Free study guide · DevOps
How to pass the Exam AZ-400: Designing and Implementing Microsoft DevOps Solutions
What the exam covers, how to plan your study, and how to read its questions. From the CertLumen course for this exam, kept up to date with the official exam guide.
- Questions
- 50
- Time
- 100 minutes
- Passing score
- 700 on a scale of 1 to 1000
- Exam fee
- USD 165 (US price; varies by country, excludes taxes; confirm on the exam page when booking)
- Valid for
- 1 year; renew for free with an online assessment on Microsoft Learn in the 6 months before expiry
- Delivery
- Online proctored (Pearson VUE) or test center
What the exam covers
A study plan that works
The default path. It covers all 19 lessons and all 10 labs in order, with a section drill after each section, daily flashcards, and the four mock exams on days 17, 18, 20 and 21. Build and release pipelines is about half of the exam, so it gets 8 of the 21 days. Plan the labs for days when you can sign in to an Azure subscription and a GitHub account, and delete resources after each one. Plan on about 1.5–2.5 hours a day.
| Day | Focus | Time |
|---|---|---|
| 1 | Start here: the exam, the flow of work and feedback | 120 min |
| 2 | Documentation, webhooks and integrations; first lab | 110 min |
| 3 | Process lab, process drill, then branching strategies | 145 min |
| 4 | Large files, scaling, permissions, tags and recovery | 105 min |
| 5 | Source control labs and drill | 130 min |
| 6 | Packages, feeds, versioning and quality gates | 110 min |
| 7 | Choosing the platform, agents, runners and triggers; YAML structure | 120 min |
| 8 | Deployment strategies and a build-and-release lab | 150 min |
| 9 | Configuration, IaC, pipeline operations; GitHub Actions lab | 135 min |
| 10 | Build and release drill | 100 min |
| 11 | Identities, credentials, permissions and projects | 115 min |
| 12 | Secrets, Key Vault and OIDC; secretless lab | 130 min |
| 13 | Scanning and compliance; scanning lab | 125 min |
| 14 | Security drill and monitoring foundations | 85 min |
| 15 | Alerts, Application Insights, tracing and KQL | 110 min |
| 16 | Instrumentation labs and drill | 150 min |
| 17 | Mock Exam 1 | 60 min |
| 18 | Mock Exam 2 | 60 min |
| 19 | Weak areas, cheat sheets and glossary | 120 min |
| 20 | Mock Exam 3 | 60 min |
| 21 | Mock Exam 4 and exam-day preparation | 60 min |
Exam strategy
How the exam works
Exam AZ-400: Designing and Implementing Microsoft DevOps Solutions is the one exam you need for the Microsoft Certified: DevOps Engineer Expert certification. It is a proctored, scenario-based exam. You are expected to know both Azure DevOps (Boards, Repos, Pipelines, Artifacts, Test Plans) and GitHub (Issues, Projects, Actions, Packages, Advanced Security), because many questions ask you to choose between them or to connect them. This course follows the skills measured as of 27 July 2026, the current English version of the exam.
| Fact | Detail (from the exam page, study guide and exam experience pages on Microsoft Learn) |
|---|---|
| Skills measured | Version dated 27 July 2026 (English). Localized versions are updated about eight weeks later. The 2026 change was minor: small updates to traceability and flow of work, security scanning, and the two instrumentation groups |
| Questions and time | Microsoft does not publish the number for AZ-400. Most Microsoft exams have 40 to 60 questions. Associate and expert role-based exams get 100 minutes (120 minutes if they may contain labs); the seat time is 20 minutes longer. This course assumes about 50 questions and 100 minutes |
| Question types | Not announced by Microsoft. Expect multiple choice, multiple response, case studies, drag and drop, build list, hot area and problem-solution sets. Some exams contain unscored items; you cannot tell which |
| Passing score | 700 on a scale of 1 to 1000. It is a scaled score, so it is not 70% of the points. There is no penalty for guessing |
| Weights | 10-15% processes and communications; 10-15% source control; 50-55% build and release pipelines; 10-15% security and compliance; 5-10% instrumentation |
| Cost | USD 165 in the US. The price depends on the country and excludes taxes; confirm it when you book |
| Delivery | Online proctored with Pearson VUE, or at a test center |
| Languages | English, Japanese, Chinese (Simplified), Korean, German, French, Spanish, Portuguese (Brazil), Chinese (Traditional), Italian. If the exam is not offered in your language you can request 30 extra minutes |
| Microsoft Learn during the exam | Allowed on associate and expert exams (not on Fundamentals or GitHub exams). It opens in a split screen from the left navigation pane. Everything under learn.microsoft.com is available except Q&A, practice assessments and your profile. No time is added and the timer keeps running |
| Results | Usually within minutes of finishing. Your score report shows the overall score and a bar chart per skill area, not which questions you missed |
| Retakes | Wait 24 hours after the first failed attempt, then 14 days between later attempts, at most five attempts in 12 months |
| Validity and renewal | One year. In the six months before it expires, renew for free with an unproctored, open-book online assessment on Microsoft Learn |
| Prerequisite | None to sit the exam. To receive the DevOps Engineer Expert certification you must also hold Azure Administrator Associate (AZ-104) or Azure Developer Associate (AZ-204) |
The exam page does not state the question count. The practice exams here use 50 questions in 100 minutes (6 + 6 + 27 + 6 + 5 per section) to match the weights. On the real exam, read the instructions screen before you start: it tells you the time and whether the exam may contain labs.
Where the questions are
| Section | Weight (range) | Weight used by this course | Questions per mock exam | Lessons |
|---|---|---|---|---|
| 1. Processes and communications | 10-15% | 13% | 6 | 3 |
| 2. Source control strategy | 10-15% | 13% | 6 | 3 |
| 3. Build and release pipelines | 50-55% | 53% | 27 | 6 |
| 4. Security and compliance | 10-15% | 13% | 6 | 4 |
| 5. Instrumentation | 5-10% | 8% | 5 | 3 |
The study guide gives ranges. The weights in this course are the midpoints. Roughly half of your score comes from section 3, so a weak area there costs more than a weak area anywhere else. Section 3 covers packages, testing and gates, YAML pipelines, agents, deployment strategies, infrastructure as code and pipeline maintenance, and the other sections still feed it: branch policies, OIDC and Key Vault appear in pipeline scenarios too.
How to study
- Learn. Read each lesson with a YAML file or a portal open. Answer the check questions before you open the answer.
- Lab. Do the labs on the Azure DevOps free tier, GitHub Free and an Azure free account. They explain the clicks the exam describes in words. Delete resource groups, feeds, service connections and test repositories when you finish.
- Drill. Take the section questions untimed, then read every explanation, including those for the options you got right.
- Flashcards. Ten minutes a day on facts you must recall exactly: limits, defaults, permission names, retirement dates.
- Mock exams. Four 50-question exams in 100 minutes. Take them under real conditions and use them for pacing, not only for the score.
- Review loop. For each miss, write the rule, not the answer. If you missed it for the wrong reason (misread, hurried) note that too.
Readiness criteria
- 85% or more on two mock exams in a row, on the first attempt. The real passing mark is a scaled 700 and includes multiple-select and case-study items, so leave a margin.
- 80% or more on every section drill, and on section 3 specifically since it is half of the exam.
- Without notes you can write a multi-stage YAML pipeline with a deployment job and an environment, a GitHub Actions OIDC login to Azure, and a KQL query for failure rate by operation.
- You can state, with the right date, which services in the lessons are retiring or already retired and what replaces them.
Reading the questions
Most questions describe a team, a constraint and a goal, then ask for the least effort, most secure, lowest cost or fewest changes option that meets it. The constraint decides: a Microsoft-hosted agent that cannot reach a private VNet, a branch that must not be pushed to directly, a secret that must not be stored. Underline the constraint before you look at the options.
| Question style | How to approach it |
|---|---|
| Multiple choice, one answer | Eliminate the options that break the constraint (cost, security, no-code, existing tools), then compare what is left |
| Multiple response ('Choose two') | Judge each option as true or false on its own; the number to pick is stated. Every correct option counts, so do not stop at the first one |
| Case study | A shared scenario with several questions. Read the requirements and constraints tab first; do not memorise the whole text, and return to it for each question |
| Drag and drop or build list | Put steps in order or match items. Think of the order in a real pipeline: build, test, publish, approve, deploy, verify |
| Hot area | Select the right setting or value from a list. Know the exact names: id-token: write, Allow externally-sourced versions, dependsOn |
| Problem-solution set | The same scenario repeated with different proposed solutions: does this one meet the goal? Check the goal and every constraint for each proposal; the answer can differ between proposals |
*Work items, backlog, sprints* point to Azure Boards. *Pull request, closing keyword, Actions* point to GitHub. *Environment, service connection, approvals and checks* point to Azure Pipelines. *Federated credential, no secret* points to OIDC. *Without changing the pipeline YAML* points to a check on a resource, not a YAML condition.
Pacing and breaks
- Aim for an average of two minutes a question. Mark any question you are not sure about within about two minutes, pick your best answer and move on.
- Case studies are expensive to read. Skim the question list first, then read the scenario for what those questions need.
- Use the review screen for the last 10 minutes, not for all questions: changing answers because of doubt costs more points than it gains.
- You can take unscheduled breaks, but the clock keeps running and you cannot go back to questions you saw before the break, even marked ones. Answer and review everything you want to before you start a break.
Using Microsoft Learn during the exam
Microsoft allows the Learn site on associate and expert exams. It is for the question where you cannot remember a setting name or a limit, not for answering every question: the time is not extended, and the exam is built so that you cannot finish if you rely on it. Searching a page with Ctrl+F (Command+F on a Mac) is the quick way in; the search is specific to Learn and does not work in the exam window. Links to other domains, such as GitHub, are blocked.
Before the exam, time yourself finding the same three facts on learn.microsoft.com with Ctrl+F: the list of approvals and checks, the Key Vault built-in roles, and the Azure Monitor alert types. If it takes more than a minute, rely on memory instead. GitHub documentation (docs.github.com) is not available during the exam, so GitHub-specific settings must come from memory.
Traps that appear again and again
- Lead time versus cycle time. The clock starting at creation is lead time; starting at In Progress is cycle time.
- Notifications versus checks. A notification only tells people. Approvals and checks on environments, service connections and agent pools stop a stage.
- Checks live on the resource. If the stem says authors must not be able to remove a control, the answer is a check or a branch policy, not a YAML condition or a
ManualValidation@0step. - Task groups and classic releases. Task groups and classic gates do not exist in YAML pipelines; the YAML equivalents are templates and environment checks.
- Managed identity from a hosted agent. A managed identity works only for code on an Azure resource. Microsoft-hosted agents and GitHub-hosted runners use workload identity federation.
- Revert versus reset versus rewrite. Revert adds history and is safe on shared branches; reset rewrites local history; removing a leaked secret needs filter-repo or BFG, a force push and rotation.
- Rolling back a flag is not rolling back data. Turning a feature flag off does not undo a schema change.
- Slots share the plan. Sticky settings do not swap, and a swap needs Standard tier or higher.
- Parallel jobs, not agents. Concurrency in Azure Pipelines is the number of parallel jobs you own, not the number of agents you register.
- Default branch for closing keywords.
Fixes #42andFixes AB#42act only when the pull request merges into the default branch. - Sampling. With sampling on,
count()under-reports; usesum(itemCount)in the classic tables.
Several services in the skills outline are being retired: Azure Automation State Configuration (30 September 2027), Azure Deployment Environments (22 February 2027), VM insights Map and the Dependency agent (30 June 2028), the Azure DevOps OIDC issuer vstoken.dev.azure.com (1 July 2027), and Azure DevOps public projects (convert to private in 2027). The exam can still ask what they do. When a question asks what to adopt for new work, choose the replacement: Azure Machine Configuration, Bicep or ARM through pipelines, Azure Monitor Agent, the Microsoft Entra issuer.
Same requirement, different tools
Words that point to the answer
Phrases in a question that usually point to one answer. The course has the full list.
| When the question says | Think of |
|---|---|
| The clock starts when the work item is created | Lead time |
| Work piling up in one column, long waits before testing | WIP limit on that column, confirmed with the Cumulative Flow Diagram |
| Pull request must link a work item before it can merge | Azure Repos branch policy Check for linked work items (GitHub: a required status check that looks for AB# or #) |
| Close the issue automatically when the pull request merges | Closing keyword such as Closes #42 (or Fixes AB#42) in a PR that targets the default branch |
| Link a GitHub commit to an Azure Boards work item | AB#123 in a commit message, PR description or issue description |
| Document a process as a diagram that can be reviewed in a pull request | Mermaid in a wiki page or Markdown file |
| Release notes grouped by label, generated from merged pull requests | .github/release.yml with changelog.categories plus Generate release notes (gh release create --generate-notes) |
| Deploy several times a day, short-lived branches, hide unfinished work | Trunk-based development with feature flags |
| A security group must approve any change under /infra | Automatically included reviewers with a path filter (GitHub: CODEOWNERS and Require review from Code Owners) |
| Keep history linear, no merge commits | Limit merge types to squash or rebase (GitHub: Require linear history) |
Revise from the cheat sheet
The course's cheat sheet has a page for each of these:
- Processes and communications: flow, metrics, wikis and integrations
- Source control: branches, policies, large files, recovery
- Build and release pipelines: packages, YAML, agents, deployments, IaC
- Security and compliance: identities, secrets, scanning
- Instrumentation: Azure Monitor, Application Insights, alerts and KQL
Practise with the real exam's mix
322 exam-style questions, 4 timed practice exams, flashcards and an AI tutor.