Free AZ-401 Practice Questions With Full Rationale
Sources checked 2026-10-26 · 14 questions · Expert level
TL;DR
These 14 scenario questions practice the Microsoft AZ-401 exam (Designing and Implementing Microsoft Agentic DevOps Solutions). They run from Easy to Hard, each answer explains the key, and each wrong option states why it fails. Microsoft's official Practice Assessment is not currently available, so independent practice is the main option during the beta.
Beta notice. The exam and the Microsoft Certified: Agentic DevOps Engineer Expert credential are both in beta. The passing score is 700, and beta exams are not scored immediately. Details live on the Microsoft Learn credential page.
This question set comes from the team that also sells AZ-401 practice-exam access on this site — worth knowing before you weigh any claim below.
Every scenario was written against Microsoft Learn documentation for Azure DevOps, Azure Monitor, Azure SRE Agent, the Azure DevOps MCP server and GitHub features. Sources are linked at the end. Answer before you open the rationale, then read the wrong-option notes even when you got the key right, because those notes teach the traps.
| Tier | Questions | What it checks |
|---|---|---|
| Easy | 1 to 4 | One fact decides the answer |
| Medium | 5 to 9 | A constraint separates two workable options |
| Hard | 10 to 14 | Documented limits, identities and agent guardrails |
Easy: one concept, one clean decision
Each scenario hinges on a single fact. Miss one of these and the Medium tier will punish the same gap harder.
A GitHub Actions workflow deploys a web app to Azure from the main branch. Company policy forbids long-lived Azure credentials stored in GitHub secrets.
Question 1 (Security and compliance): Which design meets the policy?
- A. Create a service principal, store its client secret as a GitHub secret, and rotate it every 90 days.
- B. Add a federated identity credential for the repository to a Microsoft Entra app or user-assigned managed identity, give the job id-token: write, and sign in with azure/login.
- C. Enable a system-assigned managed identity on the GitHub-hosted runner and assign it the Website Contributor role.
- D. Store a GitHub personal access token as a secret and use it to authenticate the Azure CLI.
Show answer and rationale
Correct answer: B
- A. Wrong. Rotation shortens exposure, but a client secret is still a long-lived credential kept in GitHub, which is exactly what the policy forbids.
- B. Right. The workflow exchanges GitHub's OIDC token for an Azure token through the federated credential, so nothing secret is stored. Microsoft Learn documents both an Entra app and a user-assigned managed identity as valid targets.
- C. Wrong. A managed identity attaches to an Azure resource. A GitHub-hosted runner is not an Azure resource you can switch an identity on for.
- D. Wrong. A personal access token authenticates to GitHub, not Azure, and it is a long-lived secret as well.
A platform team owns the Production environment in Azure DevOps. Application developers can edit their own pipeline YAML. The platform team needs a human approval before any stage deploys to Production, and developers must not be able to remove it by editing YAML.
Question 2 (Build and release pipelines): Where do you define the approval?
- A. In a condition on the production stage that inspects the source branch name.
- B. As a ManualValidation task at the start of the production job.
- C. As an Approval check under Approvals and checks on the Production environment.
- D. As a branch policy on main that requires two reviewers.
Show answer and rationale
Correct answer: C
- A. Wrong. A condition lives in the YAML file that developers control, and a branch-name test is not a human approval anyway.
- B. Wrong. The task is part of the pipeline definition, so the author who owns the YAML can delete it.
- C. Right. Checks are configured by the resource owner in the web interface, not in the YAML. Before a stage that uses the resource can start, every check on it must pass.
- D. Wrong. A branch policy governs merges into main. It does not stop a run from some other branch from targeting the environment, so it would need a branch control check beside it.
Your team turned on GitHub Advanced Security for Azure DevOps for an Azure Repos repository today. A reviewer suspects an API key was committed three months ago.
Question 3 (Security and compliance): Which capability can surface that old commit?
- A. Repository-level secret scanning, which starts when Advanced Security is enabled.
- B. Secret push protection, which blocks pushes that contain credentials.
- C. Dependency scanning on the default branch pipeline.
- D. CodeQL code scanning.
Show answer and rationale
Correct answer: A
- A. Right. Repository scanning looks at what is already in the repository, including historical commits, and raises an alert.
- B. Wrong. Push protection evaluates only pushes that happen after it is enabled, so an old commit never passes through it.
- C. Wrong. Dependency scanning looks for known vulnerabilities in open-source components, not credentials.
- D. Wrong. CodeQL finds code-level vulnerabilities such as injection flaws. It is not a credential detector.
After a release, the on-call engineer needs to know which operations produced failed HTTP requests during the last hour. The data is in the Application Insights Logs blade.
Question 4 (Instrumentation): Which query answers that?
- A. exceptions | where timestamp > ago(1h) | count
- B. requests | where timestamp < ago(1h) and success == true | summarize count() by name
- C. dependencies | where timestamp > ago(1h) | summarize count() by target
- D. requests | where timestamp > ago(1h) and success == false | summarize count() by name
Show answer and rationale
Correct answer: D
- A. Wrong. It returns a single total of exceptions with no split by operation, and a request can fail without a logged exception.
- B. Wrong. The time filter is inverted (older than an hour) and it keeps successful requests, so it measures the opposite population.
- C. Wrong. The dependencies table holds outbound calls from the app, grouped here by destination, not inbound requests.
- D. Right. It filters inbound requests to the last hour, keeps the failed ones, and counts them per operation name.
Medium: two plausible answers, one fits the constraint
Two options usually work in general. The scenario adds a constraint that removes one of them.
A team wants an AI assistant to read repositories, wikis and work items in an Azure DevOps organization backed by a Microsoft Entra tenant. Security requires no local install, no personal access token, and an assistant that cannot change anything.
Question 5 (Processes and communications): Which configuration fits?
- A. Run the local MCP server with a read-scoped PAT and tell the assistant in its instructions not to write.
- B. Connect to the remote MCP server with every toolset enabled and rely on the assistant's system prompt to avoid write tools.
- C. Connect to the remote MCP server with Entra ID sign-in, set X-MCP-Toolsets to repos,wiki,wit, and set X-MCP-Readonly to true.
- D. Connect to the remote MCP server and send both X-MCP-Tools and X-MCP-Toolsets listing every read tool.
Show answer and rationale
Correct answer: C
- A. Wrong. The local server needs Node.js installed and here uses a PAT, both ruled out. A prompt instruction also limits nothing at the server.
- B. Wrong. With all toolsets enabled the write tools exist. A system prompt is a request to the model, not an enforced control.
- C. Right. The remote server is hosted, signs in with Microsoft Entra ID, and the toolset header narrows the surface while the readonly header removes write tools server-side.
- D. Wrong. Microsoft documents that X-MCP-Tools should not be combined with X-MCP-Toolsets, and neither header on its own guarantees read-only behavior.
A pipeline applies a schema change and an app build to Production on every merge to main. Each run depends on the previous run, so skipping one breaks the target. Two merges land minutes apart, and the Production environment has an exclusive lock check. The earlier run was cancelled.
Question 6 (Build and release pipelines): What should you change?
- A. Set lockBehavior: runLatest on the stage.
- B. Set lockBehavior: sequential on the stage or the pipeline.
- C. Add a Business Hours check to the environment.
- D. Add a Required template check to the environment.
Show answer and rationale
Correct answer: B
- A. Wrong. runLatest is the default. It lets only the newest run take the lock and cancels older ones, which is the behavior you are trying to remove.
- B. Right. sequential makes every run acquire the lock in turn, so changes that are not cumulative are applied in order.
- C. Wrong. Business Hours limits when a deployment may start. It neither orders runs nor stops cancellation.
- D. Wrong. Required template forces pipelines to extend a given template. It has no effect on concurrency.
A production service connection has three checks: an Approval from the release managers, Branch control allowing only refs/heads/main, and an Exclusive lock. A developer queues a run from a feature branch. The production stage fails and no release manager receives an approval request.
Question 7 (Build and release pipelines): Why did no approval request go out?
- A. The release managers' notification settings suppressed the request.
- B. The exclusive lock was acquired first and blocked the approval from being created.
- C. All checks run in parallel, and branch control happened to finish before the approval.
- D. Branch control is a static check that runs before approvals, and its failure stopped the later categories from starting.
Show answer and rationale
Correct answer: D
- A. Wrong. Notification settings are not involved. The approval stage of evaluation was never reached.
- B. Wrong. The exclusive lock is evaluated last of the five categories, not first.
- C. Wrong. Parallel evaluation happens only among checks inside one category. The categories themselves run one after another.
- D. Right. Static checks (branch control, required template, evaluate artifact) run first. When one fails, later categories are not executed, so nobody is pinged for approval.
A team enables Azure SRE Agent for production incidents. It should investigate automatically, any Azure write action must wait for a human, and the agent must only be able to touch resources in the payments resource group.
Question 8 (Instrumentation): Which setup meets all three requirements?
- A. A response plan in Review mode, with the agent managed identity holding Contributor on the payments resource group only.
- B. A response plan in Autonomous mode, with Contributor on the payments resource group only.
- C. A response plan in Review mode, with Contributor on the whole subscription.
- D. A response plan in ReadOnly mode, with Contributor on the payments resource group only.
Show answer and rationale
Correct answer: A
- A. Right. Run mode controls approval and the identity's role assignments control access. Review gates write actions, and the narrow role caps the blast radius.
- B. Wrong. Autonomous mode applies mitigations without waiting for approval, which breaks the human-approval requirement.
- C. Wrong. Approval is satisfied, but the agent is constrained only by its identity permissions, and subscription-wide Contributor goes far beyond the payments group.
- D. Wrong. ReadOnly is for monitoring-only agents that never act. There would be no proposed write action for anyone to approve, so mitigation never happens.
An Azure Repos repository already has a large backlog of high-severity code scanning alerts. The team wants pull requests blocked only when the PR introduces new high or critical findings.
Question 9 (Security and compliance): What do you configure?
- A. Require the AdvancedSecurity / AllHighAndCritical status check.
- B. Require two reviewers in the branch policy.
- C. Add a build validation policy that runs the Advanced Security tasks, then require the AdvancedSecurity / NewHighAndCritical status check.
- D. Disable Marketplace tasks so only built-in tasks can run.
Show answer and rationale
Correct answer: C
- A. Wrong. AllHighAndCritical blocks until every existing critical and high alert is resolved, so the backlog would block every PR.
- B. Wrong. Reviewers are a human gate and do not evaluate scan results.
- C. Right. NewHighAndCritical prevents newly introduced findings without demanding the backlog be cleared first, and it needs a build validation policy to scan the PR branch.
- D. Wrong. Code and dependency scanning run as Marketplace-distributed pipeline tasks. Disabling them breaks the scans instead of tuning them.
Hard: platform limits, identities and agent guardrails
These reward knowing documented limits and who the actor actually is. Intuition from general DevOps work will mislead you here.
A team enables the branch policy Automatically request Copilot code review on main in Azure Repos. The organization default agent pool is a self-hosted pool inside a private network, and no review ever appears.
Question 10 (Source control strategy): What should you do?
- A. Grant the GitHub Copilot identity Contribute permission on the repository.
- B. Point Copilot code review at an agent pool of a supported type, because self-hosted pools and Managed DevOps Pools are not supported.
- C. Replace the self-hosted pool with a Managed DevOps Pool.
- D. Add the AdvancedSecurity-CodeQL-Analyze task to the build validation policy.
Show answer and rationale
Correct answer: B
- A. Wrong. Contribute matters when an agent has to push commits, as with Autofix. The review job cannot run on this pool type whatever the repository permissions are.
- B. Right. Copilot code review runs its jobs on an Azure Pipelines agent pool and Learn states that self-hosted pools and Managed DevOps Pools are not currently supported, so the review needs a supported pool.
- C. Wrong. Managed DevOps Pools are named in the same unsupported list.
- D. Wrong. CodeQL analysis is a separate scanning feature and does not affect where review jobs run.
Copilot Autofix generates a fix for a code scanning alert in Azure Repos but no pull request appears. The alert detail shows an error naming a blocked commit author email. The repository has a commit author email validation policy that allows only the company domain.
Question 11 (Security and compliance): What should you change?
- A. Re-run the scanner on the default branch and generate the fix again.
- B. Give the GitHub Copilot identity Project Administrator rights.
- C. Remove build validation from the target branch.
- D. Allow noreply@dev.azure.com in the commit author email validation policy.
Show answer and rationale
Correct answer: D
- A. Wrong. Re-running the scanner is the remedy when the alert branch was deleted or the default branch changed. Here the fix was generated and the push was rejected.
- B. Wrong. Broad rights do not satisfy an email policy, and they hand an agent far more access than the problem needs.
- C. Wrong. Pull request completion policies apply after the PR exists. The failure here happens earlier, at commit or push.
- D. Right. Autofix commits as noreply@dev.azure.com. An email validation policy that rejects that address lets the code change be generated but blocks the push.
You create an Azure Copilot Observability Agent resource with a system-assigned managed identity so it can run autonomous correlation. After creation, no issues appear in the Azure Monitor workspace.
Question 12 (Instrumentation): What is missing?
- A. Role assignments for the resource's managed identity: Issue Contributor on the workspace and Monitoring Reader on the subscriptions that hold alert rules and applications.
- B. Custom instructions that grant the agent permission to read the Application Insights data.
- C. Monitoring Contributor for the on-call engineers on the agent resource group.
- D. A Contributor role so the agent can restart failing resources.
Show answer and rationale
Correct answer: A
- A. Right. Autonomous runs use the resource's managed identity, and with a system-assigned identity the roles are granted after the resource exists.
- B. Wrong. Custom instructions shape reasoning but do not grant permissions or bypass Azure RBAC.
- C. Wrong. Autonomous operations do not run as the engineers. Interactive chat does, which is the difference this option blurs.
- D. Wrong. The agent does not restart resources or change configuration on its own. It raises issues for a human to act on.
A team writes a GitHub Agentic Workflow in Markdown that triages new issues and must add labels and comments. The security reviewer requires that the AI agent job never holds a token able to write to the repository.
Question 13 (Build and release pipelines): Which design satisfies the reviewer?
- A. Grant issue write permission in the frontmatter so the agent labels directly.
- B. Store a personal access token as a secret and let the agent call the API.
- C. Configure safe outputs for the label and comment operations, so the writes run in separate jobs and the agent job stays read-only.
- D. Add a sentence to the Markdown instructions telling the agent never to modify anything else.
Show answer and rationale
Correct answer: C
- A. Wrong. That gives the agent job itself a write-capable token, which is what the reviewer prohibits.
- B. Wrong. A PAT in the agent's reach is a write credential held by the agent job, only less visible.
- C. Right. Agent jobs run with no write access by default, and safe outputs apply pre-approved operations such as comments and labels in separate jobs, optionally behind human approval.
- D. Wrong. An instruction guides the model. It does not remove capability, so it cannot satisfy a requirement about what the job holds.
A developer pushed an Azure Key Vault client secret to main five commits ago. The repository has been cloned by many people.
Question 14 (Source control strategy): Which response is correct?
- A. Run git revert on the commit that added the secret and push the revert.
- B. Revoke and rotate the secret, then rewrite history with git filter-repo, force-push, and have everyone re-clone.
- C. Run git reset --hard HEAD~5 locally and force-push.
- D. Make the repository private.
Show answer and rationale
Correct answer: B
- A. Wrong. A revert adds a new commit, so the secret stays in earlier history and in every clone.
- B. Right. Anything pushed to shared history must be treated as compromised, so the secret is revoked first. Rewriting history then removes it from the repository, and re-cloning stops old copies re-introducing it.
- C. Wrong. It discards five commits of unrelated work, and it still leaves the exposed secret valid and present in existing clones.
- D. Wrong. Visibility does not remove the secret or invalidate it. People who already cloned keep a copy.
The nine ways these distractors try to catch you
The wrong options above were built around recurring reasoning errors, and the same shapes repeat across the AZ-401 objectives. The table names each pattern, shows the questions where it appears, and gives the habit that defeats it.
| Pattern | What the bad option looks like | Where it appears | Counter-habit |
|---|---|---|---|
| Control placed in the wrong layer | A condition or task in YAML, or a prompt instruction, offered where a resource-level check or server setting is needed | Q2, Q5, Q13 | Ask who can edit the thing that holds the control |
| Right tool, wrong actor | A managed identity on a runner that is not an Azure resource, or engineer roles for an agent that runs as its own identity | Q1, Q12 | Name the identity that actually makes the call |
| Forward-only versus retrospective | Push protection offered for an old commit, or a backlog-blocking status check offered for new-only enforcement | Q3, Q9 | Ask whether the control sees history or only new events |
| Default behavior assumed to be the fix | The default lock behavior offered as the remedy for the symptom the default causes | Q6 | Recall the default before reading the options |
| Evaluation order ignored | Parallel evaluation or lock-first reasoning applied to categories that run in sequence | Q7 | Sequence static, approvals, dynamic, post-approvals, lock |
| Mode confused with permission | Run mode treated as access control, or an access role treated as an approval step | Q8, Q12 | Run mode gates approval, roles gate reach |
| Documented unsupported configuration | A near-identical pool or tool type that the feature does not support | Q10 | Check the supported-environment list in the docs |
| History edited versus extended | Revert or reset offered for a leaked credential | Q14 | Revoke first, then rewrite, because clones persist |
| Neighboring table or scope | Exceptions or dependencies where inbound requests are needed | Q4 | Match the table to the direction of the call |
Q5 means Question 5 in the list above, numbered across all three tiers.
Read your score by tier
Missing Easy questions means the objectives list itself needs another pass in the AZ-401 study guide. Missing Medium questions usually points to the trap rows in the AZ-401 cheat sheet. Missing Hard questions means hands-on time with the agent features, since the documented limits only stick once you have hit them in a lab. Microsoft publishes a 700 passing score for the real exam, but this free set is too short to predict it.
Beyond these fourteen: full-length AZ-401 practice
The AZ-401 practice quiz covers all five domains with the same style of scenario. For a timed readiness check, use the AZ-401 readiness quiz. Certification details are on the AZ-401 page, and every other exam is listed under all certifications.
Sources: AZ-401 study guide, approvals and checks, Advanced Security for Azure DevOps, SRE Agent run modes.