CertifyDeckCargando contenido…
AZ-400 · Sample questions
10 real questions from the CertifyDeck AZ-400 bank, spread across the domains of the official Microsoft Certified: DevOps Engineer Expert skills outline, with the correct answer and a full explanation of why the other options are wrong. They are original questions written from the public syllabus, not exam dumps, and they are the same style you will find in the practice tests and mock exams.
Correct answer: C. id-token: write
The job or workflow needs id-token: write so that GitHub's OIDC provider can issue a JSON Web Token that azure/login exchanges for an Azure access token. This permission only allows requesting the OIDC token; it doesn't grant write access to repository resources. Permissions such as actions or deployments control what the GITHUB_TOKEN can do in GitHub and don't enable OIDC token requests.
Correct answer: B. Allow the collection-level Create new projects permission for the team lead.
Creating a project requires membership in Project Collection Administrators or the collection-level Create new projects permission set to Allow, so allowing that single permission meets the requirement without the rest of the administrative rights. Project Administrators and team administrators work inside an existing project and cannot create projects. Access levels control which web portal features are available, not the right to create projects.
Correct answer: A. Perf | where TimeGenerated > ago(7d) | where Computer == "web01" and CounterName == "Available MBytes" | summarize avg(CounterValue) by bin(TimeGenerated, 1h)
Filtering on the computer and the Available MBytes counter and then summarizing with bin(TimeGenerated, 1h) produces one average per hour. Summarizing directly by TimeGenerated creates a group for practically every unique timestamp, so it does not give hourly values. Using count() returns how many records arrived in each hour instead of the average value, and render must be the last operator in the query.
Correct answer: A. appInsights.setAuthenticatedUserContext(userId)
The Users tool counts users by anonymous IDs stored in browser cookies, so one person on several browsers or machines counts more than once; calling setAuthenticatedUserContext() after sign-in sets an authenticated user ID that tracks the user across devices and browsers. A custom event records an action but does not change how users are identified. Automatic route tracking creates page views for single-page app navigation, and the cloud role name identifies application components, not users.
Correct answer: D. git submodule add <library-url> libs/validation
git submodule add adds another repository as a submodule at the given path, and the superproject records which commit of that repository it expects, which is exactly a pinned, shared component. git clone --recurse-submodules only initializes submodules that a repository already defines while cloning it; it does not add a new one. sparse-checkout limits which directories of the same repository appear in the working tree, and scalar register only enrolls an existing repository for Scalar maintenance.
Correct answer: D. A tag ruleset that targets v* and lets the release-managers team bypass it
Branch and tag rulesets control how people interact with selected branches and tags, including who can delete or rename a tag; you target tags with an fnmatch pattern such as v* and grant bypass permissions to specific teams. A branch protection rule applies to branches, not tags. CODEOWNERS only defines reviewers for pull requests, and push rulesets block pushes based on file paths, extensions or sizes rather than tag names.
Correct answer: D. Favor unit tests with few external dependencies and run them in the build
The shift-left guidance is to write tests at the lowest possible level, favoring unit tests with the fewest external dependencies and running most of them as part of the build so testing completes before changes merge. UI tests are discouraged because they tend to be unreliable, which conflicts with the flakiness problem. Running most tests against production moves them later, and functional tests should use only the public API of the product.
Correct answer: A. DeleteFirewallRule: true
DeleteFirewallRule makes the task remove the IP addresses it added to the server's allowed list once the task ends (its default is true, so setting it explicitly guarantees the behaviour). IPAddressRange only changes how the agent's addresses are specified, not whether the rule is removed. DeployReport changes the action to a report, and AdditionalArguments only passes SqlPackage.exe options.
Correct answer: C. git log v2.3.0..HEAD --no-merges --pretty=format:"%h %s"
The range v2.3.0..HEAD selects commits reachable from HEAD but not from the tag, --no-merges drops commits with more than one parent, and %h and %s print the abbreviated hash and the subject. Reversing the range to HEAD..v2.3.0 selects commits reachable from the tag but not from HEAD, which is the opposite set. --merges prints only merge commits, and a single revision v2.3.0 lists the whole history up to the tag with author names instead of subjects.
Correct answer: A. A fenced code block that uses the mermaid language identifier
GitHub renders Mermaid syntax placed in a fenced code block with the mermaid identifier, and Mermaid supports flow charts, sequence diagrams and other diagram types. GeoJSON and TopoJSON blocks render interactive maps, not sequence diagrams, and STL blocks render 3D models.
Answer each question before opening the explanation, and write down why you discarded the other options. On AZ-400, most mistakes come from choosing an option that is technically possible but does not meet every requirement in the scenario.
These 10 questions are a taste of the format, not a diagnostic. To know which domains you fail, practice by domain for free and take a timed mock exam that mirrors the official weights and duration.
Start for free, no sign-up or card. Every question includes an explanation like the ones above, and the mock exam reproduces the official AZ-400 format.