CertifyDeckCargando contenido…
AZ-401 · Sample questions
10 real questions from the CertifyDeck AZ-401 bank, spread across the domains of the official Microsoft Certified: Agentic DevOps Engineer Expert skills outline, with the correct answer and a full explanation of why the other options are wrong. They are original questions written from the public syllabus, not exam dumps, and they are the same style you will find in the practice tests and mock exams.
Correct answer: D. Set Contribute to Deny for Contractors on the Ledger repository
Deny generally overrides Allow, including permissions granted through another group, and setting it on the individual repository limits the effect to Ledger. Not set neither grants nor denies, so the Allow inherited through Contributors would still apply. Denying at All Repositories or removing the group from Contributors would change access to every repository in the project.
Correct answer: B. Commit the scripts to a .githooks folder and run git config core.hooksPath .githooks
The hooks directory defaults to $GIT_DIR/hooks but can be changed with the core.hooksPath setting, so a tracked folder plus one git config command enables the versioned scripts. Content of the .git directory is not part of the commit, and the Git book notes that client-side hooks are not copied when you clone. Files ending in .sample are only examples that must be renamed, and hooks without the executable bit are ignored.
Correct answer: A. An organization webhook subscribed to the push and pull request review events
A webhook subscribed to the push and pull request review events sends an HTTP request to the external server as soon as each event happens, and an organization webhook covers every repository in the organization. Polling the REST API per repository scales poorly and quickly consumes the rate limit, which fails the stated requirement. GitHub Services were retired in favor of webhooks, and an MCP server gives Copilot tools; it is not an event delivery mechanism.
Correct answer: B. A server of type http with the URL https://mcp.dev.azure.com/{organization}
The remote Azure DevOps MCP Server is hosted by Azure DevOps, uses streamable HTTP transport and Microsoft Entra authentication, and is configured with a minimal mcp.json entry that points to https://mcp.dev.azure.com/{organization}. The npx-based server is the local option, which needs Node.js on the machine and fails the no local installation requirement. The GitHub MCP server does not expose Azure Boards data, and a service hook pushes events but gives Copilot no tools.
Correct answer: C. actor:Copilot
The actor:Copilot search term returns the record of agent activity in the audit log. The action:copilot term returns events about the Copilot plan, such as settings, policies and license changes, and action:pull_request.create returns every pull request creation, including those made by people. OpenTelemetry capture sends client telemetry to an external backend and is not an audit log search.
Correct answer: C. Save the investigation as an Azure Monitor issue
Deep investigation results are temporary; saving them as an Azure Monitor issue preserves the report, the agent's reasoning, the supporting data and the follow-up conversation so the team can resume and share it. The Observability Agent chat is temporary and is not saved for later access, and starting a new investigation would not keep the existing reasoning and follow-up context.
Correct answer: D. Create the pull requests with a GitHub App installation access token.
Pull requests created or updated with GITHUB_TOKEN produce pull_request runs in an approval-required state to prevent recursive runs; GitHub says to use a GitHub App installation access token or a personal access token instead when those runs must execute without approval. Changing the token's permissions in either workflow doesn't change this trigger behaviour, and workflow_dispatch only adds a manual or API trigger rather than running CI on the pull request event.
Correct answer: D. Add pull-requests: write
When a permissions block specifies any permission, every permission that isn't listed is set to none, so the token currently can't modify pull requests; pull-requests: write is the permission that lets an action add a label to a pull request. write-all would work but grants far more than the minimum. contents: write covers repository contents such as releases, not pull request labels, and id-token: write only allows fetching an OpenID Connect token.
Correct answer: A. Fix it in main through a pull request, then cherry-pick it into releases/M129
In the release flow, hotfixes always start in main through the normal pull request process and are then cherry-picked into the release branch, so the fix is in both branches and cannot reappear in the next release. Release branches never merge back into main, and merging a release branch can bring release-specific changes into main. Pushing directly bypasses branch policies, and deploying main would ship unreleased work from the current sprint.
Correct answer: C. In the on: failure lifecycle hook
Deployment jobs end with either the on: success or the on: failure hook, and on: failure is meant for rollback or clean-up steps when the deployment fails. postRouteTraffic runs after traffic is routed, typically to monitor the health of the new version, and preDeploy initializes resources before deployment starts. A later stage with condition: succeeded() runs only when everything succeeded, which is the opposite of what a rollback needs.
Answer each question before opening the explanation, and write down why you discarded the other options. On AZ-401, most mistakes come from choosing an option that is technically possible but does not meet every requirement in the scenario.
These 10 questions are a taste of the format, not a diagnostic. To know which domains you fail, practice by domain for free and take a timed mock exam that mirrors the official weights and duration.
Start for free, no sign-up or card. Every question includes an explanation like the ones above, and the mock exam reproduces the official AZ-401 format.