AZ-400 Dependency Management & Infrastructure as Code 3 — Questions and Answers
Question 1: A Bicep template deployment fails with 'The resource already exists and was not created by this deployment.' Which property should you add to handle existing resources?
- existing keyword in Bicep resource declaration (Correct answer)
- dependsOn with the resource ID
- forceUpdateTag on the resource
- mode: 'Incremental' in deploymentProperties
Correct answer: existing keyword in Bicep resource declaration
The `existing` keyword in Bicep allows you to reference a resource that already exists without attempting to create or update it.
Question 2: Your organization wants to enforce that all Azure resource groups created via IaC have required tags. Which combination achieves this with least effort?
- ARM template parameter files with tag defaults
- Azure Policy with Append effect + Deny for missing required tags (Correct answer)
- Bicep modules with hardcoded tag variables
- Terraform locals block with tag merging
Correct answer: Azure Policy with Append effect + Deny for missing required tags
Azure Policy with Append effect adds missing tags automatically and a Deny policy blocks deployments missing required tags, enforcing compliance at the platform level.
Question 3: Which Terraform command shows the execution plan without applying any changes?
- terraform validate
- terraform plan (Correct answer)
- terraform apply --dry-run
- terraform show
Correct answer: terraform plan
`terraform plan` generates and displays an execution plan showing what actions Terraform will take without making any changes.
Question 4: A package in Azure Artifacts is marked as 'deprecated'. What effect does this have on pipeline builds?
- Pipelines immediately fail if they reference the deprecated package
- Consumers see a warning but builds continue unless the feed blocks deprecated packages (Correct answer)
- The package is automatically deleted after 30 days
- Azure Pipelines upgrades the reference to the latest non-deprecated version
Correct answer: Consumers see a warning but builds continue unless the feed blocks deprecated packages
Marking a package as deprecated generates a warning for consumers but does not block builds by itself; feed administrators must enable additional policies to block deprecated packages.
Question 5: You want to use the same Bicep module for both development and production deployments but with different parameter values. What is the recommended approach?
- Create separate Bicep files for each environment
- Use Bicep parameter files (.bicepparam) per environment (Correct answer)
- Pass parameters as inline JSON strings in the pipeline
- Use conditional resource declarations inside the module
Correct answer: Use Bicep parameter files (.bicepparam) per environment
Bicep parameter files (.bicepparam) allow environment-specific parameter values to be stored separately and referenced during deployment without duplicating the module.
Question 6: Your Azure Pipelines YAML file uses a template from another repository. The template repository has been updated. How does the pipeline pick up the changes?
- The pipeline always uses the latest commit automatically
- The pipeline uses the ref (branch/tag/commit) specified in the repository resource (Correct answer)
- Azure Pipelines caches templates and requires a manual cache clear
- The template is embedded at pipeline creation time and must be re-imported
Correct answer: The pipeline uses the ref (branch/tag/commit) specified in the repository resource
Pipeline templates are resolved using the ref specified in the `resources.repositories` section, so updating the ref is required to pick up changes.
Question 7: When should you use `terraform import` in an Azure DevOps workflow?
- To migrate a Terraform state file between storage backends
- To bring existing Azure resources under Terraform management without recreating them (Correct answer)
- To import Terraform modules from a public registry
- To download provider plugins before running terraform init
Correct answer: To bring existing Azure resources under Terraform management without recreating them
`terraform import` maps an existing Azure resource to a Terraform state entry so it can be managed by Terraform without destroying and recreating it.
AZ-400 Dependency Management & Infrastructure as Code 3
A Bicep template deployment fails with 'The resource already exists and was not created by this deployment.' Which property should you add to handle existing resources?