AZ-400 DevOps Engineer Expert Exam Preparation Guide

The AZ-400 certification covers designing and implementing DevOps practices on Azure. The exam tests whether you can build continuous integration and continuous deployment (CI/CD) pipelines, manage infrastructure as code, and apply security and monitoring across Azure DevOps and GitHub. A pass shows you can design and run DevOps processes at enterprise scale.

This guide covers the prerequisites, the exam domains, and a week-by-week study plan.

Is AZ-400 Right for You?

Prerequisites and Target Audience

AZ-400 is an expert-level certification, the highest tier in Microsoft's Azure role-based scheme. Microsoft requires candidates to hold either AZ-104 (Azure Administrator Associate) or AZ-204 (Azure Developer Associate) before attempting AZ-400.

Beyond the formal prerequisites, the exam is aimed at:

• Azure developers with hands-on CI/CD pipeline experience
• Infrastructure and operations professionals expanding into DevOps
• Release engineers managing Azure deployments
• Cloud architects designing automation strategies
• Experienced IT professionals transitioning to DevOps roles

The exam assumes you have already deployed applications on Azure, managed repositories, and worked with deployment automation. Theory alone is not enough; you need practical experience implementing DevOps practices.

Why AZ-400 Is Challenging

AZ-400 is one of the harder Azure certifications, for three reasons.

Breadth of Coverage: The exam spans five scored skill domains, but each domain pulls in several technologies at once: Azure DevOps, GitHub Actions, containerisation, infrastructure as code, monitoring, security scanning, and compliance frameworks. You need all of them, with build and release pipelines dominating the score.

Depth of Implementation: Questions go past what each technology does and ask how to design solutions with it. Scenario questions ask you to pick the right combination of tools for a given set of requirements.

Hands-On Complexity: AZ-400 tests DevOps problem-solving, and memorisation will not get you through it. You need experience troubleshooting failed deployments, improving pipeline performance, and balancing security against deployment speed.

Exam Overview and Domains

Exam Structure

The AZ-400 exam contains 40-60 questions delivered over 100 minutes of exam time (120 minutes seat time). Question formats include:

• Multiple choice (select one correct answer)
• Multiple select (select all that apply)
• Scenario-based labs (hands-on simulations)
• Case studies with multi-question scenarios

The passing score is 700 out of 1000. Scoring accounts for question difficulty, so some questions carry more weight than others.

Domain Breakdown

Pipelines are the largest domain, at approximately 50-55% of the exam. Those questions test designing and implementing CI/CD automation, so most of your preparation time belongs there.

Core Technologies and Concepts

Azure DevOps Platform

Azure DevOps is Microsoft's suite for planning, developing, deploying, and maintaining software.

Azure Boards handles work items and team planning. You need to know how to configure boards for different team workflows, set up sprints, manage backlogs, and connect boards to pipelines so work items update automatically.

Azure Repos provides Git-based source control. The exam tests branching strategies (trunk-based development, Git flow), pull request policies, code review workflows, and repository permissions. Know when to enforce branch protection rules and how to set PR gates that require a passing build before merge.

Azure Pipelines is the CI/CD engine and gets the most exam coverage: YAML pipeline syntax, multi-stage pipelines with approval gates, variable management, service connections, and pipeline templates. You also need to understand task execution context, agent pools, and parallel job configuration.

Azure Artifacts manages NuGet, npm, Maven, and Python packages. Know how to set up feeds, configure upstream sources, manage package retention policies, and use feeds in pipelines.

Azure Test Plans organises testing across releases. It is tested less heavily, but you should understand test case management, publishing test results, and pipeline integration.

GitHub and GitHub Actions

GitHub Actions runs workflow automation inside GitHub repositories, defined in YAML files.

Workflow YAML Syntax: Actions workflows use on triggers, jobs, steps, and uses syntax. You need to write workflow files that trigger on events (push, pull request, schedule, workflow_dispatch), define job conditions, manage outputs between jobs, and use expressions for conditional logic.

Secrets and Environments: GitHub stores secrets at repository and organisation level. The exam tests passing secrets to workflows securely, environment-specific configuration, and secret rotation.

Actions and Marketplace: Know the difference between official Microsoft actions and community actions, how to use pre-built actions from the GitHub Marketplace, and when to write a custom action in JavaScript or as a Docker container.

The exam may ask you to choose between Azure DevOps Pipelines and GitHub Actions for a given scenario. As a rule, Azure DevOps Pipelines suits complex enterprise workflows and GitHub Actions suits simpler automation tied to one repository.

Infrastructure as Code (IaC)

IaC defines Azure resources in declarative templates, so deployments are repeatable and kept under version control.

Bicep: Microsoft's newer alternative to ARM templates, with a cleaner syntax. Bicep compiles to ARM JSON. The exam expects familiarity with Bicep syntax, modules, loops, conditions, and parameterising templates for reuse.

ARM Templates: The older JSON-based IaC format. Template structure, linked templates, variable definitions, and template functions are still relevant for AZ-400.

Terraform: HashiCorp's multi-cloud IaC tool, increasingly used on Azure. Know Terraform syntax, state management, modules, and how to run Terraform in pipelines with the Terraform task in Azure DevOps.

The exam tests choosing the right IaC approach for a scenario and running IaC inside CI/CD pipelines.

Containerisation and Orchestration

Containers package an application with its dependencies so it deploys the same way in every environment.

Docker: Know Dockerfile syntax, image layering, multi-stage builds, and practices such as using minimal base images and not running containers as root.

Azure Container Registry (ACR): Microsoft's private Docker registry. Understand ACR tasks for automated image builds, webhook triggers, image scanning with Defender for Containers, and geo-replication for global deployment.

Azure Kubernetes Service (AKS): Managed Kubernetes on Azure. Know how to deploy to AKS from pipelines, manage deployments, configure ingress controllers, and enforce pod security with Pod Security Admission (PodSecurityPolicy was removed in Kubernetes 1.25).

The exam tests deploying containerised applications through a full CI/CD workflow, from code commit to Kubernetes deployment.

Monitoring and Logging

Monitoring confirms systems are working and speeds up diagnosis when they are not.

Application Insights: Application Performance Monitoring (APM) that collects telemetry from applications. Know how to instrument code, set up availability tests, define custom metrics, and create alerts from performance data.

Azure Monitor: Collects metrics and logs from Azure resources. Understand metric collection, diagnostic settings, alert rules, and action groups.

Log Analytics: Queries logs with Kusto Query Language (KQL). The exam may ask for basic KQL queries to investigate issues and build dashboards.

Instrumentation strategy questions cover monitoring for whole pipelines as well as applications: tracking deployment success, pipeline performance, and infrastructure health.

Security and Compliance

DevOps security builds protection into every stage of development and deployment.

SAST (Static Application Security Testing): Tools such as SonarQube and Microsoft Security DevOps scan source code before compilation. Know how to add SAST to pipelines and read the scan results.

DAST (Dynamic Application Security Testing): Tools such as OWASP ZAP and Burp Suite test running applications. Understand where DAST belongs in a pipeline and how to fail builds on critical vulnerabilities.

Secret Management: Handling passwords, API keys, and certificates securely. Know Azure Key Vault integration with pipelines, GitHub Secrets, and variable masking.

Policy Enforcement: Azure Policy and compliance frameworks check that configurations meet organisational standards. Understand policy definitions, effects, and how policy fits into DevOps workflows.

The exam tests building pipelines that balance speed with security: when to scan, where to gate on security findings, and how to handle secrets.

10-14 Week Study Plan

This plan spreads AZ-400 preparation over 10-14 weeks, with each block building on the last.

Weeks 1-2: Foundation and Assessment

Start with a baseline. Review your AZ-104 or AZ-204 material to refresh core Azure concepts.

Take a practice test on azureprep.com to find gaps and get used to the format. azureprep.com has a free AZ-400 preview that follows the real exam format, and your first score shows which domains need the most work. Full access to everything is one All-Access subscription (monthly or annual).

Read the exam skills outline on Microsoft Learn and map it against what you already know, so your preparation follows what Microsoft actually tests.

Weeks 3-4: Azure DevOps Fundamentals

Work through the Microsoft Learn modules on:

• Azure Boards work item management and sprint planning
• Azure Repos branching strategies and code review policies
• Azure Pipelines YAML syntax and multi-stage pipeline design
• Azure Artifacts feed management

Do the hands-on labs in your own Azure subscription. Create a sample project in Azure DevOps, set up a Git repository with branch policies, and build a basic multi-stage pipeline. AZ-400 cannot be passed without this kind of practice.

Weeks 5-6: GitHub and CI/CD Advanced Topics

Study GitHub and GitHub Actions, learning the YAML workflow syntax through worked examples. Build several workflows, from a simple Node.js deployment up to multi-job orchestration.

Compare Azure DevOps Pipelines with GitHub Actions, and know when to recommend each based on the organisation's needs, its existing tooling, and the features required.

Move on to approval gates, deployment strategies (blue-green, canary), and multi-stage orchestration. Practise writing conditions that control when jobs run.

Weeks 7-8: Infrastructure as Code

Make Bicep your main IaC language. Work through parameters, variables, outputs, loops (copy), and conditions, and build reusable Bicep modules for common Azure resources.

Learn the basics of ARM templates, since older templates still appear on the exam: template structure and linked templates.

Cover Terraform basics, including state management, modules, and Azure provider configuration. Practise running Terraform in Azure Pipelines with the Terraform task.

Deploy infrastructure through pipelines. Build a Bicep pipeline that validates, previews, and deploys to test and production environments.

Weeks 9-10: Containers and Deployment

Study Docker: Dockerfile syntax, image layers, and multi-stage builds. Build Docker images for sample applications.

Learn Azure Container Registry: creating registries, configuring image scanning, setting up webhooks, and geo-replication.

Deploy to AKS from pipelines. Build a workflow that builds Docker images, pushes them to ACR, and deploys to AKS with Helm or kubectl manifests.

Practise deploying to Azure App Service from pipelines too, since the exam covers several deployment targets.

Weeks 11-12: Security, Monitoring, and Compliance

Add security scanning to your pipelines. Set up SonarQube for SAST and learn how to fail a build on critical issues. Look into OWASP integration and dependency scanning tools.

Use Azure Key Vault for secrets, reading them in pipelines through service connections and variable linking.

Instrument sample applications with Application Insights and create custom metrics, availability tests, and alerts.

Learn the basics of Log Analytics and Kusto Query Language. Write queries to investigate application issues and build dashboards.

Cover Azure Policy and compliance requirements as they apply to DevOps.

Weeks 13-14: Practice and Refinement

Spend the final weeks on practice. Take several full-length practice exams on azureprep.com to find the weak areas that remain.

For each wrong answer, go back to the underlying concept. Many candidates know the surface facts but miss questions that test deeper understanding.

Review case studies and labs. The real exam includes scenario questions that ask you to apply knowledge to a complex situation rather than recall an isolated fact.

Put your time into the domains where you scored lowest. If pipeline questions were the problem, build progressively more complex pipelines. If security questions were, go deeper into SAST/DAST integration and secret management.

A week before the exam, sit a timed practice test somewhere quiet, under conditions close to the real exam. Use the results to direct your final study.

Key Study Resources

Microsoft Learn: Microsoft's free platform has the official AZ-400 learning paths, with videos, interactive modules, and hands-on labs. Start here.

azureprep.com AZ-400 Practice Tests: Realistic practice exams with detailed explanations. The free preview shows you the format and your gaps, and the All-Access subscription unlocks the full-length tests that simulate the real exam.

Official Microsoft Documentation: The Azure DevOps and GitHub Actions documentation and Azure architecture guidance are the authoritative references. Keep them open during labs.

Hands-On Lab Environments: Use Azure free credits or a pay-as-you-go subscription to build real projects: Azure DevOps organisations, GitHub repositories, pipelines, container deployments, and monitoring. This work maps directly to exam questions.

YouTube and Community Resources: Search for Azure DevOps and GitHub Actions walkthroughs. Watching experienced practitioners build workflows shows how common practices look in use.

Common Pitfalls to Avoid

Focusing Too Much on Azure DevOps UI: The exam increasingly tests YAML pipeline syntax and GitHub Actions. Spend your time on YAML pipeline structure rather than the Azure DevOps web interface.

Ignoring Real-World Scenarios: Many questions present a business problem and ask for a solution. Knowing Azure DevOps components without knowing how to apply them leads to failed exams, so learn why each technology is used.

Neglecting Hands-On Practice: Reading about Azure DevOps is very different from configuring it, and reading alone will not get you through AZ-400. Include lab work every week.

Underestimating Security and Monitoring Domains: Together these make up 15-25% of the exam. Security scanning integration, secret management, and monitoring strategy all need proper study.

Not Understanding Pipeline Orchestration: Complex scenarios test multi-stage pipelines with approval gates, conditional job execution, and parallel stages. Practise designing these as well as simple linear deployments.

Confusing Similar Tools: Know the differences between Azure DevOps Pipelines and GitHub Actions, Bicep and ARM templates, and SAST and DAST. Scenario questions ask you to pick the right one for the context.

Exam Day Preparation

Arrive early at the testing centre, or set up your remote testing environment 15 minutes before the start time. For a remote exam, test your internet connection, webcam, and microphone.

Read each question carefully. Scenario questions contain details that decide the answer, and missing one can lead you to the wrong option.

For multiple-select questions, check exactly what is being asked before ticking boxes. Some ask "which statements are true" and others ask "which of these will NOT achieve the objective."

Flag difficult questions and come back to them. That way you collect the marks on easier questions before spending time on complex scenarios.

Watch the clock. With 40-60 questions in 100 minutes, you have approximately 2 minutes per question, and scenario questions need more than that.

The exam includes unscored pilot questions that Microsoft uses to develop future exams. You cannot tell which ones they are, so treat every question as scored.

Conclusion

AZ-400 is an expert-level exam on Azure DevOps and software delivery. Passing takes knowledge across five scored domains plus hands-on experience building complex CI/CD workflows.

Start with Azure DevOps and GitHub, then move into infrastructure as code and containerisation, covering security and monitoring along the way. Use azureprep.com practice tests to measure progress and find the areas that still need work.

Set aside 10-14 weeks, with a large share of hands-on practice. Build real projects, automate real deployments, and troubleshoot real pipeline failures. That experience helps on the exam and in the job.