About these questions
These five questions are original. We wrote them in the style of the AZ-400 skills measured, one for each domain. They are not real exam questions, and the real exam will word things differently and often use longer scenarios. Because pipelines are over half of the real exam, a full practice set weights them more heavily than this short sample does.
How to use these
Try each question without looking at your notes, and pick an answer before you open the explanation. Then read the explanation even when you were right, because the reason the closest wrong option fails is where the learning is. Note any domain where you slipped and revisit it in the domains explained page.
Question 1 (Design and implement processes and communications)
A customer support team uses Azure Boards. The manager wants a dashboard widget that shows how long tickets take from the moment they are created until they are closed, so the team can promise realistic response times to customers. Which widget should the manager add?
- A. Velocity
- B. Cycle Time
- C. Sprint Burndown
- D. Lead Time
Show the answer and explanation
Correct answer: D. Lead time measures the elapsed time from when a work item is created until it is completed, which is what a customer experiences as waiting time. Cycle Time is the closest wrong option. It starts only when work moves into an In Progress state, so it hides the time a ticket sat in the queue. Velocity counts work finished per sprint, and Sprint Burndown shows remaining work within one sprint. Neither measures elapsed time per item.
Question 2 (Design and implement a source control strategy)
Your team keeps infrastructure code in an Azure Repos repository. Changes to the release branch must be approved by at least two reviewers before a pull request can be completed, and the person who opened the pull request must not count as one of them. Which branch policy should you configure?
- A. Build validation
- B. Limit merge types
- C. Require a minimum number of reviewers
- D. Check for linked work items
Show the answer and explanation
Correct answer: C. This policy blocks completion of a pull request until the set number of approvals is reached. By default the creator’s own vote does not count, unless someone selects the option that lets requestors approve their own changes. Build validation, the closest wrong option, is also a quality gate, but it runs a pipeline and checks the result. It does not count people. Limit merge types controls which merge strategies are allowed, and Check for linked work items enforces traceability.
Question 3 (Design and implement build and release pipelines)
A YAML pipeline in Azure Pipelines must test a library against four Python versions at the same time, but your agent pool can run only three jobs at once and you want to stay within that. What should you use?
- A. `strategy: parallel: 3`
- B. `strategy: matrix` with `maxParallel: 3`
- C. Four stages, each linked to the previous one with `dependsOn`
- D. `strategy: matrix` with `parallel: 3`
Show the answer and explanation
Correct answer: B. A matrix strategy creates one job per set of variables, such as one per Python version, and `maxParallel` caps how many of those jobs run at once. The closest wrong option is A. The `parallel` strategy runs identical copies of a job to split work, and it gives no way to vary the Python version per copy. Option D is not valid because `matrix` and `parallel` cannot be combined in one strategy. Option C would run the four tests one after another, not in parallel.
Question 4 (Develop a security and compliance plan)
A team moves a GitHub Actions workflow from a stored Azure client secret to workload identity federation by using OpenID Connect. Which two benefits does this give them? Choose two.
- A. No long-lived Azure credential has to be stored in GitHub
- B. The Azure access token stays valid for 90 days so it rarely needs renewing
- C. GitHub rotates the Azure password on a schedule
- D. The workflow receives a short-lived token that is valid for the job
- E. Secrets in GitHub are no longer encrypted, so deployments run faster
Show the answer and explanation
Correct answers: A and D. With OpenID Connect, the job asks GitHub’s identity provider for a token and exchanges it with Azure for a short-lived access token, so there is no cloud secret to store, leak, or rotate. Option C is the closest wrong answer. It sounds like a convenience, but there is no Azure password in this setup, so there is nothing for GitHub to rotate. Option B is wrong because long-lived tokens are the weakness this approach removes. Option E is wrong because GitHub secrets stay encrypted whatever authentication method you use.
Question 5 (Implement an instrumentation strategy)
Your company runs Linux virtual machines that send data to a Log Analytics workspace by using the Azure Monitor Agent. You want a log query that lists machines whose agent has stopped reporting in the last hour. Which table should you query?
- A. Perf
- B. Heartbeat
- C. AzureActivity
- D. Syslog
Show the answer and explanation
Correct answer: B. The Azure Monitor Agent writes a record to the Heartbeat table about once a minute. A query that finds the latest `TimeGenerated` per computer shows which machines have gone quiet. Perf is the closest wrong option, since it also arrives from the agent, but it holds performance counters and a gap there does not reliably prove the agent stopped. Syslog holds Linux log messages, and AzureActivity holds subscription-level control plane events.
More guides for AZ-400
- AZ-400 Exam Format: Time, Score, Retakes
- AZ-400 Study Plan: 4-Week and 8-Week
- Is AZ-400 Hard? An Honest Difficulty Check
- AZ-400 Prerequisites and Skills Self-Check
- AZ-400 Renewal and Retakes Explained
- Is AZ-400 Worth It? An Honest Look
- AZ-400 Cheat Sheet: Key Facts to Review
- AZ-104 vs AZ-400: Which First?
- AZ-305 vs AZ-400: Which Exam First?
Next step
If a domain felt weak, read its section in domains explained. For more questions with per-option explanations, see our AZ-400 practice tests.