active Directory.

SAMPLE EXAM QUESTION #4

This next one is a wordy question. Don't be surprised to see questions like this on the AZ-400 certification exam.

Even though it is a very wordy question and there's a whole bunch of wordy answers, there really is kind of a more simplistic explanation here.

The portions we need to focus on are that the security team has expressed interest in managing configuration drift. And because of that, they'd also like ongoing reports on the management of the machines.

Now technically, every single one of these methods in the answers can actually work for the initial desired state configuration of your build servers. However, the report server and reports on the management of the machines and the configuration drift is a key aspect of it.

The other key aspect is they have also expressed interest in managing that configuration drift with their own machines. And because of that, all the other ones as managing push servers, as configuring as DSC pull servers — everything other than enabling Azure Automation State Configuration does not include any of the reporting aspects and the eventual pulling in other machines in order to manage that configuration drift as well.

So Azure Automation State Configuration is going to be able to generate those regular reports for the security team and it's also going to be the best solution in managing configuration drift on a larger scale that could potentially occur in the future.

Based on that, D is our correct answer.

Exam tip #3: Break down problems and solve them logically using relevant information.

For the AZ-400 and beyond, A Cloud Guru has the tools you need to succeed in cloud.

• Course: AZ-400: Designing and Implementing Microsoft DevOps Solutions (Logged in to ACG? Start the course here.)
• Microsoft AZ-400 Practice Exam
• Sign up for a free ACG account (no credit card needed!)
• Video: The Microsoft Azure certficaition guide
• Blog: Which Azure certficiation is right for me?

Want to keep up with all things cloud? Subscribe to A Cloud Guru on YouTube for weekly Microsoft Azure news (plus news from those other cloud providers too). You can also like us on Facebook, follow us on Twitter, or join the conversation on Discord!

WATCH: Solving The "No Experience" Cloud Hiring Problem
Need experience to get a job, but need a job to get experience. It's a cloudy Catch-22! Watch this free, on-demand webinar with insights from the ACG challenge that helped dozens get their first cloud job.