AZ-400 Infrastructure as Code 3 — Questions and Answers
Question 1: In Terraform, what is a `data` source used for?
- Storing sensitive values like passwords
- Reading information from existing infrastructure not managed by the current config (Correct answer)
- Defining output values to share with other modules
- Creating resources with dynamic configurations
Correct answer: Reading information from existing infrastructure not managed by the current config
Data sources allow Terraform to fetch read-only information from existing resources or external systems without managing those resources.
Question 2: What is the recommended approach when an Azure ARM template deployment fails midway through a resource group deployment?
- Always use Complete mode to reset the resource group to the template's desired state
- Use Incremental mode so only failed resources are re-deployed on retry
- Manually delete all resources and redeploy from scratch
- Roll back using the Azure CLI `az deployment group rollback` command (Correct answer)
Correct answer: Roll back using the Azure CLI `az deployment group rollback` command
`az deployment group rollback` rolls back a resource group to the last successful deployment, restoring the previous known-good state.
Question 3: Which tool is specifically designed to test Azure Bicep and ARM templates for compliance with organizational policies before deployment?
- Terraform Sentinel
- Azure Policy Compliance Scan
- ARM Template Test Toolkit (arm-ttk) (Correct answer)
- Azure Blueprints Validator
Correct answer: ARM Template Test Toolkit (arm-ttk)
The ARM Template Test Toolkit (arm-ttk) is a PowerShell-based testing framework that validates ARM and Bicep templates against best-practice rules.
Question 4: In a Terraform remote backend configuration using Azure Storage, what is the purpose of the `key` argument?
- The encryption key for the storage account
- The blob name used to store the Terraform state file (Correct answer)
- The access key for authenticating to the storage account
- The resource group key for the storage backend
Correct answer: The blob name used to store the Terraform state file
The `key` argument specifies the blob name (path) within the Azure Storage container where the `.tfstate` file will be stored.
Question 5: When using Azure Bicep modules, what file path convention makes a module reusable across multiple Bicep files in the same project?
- Referencing via a public registry URL like br/public:...
- Using relative file paths such as `./modules/storage.bicep` (Correct answer)
- Embedding the module inline with the `@module` decorator
- Publishing to an Azure Container Registry and referencing by digest
Correct answer: Using relative file paths such as `./modules/storage.bicep`
Relative file paths like `./modules/storage.bicep` are the simplest way to reference local Bicep modules within the same repository.
Question 6: What is the key difference between `terraform destroy` and removing resources from a Terraform configuration?
- `terraform destroy` is faster because it runs in parallel
- Removing from config on next apply deletes only those removed resources; destroy targets all managed resources (Correct answer)
- `terraform destroy` requires manual approval for each resource
- Removing from config preserves the resource in Azure while destroy removes it
Correct answer: Removing from config on next apply deletes only those removed resources; destroy targets all managed resources
`terraform destroy` destroys ALL resources in the state; removing a resource block from config and applying deletes only that specific resource while leaving others intact.
Question 7: In Azure DevOps, which YAML pipeline task is used to deploy an ARM template to a resource group?
- AzureWebApp@1
- AzureResourceManagerTemplateDeployment@3
- AzureCLI@2 with az deployment group create
- Both B and C are valid approaches (Correct answer)
Correct answer: Both B and C are valid approaches
Both the `AzureResourceManagerTemplateDeployment@3` task and the `AzureCLI@2` task running `az deployment group create` are valid ways to deploy ARM templates in Azure DevOps pipelines.
AZ-400 Infrastructure as Code 3
In Terraform, what is a `data` source used for?