AZ-400 Tests Pipeline Design Across Azure DevOps and GitHub — Not Tool Trivia
An expert-level exam for engineers who build delivery systems. Build and release pipelines alone are 50–55%, so YAML structure, agents, environments, deployment patterns and IaC decide the result.
Check Your Readiness →Most candidates understand Designing and Implementing Microsoft DevOps Solutions (AZ-400) concepts — and still fail. This exam tests how you apply knowledge under pressure.
Scenarios mix Azure DevOps and GitHub, and the right answer is usually the built-in feature with least effort and least privilege rather than a custom script. Half the exam is YAML, agents, environments, feeds and deployment strategies. 100 minutes; question count not published.
Create a PAT on an administrator account for the bot
A PAT is tied to a person and usually broader than needed. A GitHub App installs on the organization with fine-grained permissions and short-lived tokens. For same-repository tasks, GITHUB_TOKEN limited by the permissions key is enough.
Create separate dev, test and prod feeds and republish
Use feed views: promote the same package version from @local to @prerelease to @release. Consumers point at the view and the binary never changes, preserving traceability. Upstream sources separately cache public registry packages on first use.
Use a rolling deployment across the instances
Rolling rollback redeploys batch by batch. App Service deployment slots or blue-green let you swap back instantly; warm the staging slot before swapping and mark environment-specific settings slot-sticky so they stay put.
Move the repository's files into Git LFS
Git LFS solves large binary files, not repository breadth or history size. Scalar enables partial clone, sparse checkout and background maintenance for very large repositories, so developers fetch and check out only what they need.
Scale up the App Service plan
Healthy resource metrics point to a slow dependency. Use Application Insights end-to-end transaction details and the application map to find the slow call; instrument with the Azure Monitor OpenTelemetry Distro if telemetry is missing.
Approvals and checks live on the environment, service connection or other protected resource, outside YAML, so editing the pipeline cannot bypass them. In GitHub Actions the equivalent is environment protection rules with required reviewers and environment secrets.
Hosted agents run outside your network and cannot reach resources with public access disabled. Use a self-hosted agent or runner inside the VNet, or Managed DevOps Pools for Azure Pipelines. A managed identity also needs code running on your own Azure resource.
Federation exchanges a short-lived OIDC token from the pipeline for Microsoft Entra access, so no client secret is stored or rotated. A 30-day secret is still a stored secret. Restrict each service connection to approved pipelines as well.
The credential stays in earlier history. Rewrite history with git filter-repo or BFG, force push, have everyone re-clone, and rotate the secret because it is already exposed. Secret scanning with push protection stops the next leak before it lands.
Lead time starts when the work item is created and reflects what customers wait. Cycle time starts when work begins and reflects team throughput. A widening band on a cumulative flow diagram, not a burndown, shows where work is stuck.
Strengthen weak areas with exam-style practice questions and detailed explanations.
Simulate the real exam experience and assess your readiness under timed conditions.
Review key concepts, objectives, and exam topics in one place.
Get personalized explanations, learning recommendations, and instant answers.
Follow a structured learning path designed to help you prepare efficiently.
Find out whether your pipeline, identity and deployment choices meet the AZ-400 bar.