AZ-400 Dependency Management & Infrastructure as Code 5 — Questions and Answers
Question 1: A pipeline stage deploys infrastructure using Terraform and the next stage deploys an application. The application stage must use the Storage Account connection string output by Terraform. How should you pass this value?
- Hard-code the connection string in the application stage YAML
- Use terraform output to write the value to a pipeline variable via ##vso[task.setvariable] (Correct answer)
- Store the Terraform state and have the app stage read it directly
- Pass it as a Terraform variable in the next stage
Correct answer: Use terraform output to write the value to a pipeline variable via ##vso[task.setvariable]
Using `terraform output` combined with the `##vso[task.setvariable]` logging command sets a pipeline variable that downstream stages can consume securely.
Question 2: Which command validates that a Bicep file is syntactically correct and will compile to valid ARM JSON without deploying?
- az bicep validate --file main.bicep
- bicep build main.bicep (Correct answer)
- az deployment group validate
- bicep lint main.bicep
Correct answer: bicep build main.bicep
`bicep build main.bicep` compiles the Bicep file to ARM JSON and reports any syntax or semantic errors without deploying anything.
Question 3: Your team uses Semantic Versioning for NuGet packages. A change fixes a bug without breaking the public API. Which version part should be incremented?
- Major
- Minor
- Patch (Correct answer)
- Build metadata label
Correct answer: Patch
In Semantic Versioning, the Patch version is incremented for backwards-compatible bug fixes that do not change the public API.
Question 4: A Terraform deployment fails because two team members applied changes simultaneously, causing a state lock conflict. What is the standard resolution?
- Delete the state file and re-import all resources
- Run terraform force-unlock with the lock ID after confirming no other apply is running (Correct answer)
- Revert both changes and redeploy sequentially
- Switch to a local backend to avoid locking
Correct answer: Run terraform force-unlock with the lock ID after confirming no other apply is running
`terraform force-unlock` releases a stuck state lock using its lock ID; this should only be done after confirming no legitimate apply process is still running.
Question 5: Which Azure Artifacts feature ensures that a deleted package version cannot be accidentally re-published with the same version number?
- Artifact retention policy
- Immutable package versions (Correct answer)
- Package demotion
- Feed permissions set to Reader for CI accounts
Correct answer: Immutable package versions
Azure Artifacts enforces immutable package versions, preventing any package from being republished under a version number that has previously been published.
Question 6: You need to deploy infrastructure to multiple Azure subscriptions using a single Terraform configuration. Which Terraform feature enables this?
- Terraform workspaces with separate subscription IDs
- Multiple provider blocks with aliases and per-resource provider argument (Correct answer)
- Separate terraform.tfvars files per subscription
- az account set before each terraform apply
Correct answer: Multiple provider blocks with aliases and per-resource provider argument
Multiple provider blocks with unique aliases allow resources to target different Azure subscriptions within a single Terraform configuration by specifying the provider alias on each resource.
Question 7: A Bicep deployment uses `targetScope = 'subscription'`. Which Azure CLI command is correct to deploy this template?
- az deployment group create
- az deployment sub create (Correct answer)
- az deployment mg create
- az deployment tenant create
Correct answer: az deployment sub create
`az deployment sub create` deploys ARM/Bicep templates scoped to an Azure subscription, matching the `targetScope = 'subscription'` Bicep declaration.
AZ-400 Dependency Management & Infrastructure as Code 5
A pipeline stage deploys infrastructure using Terraform and the next stage deploys an application.
The application stage must use the Storage Account connection string output by Terraform.
How should you pass this value?