Microsoft Certified: DevOps Engineer Expert (AZ-400)

The Microsoft Certified: DevOps Engineer Expert (AZ-400) validates the ability to combine people, process, and technologies to deliver continuous value using Azure DevOps. It covers CI/CD implementation, site reliability engineering, and infrastructure as code to streamline software delivery. Achieving the symbol AZ_AZ_400 marks a professional as an expert in driving efficient and reliable DevOps practices.

---------- Question 1

You are managing a complex environment with hundreds of virtual machines and containers. You need to perform a custom analysis of the log data stored in a Log Analytics workspace to find the top 10 containers that have used the most memory over the last 24 hours. Which language and approach should you use to retrieve this?

1. SQL Structured Query Language using a standard SELECT statement against the Log Analytics virtual tables through a linked server connection.
2. Kusto Query Language KQL using the summarize operator and the top function to aggregate and sort the performance data.
3. PowerShell Scripting using the Get-AzLogAnalyticsData cmdlet to download all logs to a local CSV file for analysis in Microsoft Excel.
4. PromQL Prometheus Query Language which is the native language for all Azure Monitor metrics and logs regardless of the resource type.

---------- Question 2

You need to enforce a code review process for your main branch in Azure Repos. You want to ensure that no developer can merge code directly into the main branch, that at least two senior engineers approve every change, and that the code must successfully compile in a build pipeline before merging. Which feature of Azure Repos should you configure to meet these requirements?

1. Access Control Lists
2. Branch Policies
3. Repository Tags
4. Service Connections

---------- Question 3

As part of your compliance plan, you need to implement container scanning in your Azure-based CI/CD pipeline. You want to ensure that every Docker image produced by the pipeline is checked for OS-level vulnerabilities and misconfigurations before it is allowed to be deployed to the production Kubernetes cluster. Which service provides integrated vulnerability scanning for container images in Azure?

1. Azure Container Registry using Microsoft Defender for Containers
2. Azure Repos using Branch Policies
3. Azure Monitor using Container Insights
4. Azure Pipelines using the Docker task

---------- Question 4

Your project requires complex technical documentation that includes architectural diagrams which must be updated automatically whenever the infrastructure code changes. You want to store this documentation within the repository itself using Markdown. Which tool or syntax should you use to embed live-editable diagrams within your Azure DevOps Wiki or GitHub README files?

1. Embed static JPEG images that are updated manually using a local drawing tool and uploaded via FTP.
2. Use Mermaid syntax within Markdown blocks to define flowcharts, sequence diagrams, and Gantt charts.
3. Link to external Visio files stored in a separate OneDrive folder with restricted access permissions.
4. Write documentation in plain text and use ASCII art to represent complex cloud architecture components.

---------- Question 5

A DevOps engineer is designing a multi-stage YAML pipeline for a microservices application. The requirement is to ensure that the 'Production' stage only executes if the 'Staging' stage is successful and a manual approval is granted by the release manager. Additionally, the pipeline must run integration tests in parallel to save time. How should these requirements be defined in the YAML file?

1. Define 'Production' with a 'dependsOn' staging property, use 'environments' for approvals, and use the 'parallel' strategy for test jobs.
2. Use a single job for all stages and insert a 'Sleep' command to give the manager time to check the staging site manually.
3. Create two separate pipeline files and use a web hook to trigger the second one after the first one finishes successfully.
4. Set the 'condition' property of the production stage to 'manual' and use a sequential loop for all testing tasks.

---------- Question 6

You are configuring a deployment pipeline for a business-critical application in Azure DevOps. You need to ensure that the application is deployed to a small percentage of users first to monitor for errors before rolling it out to the entire user base. If any issues are detected, the system should stop the rollout. Which deployment strategy does this describe?

1. Blue-Green deployment, where you switch traffic between two identical production environments.
2. Canary deployment, where a new version is released to a subset of users before the full rollout.
3. Rolling deployment, where you update instances of the application one by one until all are running the new version.
4. Recreate deployment, where the old version is completely shut down before the new version is started.

---------- Question 7

Your organization uses GitHub and wants to enhance the security of their development lifecycle. You need to implement a solution that automatically scans for vulnerabilities in third-party libraries and dependencies whenever a developer opens a pull request. Which GitHub feature should you enable and configure to provide these automated security alerts and updates?

1. GitHub Actions
2. Dependabot
3. GitHub Copilot
4. Secret Scanning

---------- Question 8

Your team needs to query millions of log lines in Azure Log Analytics to find all instances of a specific error code (500) that occurred in the last 4 hours, grouped by the specific cloud instance ID. Which language should you use to perform this analysis?

1. Standard SQL (Structured Query Language) as used in SQL Server or MySQL.
2. KQL (Kusto Query Language), specifically designed for fast telemetry and log analysis.
3. JavaScript, using a 'for' loop to iterate through every log entry in a JSON file.
4. Regular Expressions (Regex) written in a Notepad++ search window after downloading the logs.

---------- Question 9

A development team is transitioning to a high-velocity delivery model using GitHub and Azure Boards. You need to design a feedback cycle strategy that ensures developers are immediately notified of high-priority bugs while minimizing notification fatigue from routine pull request updates. The solution must integrate work item tracking with the source control flow to maintain full traceability. Which configuration provides the most efficient automated feedback loop for this specific scenario?

1. Configure a generic webhook in GitHub to send all repository events to a logic app that filters for bug labels and sends emails.
2. Install the Azure Boards app for GitHub and configure subscriptions to sync GitHub issues with Azure Boards work items while setting up specific area path notifications.
3. Create a manual process where QA engineers update a shared Microsoft Excel spreadsheet that is periodically imported into Azure DevOps to trigger manual notifications.
4. Use GitHub Actions to generate a Markdown file in the repository root for every bug found which developers must manually check during their daily stand-up meetings.

---------- Question 10

You are configuring GitHub Advanced Security for a private repository. You need to ensure that any pull request that introduces a new vulnerability is automatically blocked from being merged. Which specific component of the GitHub ecosystem should you configure to enforce this policy based on the results of static analysis?

1. Enable 'Required reviews' in the branch protection settings and assign the Security Team as the mandatory reviewers.
2. Configure 'Status checks' in the branch protection rules to require the successful completion of the CodeQL analysis workflow.
3. Set up a GitHub Action that uses the 'delete-branch' command whenever a security alert is triggered by the Dependabot scanner.
4. Use the GitHub Security Advisory feature to publicly disclose the vulnerability so the community can provide a fix before the merge.

---

Are they useful?

Click here to get 360 more questions to pass this certification at the first try! Explanation for each answer is included!

Follow the below LINKEDIN channel to stay updated about 89+ exams!

Digital Intelligence Network