AZ-400 Dependency Management & Infrastructure as Code 4 — Questions and Answers
Question 1: A security audit finds that Terraform state files stored in Azure Blob Storage contain sensitive data in plaintext. What is the recommended mitigation?
- Encrypt state files manually before uploading
- Enable Azure Storage encryption with customer-managed keys and restrict access via RBAC (Correct answer)
- Move state storage to a local backend
- Use terraform state rm to remove sensitive resources from state
Correct answer: Enable Azure Storage encryption with customer-managed keys and restrict access via RBAC
Enabling Azure Storage encryption with customer-managed keys ensures state data is encrypted at rest, while RBAC restricts who can read the state file.
Question 2: You need to share a private npm package across multiple Azure DevOps projects within the same organization. What is the most efficient approach?
- Create a separate Azure Artifacts feed per project and publish to each
- Use a single organization-scoped Azure Artifacts feed with project visibility settings (Correct answer)
- Publish the package to GitHub Packages and configure upstream in each project
- Copy the package files to a shared Azure Blob Storage container
Correct answer: Use a single organization-scoped Azure Artifacts feed with project visibility settings
An organization-scoped Azure Artifacts feed can be shared across all projects in the organization, eliminating redundant feeds and publish steps.
Question 3: What is the purpose of the `dependsOn` property in an Azure Resource Manager (ARM) template?
- It specifies the ARM template schema version
- It defines explicit resource deployment ordering when implicit ordering cannot be determined (Correct answer)
- It links a child resource to its parent resource
- It sets the API version for a dependent resource type
Correct answer: It defines explicit resource deployment ordering when implicit ordering cannot be determined
`dependsOn` explicitly declares that one resource must be fully deployed before another begins, used when ARM cannot infer the dependency from template references.
Question 4: A Terraform plan shows that a resource will be destroyed and recreated due to a change. Which Terraform meta-argument can prevent recreation by updating in-place if the provider supports it?
- prevent_destroy
- ignore_changes (Correct answer)
- create_before_destroy
- lifecycle { replace_triggered_by }
Correct answer: ignore_changes
`ignore_changes` tells Terraform to disregard changes to specified attributes, preventing a destroy-and-recreate cycle when those attributes change outside of Terraform.
Question 5: Which Azure DevOps gate or check would you configure to pause a pipeline stage until a work item linked to the release is in 'Resolved' state?
- Branch policy with required reviewers
- Invoke REST API gate calling Azure Boards API
- Query work items gate (Correct answer)
- Approval and checks with manual validation
Correct answer: Query work items gate
The Query Work Items gate runs an Azure Boards query and only allows the pipeline to proceed if the query results meet specified criteria, such as all linked items being Resolved.
Question 6: Your organization requires that all Bicep-deployed resources have a specific 'CostCenter' tag. A developer deploys without the tag. Which Azure Policy effect modifies the deployment to add the missing tag automatically?
- Audit
- Deny
- Append
- Modify (Correct answer)
Correct answer: Modify
The Modify effect adds or updates tags on resources during deployment, automatically inserting the required 'CostCenter' tag if missing.
Question 7: When configuring upstream sources in Azure Artifacts, what is the maximum number of official upstream sources you can add to a single feed?
- 5
- 10
- 25 (Correct answer)
- Unlimited within the organization
Correct answer: 25
Azure Artifacts supports up to 25 upstream sources per feed, covering public package registries like NuGet.org, npmjs.com, PyPI, and Maven Central.
AZ-400 Dependency Management & Infrastructure as Code 4
A security audit finds that Terraform state files stored in Azure Blob Storage contain sensitive data in plaintext.
What is the recommended mitigation?