10 free Microsoft AZ-400 practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 564 questions. Work through them, then open each answer to check your reasoning.
Get all 564 questions (US$39) · Download these 10 as a PDF
Question 1
You are configuring project metrics for dashboards in Azure DevOps.
You need to configure a chart widget that measures the elapsed time to complete work items once they become active.
Which of the following is the widget you should use?
Show answer and explanation
Correct answer: C. Cycle time
Cycle time is the widget that specifically measures the elapsed time from when a work item becomes active until it is completed. It tracks the duration spent in active states, distinguishing it from lead time which measures from creation. Cumulative Flow Diagram shows work item distribution across states, Burnup tracks completed work against total scope, and Burndown tracks remaining work over time.
Why the other options are wrong
- A. Cumulative Flow Diagram visualizes the distribution of work items across workflow states but does not measure elapsed time.
- B. Burnup measures completed work against total scope, not the time elapsed once work becomes active.
- D. Burndown tracks remaining work over time, not the elapsed time for active work items.
Question 2
You need to consider the underlined segment to establish whether it is accurate.
The Burnup widget measures the elapsed time from creation of work items to their completion.
Select `No adjustment required` if the underlined segment is accurate. If the underlined segment is inaccurate, select the accurate option.
Show answer and explanation
Correct answer: B. Lead time
The underlined statement is inaccurate. The Burnup widget measures completed work against total scope over time. Lead time is the metric that measures elapsed time from creation of work items to their completion, encompassing the entire lifecycle including time spent waiting before work begins.
Why the other options are wrong
- A. The statement about Burnup is incorrect; Burnup does not measure from creation to completion.
- C. Test results trend is a completely different metric tracking test execution results, not time measurement.
- D. Burndown tracks remaining work, not elapsed time from creation to completion.
Question 3
You are making use of Azure DevOps manage build pipelines, and also deploy pipelines.
The development team is quite large, and is regularly added to.
You have been informed that the management of users and licenses must be automated when it can be.
Which of the following is a task that can't be automated?
Show answer and explanation
Correct answer: D. License procurement
License procurement, the purchasing and acquisition of licenses, cannot be automated as it involves business decisions, vendor management, budgeting, and external procurement processes. Group membership changes, license assignment, and entitlements assignment are all administrative tasks that can be automated through Azure DevOps APIs and automation tools.
Why the other options are wrong
- A. Group membership changes can be automated through Azure DevOps APIs and directory integration.
- B. License assignment can be automated using Azure DevOps automation features and scripting.
- C. Assigning entitlements can be automated through Azure DevOps entitlements management features.
Question 4
You have been tasked with strengthening the security of your team's development process.
You need to suggest a security tool type for the Continuous Integration (CI) phase of the development process.
Which of the following is the option you would suggest?
Show answer and explanation
Correct answer: B. Static code analysis
Static code analysis is the appropriate security tool for the Continuous Integration phase because it analyzes source code without executing it, identifying vulnerabilities early in development before code is deployed. It integrates seamlessly into CI pipelines. Penetration testing and dynamic code analysis occur post-deployment, while threat modeling is a planning activity, not a CI-phase automated tool.
Why the other options are wrong
- A. Penetration testing is performed on deployed systems, not during CI.
- C. Threat modeling is a design and planning activity, not an automated CI-phase security tool.
- D. Dynamic code analysis requires executing code and is typically performed in later testing phases, not CI.
Question 5
Your company is currently making use of Team Foundation Server 2013 (TFS 2013), but intend to migrate to Azure DevOps.
You have been tasked with supplying a migration approach that allows for the preservation of Team Foundation Version Control changesets dates, as well as the changes dates of work items revisions. The approach should also allow for the migration of all TFS artifacts, while keeping migration effort to a minimum.
You have suggested upgrading TFS to the most recent RTW release.
Which of the following should also be suggested?
Show answer and explanation
Correct answer: B. Using the TFS Database Import Service to perform the upgrade.
The TFS Database Import Service is the tool specifically designed to migrate from Team Foundation Server to Azure DevOps while preserving historical data including changeset dates and work item revision dates. It minimizes migration effort and handles all TFS artifacts comprehensively. Upgrading to the most recent RTW release prepares the source system for migration, and the Database Import Service completes the process.
Why the other options are wrong
- A. The TFS Java SDK is for Java-based TFS integrations, not for migration to Azure DevOps.
- C. PowerShell Core version is not the relevant tool for TFS to Azure DevOps migration.
- D. The TFS Integration Platform is an older tool for different integration scenarios, not the recommended modern migration approach.
Question 6
You are currently developing a project for a client that will be managing work items via Azure DevOps.
You want to make sure that the work item process you use for the client allows for requirements, change requests, risks, and reviews to be tracked.
Which of the following is the option you would choose?
Show answer and explanation
Correct answer: D. CMMI
CMMI (Capability Maturity Model Integration) is the process template that includes work item types for requirements, change requests, risks, and reviews. It is designed for organizations following formal process governance. Basic lacks these specialized types, Agile focuses on user stories and tasks, and Scrum emphasizes product backlog items and sprints without dedicated change request and risk tracking.
Why the other options are wrong
- A. Basic process has minimal work item types and does not include change requests or risks.
- B. Agile process focuses on user stories and does not include dedicated change request and risk work item types.
- C. Scrum process emphasizes sprint-based development and lacks dedicated change request and risk tracking work item types.
Question 7
Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result.
Establish if the solution satisfies the requirements.
You run the Register-AzureRmAutomationDscNode command in your company's environment.
You need to make sure that your company's test servers remain correctly configured, regardless of configuration drift.
Solution: You set the -ConfigurationMode parameter to ApplyOnly.
Does the solution meet the goal?
Show answer and explanation
Correct answer: B. No
Setting -ConfigurationMode to ApplyOnly applies the desired configuration once but does not monitor for configuration drift afterward. To maintain correct configuration regardless of drift, the mode must actively detect and report deviations. ApplyOnly is insufficient because it does not address ongoing configuration drift, which means servers could diverge from the desired state without detection or remediation.
Why the other options are wrong
- A. ApplyOnly does not satisfy the requirement to maintain correct configuration despite drift, as it lacks monitoring and enforcement.
Question 8
Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result.
Establish if the solution satisfies the requirements.
You run the Register-AzureRmAutomationDscNode command in your company's environment.
You need to make sure that your company's test servers remain correctly configured, regardless of configuration drift.
Solution: You set the -ConfigurationMode parameter to ApplyAndMonitor.
Does the solution meet the goal?
Show answer and explanation
Correct answer: B. No
ApplyAndMonitor applies the desired configuration and monitors for configuration drift, detecting deviations from the desired state. However, it does not automatically remediate drift, it only reports it. To truly ensure servers remain correctly configured regardless of drift, ApplyAndAutoCorrect mode is required, which actively corrects any detected deviations. ApplyAndMonitor satisfies monitoring but not the remediation aspect of the requirement.
Why the other options are wrong
- A. ApplyAndMonitor detects drift but does not automatically correct it, so servers may not remain correctly configured without intervention.
Question 9
Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result.
Establish if the solution satisfies the requirements.
You run the Register-AzureRmAutomationDscNode command in your company's environment.
You need to make sure that your company's test servers remain correctly configured, regardless of configuration drift.
Solution: You set the -ConfigurationMode parameter to ApplyAndAutocorrect.
Does the solution meet the goal?
Show answer and explanation
Correct answer: A. Yes
The ApplyAndAutocorrect configuration mode automatically corrects configuration drift by applying the desired configuration whenever drift is detected. This ensures servers remain in their desired state regardless of changes, which directly satisfies the requirement to keep test servers correctly configured and handle configuration drift.
Why the other options are wrong
- B. ApplyAndAutocorrect is the correct mode for automatic correction of configuration drift.
Question 10
You need to consider the underlined segment to establish whether it is accurate.
To compile an Internet Information Services (IIS) web application that runs docker, you should use a Default build agent pool.
Select `No adjustment required` if the underlined segment is accurate. If the underlined segment is inaccurate, select the accurate option.
Show answer and explanation
Correct answer: B. Hosted Windows Container
An IIS web application packaged as a Docker image must be built as a Windows container image, and that requires a build agent whose host runs Windows with the Windows container feature enabled. The Hosted Windows Container pool is the Microsoft-hosted pool that supplies those agents, so the underlined segment must be replaced. The generic Hosted pool images do not support building Windows container images for IIS workloads.
Why the other options are wrong
- A. The Default pool contains self-hosted agents that you supply and configure yourself, so it does not guarantee the Windows container support this build needs.
- C. The Hosted pool provides general Windows build agents without the Windows container support required to build an IIS Docker image.
- D. Hosted macOS targets Xcode, iOS and macOS builds and cannot build Windows container images for IIS.
That was 10 of 564.
The full Microsoft AZ-400 pack has all 564 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.