You have reached the last set in our AZ-400 series. These final ten questions mix every domain of the exam — processes, source control, packages, testing, pipelines, deployments, infrastructure as code, security, and monitoring — the way the real exam does. Treat this set as a readiness check: answer all ten before revealing any, then go back to the sets that cover the topics you missed.
This is the tenth post in our AZ-400 series (Questions 91-100). The previous set, AZ-400 Questions 81-90: Containers, GitHub Actions, and Advanced Pipelines, covers AKS, deployment strategies in YAML, and GitHub Actions. Every question here is an original practice scenario, not a copy of a real exam item.
Question 91: Every Change Linked to Work
Auditors at Contoso require that every change merged into main in Azure Repos can be traced to an approved work item. What should you configure?
A) A dashboard listing recent commits
B) A branch policy on main that checks for linked work items
C) A wiki page where developers record their changes
D) A nightly report of open bugs
👁 Reveal Answer
Correct Answer: B
Explanation: The “check for linked work items” branch policy can be required, so a pull request cannot complete until it is linked to a work item. That creates enforced traceability from requirement to code to build. A shows activity without enforcing anything. C depends on people remembering. D tracks bugs but not the link between work and changes. (Covered in Set 1.)
Question 92: Removing a File from All of History
A file containing customer data was committed months ago and now appears in hundreds of commits. After the data owner has been informed and any exposed credentials rotated, the team must remove the file from the entire history of the repository. Which tool is recommended for this rewrite?
A) git revert
B) git stash
C) git cherry-pick
D) git filter-repo
👁 Reveal Answer
Correct Answer: D
Explanation: git filter-repo rewrites history to remove files or paths from every commit; it is the tool the Git project recommends over the older filter-branch, and the BFG Repo-Cleaner is another common option. After rewriting, force-push and have everyone re-clone, and ask the hosting provider to clear cached views if needed. A adds a new commit but leaves the file in older commits. B saves local uncommitted work. C copies commits; it removes nothing. (Covered in Sets 1 and 8.)
Question 93: Versioning Tools That Are Not Code Libraries
Fabrikam’s pipelines download a 600 MB set of test datasets and command-line tools that are not NuGet, npm, Maven, or Python packages. The team wants them versioned and stored in Azure Artifacts alongside other packages. Which package type should they use?
A) Universal Packages
B) npm packages with a fake package.json
C) Pipeline caching
D) Secure files
👁 Reveal Answer
Correct Answer: A
Explanation: Universal Packages store any set of files as a versioned package in an Azure Artifacts feed, with permissions, views, and retention like other packages. They are designed for large binaries, tools, and assets that do not belong to a language ecosystem. B misuses a package manager and invites confusion. C speeds up builds but is not a versioned, durable store. D is for small sensitive files such as certificates. (Covered in Set 3.)
Question 94: An External Approval Gate
Northwind Traders must deploy to production only if the change has an approved ticket in its IT service management system, which exposes a REST API. The pipeline uses YAML environments. What should you configure?
A) A manual approval from the change manager on every run
B) A branch policy requiring a linked work item
C) An Invoke REST API check on the production environment that passes only when the ticket is approved
D) A variable named TicketApproved set to true
👁 Reveal Answer
Correct Answer: C
Explanation: The Invoke REST API check calls an external service and evaluates its response, so the deployment proceeds automatically once the ticket is approved, with no one watching the pipeline. It is a governance-focused release gate. A works but adds a manual step that the system can already answer. B links to Azure Boards items, not an external ticketing system. D can be set by anyone and proves nothing. (Covered in Sets 2 and 3.)
Question 95: Building an iOS App
Woodgrove Bank’s mobile team needs its Azure Pipelines build to compile and sign an iOS app with Xcode. They do not want to maintain build hardware. Which agent should the job use?
A) A Microsoft-hosted Ubuntu agent
B) A self-hosted Windows agent
C) An agentless server job
D) A Microsoft-hosted macOS agent, with the signing certificate supplied as a secure file
👁 Reveal Answer
Correct Answer: D
Explanation: Xcode runs only on macOS, and Microsoft-hosted macOS agents come with Xcode installed and maintained by Microsoft, so there is no hardware to manage. The signing certificate and provisioning profile belong in secure files (or Azure Key Vault), downloaded at run time. A and B cannot run Xcode. C runs server-side tasks such as checks and REST calls; it cannot compile code. (Covered in Sets 2 and 6.)
Question 96: Surviving a Bad Deployment in One Region
Adventure Works runs the same web app in two Azure regions behind Azure Front Door. It wants a deployment strategy where a faulty release cannot take down both regions at once. What should the pipeline do?
A) Deploy to both regions at the same time to keep them identical
B) Deploy to one region, verify health, then deploy to the second, while Front Door health probes route users away from an unhealthy region
C) Turn off health probes during deployment
D) Deploy only on weekends
👁 Reveal Answer
Correct Answer: B
Explanation: Deploying region by region, with health verification between stages, limits the blast radius of a bad release. Front Door health probes automatically send traffic to the healthy region if one fails. This is a resiliency strategy for deployment, combining progressive exposure with load balancing. A risks both regions failing together. C removes the safety net exactly when it is needed. D changes timing but not risk. (Covered in Set 4.)
Question 97: Configuring Software Inside Linux VMs
Tailspin Toys provisions Linux VMs with Bicep. It now needs to install and configure packages, users, and services inside those VMs, connecting over SSH without installing an agent on each machine. Which configuration management tool fits best?
A) Bicep modules
B) Azure Policy definitions only
C) Ansible playbooks
D) Azure Resource Graph queries
👁 Reveal Answer
Correct Answer: C
Explanation: Ansible is agentless: it connects over SSH and applies idempotent playbooks to configure software and settings inside machines. That complements Bicep, which defines the Azure resources themselves. A creates resources, not OS-level configuration. B evaluates and enforces rules on Azure resources; used with Azure Machine Configuration it can audit settings inside machines, but it is not a tool for running install steps. D queries resource inventory. Chef and Puppet are other configuration management tools, typically using agents. (Covered in Set 5.)
Question 98: Safer Personal Access Tokens
A script at Coho Winery uses an Azure DevOps personal access token with full access to the organization and a one-year expiry. Security asks you to reduce the risk while the script still needs to read work items. What should you do?
A) Replace it with a token scoped only to Work Items (Read) with a short expiry — or, better, use a Microsoft Entra token from a service principal or managed identity
B) Keep the token but store it in the script’s source code
C) Extend the expiry so it does not break
D) Share the token with the whole team so more people can rotate it
👁 Reveal Answer
Correct Answer: A
Explanation: Least privilege applies to tokens: grant only the scopes needed and the shortest practical lifetime, and store the token in a secret store. Microsoft recommends Microsoft Entra tokens over personal access tokens where possible, because they are not tied to one person’s long-lived secret. B exposes the token to anyone who reads the code. C increases the window of misuse. D multiplies the number of people who can leak it. (Covered in Set 6.)
Question 99: Did the Deployment Cause the Spike?
Litware’s error rate jumped at 14:05. The team wants its Application Insights charts to show exactly when each release was deployed, so they can see at a glance whether a deployment lines up with the change. What should they set up?
A) A second Application Insights resource for each release
B) An availability test
C) A KQL query that deletes old telemetry
D) Release annotations created by the deployment pipeline
👁 Reveal Answer
Correct Answer: D
Explanation: Release annotations mark deployments on Application Insights charts, so you can see whether a spike in errors or response time follows a release. A pipeline step can create the annotation automatically on every deployment. A splits telemetry and makes comparison harder. B checks reachability but says nothing about deployment timing. C removes evidence rather than adding context. (Covered in Set 7.)
Question 100: Migrating Classic Release Stages to YAML
A classic release pipeline at Contoso has Dev, Test, and Prod stages, each with pre-deployment approvals. The team is migrating it to YAML. What is the YAML equivalent?
A) One job containing all deployment steps, with comments marking each stage
B) Three stages, each with a deployment job targeting an environment (dev, test, prod) that holds its approvals and checks
C) Three separate pipelines triggered manually
D) Task groups for each stage
👁 Reveal Answer
Correct Answer: B
Explanation: In YAML, each classic stage becomes a stage with a deployment job, and each deployment target becomes an environment. Pre-deployment approvals move onto the environment as approvals and checks, where they apply to any pipeline that deploys there. A loses stage separation and approvals. C splits the flow and adds manual steps. D are a classic-only feature. (Covered in Sets 2 and 5.)
How Did You Do?
- 9-10 correct: You are in good shape. Review the official skills outline for any gaps and book the exam.
- 6-8 correct: Revisit the sets named under each question you missed, then retake this review in a few days.
- 5 or fewer: Work through the full series again, starting with Questions 1-10, and practice the hands-on parts (YAML, Git, KQL) in a free Azure DevOps organization.
The Complete AZ-400 Series
- Questions 1-10: DevOps Processes and Source Control
- Questions 11-20: Azure Pipelines, Agents, and YAML Design
- Questions 21-30: Package Management and Testing Strategy
- Questions 31-40: Deployment Strategies and Release Safety
- Questions 41-50: Infrastructure as Code and Pipeline Maintenance
- Questions 51-60: Security, Secrets, and Compliance Scanning
- Questions 61-70: Monitoring, Application Insights, and KQL
- Questions 71-80: Repositories, Permissions, and DevOps Metrics
- Questions 81-90: Containers, GitHub Actions, and Advanced Pipelines
- Questions 91-100: Final Mixed Review (this post)
Before exam day, read the official AZ-400 study guide once more, and remember that passing AZ-400 earns the DevOps Engineer Expert title only if you also hold the Azure Administrator Associate or Azure Developer Associate certification. Check the certification page on Microsoft Learn for the current prerequisite list, since Microsoft updates it as exams retire. Our AZ-104 series can help with that prerequisite. Good luck!